CYBRARY Program
Ransomware resilience
Everything after impact: trustworthy recovery points, isolated proof, forest recovery, staged reconnection and an after-action record that survives review.
Who it is for: Recovery leads, IR managers, backup and platform engineers.
The path through it
The Northwind arc in the order a real event forces on you: see the staging in telemetry while it is still cheap to stop, contain it without destroying the evidence, know what would survive, decide which recovery point can be trusted, rebuild identity before anything else, and run the recovery room under a clock.
- 0 · Basics
No ransomware content yet — just the two skills every later stage assumes: asking telemetry a question, and reading a workflow run end to end. Skip this stage only if you can already write the aggregation and the substring match unaided.
- qr-01-hunt-the-wireHunt: the wire25 min
- f-101Anatomy of a workflow run25 min
- 1 · See it early
Every hour of recovery you avoid is bought here. Ransomware staging is loud in identity, DNS and egress telemetry long before anything encrypts — these are the queries that catch it.
- qr-11-hunt-the-exfilHunt: exfiltration30 min
- qr-03-hunt-the-identityHunt: identity across sources30 min
- qr-08-hunt-the-spreadHunt: lateral movement45 min
- 2 · Contain without burning the evidence
Containment during an encryption event is a scoped, reversible, logged action. The playbook has to isolate the host and preserve exactly what the recovery decision will need later.
- s-101Artifact discipline35 min
- c-201One incident, three vocabularies45 min
- b-301Bridge: from chained hunt to triggered playbook40 min
- 3 · Recovery foundations
Before the event: which copies survive an attacker with backup-admin rights, and what depends on what.
- ran-101Recovery readiness assessment45 min
- ran-110Blast radius and dependency mapping50 min
- 4 · Trust decisions
The hardest call in the event: the newest copy is the closest to the business and the likeliest to be dirty.
- ran-120Choosing a recovery point you can defend55 min
- ran-130Isolated restore and validation55 min
- 5 · Rebuild and return
Golden images, forest recovery with krbtgt double-rotated, then staged reconnection behind gates.
- ran-201Clean rebuild from a golden image50 min
- ran-210Active Directory forest recovery60 min
- ran-220Staged reconnection and credential rotation50 min
- 6 · Run the recovery
The recovery room under injects and a clock, then the after-action record that turns it into control uplift.
- ran-401Recovery Room capstone90 min
- ran-410After-action review and control uplift45 min
- ran-420Full kill-chain capstone: detonation to reconnection150 min
- 7 · Enterprise scale
One recovered estate is not a resilient company. This stage moves the work off the incident and onto the organization: the regulatory clock the event starts, the monitoring that has to keep proving itself between events, and an independent assurance pass over the uplift the after-action review promised.
- ir-201The 72-hour regulatory clock45 min
- cmp-201Continuous control monitoring, honestly45 min
- dr-405Northwind recovery assurance90 min
NICE capabilities this program evidences
- Telemetry queryingfirst proven in qr-01-hunt-the-wireWrite and defend searches against host, network, identity and cloud telemetry.
- Threat huntingfirst proven in qr-01-hunt-the-wireFollow an intrusion across telemetry families from a hypothesis, not an alert.
- Response automationfirst proven in f-101Author, version and safely gate a playbook that changes the estate.
- Incident triagefirst proven in f-101Qualify, scope and prioritize an alert into a case with evidence attached.
- Evidence handlingfirst proven in s-101Preserve artifacts and keep an auditable chain from observation to conclusion.
- Detection engineeringfirst proven in b-301Promote a search into a rule with a threshold, an owner and a tested false-positive budget.
- Recovery operationsfirst proven in ran-101Plan and execute a recovery with recovery points, waves and an after-action record.
- Continuity planningfirst proven in ran-101Set and defend RTO and RPO, map service dependencies, and sequence a restore the business can live with.
- Control assurancefirst proven in ran-410Prove a control collects, matches and notifies — and find the stage where it does not.
- Risk and policy governancefirst proven in ran-410Turn a finding into a rated, owned, dated risk decision that survives the next review.
- Audit and control evidencefirst proven in cmp-201Test a control against its stated design and produce artifacts an external assessor accepts.
Roles this program trains toward
- Ransomware recovery lead
The seat that has to bring an estate back — deciding which recovery point can be trusted, in what order services return, and what data loss the business is going to take.
Other programs
- SOC operations — The detection and response core: query telemetry, triage a queue, hunt a hypothesis, automate the response and prove the control fired.
- Governance & audit — Controls, evidence and the paperwork an auditor will actually accept — assessed the way a real assessment runs, on artifacts rather than assertions.
- AI security — Securing the agents now sitting inside the SOC: prompt injection, poisoned tool catalogs, approval ceilings and the oversight boundary around autonomy.
- Adversary craft & systems — Host-level ground truth: patch state, exploitation preconditions and the machine behavior every detection above it depends on.