TryBench
Ransomware First Steps: Isolate the Computer
Execute CISA-aligned ransomware containment: isolate network interfaces immediately and escalate to incident response.
Why this matters
Ransomware can lock a whole office in minutes. The first few steps decide how much damage it does.
Ransomware Spreads Over Networks
Ransomware spreads fast over network cables, Wi-Fi, and shared folders. It can lock other computers and file servers within minutes.
In real life: Think of a fire in an office. It spreads through doors and corridors. In a network, cables and Wi-Fi are the corridors, and ransomware can use them quickly.
Cut the Network First
CISA advises: unplug the network cable and turn off Wi-Fi and Bluetooth. Stopping the spread comes first. Power off only if you cannot disconnect.
In real life: To stop a fire spreading, you close the doors first. Unplugging the cable and switching off Wi-Fi closes the doors on the network before you do anything else.
Escalate and Protect Backups
Next: 1. Tell your incident lead. 2. Check that offline backups are safe. 3. Never pay a ransom on your own.
In real life: After the doors are closed, call the fire chief (incident lead), check that the fireproof safe (offline backups) is untouched, and do not pay the arsonist.
Your practice task
From the EDR alert below, instruct the AI to draft an urgent containment order in 35 words or fewer (no greeting) for the on-site technician. It must name the infected workstation, order immediate network and Wi-Fi disconnection to halt SMB spread, and instruct them to escalate to the incident lead.
How to do it
- Read the security alert above.
- Ask the AI to write an order of 35 words or fewer, with no greeting.
- Name the infected computer and order it disconnected from cables and Wi-Fi.
- Tell the technician to escalate to the incident lead. Press Run proof.
Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.
Quick reference: CISA Ransomware Host Containment Protocol
Follow CISA and MS-ISAC Joint Ransomware First-Responder Guidelines.
1. Physically unplug Ethernet cable and disable Wi-Fi/Bluetooth immediately. 2. Escalate to incident lead and disconnect offline backup storage. 3. Preserve system memory for digital forensics; do not negotiate or pay alone.
More lessons in this course
- Writing an Incident Escalation BriefCombine defanged indicators, redacted user secrets, and containment status into a shift handover brief.
- Why Attackers Target AccountsUnderstand the CIA triad and why attackers seek credentials to siphon money and corporate data.
- Passphrases & Multi-Factor ArmorReplace weak passwords with long passphrases and upgrade from SMS OTPs to authenticator apps.