Ransomware en una pyme

A 90-minute, 4-round beginner-to-intermediate Express simulation for Spanish vocational training (Formacion Profesional, grado medio), module 0226 Seguridad informatica of the Tecnico en Sistemas Microinformaticos y Redes.

You are Alba Lasarte, a 20-year-old support technician at a small IT maintenance company who looks after Asesoria Iturmendi, a fictional tax and payroll advisory firm with 15 workstations, a NAS shared drive, a USB backup disk and a cloud sync. On a Monday morning in the middle of the quarterly tax campaign, ransomware has encrypted three computers and is encrypting the shared drive.

Round 1: you triage and decide what to do with the affected computers. Round 2: you cut off the shared drive and check which backup is sound. Round 3: you restore and close the entry door (remote desktop open on the router). Round 4: client data has been copied out - you decide how the breach is notified and how you close the incident.

The model works with expected values; each round is scored on all phases so far, on devices encrypted, hours the office is stopped, hours of work lost and protocol followed. Uploading client data to a personal account, or not notifying a personal data breach, caps the score. The lesson: isolate first and restore afterwards - the backup only helps once the attack is contained. Spanish with English.

An intermediate simulation for participants who already know the core concepts of the subject, designed for master's and MBA programmes.