Global Learning for Operational Leaders
Classroom
14 sessions
Scroll for more
Online / Live
14 sessions
Scroll for more
Introduction
Course overview
Ransomware is one of the most damaging cyber threats facing organisations, capable of halting operations for weeks and exposing sensitive data. Defence requires prevention, detection, resilient backups and rehearsed response.
This Aractech course explains how ransomware attacks unfold, initial access vectors, hardening and prevention, detection of early indicators, backup and recovery architectures, response decision-making including extortion demands, communication and lessons learned. Participants take part in a ransomware response exercise.
The course serves both technical and management audiences.
What you will achieve
Learning objectives
- Explain the ransomware attack life cycle
- Reduce initial access and lateral movement risks
- Detect early indicators of ransomware
- Design resilient backup and recovery
- Plan response and decision-making
- Recover operations and learn from incidents
Who should attend
Target audience
- IT and security managers
- System administrators
- Business continuity professionals
- CISOs
- Risk managers
- Senior managers
Methodology
Learning approach
- Threat briefings
- Hardening workshops
- Backup design exercise
- Response simulation
- Case studies
Complete course outline
Five focused days of learning and application
The timings provided are estimates and may vary depending on the number of participants and the discussions taking place during the sessions. They are indicative only and do not constitute a binding commitment.
Day 1
Understanding Ransomware
- Ransomware business model
- Attack life cycle
- Double extortion
- Notable incidents
- Coffee break
- Notable incidents (continued)
- Threat actors
- Case study: Major ransomware attack
Day 2
Prevention
- Initial access vectors
- Patching and hardening
- Identity protection
- Email and endpoint controls
- Coffee break
- Email and endpoint controls (continued)
- Segmentation
- Workshop: Hardening plan
Day 3
Detection
- Indicators of compromise
- Monitoring
- Endpoint detection
- Threat hunting
- Coffee break
- Threat hunting (continued)
- Early containment
- Exercise: Detection review
Day 4
Backup and Recovery
- Backup strategies
- Immutable backups
- Recovery testing
- Recovery priorities
- Coffee break
- Recovery priorities (continued)
- Business continuity
- Workshop: Backup architecture
Day 5
Response
- Response plan
- Decision-making on demands
- Legal and regulatory
- Communication
- Coffee break
- Communication (continued)
- Lessons learned
- Capstone: Ransomware simulation
FAQ
Frequently asked questions
What does Ransomware Defence and Recovery (IMCS-017) cover?
This course covers IT Management and Cyber Security through a structured five-day outline focused on practical application, discussion, and implementation planning.
When is the next available session?
The next scheduled session starts on 16 - 20 November 2026. See the course schedules section for the available dates and delivery formats.
Who should attend this course?
IT and security managers, System administrators, Business continuity professionals
Is bilingual course delivery available?
Yes. All course materials and presentations are provided in English, while bilingual explanation and discussion support may be available depending on the selected location and trainer availability. For example, when attending a course in Istanbul, you may request a Turkish-speaking trainer to explain the English course content in Turkish. Arabic explanation support may also be requested at this location. Other languages are available in selected cities. You can choose your preferred language support as an optional preference during registration.
How can I register for a session?
Use any Register button next to the available course dates to open the participant registration page and submit your booking request for the selected session.
Is this course available online as well as classroom-based?
Check the course schedules section for currently published classroom and Online / Live sessions.
Where are classroom sessions delivered?
Current classroom venues include Kuala lumpur, Barcelona, Cape Town, Frankfurt, London, Rome, Paris.
How long is the training programme?
The programme runs for five days from 09:00 to 14:00, which gives 25 contact hours, including a daily 30-minute break (22.5 hours of instruction).
Quick request
Send quick request
Send a fast enquiry about this course and the academy team will get back to you.
Get a quotation
Request a formal quotation
Choose an available date and venue, add your participants, and we will email a formal quotation for Ransomware Defence and Recovery to your business address.