{"id":31399,"date":"2023-09-10T04:13:35","date_gmt":"2023-09-10T04:13:35","guid":{"rendered":"https:\/\/www.process.st\/templates\/ransomware-incident-response-checklist\/"},"modified":"2024-03-05T13:59:30","modified_gmt":"2024-03-05T13:59:30","slug":"ransomware-incident-response-checklist","status":"publish","type":"post","link":"https:\/\/www.process.st\/templates\/ransomware-incident-response-checklist\/","title":{"rendered":"Ransomware Incident Response Checklist"},"content":{"rendered":"\n<section id=\"detect-and-confirm-ransomware-attack\"> \n <h2>Detect and confirm ransomware attack<\/h2>\n <div class=\"text-content\">\n   This task is responsible for detecting and confirming a ransomware attack. It plays a crucial role in initiating the incident response process. Its successful completion will ensure that the appropriate response plan is executed promptly. To complete this task, you will need to utilize various detection tools and techniques, such as antivirus scans, network monitoring, or user reports. Any suspicious behavior or indications of ransomware must be confirmed through analysis and verification. If a ransomware attack is confirmed, proceed to the next task. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Confirmation method <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"multi-choice-content form-field-content\"> \n  <div class=\"form-group\"> <label> Indications of ransomware <\/label> <select disabled class=\"form-control\"> <option value=\"\">Multiple options can be selected from this list<\/option> <\/select> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Pop-up messages demanding ransom \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Files encrypted with unusual extensions \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Unusual network traffic \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       4 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Abnormal system behavior \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       5 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Suspicious email attachments \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n <div class=\"url-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Link to detection tools <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"identify-type-and-strain-of-ransomware\"> \n <h2>Identify type and strain of ransomware<\/h2>\n <div class=\"text-content\">\n   Understanding the type and strain of ransomware is crucial for developing an effective response plan and determining potential recovery options. This task requires identifying the specific ransomware variant involved in the attack. You will need to utilize threat intelligence sources, malware analysis tools, or expert assistance to accurately identify the ransomware type and strain. Document the findings for further analysis during the response process. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Type of ransomware <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"textarea-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Strain details <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea> \n  <\/div> \n <\/div> \n <div class=\"file-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Upload ransomware sample <\/label> \n   <div class=\"file-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-upload btn-icon\"><\/i> File will be uploaded here <\/button> \n   <\/div> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"isolate-affected-systems\"> \n <h2>Isolate affected systems<\/h2>\n <div class=\"text-content\">\n   This task aims to prevent further spread of the ransomware by isolating the affected systems from the network. By isolating the systems, you can minimize the impact on other connected devices and data. Ensure that the isolated systems have no network connectivity but remain powered on for subsequent tasks. Follow the isolation guidelines provided by your organization or security team to maintain a secure environment for analysis and recovery. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Isolation method <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"multi-select-content form-field-content\"> \n  <div class=\"form-group\"> <label> Systems to isolate <\/label> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Workstation A \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Server B \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Virtual Machine C \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"preserve-evidence-and-take-system-snapshots\"> \n <h2>Preserve evidence and take system snapshots<\/h2>\n <div class=\"text-content\">\n   Preserving evidence and taking system snapshots are essential steps to maintain a record of the ransomware attack and ensure accurate analysis and investigation. This task involves creating a forensic copy of the affected systems and capturing relevant data. Use forensic acquisition tools or methods approved by your organization to create an image or snapshot of the affected systems. Document the details and ensure the preservation of evidence for future analysis or legal purposes. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Evidence preservation method <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"date-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Date of evidence preservation <\/label> \n   <div class=\"date-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-calendar btn-icon\"><\/i> Date will be set here <\/button> \n   <\/div> \n  <\/div> \n <\/div> \n <div class=\"textarea-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Snapshot details <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"inventory-affected-systems-and-data\"> \n <h2>Inventory affected systems and data<\/h2>\n <div class=\"text-content\">\n   Creating an inventory of the affected systems and data helps in understanding the scope of the ransomware attack and prioritizing the recovery process. This task involves collecting information about the compromised systems, their configurations, affected files, and potential data loss. Use inventory tools, system logs, or manual inspection to gather the necessary information. Document the inventory details and ensure it is easily accessible for future reference. \n <\/div> \n <div class=\"multi-select-content form-field-content\"> \n  <div class=\"form-group\"> <label> Affected systems <\/label> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Server A \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Desktop B \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Laptop C \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n <div class=\"select-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> System configuration types <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Windows \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Mac \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Linux \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n <div class=\"file-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Upload inventory report <\/label> \n   <div class=\"file-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-upload btn-icon\"><\/i> File will be uploaded here <\/button> \n   <\/div> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"determine-source-of-ransomware\"> \n <h2>Determine source of ransomware<\/h2>\n <div class=\"text-content\">\n   Identifying the source of the ransomware is crucial for tracking down the responsible parties, understanding the attack vector, and preventing future incidents. This task requires conducting a thorough analysis of the ransomware's entry point, propagation methods, and potential vulnerabilities exploited. Analyze network logs, email headers, or conduct forensic investigations to determine the source. Document the findings and any discovered vulnerabilities or security gaps. \n <\/div> \n <div class=\"textarea-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Ransomware entry point <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea> \n  <\/div> \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Propagation methods <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"select-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Exploited vulnerability <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Unpatched software \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Phishing attack \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Remote Desktop Protocol (RDP) compromise \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       4 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Malvertising \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       5 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Drive-by downloads \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"disable-system-restore-and-delete-shadow-copies-for-windows\"> \n <h2>Disable system restore and delete shadow copies for Windows<\/h2>\n <div class=\"text-content\">\n   Disabling system restore and deleting shadow copies are necessary steps to prevent the ransomware from reverting changes and enabling potential recovery options later on. This task is specific to Windows systems. Follow the instructions provided and ensure that system restore is disabled and all shadow copies are permanently deleted. Be cautious as these actions are irreversible and can affect any legitimate recovery attempts. \n <\/div> \n <div class=\"select-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Windows version <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Windows 7 \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Windows 8\/8.1 \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Windows 10 \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"removal-of-the-ransomware-from-the-infected-systems\"> \n <h2>Removal of the ransomware from the infected systems<\/h2>\n <div class=\"text-content\">\n   Removing the ransomware from the infected systems is essential to mitigate further damages and restore normal operations. This task involves utilizing antivirus software or specialized malware removal tools to detect and eliminate the ransomware. Follow the provided instructions or consult with your organization's security team for guidance. Ensure that the removal process is thoroughly documented and validated to prevent any residual threats or reinfection. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Antivirus software used <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Malware removal tool used <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"approval-it-manager-for-ransom-note-assessment\"> \n <h2>Approval: IT Manager for ransom note assessment<\/h2>\n <div class=\"approval-content\"> \n  <div class=\"header\"> \n   <div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div> \n  <\/div> \n  <div class=\"approval-rule-subject-tasks-list\"> \n   <ul class=\"list\"> \n    <li> \n     <div class=\"approval-rule-subject-tasks-list-item\"> \n      <div class=\"item\"> \n       <div class=\"container\"> <span class=\"title\">Identify type and strain of ransomware<\/span> \n        <div class=\"body\">\n         Will be submitted\n        <\/div> \n       <\/div> \n      <\/div> \n     <\/div> <\/li>\n    <li> \n     <div class=\"approval-rule-subject-tasks-list-item\"> \n      <div class=\"item\"> \n       <div class=\"container\"> <span class=\"title\">Preserve evidence and take system snapshots<\/span> \n        <div class=\"body\">\n         Will be submitted\n        <\/div> \n       <\/div> \n      <\/div> \n     <\/div> <\/li> \n   <\/ul> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"analyze-the-ransom-note\"> \n <h2>Analyze the ransom note<\/h2>\n <div class=\"text-content\">\n   Analysing the ransom note can provide valuable insights into the motives, demands, and potential negotiation options with the threat actors. This task involves carefully examining the ransom note left by the attackers and documenting its content. Analyze any embedded contact information, payment demands, or instructions provided. Consider involving your organization's legal or law enforcement experts to assess the situation and determine the appropriate course of action. \n <\/div> \n <div class=\"textarea-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Ransom note content <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea> \n  <\/div> \n <\/div> \n <div class=\"multi-select-content form-field-content\"> \n  <div class=\"form-group\"> <label> Contact information <\/label> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Email address \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Bitcoin wallet address \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Tor website link \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"determine-whether-backups-are-usable\"> \n <h2>Determine whether backups are usable<\/h2>\n <div class=\"text-content\">\n   Assessing the usability of backups is crucial to determine the availability of data for restoration and recovery purposes. This task involves evaluating the integrity, completeness, and accessibility of backups. Utilize backup management tools, testing procedures, or consult with backup administrators to verify the usability of backups. Document the backup assessment results and identify any issues or limitations that may impact the recovery process. \n <\/div> \n <div class=\"multi-select-content form-field-content\"> \n  <div class=\"form-group\"> <label> Backup types <\/label> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      On-site physical backups \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Off-site backups \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Cloud backups \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n <div class=\"select-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Backup integrity <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Intact and up-to-date \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Partially corrupted \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Outdated but recoverable \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"execute-response-plan\"> \n <h2>Execute response plan<\/h2>\n <div class=\"text-content\">\n   Executing the response plan ensures a structured and coordinated approach to mitigate the impact of the ransomware attack. This task requires following the predefined response plan, which outlines the necessary steps, responsibilities, and communication channels. Ensure that all key stakeholders are informed, relevant procedures are followed, and tasks are completed within the established timelines. Regularly review and update the response plan based on lessons learned and evolving threats. \n <\/div> \n <div class=\"multi-select-content form-field-content\"> \n  <div class=\"form-group\"> <label> Response plan tasks <\/label> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Notify incident response team \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Activate incident communication channels \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Engage third-party cybersecurity experts \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       4 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Implement temporary mitigations \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       5 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Coordinate with legal and law enforcement \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"approval-ceo-for-funds-transfer-for-ransom\"> \n <h2>Approval: CEO for funds transfer for ransom<\/h2>\n <div class=\"approval-content\"> \n  <div class=\"header\"> \n   <div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div> \n  <\/div> \n  <div class=\"approval-rule-subject-tasks-list\"> \n   <ul class=\"list\"> \n    <li> \n     <div class=\"approval-rule-subject-tasks-list-item\"> \n      <div class=\"item\"> \n       <div class=\"container\"> <span class=\"title\">Determine whether backups are usable<\/span> \n        <div class=\"body\">\n         Will be submitted\n        <\/div> \n       <\/div> \n      <\/div> \n     <\/div> <\/li> \n   <\/ul> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"notify-law-enforcement\"> \n <h2>Notify law enforcement<\/h2>\n <div class=\"text-content\">\n   Notifying law enforcement authorities about the ransomware attack is essential to report the incident, gather intelligence, and potentially aid in the investigation or prosecution of the attackers. This task involves reaching out to the appropriate law enforcement agency and providing them with the necessary information. Understand the legal requirements and obligations involved in reporting cyber incidents in your jurisdiction. Document the details of the law enforcement notification for future reference. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Law enforcement agency <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"members-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Investigating officer <\/label> <select disabled class=\"form-control\"> <option value=\"A member or group will be selected here\">A member or group will be selected here<\/option> <\/select> \n  <\/div> \n <\/div> \n <div class=\"date-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Notification date <\/label> \n   <div class=\"date-container\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-calendar btn-icon\"><\/i> Date will be set here <\/button> \n   <\/div> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"notify-affected-individuals\"> \n <h2>Notify affected individuals<\/h2>\n <div class=\"text-content\">\n   Notifying the affected individuals or stakeholders about the ransomware attack is necessary to provide guidance, support, and ensure transparency. This task involves developing a communication plan and notifying the impacted parties in a timely manner. Prepare a template or draft communication for notifying affected individuals about the incident, potential risks, and recommended actions. Consider involving legal or public relations experts in the communication process. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Communication method <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"members-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Internal communication contact <\/label> <select disabled class=\"form-control\"> <option value=\"A member or group will be selected here\">A member or group will be selected here<\/option> <\/select> \n  <\/div> \n <\/div> \n <div class=\"members-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> External communication contact <\/label> <select disabled class=\"form-control\"> <option value=\"A member or group will be selected here\">A member or group will be selected here<\/option> <\/select> \n  <\/div> \n <\/div> \n <div class=\"send-rich-email-content form-field-content\"> <!-- No Recipients --> <!-- No Recipients --> <!-- No Recipients --> \n  <div class=\"form-group subject\"> <label>Subject<\/label> \n   <p class=\"form-control-static\"> Notification regarding ransomware attack <\/p> \n  <\/div> \n  <div class=\"form-group body\"> <label>Body<\/label> <iframe srcdoc=\"<p>Dear {{form_Internal_communication_contact}},<\/p><p>We regret to inform you that our organization has experienced a ransomware attack. Your systems or data may have been affected by this incident. It is important to take immediate action to mitigate the impact and prevent further damage.<\/p><p>Please review the attached document that provides instructions and recommended measures for responding to the attack. If you have any questions or require further assistance, do not hesitate to reach out to us.<\/p><p>Thank you for your understanding and cooperation.<\/p>\n<style>*{font-family:Inter,&quot;Segoe UI&quot;,&quot;Roboto&quot;,&quot;Oxygen&quot;,&quot;Ubuntu&quot;,&quot;Cantarell&quot;,&quot;Fira Sans&quot;,&quot;Droid Sans&quot;,&quot;Helvetica Neue&quot;,system-ui,sans-serif}<\/style>\n\" sandbox=\"\"><\/iframe> \n  <\/div> \n  <div class=\"form-group\"> <button type=\"button\" disabled class=\"btn btn-default\"> <i class=\"fa fa-envelope btn-icon\"><\/i> Send <\/button> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"report-to-regulatory-body\"> \n <h2>Report to regulatory body<\/h2>\n <div class=\"text-content\">\n   Reporting the ransomware attack to the relevant regulatory body or authority is necessary to comply with data breach notification requirements and industry regulations. This task involves identifying the appropriate regulatory body, understanding the reporting obligations, and providing the necessary information about the incident. Consult legal experts or regulatory compliance resources to ensure accurate reporting and adherence to the established timelines. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Regulatory body <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Reporting obligations <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"members-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Regulatory compliance contact <\/label> <select disabled class=\"form-control\"> <option value=\"A member or group will be selected here\">A member or group will be selected here<\/option> <\/select> \n  <\/div> \n <\/div> \n<\/section> \n<section id=\"restoration-of-affected-systems\"> \n <h2>Restoration of affected systems<\/h2>\n <div class=\"text-content\">\n   Restoring the affected systems, files, and data is paramount to resume normal business operations after a ransomware attack. This task involves recovering the compromised systems from backups or rebuilding them from scratch. Follow the established restoration procedures or consult with IT administrators to ensure the successful restoration of systems, data, and configurations. Test the restored systems for functionality and verify the integrity of the recovered data. \n <\/div> \n <div class=\"multi-select-content form-field-content\"> \n  <div class=\"form-group\"> <label> Restoration method <\/label> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Backup restoration \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      System rebuild \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Data recovery \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n <div class=\"select-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> System functionality <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Fully operational \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Partial functionality \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Requires further troubleshooting \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"monitor-systems-for-unusual-activities\"> \n <h2>Monitor systems for unusual activities<\/h2>\n <div class=\"text-content\">\n   Continuous monitoring of systems for any unusual activities is essential to detect any potential remnants of the ransomware or new malicious activities. This task involves implementing monitoring tools, intrusion detection systems, or threat intelligence feeds to identify any signs of malicious behavior. Monitor network traffic, system logs, and user activities to ensure early detection and swift response to any potential threats or indicators of compromise. \n <\/div> \n <div class=\"text-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Monitoring tools used <\/label> \n   <input type=\"text\" placeholder=\"Something will be typed here...\" disabled class=\"form-control\"> \n  <\/div> \n <\/div> \n <div class=\"select-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Monitoring frequency <\/label> <select disabled class=\"form-control\"> <option value=\"An option will be selected here\">An option will be selected here<\/option> <\/select> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Hourly \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Daily \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Weekly \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"implement-stronger-security-measures-to-prevent-future-attacks\"> \n <h2>Implement stronger security measures to prevent future attacks<\/h2>\n <div class=\"text-content\">\n   Enhancing security measures is necessary to prevent future ransomware attacks and protect the organization's systems and data. This task involves reviewing and improving existing security controls, updating software and system configurations, or implementing additional preventive measures. Consult with cybersecurity experts, perform risk assessments, and consider implementing measures such as access controls, data encryption, regular patching, and employee training programs. \n <\/div> \n <div class=\"multi-select-content form-field-content\"> \n  <div class=\"form-group\"> <label> Security measures <\/label> \n  <\/div> \n  <ul class=\"items\"> \n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       1 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Two-factor authentication \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       2 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Firewall configuration update \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       3 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Endpoint protection deployment \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       4 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Employee security awareness training \n    <\/div> <\/li>\n   <li class=\"item\"> \n    <div class=\"step-number-container\"> \n     <div class=\"step-number\">\n       5 \n     <\/div> \n    <\/div> \n    <div class=\"step-checkbox-container\"> \n     <div class=\"step-checkbox\"><\/div> \n    <\/div> \n    <div class=\"item-name-static\">\n      Data backup policy enhancement \n    <\/div> <\/li> \n  <\/ul> \n <\/div> \n<\/section> \n<section id=\"gain-organizational-lessons-learned-and-revise-response-plan\"> \n <h2>Gain organizational lessons learned and revise response plan<\/h2>\n <div class=\"text-content\">\n   Gaining organizational lessons learned from the ransomware incident is crucial for improving future incident response strategies and refining the response plan. This task involves conducting post-incident reviews, collecting feedback from stakeholders, and identifying areas for improvement. Analyze the effectiveness of the response actions, communication processes, and overall incident management. Revise the response plan based on the lessons learned to enhance the organization's resilience to future ransomware attacks. \n <\/div> \n <div class=\"textarea-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Lessons learned <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea> \n  <\/div> \n <\/div> \n <div class=\"textarea-field-content form-field-content\"> \n  <div class=\"form-group\"> <label> Response plan revisions <\/label> <textarea placeholder=\"Something will be typed here...\" rows=\"3\" disabled class=\"form-control\"><\/textarea> \n  <\/div> \n <\/div> \n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Detect and confirm ransomware attack This task is responsible for detecting and confirming a ransomware attack. It plays a crucial role in initiating the incident response process. Its successful completion will ensure that the appropriate response plan is executed promptly. To complete this task, you will need to utilize various detection tools and techniques, such [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ep_exclude_from_search":false,"cover_icon_emoji":"\ud83d\udd12","cover_icon_url":"","tasks_count":"20","template_description":"","template_id":"sGKh2FmT9RylrbiusctMtw","task_0":"Detect and confirm ransomware attack","task_slug_0":"detect-and-confirm-ransomware-attack","task_1":"Identify type and strain of ransomware","task_slug_1":"identify-type-and-strain-of-ransomware","task_2":"Isolate affected systems","task_slug_2":"isolate-affected-systems","task_3":"Preserve evidence and take system snapshots","task_slug_3":"preserve-evidence-and-take-system-snapshots","task_4":"Inventory affected systems and data","task_slug_4":"inventory-affected-systems-and-data","task_5":"Determine source of ransomware","task_slug_5":"determine-source-of-ransomware","task_6":"Disable system restore and delete shadow copies for Windows","task_slug_6":"disable-system-restore-and-delete-shadow-copies-for-windows","task_7":"Removal of the ransomware from the infected systems","task_slug_7":"removal-of-the-ransomware-from-the-infected-systems","task_8":"Approval: IT Manager for ransom note assessment","task_slug_8":"approval-it-manager-for-ransom-note-assessment","task_9":"Analyze the ransom note","task_slug_9":"analyze-the-ransom-note","task_10":"Determine whether backups are usable","task_slug_10":"determine-whether-backups-are-usable","task_11":"Execute response plan","task_slug_11":"execute-response-plan","task_12":"Approval: CEO for funds transfer for ransom","task_slug_12":"approval-ceo-for-funds-transfer-for-ransom","task_13":"Notify law enforcement","task_slug_13":"notify-law-enforcement","task_14":"Notify affected individuals","task_slug_14":"notify-affected-individuals","task_15":"Report to regulatory body","task_slug_15":"report-to-regulatory-body","task_16":"Restoration of affected systems","task_slug_16":"restoration-of-affected-systems","task_17":"Monitor systems for unusual activities","task_slug_17":"monitor-systems-for-unusual-activities","task_18":"Implement stronger security measures to prevent future attacks","task_slug_18":"implement-stronger-security-measures-to-prevent-future-attacks","task_19":"Gain organizational lessons learned and revise response plan","task_slug_19":"gain-organizational-lessons-learned-and-revise-response-plan","task_20":"","task_slug_20":"","task_21":"","task_slug_21":"","task_22":"","task_slug_22":"","task_23":"","task_slug_23":"","task_24":"","task_slug_24":"","task_25":"","task_slug_25":"","task_26":"","task_slug_26":"","task_27":"","task_slug_27":"","task_28":"","task_slug_28":"","task_29":"","task_slug_29":"","task_30":"","task_slug_30":"","task_31":"","task_slug_31":"","task_32":"","task_slug_32":"","task_33":"","task_slug_33":"","task_34":"","task_slug_34":"","task_35":"","task_slug_35":"","task_36":"","task_slug_36":"","task_37":"","task_slug_37":"","task_38":"","task_slug_38":"","task_39":"","task_slug_39":"","task_40":"","task_slug_40":"","task_41":"","task_slug_41":"","task_42":"","task_slug_42":"","task_43":"","task_slug_43":"","task_44":"","task_slug_44":"","task_45":"","task_slug_45":"","task_46":"","task_slug_46":"","task_47":"","task_slug_47":"","task_48":"","task_slug_48":"","task_49":"","task_slug_49":"","task_50":"","task_slug_50":"","task_51":"","task_slug_51":"","task_52":"","task_slug_52":"","task_53":"","task_slug_53":"","task_54":"","task_slug_54":"","task_55":"","task_slug_55":"","task_56":"","task_slug_56":"","task_57":"","task_slug_57":"","task_58":"","task_slug_58":"","task_59":"","task_slug_59":"","task_60":"","task_slug_60":"","task_61":"","task_slug_61":"","task_62":"","task_slug_62":"","task_63":"","task_slug_63":"","task_64":"","task_slug_64":"","task_65":"","task_slug_65":"","task_66":"","task_slug_66":"","task_67":"","task_slug_67":"","task_68":"","task_slug_68":"","task_69":"","task_slug_69":"","task_70":"","task_slug_70":"","task_71":"","task_slug_71":"","task_72":"","task_slug_72":"","task_73":"","task_slug_73":"","task_74":"","task_slug_74":"","task_75":"","task_slug_75":"","task_76":"","task_slug_76":"","task_77":"","task_slug_77":"","task_78":"","task_slug_78":"","task_79":"","task_slug_79":"","task_80":"","task_slug_80":"","task_81":"","task_slug_81":"","task_82":"","task_slug_82":"","task_83":"","task_slug_83":"","task_84":"","task_slug_84":"","task_85":"","task_slug_85":"","task_86":"","task_slug_86":"","task_87":"","task_slug_87":"","task_88":"","task_slug_88":"","task_89":"","task_slug_89":"","task_90":"","task_slug_90":"","task_91":"","task_slug_91":"","task_92":"","task_slug_92":"","task_93":"","task_slug_93":"","task_94":"","task_slug_94":"","task_95":"","task_slug_95":"","task_96":"","task_slug_96":"","task_97":"","task_slug_97":"","task_98":"","task_slug_98":"","task_99":"","task_slug_99":"","footnotes":""},"categories":[72,23],"tags":[],"class_list":["post-31399","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-operations"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/31399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/comments?post=31399"}],"version-history":[{"count":0,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/31399\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media?parent=31399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/categories?post=31399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/tags?post=31399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}