Återställning efter ransomware attacker : En studie av praktisk hantering och prioritering av verksamhetskritiska system

Sammanfattning

Ransomware attacks have become one of the most serious threats to organizations' information security, causing extensive operational disruptions and significant economic losses. When an attack occurs, it is rarely possible to restore all systems simultaneously, making it critical to prioritize which systems should be recovered first. Despite this, many organizations lack structured methods for making these prioritization decisions, particularly under the time pressure and uncertainty that characterizes an active incident. The purpose is to identify the factors that influence the prioritization of IT systems during recovery after ransomware attacks, and to develop a conceptual scoring model that can serve as decision support for organizations in the recovery process. The study is based on a qualitative research strategy with semi-structured interviews conducted with professionals in IT security and incident management, as well as IT managers within the Swedish grocery retail sector. The results show that organizations primarily identify critical IT systems based on their business processes rather than technical characteristics. The most influential factors in prioritization decisions are economic impact, time criticality in terms of Recovery Time Objective, and system dependencies. Systems such as point-of-sale systems and payment terminals are identified as the most critical within grocery retail, as their failure immediately halts core business operations. Based on these findings, a conceptual scoring model was developed that evaluates IT systems across six weighted factors, generating a priority score on a scale from 0 to 100. The model was positively received by all respondents, who described it as a useful tool for structuring prioritization decisions, particularly in smaller and medium-sized organizations that lack established frameworks for incident response. The study contributes both a concrete artifact in the form of the scoring model, and increased understanding of the practical factors that influence IT system prioritization during ransomware recovery within the grocery retail sector.