How to sequence identity containment and recovery in a ransomware incident