What are the first three steps you take when you suspect a high-priority system has been compromised by ransomware at Sony?