Eleven steps to an effective ransomware response checklist

Issue 1 2023 Editor's Choice, Cyber Security

FortiGuard Labs' research shows that organisations in almost all areas around the world are possible targets for ransomware attacks. Therefore, it is important to keep in mind that no sector is safe from ransomware. Organisations should consider this ransomware attack response checklist to effectively deal with an active ransomware attack.

1. Don’t panic

Once you realise you have been targeted, you need to stay calm and act purposefully. If you could not make a response plan or were caught off guard, reach out to your security vendor for help or report the incident to your insurance company; they may already have a list of expert security providers who can help you.

Further, consider the potential impact the security incident may have. Take into account not only the obviously compromised areas, such as data encryption and application removal, but also additional areas of potential compromise. Try to get a running list of all possible areas that may be affected.

2. Isolate your systems and stop the spread

First, identify the range of the attack. If the incident is already known to be widespread, implement blocks at the network level (i.e., isolating traffic at the switch or the firewall edge) or consider temporarily taking down the internet connection. If the incident scope is confirmed to be narrow, infecting only a few systems, isolate attackers at the device level by possibly pulling the ethernet or disconnecting the Wi-Fi.

If available, endpoint detection and response (EDR) technology may block the ransomware attack at the process level, which would be the best immediate option with minimal business disruption. Most ransomware attackers find a vulnerability to get into your organisation, such as exposed RDP, phishing emails, or other types of similar methods.

3. Identify the ransomware variant

Many of the tactics, techniques, and procedures (TTPs) of each ransomware variant are publicly documented. Determining which strain you are dealing with can give you clues on the location of the threat and how it is spreading. Depending on the variant, some decryption tools may already be available for you to decrypt your ransomed files.

4. Identify initial access

Determining the initial access point, or patient zero will help identify and close the hole in your security. Common initial access vectors are phishing, exploits on your edge services (such as remote desktop services), and the unauthorised use of credentials. Determining the initial point of access is sometimes difficult and may need the expertise of digital forensics teams and IR experts.

5. Identify all infected systems and accounts (scope)

Identify any active malware or persistent leftovers on systems that are still communicating to the command-and-control (C2) server. Common persistence techniques include creating new processes running the malicious payload, using run registry keys, or creating new scheduled tasks.

6. Determine if data was exfiltrated

Oftentimes, ransomware attacks not only encrypt your files but also exfiltrate your data. They will do this to increase the chances of ransom payment by threatening to post things like proprietary or embarrassing data online. They may even contact your business partners if they identify any of their data that was stolen and threaten them as well. Look for signs of data exfiltration, such as large data transfers, on your firewall edge devices. Search for odd communications from servers going to cloud storage applications.

7. Locate your backups and determine integrity

A ransomware attack will attempt to wipe your online backups and volume shadow copies to decrease the chances of data recovery. Because of this, ensure your backup technology was not affected by the incident and is still operational. With many ransomware attacks, attackers have usually been in your network for days, if not weeks, before deciding to encrypt your files. This means that you may have backups that contain malicious payloads that you do not want to restore to a clean system. Scan your backups to determine their integrity.

8. Sanitise systems or create new builds

If you feel confident in your ability to identify all of the active malware and incidents of persistence in your systems, then you may be able to save some time by not rebuilding. However, it may just be easier and safer to create new, clean systems. You may even consider building an entirely separate, clean environment that you can then migrate to. This should not take too long if you are running a virtual environment. When rebuilding or sanitising your network, ensure the appropriate security controls are installed and are following best practices to ensure devices do not become reinfected.

9. Report the incident

It’s important to report the incident. You should also determine if reporting to law enforcement is needed and required. Your legal team can help address any legal obligations around regulated data.

10. Paying the ransom?

Law enforcement advises against paying the ransom. However, if you are considering it, you should hire a security company with specialised skills to help you. Additionally, paying the ransom or working out a settlement is not going to remediate the vulnerabilities that the attackers exploited, so it is still essential to ensure you have identified the initial access point and patched the vulnerabilities.

11. Conduct a post-incident review

Review your ransomware incident response to understand what went right and to document opportunities for improvement. This ensures the continuous improvement of your response and recovery capabilities for the future. Consider simulating the technical and non-technical details of the attack in the red team and table-top exercises so you can review your options. You can also consider doing proactive playbook building focused on different attack scenarios such as ransomware. If IT or security team staffing is limited, consider building a playbook using a service.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Prevention-first approach to cybersecurity
News Cyber Security
Check Point CEO, Gil Shwed, highlights the increasing importance of artificial intelligence in defending evolving networks and protecting against cyber threats at annual CPX 360 customer and partner event.

Off-grid power solution for residential estate
Editor's Choice Security Services & Risk Management Residential Estate (Industry) Products
Coral Beach Estate, an upmarket residential estate based in East London, has been struggling with load shedding and power outages due to South Africa's energy crisis, as well as the vandalism of its power infrastructure.

Cybersecurity in Africa: The challenges and solutions
Training & Education Cyber Security
Africa faces a significant challenge when it comes to the availability and distribution of cybersecurity talent and secure IT infrastructures. Facing this challenge will require supporting and nurturing the next generation of security graduates and professionals.

Top seven trends for the security industry
Hikvision South Africa Editor's Choice
Expect security systems to become even more deeply integrated and comprehensive, expanding with capabilities that are now shouldering tasks that are more intelligent, to improve efficiency in security as well as other operational functions.

AI’s take on physical security trends
Technews Publishing Editor's Choice
In Issue 1 every year, Hi-Tech Security Solutions looks at expected trends in the security industry, incorporating views from different sources. This year is no different, except we have a new contributor, ChatGPT from OpenAI.

Developing an effective CCTV control room culture
Leaderware Editor's Choice CCTV, Surveillance & Remote Monitoring Training & Education
Organisational culture in organisations can be seen as the set of values, practices, focus, standards and behaviours, and ways of interacting with others that are accepted and subscribed to by the people who work there.

Women in Security
Technews Publishing Editor's Choice News
Hi-Tech Security Solutions together with ASIS International’s South Africa Chapter, will be focusing on women working within the South African physical security services and information technology sectors during 2023.

Enter the 2023 South African OSPA Awards
Editor's Choice News
Nominations for the 2023 South African Outstanding Security Performance Awards (OSPAs) in six categories have been extended and entries can be submitted until 18 April 2023.

Hardening physical security against cyberattacks
Genetec Editor's Choice Cyber Security IT infrastructure
As the world becomes increasingly interconnected through the move to cloud computing and Internet of Things (IoT) devices, cybercrime has risen steadily, along with tools to combat it. Geopolitical tensions have the potential to rapidly unleash devastating cyberattacks worldwide.

Fast, reliable and secure cloud services
Technews Publishing Editor's Choice Cyber Security IT infrastructure
Security and speed are critical components of today’s cloud-based services infrastructure. Cloudflare offers a range of services supporting these goals beyond what most people think it does.