Ransomware

1. Preparation #

• Objective: Be able to survive encryption without paying, which is a backup and identity problem long before it is a malware problem.
• Scope & scenarios:
  • Opportunistic encryption of endpoints or a file share, usually automated and fast.
  • Human-operated intrusion ending in mass encryption, preceded by days or weeks of reconnaissance, privilege escalation and backup destruction.
  • Extortion without encryption, where data is stolen and publication threatened. There is no availability symptom at all.
  • Double or triple extortion combining encryption, publication and pressure on customers, regulators or staff directly.
• The framing that matters most: encryption is the end of the intrusion, not the beginning. By the time files are encrypted the adversary has usually held privileged access for some time. The scope of the incident is therefore never “which files were encrypted”.
• Backup strategy, treated as a control rather than an IT service:
  • At least one copy that cannot be deleted or altered by an administrator of the production estate, whether offline, immutable or held under separate credentials.
  • Backup infrastructure on a separate identity plane. Domain administrator should not imply backup administrator.
  • Restores tested and timed, not merely scheduled. An untested backup is an assumption.
  • Documented recovery objectives per system, so that recovery order is decided before the pressure arrives.
• Prerequisites & controls: endpoint detection on servers as well as workstations with tamper protection; multi-factor authentication on remote access and privileged accounts; network and identity segmentation; restricted lateral movement protocols; controlled outbound egress.
• Roles & decision makers: incident commander, SOC lead, infrastructure and backup owners, identity administrator, legal and privacy, communications, executive sponsor, and pre-agreed external incident response and insurance contacts.
• Decisions to take before an incident, not during one:
  • The organisation’s position on paying, and who alone may change it.
  • Who may disconnect a site or a network segment without further approval.
  • The threshold at which crisis management is convened rather than an incident worked.
  • Where response will be coordinated if corporate mail and chat cannot be trusted.

2. Identification #