How can we improve our Incident Response Plan to better handle ransomware attacks?

All answers to this question.

A modern IR plan for ransomware must prioritize "Immutable Backups." If your backups can be encrypted by the attacker, your recovery plan is useless. Secondly, define clear communication channels that do not rely on your primary corporate network, as that will likely be down. Your plan should also include pre-negotiated contracts with external digital forensics and incident response (DFIR) firms. Speed is everything; having a clear "playbook" for isolation helps contain the infection before it spreads from a single workstation to your entire data center or cloud storage.

   Answered 2024-08-24 by Deborah Mitchell

The technical side is clear, but have you run any "Tabletop Exercises" with your executive leadership team yet? How do they plan to handle the legal and PR ramifications if sensitive customer data is exfiltrated and posted on a leak site before you even finish the decryption process?

   Answered 2024-08-26 by Gregory Vance

• Gregory, we actually have our first tabletop exercise scheduled for next month. We are involving our legal counsel and a PR firm to simulate a "double extortion" scenario. It’s opening a lot of eyes about how complex the decision-making process becomes when data is held hostage.

     Commented 2024-08-28 by Justin Fletcher

Offline backups are still relevant. We keep an "Air-Gapped" copy of our most critical database off-site. It is our absolute last line of defense, but it gives us peace of mind during high-alert periods.

   Answered 2024-08-30 by Sarah Jenkins

• Absolutely, Sarah. Air-gapping might seem old-fashioned to some, but in the era of sophisticated cloud-based ransomware, having a physical disconnect is the only way to be 100% sure your data is safe.

     Commented 2024-09-01 by Deborah Mitchell