Ransomware: what is your plan?

Ransomware is no longer something that happens to others. Logins, customer data and ready-made access to company networks are bought and sold every day on the dark web. Ransomware groups buy that access, quietly steal your data, encrypt your systems and demand payment, often with the threat of publishing everything they took.

For some companies, a single attack means weeks without production, lost customers and, in the worst case, the end of the business. The companies that come through it have one thing in common: they had a plan before it happened.

Before: prepare while it is calm

• Backups that cannot be encrypted. Keep immutable or offline copies, separated from your normal accounts, and test a full restore regularly. A backup you have never restored is a hope, not a plan.
• Close the common ways in. Multi-factor authentication everywhere, fast patching, and phishing awareness for everyone.
• Limit the spread. Segment your network and remove admin rights that are not needed.
• Know what is already leaked. Monitor the dark web for logins and data linked to your company.
• Write the plan and practise it. Who decides? Who do you call? How do you communicate? Run a tabletop exercise with management at least once a year.

During: the first hours

1. Isolate affected systems. Disconnect them from the network, but do not switch everything off: evidence matters.
2. Get expert help immediately. The first hours decide how bad it gets.
3. Report. Under NIS2, an early warning is due within 24 hours. Under GDPR, a personal data breach must be reported to the supervisory authority within 72 hours. Report the crime to the police.
4. Do not decide on the ransom in panic. Paying gives no guarantee that you get your data back or that it is not published. Take the decision with legal advice and the police.
5. Communicate clearly with staff, customers and partners.

After: recover and get stronger

• Restore from clean backups, and rebuild what cannot be trusted.
• Find out how the attackers got in, and close that door before you go live again.
• Change all passwords and keys that may have been exposed.
• Hold a lessons-learned review and improve your controls.

Five questions for your next board meeting

1. Can we restore all critical systems if everything is encrypted tonight?
2. When did we last test a full restore?
3. Who decides, and who do we call, in the first hour?
4. What leaked data about us is already for sale?
5. Do we meet the NIS2 and GDPR reporting deadlines?

If any answer is "we don't know", that is where to start. Talk to us about a ransomware readiness review.