Organizations of all shapes and sizes, in all sectors, are impacted by ransomware. Business leaders should be ready to respond to ransomware, whether they are in charge of a major corporation or a small company with a few people. Additionally, ransomware response plans are a useful tool for both internal IT teams and MSPs that outsource their IT assistance to enterprises.
In the previous 12 months, ransomware attacks or breaches have affected more than a third of all international organizations.
According to the “Global Threat Landscape Report” by Fortinet, there were an average of 149,000 ransomware assaults per week in June 2021, up from 14,000 in June 2020. Hence, having a ransomware response strategy in place is essential.
Let’s examine four crucial measures in a successful ransomware response strategy.
Identify the extent of the infection
Businesses must assess how much of their file structure is encrypted or corrupted. Additionally, they must ensure that patient zero has no access to things like network storage, cloud storage, shared or private files, external hard drives, and USBs. Firms must look for any indications of malware or encryption in these. Also, organizations should check to see if the file listings and system registry are encrypted. If they have backups, make sure they are current and complete. Businesses need to be aware that even if PCs on their network have not been shared directly, ransomware might attach itself to them. Ransomware may propagate and set itself up on other computers as long as patient zero is linked to a shared network, disc, or folder (similar to a biological worm or virus).
Also Read: Strengthening Security as Threat Actors Recycle Ransomware
A checklist of urgent tasks
A list of immediate actions to take in a crisis is part of the best response strategy. To contain an assault, businesses must create a step-by-step playbook of actions, like isolating hardware and shutting down services. They need to specify how to get in touch with management and law enforcement.
Organizational cybercrime and threat actors supported by nation-states frequently carry out cyber-attacks. This makes notifying law enforcement of an offense against the organization crucial. To combat cybercrime and improve collaboration between business and public sector entities, victim organizations must share intelligence with law enforcement and government authorities.
Quickly containing an onslaught is essential. Establishing a strategy for reliably restoring data from backups is crucial, assuming that the adversary has already obtained encrypted data. The impact on operations will increase the longer businesses wait. Enterprises should regularly back up their data and evaluate their recovery processes.
Consider obligations
Depending on the region and sector, ransomware laws might be very different. In light of this, businesses should evaluate if they have any legal obligation to take any specific activities in response to the assault. For instance, a company could be legally obligated to alert consumers and regulators of the attack. Likewise, several localities have laws requiring ransomware victims to inform law enforcement about assaults.
It is essential to carefully assess if it is in the business’s best interests to conceal the occurrence if the firm is not legally compelled to disclose ransomware attacks. It’s generally best to acknowledge the attack if customer data was possibly exposed. A cover-up might do far more harm if it is ever discovered, even if an admission of this kind will surely result in some negative press and lost income.
Also Read: Five Key Points Every Cybersecurity Disaster Recovery Plan Must Entail
Keep up with the best backup techniques
Traditional backups to outdated tape drives, a potential line of security against ransomware, can be incredibly sluggish because of their mechanical nature. Additionally, tapes deteriorate over time, raising the chance of data loss.
Industry experts advise reconsidering how to go about cyber recovery. Strategies for Disaster Recovery (DR) are ineffective for recovering from ransomware. As an alternative, firms could think about taking logically air-gapped snapshots of their primary warehouse, which would provide rigid, incorruptible data copies.
For more such updates follow us on Google News ITsecuritywire News
