Network and Security Consultant Resources: Ransomware Response Checklist

Cyber threats are always growing. As a network and security consultant, we advise clients to be aware of incidents like ransomware attacks. Unfortunately, these incidents are more common than people realize. And although they are not as dramatized as they may seem in the media or in movies, these attacks are serious. Would you know how to respond when cybercriminals claim to hold your data hostage and threaten to leak it unless you pay?  

A ransomware attack is a nerve-wracking experience. However, if you have a thorough response plan and act quickly you can help recover data, minimize the damage and get your business back up and running. 

There are 10 important steps you must follow to help mitigate the attack. 

1. Isolate Infected Systems to Stop the Spread 

As a network and security consultant, your priority when handling a ransomware attack is to stop the spread. To do this you must identify and isolate any infected systems. 

To identify infected systems look for encrypted files, ransom notes, unusual file extensions or any slowdowns to the system. After you’ve identified an infected system, you need to immediately disconnect it from the network so other systems that are part of the network won’t be infected. 

Powering down your devices should only be done if you are unable to safely disconnect a system. It is crucial to stop the ransomware from further spreading. 

2. Understanding the Ransomware and Identifying the Enemy 

You know the saying “knowing your enemy is half the battle”? That sentiment rings especially true when dealing with a ransomware attack. You must identify the strain of ransomware because each strain has its own behavior and encryption method. 

If you are able to identify the specific strain of ransomware then you can determine the best course of action to recover. Some tools are available to help identify which type of ransomware you have. It is important to ensure that you only use tools from a reputable resource like a U.S. government agency or reputable cybersecurity provider. 

3. Assemble Your Response Team 

It’s important not to fight this attack alone; a network and security consultant should be part of your response and recovery team. Ransomware requires a coordinated effort as it is a difficult beast to tame. As you build your team, consider the following:

• Your internal IT staff members are some of the most important people on the team. They can isolate infected systems, are very knowledgeable about your network and will help with initial recovery efforts. 
• If you have a managed service provider that helps with your cybersecurity efforts you need to contact that provider immediately. They will assist with threat analysis and can potentially offer specialized resources and tools. The provider’s experience with incident response will make them invaluable. 
• Law enforcement is another partner to lean on in your response, especially federal agencies like the FBI, as they may have information on your specific strain and possibly decryption tools. 

4. Collect Evidence for Investigation

Collecting evidence is an important part of the response to ransomware attacks. The evidence will help with future investigation and recovery efforts. System logs are an important piece of information to grab from affected systems, because they may have information on entry points, attack timelines and the cybercriminal’s activities on your network. 

Security researchers might be able to develop a decryptor based on samples of infected files. It is important to isolate and preserve these, so you can potentially help others who are attacked with the same strain in the future. 

Lastly, take screenshots of odd system behavior, and any ransom notes. These pieces of information can be crucial for investigators.  

5. Look for a Decryption Key

Cybersecurity researchers and law enforcement agencies may have experience with decrypting the ransomware that is currently infecting your network system. Your IT service provider may also have a decryptor available for your particular strain of ransomware. 

One of the most effective defenses against ransomware is a thorough and robust backup strategy. As a network and security consultant, we ensure advise all our clients to have backup procedures to help them recover from an attack. If you have recent backups that are not infected then you can restore the systems to a recovery point before the attack occurred. It is important to double, if not triple, check that the backup is 100 percent clean. 

6. Prioritize Recovery 

As you respond to a ransomware attack, it’s critical to take a strategic approach. You can prioritize your efforts by focusing on getting essential systems back online first and restoring critical data lost in the attack. Essential systems may involve accounting and finance, storage of sensitive data, operational equipment and any other systems critical for daily workflow.  

Obviously, your data is critical, but negotiating with attackers to return it should be your last resort. From customer or employees’ sensitive information to bank account numbers and intellectual property, you can restore critical data by using recovery tools and relying on robust backup practices. 

7. Rebuild and Clean Your Systems 

Rebuilding should take place after you’ve recovered your data and kicked the cybercriminal to the curb. You may have restored your data and the cybercriminal may be gone, but there are likely traces of ransomware in your systems. 

First, conduct an anti-malware scan. A thorough exam needs to be done on all potentially affected systems. If you are unsure if a system was affected, it’s better to do a preemptive malware scan. You don’t want to leave any doors open for criminals to sneak back in. 

Once your anti-malware scans have been completed, it’s time to make your systems even more secure and resistant to future attacks. Your network and security consultant should ensure you have processes in place to patch software vulnerabilities, review access controls, update security protocols and eliminate any potential weaknesses. 

8. Learn From the Experience

While it’s certainly unpleasant, business owners and leaders can use a ransomware attack as a learning experience. Once the attack is over and your system is back up and running, take some time to do an incident review. Your goal should be to understand how the attack happened and any vulnerabilities that were exploited. 

Next, it is important to train all of your employees on cybersecurity best practices, especially on secure, strong passwords and phishing awareness. Cybersecurity training needs to be regular and consistently repeated so it is always top of mind. 

Lastly, update your cybersecurity response plan with everything you have learned and what could have been done better. Ensure your response plan is clearly laid out with roles, responsibilities and contact information for your network and security consultant. If you have another attack, this will help ensure your reaction is swift and targeted. 

9. Share Your Expertise 

As we mentioned earlier, you need to take screenshots of evidence and share those with relevant authorities but we also recommend sharing them in industry groups. Any information you can give on the ransomware attack could help someone else in the future.  

10. Consult a Network and Security Consultant 

Network and security consultants are your allies during a ransomware attack and afterward. They can give you guidance on how to respond to the incident, provide security awareness training post-attack, and perform penetration testing and vulnerability assessments to find any weak spots in your cybersecurity posture. 

Decrease the Cyberattack Likelihood

You need a partner on your team to help with cybersecurity issues, like cyberattacks. Leveraging the knowledge of a network and security consultant can increase the chances of surviving an attack. It can also minimize risk, downtime and damages. Synchronet has the expertise needed to keep your business safe. If you are ready to boost your cybersecurity protocols, let’s talk.