How do we prepare for a ransomware incident?

By putting in place the five controls that decide the outcome and rehearsing the response. Phishing-resistant multi-factor authentication on administrative, remote and email access removes the most common entry. Endpoint detection and response on every device, with someone acting on it, catches the intrusion before encryption. Removing standing administrative privilege stops one machine becoming the whole environment. Segmenting backups and servers from workstations limits the blast. Isolated, immutable backups with a tested restore make recovery possible without paying. Then: a playbook, counsel and the insurer engaged in advance, evidence preservation, a decision on payment made before it is needed, and a tabletop that rehearses all of it.

CISA’s StopRansomware guidance covers the same ground in more detail. Insurers ask about ransomware above all, and a readiness review that evidences the five controls is what answers them.

The decisions made in advance matter as much as the controls: who can isolate systems, who calls whom, whether the organization will pay and who decides, what is preserved before anything is rebuilt. An organization deciding these during an attack decides them badly.

See the ransomware readiness checklist, ransomware readiness review, the five controls that decide the outcome and who do we call first in a breach.

How do we prepare for a ransomware incident?

The reasoning.

Read next.

Tell us what must not fail.