Panic-driven decisions after discovering ransomware can multiply the damage. A disciplined response plan for the first 24 hours is essential.
The first two hours
- Disconnect affected systems from the network; avoid shutting them down because volatile evidence may be lost
- Activate the incident response team
- Provide initial updates to management and legal advisers
- Restrict access to backups, which may be targeted in a second wave
- Centralize external communication with clients and the press
Hours 2–8: Assessment
Determine the scope of the attack and the type of malware. Which systems are affected? Is the attacker still present? Could data have been exfiltrated? Forensic analysis should help answer these questions.
Hours 8–24: The recovery decision
Recovery can begin when clean backups are available. If they are not, or if data has been exfiltrated, coordination with legal advisers and insurers is critical. Any consideration of ransom payment should be a last resort evaluated with professional advice.
Lost time can cost more than the ransom itself. Prepared organizations can recover in hours rather than days.
Keep reading