Ransomware attacks have become increasingly common in recent years. When a business suffers a ransomware attack, it can result in significant data loss, downtime, and financial costs. Having an effective incident response plan is crucial for minimizing damage and recovering quickly after an attack. Here are some best practices for organizations to follow when responding to a ransomware incident.
Preparation
The most important ransomware response best practice is preparation. Organizations should take proactive steps to protect themselves and be ready to respond if an attack occurs. Some key preparation activities include:
- Conducting regular backups of critical data and systems
- Keeping backups isolated and offline to prevent encryption by ransomware
- Installing and updating anti-malware/anti-ransomware tools
- Educating employees on ransomware risks and response
- Developing and testing an incident response plan for ransomware attacks
- Ensuring robust cybersecurity policies and controls are in place
With strong preventative measures, organizations can stop many ransomware attacks before they cause major damage. However, it’s still important to be prepared to respond in case an attack succeeds.
Detection
Fast detection of a ransomware attack is crucial for limiting its impact. Some signs that may indicate ransomware activity include:
- Inability to access files or data
- Files encrypted with extensions like .encrypted or .locked
- Ransom note left on computers or company website
- Increase in unusual internal traffic or connection attempts
- Crashed systems, especially databases or file shares
- Frantic calls from employees unable to access data
Organizations should monitor networks closely for these indicators and investigate any anomalies thoroughly. The sooner ransomware is detected, the less data will be lost.
Response
Once ransomware is identified, quick action is required to contain the attack’s spread. Initial response steps include:
- Isolate infected systems immediately by disconnecting from networks
- Shut down any related services, software, or equipment as applicable
- Secure backups and ensure they are free of malware
- Change passwords for any potentially affected accounts
- Alert necessary response team members and executives of the attack
- Notify relevant internal stakeholders like employees, customers, partners etc.
Slowing an active infection is the top priority so it does not impact more systems. Communication and coordination are also vital for an effective response.
Investigation & Analysis
After initial containment, a thorough investigation helps determine the root cause and full scope of the incident. Key investigation and analysis steps include:
- Documenting all system changes and suspicious activity
- Reviewing antivirus and security logs to identify primary infection vector
- Analyzing file modification dates to determine when encryption occurred
- Checking email logs for phishing attacks or other malicious messages
- Using available decryption tools to recover files if keys are obtainable
- Identifying and addressing any security gaps that enabled the attack
Understanding how the attack occurred and which systems were impacted allows organizations to fully remediate issues and prevent repeat incidents.
Remediation
Eradicating the ransomware from systems and restoring encrypted data should occur in tandem with investigation. Best practices for remediation include:
- Wiping and reimaging infected systems to eliminate malware
- Restoring data from clean, unencrypted backups
- Resetting account credentials that may be compromised
- Conducting vulnerability scans to identify and patch security holes
- Strengthening defenses like firewalls and endpoint security
- Increasing staff phishing awareness through new training
This helps remove any residual malware traces while hardening security. Testing restored systems is then critical before returning them to production use.
Recovery & Improvement
Recovery after a ransomware attack involves both restoring business operations and enhancing defenses. Important steps include:
- Implementing enhanced security controls and policies based on the attack’s lessons
- Improving backups and continuity plans using updated risk assessments
- Monitoring systems closely for signs of continued compromise post-recovery
- Verifying ability to restore encrypted data before deleting originals
- Testing entire incident response process through practice scenarios
Documenting the attack timeline, cost, and other impacts also provides data to gauge response effectiveness. This drives continual improvement in dealing with future ransomware incidents.
Reporting & Notification
Notifying relevant parties about the attack is important legally, contractually, and reputationally. Key reporting and notification best practices include:
- Informing law enforcement if the attack appears criminal
- Contacting cyber insurance providers per policy requirements
- Notifying customers and partners if their data may be impacted
- Reporting to data protection authorities if personal data was compromised
- Being transparent about attack details with key stakeholders
- Using the incident to spread ransomware awareness in the organization and industry
Proper reporting helps organizations comply with disclosure laws, maintain trust, and obtain assistance. It also provides cyber intelligence to help defend against future attacks.
Should organizations pay the ransom?
Paying ransoms is controversial. Potential pros include quick restoration of data and systems. However, cons often outweigh these benefits:
- No guarantee encrypted data will be recovered
- Rewarding criminal behavior encourages more attacks
- Payment may violate laws prohibiting support of cybercrime
- Funds could strengthen capabilities of malicious actors
- Attackers may repeatedly target organizations that pay
Paying ransoms also provides finite relief, while bolstering defenses delivers long-term security. Weighing all these factors, most experts advise avoiding ransom payments if possible.
How much do ransomware attacks cost organizations?
Ransomware attack costs vary based on factors like:
- Size of organization
- Length of business disruption
- Amount of data and systems encrypted
- Negotiated ransom payment (if made)
- Resources required for remediation
- Legal, regulatory, and PR expenses
According to IDC, the average cost of recovery from a ransomware attack exceeds $1.4 million. Large organizations or healthcare providers often suffer costs in the tens or hundreds of millions. But even for small businesses, thousands in damages are common.
Average reported ransomware recovery costs
| Cost Type | Average Cost |
| Business disruption | $660,000 |
| Lost revenue | $550,000 |
| Ransom payments | $54,000 |
| Device remediation | $57,000 |
| Network costs | $55,000 |
| Personnel costs | $21,000 |
The financial toll makes comprehensive preparedness and response critical for managing ransomware risk.
What are the most common ransomware attack vectors?
Cybercriminals use various techniques to infiltrate networks and deploy ransomware. Most attacks occur through:
- Phishing – Deceptive emails with malicious links or attachments
- Remote desktop protocol (RDP) – Brute forcing weak credentials to access RDP servers
- Software vulnerabilities – Exploiting unpatched apps, operating systems, etc.
- Managed service providers (MSPs) – Compromising MSPs to deploy ransomware on customer networks
- Drive-by downloads – Downloading malware from malicious websites and ads
Organizations should analyze these and other vectors to prioritize security measures that address their ransomware entry risks.
What are some common ransomware variants?
Today’s most prolific ransomware strains include:
- Sodinokibi/REvil – Encrypts data and exfiltrates it for double extortion
- Conti – Fast-spreading and service-halting ransomware-as-a-service
- Ryuk – Targets large enterprises and demands massive ransoms
- Maze – Also exfiltrates data prior to encryption
- DoppelPaymer – Spreads across networks rapidly once inside
Understanding prominent malware types helps inform protections, monitoring, and response plans.
Should ransom be paid to recover encrypted data?
There are reasonable arguments on both sides of paying ransom:
Potential benefits of paying ransom:
- May allow quick recovery of encrypted data
- Can minimize costly business disruption
- Shows attackers the organization will meet demands
Potential downsides of paying ransom:
- No guarantee data will be recovered
- Sets precedent that paying works, risking repeat attacks
- May violate laws prohibiting support of cybercrime
- Could enable criminals to improve capabilities
- Funds may support other illicit activity
There are merits to each perspective. But in aggregate, most experts caution organizations against paying ransoms to discourage the profitability of ransomware attacks overall.
What cyber insurance policies may help recover from an attack?
Cyber insurance can offset some costs of a ransomware incident, with policies potentially covering:
- Extortion payments and negotiation services
- Costs of investigation and remediation
- Lost income from business disruption
- Public relations services
- Notifications to customers and partners
- Legal costs related to the attack
- Liability from data breaches or service interruptions
But policies vary, so organizations should ensure they understand policy exclusions, limits, deductibles and insurer notification requirements. Cyber insurance is not a substitute for strong security.
Should law enforcement be contacted if a business is hit with ransomware?
Contacting law enforcement has some potential benefits if ransomware strikes an organization:
- Authorities may help track or prosecute attackers
- FBI or Secret Service may obtain keys if ransomware is widespread
- Notifications can provide cyber threat intelligence to aid response
- Helps law enforcement gain better visibility into overall ransomware trends
However, law enforcement involvement may not always recover encrypted data or stolen information. Organizations should consider risks like potential publicity and carefully weigh benefits of contacting officials after an attack.
What employee cybersecurity training helps prevent ransomware attacks?
Effective security training equips employees to help prevent ransomware from deploying and spreading. Important topics to cover include:
- Realistic phishing simulations and awareness building
- Identifying social engineering and ransomware warning signs
- Practicing good password hygiene
- Keeping software up-to-date with current patches
- Spotting potentially malicious links and attachments
- Handling sensitive data securely and cautiously
- Basic cybersecurity concepts like Principle of Least Privilege
Proactive training makes employees a strong last line of defense against ransomware gaining a foothold.
How can organizations improve ransomware resilience?
Key strategies to enhance ransomware resilience include:
- Implementing layered defenses like email filtering, endpoint protection, and intrusion prevention systems
- Testing and refining incident response plans regularly
- Backing up critical data frequently and keeping backups offline
- Using data encryption extensively to make stolen information unusable
- Securing RDP access with MFA and allowing only through VPNs
- Enforcing least privilege and strict access controls on file servers
- Developing capabilities to quickly isolate infected systems
Preparedness, containment capabilities, and defense-in-depth make organizations far more ransomware resilient.
Conclusion
Ransomware remains a severe threat to organizations, making comprehensive readiness vital. Following best practices around prevention, detection, response, remediation, and reporting enables effective incident management and business continuity. Cyber insurance and law enforcement can aid recovery as well. But resilient backup solutions, employee training, and layered security defenses provide the best protections against costly ransomware disruptions and data loss.