Ransomware attacks have become an increasingly common cyber threat that can cripple businesses and organizations. If you find yourself the victim of a ransomware attack, it’s important to know who you can turn to for help with assessing the damage, remediating the issue, and recovering your files or systems. This comprehensive guide will outline the key players who can provide assistance with ransomware attacks and how they can help you respond effectively.
IT/Security Teams
If your organization has dedicated IT and security teams, they should be the first line of defense and response. IT will have insight into your systems, networks, and backups that can help identify the infection point and scope of compromise. Security teams can advise on containment to prevent further spread and guide efforts to remove the ransomware from systems.
Leveraging internal security expertise can help make rapid assessments to understand the impact. They can also advise on whether paying the ransom is advisable or not, based on the specific strain of ransomware used in the attack.
How internal IT/security teams can help:
- Assess the initial infection point
- Determine scope of systems and data encrypted or compromised
- Isolate affected systems to prevent spread
- Leverage backups and restore data if possible
- Advise on recommended response based on ransomware identification
- Remove ransomware from affected systems
- Strengthen defenses to prevent repeat compromise
External IT Security Firms
If your organization lacks robust internal security expertise, engaging an external IT security firm can provide the depth of experience required to respond to a ransomware event. IT security firms have extensive experience with leading ransomware variants and can help contain an attack, remediate affected systems, restore data, and implement improved defenses.
These firms have worked with many ransomware victims and understand effective response strategies. They can rapidly deploy technical resources onsite and remotely to help your organization recover. Hiring a reputable IT security firm provides 24/7 ransomware response capabilities.
Services provided by IT security firms:
| Emergency incident response | Help contain and assess damage of attack |
| Forensic investigation | Identify root cause and scope of compromise |
| Ransomware removal | Clean infected systems and restore data from backups |
| Vulnerability assessment | Identify security gaps for improvement |
| Implement additional controls | Improve defenses to prevent repeat attacks |
Cybersecurity Insurance
If your organization has cybersecurity insurance, your provider can offer crucial assistance responding to a ransomware event. Most insurers partner with IT security firms to help clients contain and recover from attacks. Your insurance can cover the costs of hiring a security firm to investigate the ransomware attack and restore compromised networks and data.
In addition to connecting clients with IT security help, insurers can advise on communicating with stakeholders, steps to retrieve encrypted data, and negotiating with threat actors. They have experience managing ransomware incidents across many organizations.
Assistance offered by cyber insurers:
- Emergency response services via IT security partners
- Coverage for costs of investigation and restoration
- Guidance on responding to and containing the incident
- Negotiation advice for interacting with threat actors
- PR crisis management and communicating with stakeholders
- Steps to retrieve encrypted data without paying ransom
Law Enforcement
Contacting law enforcement agencies like the FBI or Secret Service can help if you are the victim of a ransomware attack. These agencies may investigate the incident and identify the perpetrators behind the attack. This can prevent the threat actors from being able to launch attacks against other organizations.
While law enforcement intervention may not lead to immediate recovery of your encrypted data, it can target the broader ransomware operation. Reporting ransomware attacks also provides important statistics for understanding the evolving threat landscape.
How law enforcement can assist:
- Identify and pursue threat actors responsible for attack
- Prevent future attacks by taking down ransomware infrastructure
- Provide guidance on handling and reporting the incident
- Prosecute ransomware operators to deter future attacks
- Gather information on ransomware trends and new techniques
Managed Service Providers
If your IT infrastructure and systems are managed by a managed service provider (MSP), they can leverage their administrative access and knowledge of your environment to help detect and respond to a ransomware attack.
MSPs can isolate compromised systems, determine the infection source, remove the ransomware, restore data and backups, and enhance security controls. Their experience across client networks gives them visibility into new ransomware strains and methods to mitigate them.
Ransomware response assistance from MSPs:
- Identify Patient Zero and containment strategies
- Remove ransomware from administered systems
- Restore data and operations from backups
- Conduct forensics to determine root cause
- Pinpoint weaknesses exploited by attackers
- Update antivirus software and signatures
- Enable additional security controls to prevent repeat attacks
Data Backup Vendors
If your organization utilizes data backup solutions, your backup vendor can be an invaluable resource for restoring data encrypted or corrupted by a ransomware attack. Leveraging recent backup snapshots can enable the recovery of encrypted files without paying a ransom.
Backup vendors have tools and expertise to rapidly restore systems from backup images. They can revert infected systems to a pre-infection state. This facilitates the recovery process and rebuilds systems to a last known good configuration.
How backup vendors assist with ransomware recovery:
- Guide restore process from backups
- Provide rapid large-scale recovery of infected systems
- Assist with granular recovery of specific files
- Restore data and applications to last usable state
- Remove backed-up ransomware payload during restores
- Ensure integrity of restoration process
- Recommend backup policies to mitigate future risk
Incident Response Firms
Engaging an incident response firm provides skilled expertise in developing an effective strategy to deal with a ransomware event. They act as quarterback developing a response plan, interfacing across teams, and centralizing communications.
Incident responders have diverse skills covering crisis management, PR, forensics, malware analysis, negotiations, security, and restoring IT operations. Leveraging a dedicated incident response team provides an efficient centralized command managing the many facets of a ransomware response.
Responsibilities of an incident response team:
- Develop comprehensive response strategy and execute plan
- Interface across internal teams and external providers
- Perform forensic investigation and determine root cause
- Manage communications and PR around the attack
- Negotiate with threat actors and advise on options
- Restore encrypted data and impacted systems
- Strengthen security and close gaps exploited by attackers
Ransomware Negotiation Firms
If paying the ransom demand becomes an inevitability, engaging professional ransomware negotiators can increase chances of successfully retrieving your data. These consultants have experience communicating with threat actors and negotiating cost-effective solutions.
Negotiation specialists can serve as an intermediary managing payment of the ransom, verifying decryption capability by threat actors, and facilitating the recovery process. They understand strategies for negotiating lower ransom amounts. Multi-pronged negotiation is often required for optimal outcomes when paying ransoms.
Ransomware negotiation and payment services:
| Establish secure communications | Set up anonymous channels to interact with threat actors |
| Demand proof of decryption | Have attackers demo restoration of encrypted files |
| Negotiate lower ransom | Leverage strategies to reduce payment amount |
| Facilitate payment | Manage ransom payment process and exchange |
| Decryption management | Assist with decrypting data once ransom is paid |
Conclusion
Recovering from a ransomware attack often requires a coordinated effort across multiple parties. While internal IT and security teams provide first level response, additional resources are usually needed to fully investigate, contain damage, and restore operations after a significant attack.
Leveraging the collective experience of external IT security firms, cyber insurers, backup vendors, incident responders, and ransom negotiators plays a crucial role in recovering from ransomware. A unified effort across these parties facilitates the most effective response.
Understanding the roles each of these players fulfils allows victims to assemble the right team and get the assistance needed to emerge from a ransomware event in the best possible position. With the help of the right partners, organizations can move past an attack and implement lessons learned to prepare better defenses against future threats.