Key takeaway
Ransomware preparedness takes more than one tool. Combine a response plan, current antivirus, vulnerability remediation, limited access and usable backups. Behavioral analysis and isolation can add protection. Even with backups available, cleaning and rebuilding infected systems can take time.
Prepare response and recovery before an attack
Identify critical systems and responsible people in advance so a ransomware attack does not become a scramble to assign tasks. The plan should give the team a clear basis for action. Preparation covers limiting the impact and returning systems to operation.
Identify critical systems
List the software and infrastructure essential to the organization. Assess the protection of their data and the ability to return those systems to a working state.
Assign actions and responsibility
Write down the actions needed during an attack and who will carry them out. Clear responsibilities reduce the risk of missing an important step amid uncertainty.
Connect the plan to recovery capability
Consider recovery alongside the protections in place and the condition of the data. Do not treat the time needed to resume work as guaranteed.
Use antivirus and keep it current
Not every attack uses new, sophisticated malware. Older variants remain in circulation, making antivirus installation and updates basic protective measures. Signature-based checks help detect samples that are already known.
Behavioral analysis examines what a program does and can help identify altered variants that do not match earlier signatures. Antivirus is one part of the plan; system updates, access restrictions and backups are needed alongside it.
Reduce weaknesses across the infrastructure
Attackers can exploit existing software and infrastructure vulnerabilities. Hardening involves ongoing management of updates, weaknesses and access permissions.
Updates and vulnerabilities
Connect vulnerability discovery to remediation. Current patches and fixes for identified weaknesses reduce opportunities for attackers.
All connected components
Include IoT devices, network equipment and services alongside computers and servers. A poorly protected component can become a route into other systems.
Only the access that is needed
Apply least privilege to critical resources. If credentials are compromised, limited permissions can reduce the potential impact.
Prepare backups for recovery
Current, usable backups provide a basis for cleaning infected systems and rebuilding them into a safe state. That option depends on regularly backing up all critical data. Recovery still takes time: having a copy does not guarantee an immediate return to work.
Cover critical information
Critical information may be held on servers and employees’ computers. Include essential files on those workstations in the backup coverage.
Make copies regularly
Back up critical data regularly and frequently. Keeping backups of essential workstation data in a central location helps include it in the overall recovery plan.
Allow for rebuilding the systems
A backup does not remove the work of cleaning and rebuilding an infected machine. Allow time for those tasks rather than promising a quick outcome.
Assess software behavior and contain harmful actions
A program’s origin or signature alone may be insufficient to establish safety. Behavioral analysis considers the state in which a program starts and the actions it takes. Artificial intelligence and machine learning are among the methods that can assist that assessment.
Isolation and virtualization aim to limit the effect of unverified software on the underlying system. Consider them alongside response planning, antivirus, infrastructure hardening and backups. Additional technology does not replace those basic measures.