Defend · Incident response
Ransomware
A ransom note on a Monday morning is the day every backup, every admin key and every rehearsal was for. This is the sequence, and what has to be in place before that day.
The day is decided before it happens.
Ransomware encrypts what it can reach and leaves a note. What happens next is decided less on that day than in the months before it: whether there is a tested way back the attacker couldn’t reach, whether the admin keys were in the vault or on a laptop, and whether your leadership has walked through who decides what. On the day, the sequence is the same as for every incident, with one difference: the way back is the restore, in an order agreed with you, and the question of whether to pay is yours. We don’t decide it for you, and not in the night. We give you what it needs: what was reached, what left, what can be restored and by when.
The sequence
What we do, in this order.
Within our service hours the incident goes straight to the engineers who know your setup, your TechPilot in charge; outside them, as agreed in your contract. The order below doesn’t change.
-
Cut it off
Affected servers and devices are isolated from the network and from each other, so the encryption stops spreading. Backups are disconnected from anything the attacker could reach. Nothing is switched off that still holds evidence.
-
Keep the evidence
Before any machine is rebuilt, the logs, the note, the encrypted samples and the sign-in records are secured. They tell how it got in, since when, and what left, and your insurer and the authority will ask for them.
-
Find the way in, and what left
The way in: a phished account, an unpatched system, a remote access nobody closed. And what was taken before the encryption started, because that decides what you have to report and to whom.
-
Decide with you
What to restore first, what to report, whom to tell, and the question of paying: your decisions, made on the facts we put in front of you. The legal assessment stays with you; we prepare what your lawyer, your data protection officer and your insurer need.
-
Bring it back, in the agreed order
Restored from the tested way back, not repaired: clean systems from clean copies, in the order agreed with you: sign-in first, then the systems your work can’t run without, then the rest. Each one checked before it goes back on the network.
-
Close the door, write it down
The way in is closed, every admin credential is changed, and the monitoring watches for a return. What happened, what we did and what we changed goes into your evidence file, with the timeline your insurer asks for.
On record
In your evidence file.
- The timeline: first sign, cut off, way in found, decisions, systems back, last check
- What was reached and what left, as far as the evidence shows
- What you decided, and what your data protection officer and insurer were given, and when
- What was restored from which copy, in which order, and what was checked first
- What we changed afterwards, so it doesn’t happen the same way again
What has to be in place before the day.
-
A backup the attacker can’t delete
Attackers go for the backups first, with the admin password they stole. The way back has to be a copy that a stolen admin password can’t reach or delete, and it has to have been restored in a test.
-
Admin keys in the vault, not on a laptop
An admin password in a spreadsheet or a browser is the attacker’s master key. In the vault, with every use logged, it’s the one thing they don’t get with the first laptop.
-
The plan walked through with leadership
Who decides what, who tells whom, in what order the systems come back, and who answers the phone on the day: rehearsed with your leadership before it’s needed, not improvised in the night.
Also under Incident response
Questions we get
Would you advise us to pay?
That’s your decision, and we won’t make it for you. What we do is give you what the decision needs: what was reached, what left, what can be restored from the tested way back and roughly by when. Firms with a tested restore rarely face the question the way firms without one do.
How long until we’re working again?
That depends on what was reached and what was prepared, so we don’t promise a time. What we can say: the order in which your systems come back is agreed with you beforehand, sign-in first, then the systems your work can’t run without, and each restore has been tested before the day.
Do we have to report a ransomware attack?
Often, and to several places: the data protection authority where personal data was reached, your insurer within the period its policy sets, sometimes clients or your regulator. Which of these apply is a legal assessment that stays with you and your advisers. We supply the facts and the timeline those reports need, as they happen.
Can you make sure it never happens?
No one can. The layers before this page, patching, device protection, admin access in the vault, a second factor for everyone, keep most of it out. This page is for the day something gets through, and what it promises is a way back that was tested before you needed it.
Start
If a server showed a ransom note tomorrow, what would come back?
In a first call we go through where your backups live and whether an attacker could reach them, who holds your admin keys, and whether your leadership has walked through the day.
- No first level
- No surprises
- Pilot before you buy