How to Create a Ransomware Incident Response Plan

Falling victim to a ransomware attack is one of the most dreaded cybersecurity events organizations can experience today. Getting the dreaded call from an end-user noting a strange message about a “ransom” note is not what any IT department wants to hear. Yet, as businesses increasingly rely on data-driven processes and technology systems, ransomware is a critical threat that companies must take seriously. So how can an incident response plan help deal with a ransomware attack? How can you create one? How can you include your cloud Software-as-a-Service (SaaS) environments in your ransomware incident response plan?

What is an incident response plan?

First of all, we need to know what an incident response plan is before we can create a ransomware incident response plan. So, what is an incident response plan? An incident response plan is a set of instructions (plan) to detect, respond to, and remediate cybersecurity events. Incident response plans cover more than just ransomware attacks. In general, they can cover any disruption that can lead to data loss, service outages, data leaks, or any other undesirable result from a business or security perspective.

Why is an incident response plan needed?

Why do organizations need to have an incident response plan? Incident response plans can cover a wide range of disruptions, including a ransomware attack. A detailed and thorough incident response plan is extremely beneficial as it can help provide the detailed plan of action and steps needed to stop, contain, and control the incident affecting the organization. It has often been said that you don’t want to wait until a disaster occurs to start thinking about what steps you would take. Instead, you want to carefully and slowly think through the steps that need to be taken BEFORE a disaster strikes. 

It becomes much more challenging to think clearly or quickly during a disaster. At this time, an incident response plan helps to take the guesswork out of the equation and provide detailed “playbooks” of steps that need to be taken to remediate the situation. 

Another sobering thought is that having a ransomware incident response plan can make it much more likely the business will be successful in recovering from an attack without paying the ransom. But unfortunately, even when companies have good data backups, they are ill-prepared to deal with all the tasks involved in dealing with the events precipitated by the attack.

In addition, when organizations use cloud Software-as-a-Service (SaaS) environments, these must be considered as companies continue to increasingly use the cloud for storing their critical data and cloud services. As attackers continue to target cloud SaaS environments, organizations need to have a plan of action for their cloud SaaS information and recovering from an attack.

What is a ransomware incident response plan?

A ransomware incident response plan is a specific type of incident response plan that helps to deal specifically with this type of attack. It allows companies to contain, isolate, remediate, recover, and implement new safeguards to help introduce a more robust cybersecurity posture. The ransomware incident response plan should help organizations through the entire lifecycle of an attack from start to finish, from the first indication of the attack to recovering data and then implementing new safeguards.

How to create a ransomware incident response plan

Now that we have seen what an incident response plan is, why they are needed, and the specifics of a ransomware incident response plan, let’s see how to create a ransomware incident response plan. What are the recommended steps to creating a ransomware incident response plan? We will consider the following:

1. Contain and Isolate
2. Access and Scope
3. Remediate the attack vector
4. Recover data
5. Post mortem

These steps will provide a framework for filling in the “details” for your particular business to work your way through stopping, remediating, and recovering from a ransomware attack.

1. Contain and isolate

While some ransomware incident response plans may list containing and isolating systems as a later step, it is essential to consider placing this at the top. Why? When you are hit with a ransomware attack, minutes and even seconds count. From the time ransomware is first discovered in the environment, it is crawling through the network. Pausing or waiting to take action to isolate systems and take down the network can lead to more if not all of your business-critical data getting encrypted.

Containing and isolating systems and network segments, even if ransomware is suspected but not yet confirmed, can potentially save the day. Even if it is initially disruptive and may cause a temporary outage, it is better to isolate unnecessarily than not isolate critical systems and have your data ravaged.

2. Access and Scope

After we have contained the ransomware or malware infection to a reasonable degree, IT can begin assessing the situation and determining the scope of the attack. For example, how far has the ransomware spread throughout the infrastructure? What clients or servers have been affected? If there are multiple sites, has any ransomware activity been discovered at alternate sites, or is it limited to one in particular?

Have any particular applications exhibited errors or issues connecting to backend resources in the data center? Are any databases suspect? Network engineers and SecOps professionals should begin scrutinizing network connections made to the outside and incoming connections. Depending on what is determined by the initial assessment, the decision may be made to take down all Internet connectivity.

3. Remediate the attack vector

By the time the organization has made it to step number 3, you should be confident the ransomware attack has been contained and thoroughly assessed the situation. Also, at this step, by working in conjunction with SecOps, you should be able to determine the attack vector for the ransomware attack. It is important to now remediate the attack vector. For example, was there a vulnerability exploited for an application? Did an end-user click a phishing email? Was a server in the DMZ improperly exposed on a vulnerable port to the Internet? 

Without feeling confident you have closed the attack vector, it will be difficult to move on with recovering data and remediating the damage as attackers may still have a way into the network via a compromised server, client, or other means. If you have cloud SaaS environments, have a plan of action to understand how to identify and remediate the attack vector.

4. Recover data

Step four involves recovering your data. Recovering data consists of restoring data to the point it existed before the ransomware encryption. Depending on when the ransomware infection was discovered and if you use traditional backup and cybersecurity solutions, the challenge may be knowing which restore point to restore.

Your backup solution may have backed up a restore point or several with encrypted data from the ransomware attack. Unfortunately, this scenario is where time can be lost when trying to restore business continuity. Depending on the attack timeline, it may take trial and error to discover the “clean” restore point.

In the ransomware incident response plan, ensure the method for staging data restores has been thought through and tested. In this way, no additional time will be lost in assessing the integrity of restore points.

5. Post mortem

Your ransomware incident response plan should include a section for post-mortem. In the post-mortem, the organization analyzes the entire attack timeline and lessons learned. This process allows businesses to “learn from the mistakes” made in cybersecurity or gaps in coverage that led up to the ransomware incident. 

It helps to prepare the organization to be stronger for future attacks. Additionally, any findings in this post-mortem can be used to bolster the ransomware incident response plan moving forward. It can also shed light on additional monitoring and security defenses that need to be put in place. 

SpinOne Ransomware Protection provides automated incident response

One common theme with the ransomware incident response plan is that it requires many manual tasks and steps. Unfortunately, there are just several tasks that require manual efforts with traditional infrastructure housed on-premises. However, even with cloud SaaS environments like Google Workspace or Microsoft Office 365, organizations can be challenged to stop, clean up, and recover from ransomware effectively.

SpinOne is a cloud SaaS cybersecurity solution that helps to automate many of the steps already discussed as part of the ransomware incident response plan. How does it do this? The SpinOne Ransomware Protection module automates the cyber security responses to protect your cloud SaaS environment from ransomware.

Google Workspace Backup Solution Comparison Table

View our competitive pricing chart

Download PDF

*Contact Us for current pricing.

The ransomware protection module provides an automated five-step response, including:

1. An automated cybersecurity scanner, empowered with artificial intelligence that helps detect ransomware activity automatically 24x7x365
2. If ransomware is discovered, SpinOne automatically blocks the ransomware process
3. It automatically identifies any files affected by the malicious process
4. Files are automatically recovered from the last good backup taken by SpinOne
5. SpinOne notifies the cloud SaaS administrator about the ransomware attack

SpinOne provides an effective combination of enterprise-grade backups and AI-assisted cybersecurity, helping to meet the challenges of protecting against ransomware and other cybersecurity threats in cloud SaaS environments. In addition to the proactive ransomware protection features, it includes:

• Automatic, incremental backups – SpinOne’s automated enterprise backups provide agentless versioned backups of your cloud SaaS environment up to 3x daily, allowing you to protect business-critical assets in your cloud SaaS environment
• Insider threat protection – Gain visibility to threats from inside the organization and easily spot anomalous behaviors coming from unscrupulous employees or a potentially compromised account
• Third-party apps control – Control which third-party apps and browser extensions can be installed in the cloud SaaS environment, greatly reducing the risk of ransomware coming from malicious applications granted OAuth authorization from an unsuspecting end-user
• Alerting and Reporting – Satisfy audit requirements and maintain visibility with the comprehensive alerting and reporting provided by Spin

While manual steps may be required for traditional infrastructure in the environment when ransomware attacks occur, automate the steps that can be automated. SpinOne’s intelligent, automated cybersecurity solution helps to eliminate the remediation steps needed when ransomware attacks occur in cloud SaaS environments. It leads to reducing downtime to 2 hours and recovery costs up to 90%, with recovery happening in minutes, not weeks.

Learn more about how SpinOne can protect your environment here.  

FAQ