Ransomware remains the number-one threat to organisations. Understanding how it unfolds is the first step towards defending against it — and towards knowing how to react when prevention has failed.
Anatomy of an attack
An attack almost always follows the same pattern: initial intrusion (phishing, a vulnerable VPN, stolen credentials), lateral movement across the network, privilege escalation up to the directory, exfiltration of data for extortion purposes, then mass encryption. Several days often pass between the intrusion and the encryption: so many windows in which to detect and stop the attack.
The remediation plan
When an incident strikes, every hour counts. The response is structured in five stages:
- Containment: isolate the affected systems, cut off the spread, preserve the evidence.
- Investigation: identify the point of entry, the extent of the compromise and the data exfiltrated.
- Eradication: remove the attacker’s access, reset secrets, rebuild privileged accounts.
- Restoration: recover from clean, immutable backups, in a sanitised environment.
- Post-incident hardening: close the exploited gaps and update the information security policy.
Prevention is better than cure
The best remediation is the one you never have to carry out. Immutable, tested backups, EDR/XDR, MFA across the board, network segmentation and continuous monitoring drastically reduce both the likelihood — and the impact — of an attack.
ZENISEC works upstream to prevent, and reactively to contain, eradicate and rebuild, through to full restoration of the information system.
Comments are closed