What every business should have in place before an incident, and what to do inside the first hour when one happens.
Every business owner we've talked to who's been through a ransomware incident says the same thing afterward: they wish they'd had the plan on a piece of paper before it happened. This is that piece of paper.
Prevent
- Multi-factor authentication on every account, no exceptions, including the ones people complain about
- Air-gapped or immutable backups with 30/90/365-day retention
- Endpoint detection and response, not the antivirus you had in 2018
- Email security with URL rewriting and attachment sandboxing
- Annual tabletop exercise with the executive team, including the awkward one
The first hour if one happens
- ISOLATE: pull affected systems from the network immediately
- PRESERVE: do not power off, do not delete anything, do not "clean it up"
- REPORT: call your cyber-insurance carrier's claims or breach line and your legal counsel early (most policies require prompt notice and their own approved response firm), and your MSP to contain the damage
- REPORT to the FBI at ic3.gov as well; it costs nothing and can help with recovery
- DO NOT PAY without written authorization from your cyber-insurance carrier and your counsel
← All whitepapers
