RANSOMWARE RESPONSE CHECKLIST

DO THIS FIRST

• Call the insurance company that holds your cyber security insurance. They will guide you on their requirements. Their requirements take precedence. Certain steps may need to be taken to protect forensic data. You never want to place yourself between your customer and their ability to collect an insurance claim.
• Check the affected business’s Business Continuity/Disaster/Cyber Recovery Plan for the business. There may be specific requirements mandated by policy or the business owners.
• If possible acknowledge, either in writing or via email, that the infection on occurred prior to your arrival onsite and that you were not the cause of this infection.
• Remember to communicate or reiterate the company’s rules of disclosure to your employees addressing what should or should not be communicated on social media, to the press, and to clients. Typical recommendation is that nothing is permitted to be disclosed un l such time as the company releases a statement (after all the facts of the event have been gathered and analyzed).
• Back up everything, even the encrypted or infected computers, to have a recovery path if the containment or remediation steps destroy data, or in the event that decryption fails and a recovery key is discovered after the event has occurred. There are cases where the threat actor releases the decryption key months after an attack has stopped paying dividends

CONTAINMENT

• Run an external penetration test from the internet to look for anything unusual (ports) that shouldn’t be open in the firewall. If you don’t know how to do this or don’t have access to those tools, please send ALL public IP addresses to Creative IT as we may be able to check for you.
• Deny all international traffic in the firewall.
• Deny all inbound traffic across RDP or other remote access tools to the client site. If necessary, enable VPN access first, then RDP across the VPN protected connection. If possible, you could unplug your Internet connection at the router until you have regained control of the network. You could also unplug all switches on the network to help avoid lateral movement of the threat and isolate segments of the network as you work to contain.

● ● ●