Ransomware readiness: turning the #StopRansomware Guide into work you can actually do

Backups are the first thing an attacker goes looking for

The guide is blunt about this: most ransomware operators try to find and destroy backups before encrypting anything else. Having backups is therefore not the same as being ready, if those backups are reachable from the same network and with the same account as the systems being attacked.

• Keep at least one copy offline, or in a form that cannot be altered or deleted.
• Separate the accounts that manage backups from ordinary administrator accounts.
• Test restores regularly — a backup that cannot be restored is worth exactly nothing.
• Measure how long a real restore takes, and compare it to how long the business can actually be down.

The prevention work with the best return

• Close off remote access that reaches the internet without multi-factor authentication.
• Patch externally reachable systems first.
• Segment critical systems away from the general user network to limit spread.
• Keep administrative rights to what the role needs, and review them periodically.

A checklist for the first hour

The second part of the guide is a checklist designed to be picked up the moment something happens. The value of a checklist like this is that it removes decisions from a moment when everyone is under pressure. It is worth keeping a printed copy, in a form that stays readable when internal systems are not.

A note for management

The hardest decision during an incident is usually not technical. It is which systems to take down and for how long, which is a business decision. Organisations that agree those thresholds in advance, while nothing is on fire, lose far less time when something is.