A responsive ransomware incident plan is critical for organisations. Carol Murphy and Ross Spelman outline what the plan should include and how to respond in the case of an attack.

Every organisation should have a ransomware incident response plan in place, and this should be regularly tested, reviewed, and updated. This plan should include roles and responsibilities for all stakeholders, including IT, legal, compliance, human resources, operations, communications, and end-users.

The response effort should focus on key functional areas, including IT, information security, legal, and communications. The teams looking after these areas should share information in a central location and establish clear communication channels with regularly scheduled incident update sessions.

IT

Ransomware is a technology problem and, once detected, the first step is to disconnect any infected or suspected systems from the network and shut down non-infected systems to protect them from infection. Once that is complete, available backups should be identified and evaluated. It is critically important that backups pre-date the attack. If a system cannot be cleaned and brought back to a secure, operational state, the system must be rebuilt or restored.

The restoration process should follow a clear, prioritised sequence based on business criticality and risk exposure. For example, critical production servers or systems providing email/collaboration services may come first, followed by business-critical workstations supporting payroll and other critical areas of the business. Depending on the priority, general user workstations may come last.

Information security

The information security team should attempt to identify the type of ransomware that has infected the system and, if possible, pinpoint the criminals responsible for it and then determine if a decryption key or remediation software is publicly available.

A forensic investigation should be undertaken to determine whether any data was stolen, how the network was accessed, the particular systems accessed, and what activities took place on them. Devices and equipment which appear to be non-infected should be examined for evidence of hacker activity as a matter of routine.

Once the investigation is complete, the team should work with IT to fix the vulnerabilities used by the criminals to access the network.

It is not good enough to fix the root cause(s) or vulnerabilities exploited by the attacker: the organisation should strengthen multiple layers of security controls and improve/adopt a defence-in-depth approach to security.

Legal and communications

Depending on the criticality of the incident, company officers and employees may need to be notified immediately. Business partners and key external parties should also be informed at the earliest possible juncture and kept informed as the investigation progresses.

The legal and communication teams should prepare a statement to inform the broader public of the incident. They should also work with IT and Information Security to develop and implement temporary workarounds for impacted critical functions, including email, payroll, and customer portals.

The team should also prepare for regulatory or compliance reporting requirements such as those covered by GDPR.

No ransom

We do not think you should pay ransom demands for a variety of reasons. Paying ransoms will only fund continued criminal activity. Payment could also expose companies to legal risk with no guarantee that the criminals will make good on their promise to supply a decryption key or other means of recovering data. Indeed, companies that pay ransoms may find themselves vulnerable to re-infection by the same criminals or their associates.

No organisation can afford to be without a cyberattack or ransomware response plan. The plan should be subject to periodic review and set out the role of all appropriate sections of the organisation in the response and recovery process. Particular emphasis should be placed on the investigation phase as this will assist in the prevention of future attacks. When an organisation recovers from a ransomware incident, it should emerge much stronger.

Carol Murphy is Consulting Partner and Head of Risk Transformation at EY.

Ross Spelman is Cybersecurity Director and Lead at EY.