Lesson 4.9: Responding to ransomware
The first hour of a ransomware incident decides how bad it gets. Contain first: cut the attacker's connections, disable the accounts they use and stop the damage spreading, without destroying evidence. Then preserve evidence, escalate and start the legal clocks: data protection authorities and, in many sectors, national CSIRTs must be told within days or hours. In the lab you're on fs02 while ws-140 is still connected: you block it, lock svc-backup, stop the share, secure the evidence with hashes, and check the playbook for the notification deadlines.
17 min
You will learn to
- Order the first response steps
- Cut an active attacker connection
- Disable a compromised account
- Preserve evidence with hashes
- Know the notification deadlines (GDPR, NIS2)
Key terms
- Containment
- Stopping an incident from spreading or continuing, without destroying evidence.
- Playbook
- A pre-agreed, step-by-step plan for a type of incident.
- Chain of custody
- A record of who collected, handled and stored each piece of evidence, and when.
- Breach notification
- The legal duty to tell authorities (and sometimes affected people) about certain incidents.
- No More Ransom
- A project by Europol, police forces and security companies offering free decryptors.
← Spaces in paths and file names · All lessons · UDP and ICMP: fast messages and network signals →