Ransomware defense and response

Reduce the paths an attacker can use

Inventory exposed remote access, enforce strong authentication and address vulnerable systems. Separate ordinary accounts from administrative privileges. A single stolen credential should not provide unrestricted access to workstations, servers and backups. Segmentation and monitoring help limit and detect movement, but neither is a substitute for maintained access controls.

Coordinate containment

When encryption or a credible intrusion is detected, use the incident plan and a trusted communication channel. Identify affected and at-risk systems. Isolation should be coordinated with the response team, especially for shared or critical services. Preserve logs, messages and a timeline. Avoid improvised cleanup that destroys evidence or reconnects an attacker to clean systems.

Recover to a defensible state

A backup is a recovery input, not proof that the attacker is gone. Understand the initial access, scope and persistence; remediate affected identities and systems. Restore in an isolated environment, verify data and application dependencies, and monitor before reconnecting users. Decide recovery order from business priorities and measured RPO/RTO objectives.

Learn from the event

Document what was known at each decision, who approved containment and how recovery was validated. Convert gaps into assigned improvements. A tabletop exercise and a measured restore test are more useful than an untested statement that recovery is “covered.”

Common mistakes

• Connecting backups to compromised administration
• Equating restored files with complete recovery
• Skipping a decision timeline

Your practical checklist

Checklist ticks are temporary and are not recorded as account progress.