Incident Response and Recovery

Incident response runs on preparation, not improvisation. A documented ransomware playbook, known roles, and rehearsed procedures turn chaos into a controlled process.

Response follows recognized phases: preparation, identification, containment, eradication, recovery, and lessons learned. This lesson walks through each in a ransomware context.

Ransomware is a business crisis, not just an IT problem. The team spans multiple functions:

• Incident commander to coordinate and decide
• Security and IT for technical work
• Legal for breach obligations and sanctions risk
• Communications for internal and external messaging
• Leadership for business decisions

Use out-of-band communication (the attacker may be reading your email and chat).

Before acting broadly, understand what you are dealing with.

• Which strain and which systems are affected?
• Where did entry occur (patient zero) and how?
• Was data exfiltrated, indicating a breach?

Preserve forensic evidence: capture memory and disk images and logs before wiping, so you can answer these questions and meet legal needs. Do not destroy the trail in a rush to clean up.

Containment stops the spread while preserving evidence. Isolate, do not power off blindly, because shutting down can destroy volatile memory evidence and may trigger booby-traps in some strains.

During containment, immediately safeguard the resources you will need to recover.

• Verify your immutable and offline backups are intact and unreachable by the attacker
• Secure the identity system (domain controllers); attackers often hold privileged accounts
• Reset privileged and service account credentials
• Disconnect backup systems from the compromised network until cleared

Losing your backups now means losing your recovery path.

Eradication removes the attacker's access completely. A partial cleanup invites reinfection.

• Remove malware, backdoors, and persistence (services, scheduled tasks)
• Identify and close the initial access vector
• Reset all potentially compromised credentials, including service accounts
• Hunt for remaining footholds before declaring clean

Assume the attacker had broad access; if domain controllers were touched, a full identity rebuild may be required.

Restore systems on a clean, rebuilt network, never back into a compromised one. Prioritize by business criticality.

• Rebuild from trusted backups or clean images, not the encrypted systems
• Restore core infrastructure first (identity, DNS), then critical services
• Scan restored systems before reconnecting them
• Bring services back in controlled stages, watching for reinfection

Whether to pay is a leadership and legal decision, not a technical one, and should be informed by counsel and possibly law enforcement.

• Payment may be restricted by sanctions law against certain groups
• Decryptors are unreliable, slow, and may not be provided
• Stolen data may be leaked regardless

The defensible posture, established by good backups and IR planning, is to recover without paying. Engage law enforcement early; they may provide intelligence or decryptors.

If data was exfiltrated, the incident is a data breach with regulatory and contractual obligations.

• Determine notification requirements (regulators, customers, partners) and deadlines
• Document the timeline and decisions for auditors and insurers
• Coordinate external communications through one channel
• Engage cyber-insurance per policy terms early

Legal and communications must run in parallel with technical recovery, not after it.

After recovery, run a blameless post-incident review to convert pain into improvement.

• How did they get in, and why was it not caught sooner?
• Which controls worked, and which gaps enabled spread?
• What detection or backup improvements would have helped?
• Update the playbook and schedule a re-test

The most important deliverable is a concrete action list with owners and dates, so the next attack meets stronger defenses.

An untested plan fails under pressure. Rehearse before you need it.

• Tabletop exercises walk the team through a simulated attack
• Test restores at scale, not just single files
• Verify out-of-band comms and contact lists actually work
• Time your recovery to validate RTO/RPO targets

Teams that rehearse recover in days; teams that do not can take weeks.

Pick the action that contains without destroying evidence or backups.

You can now respond to a confirmed ransomware attack.

• Follow the phases: prepare, identify, contain, eradicate, recover, learn
• Activate a cross-functional team using out-of-band comms
• Isolate, do not blindly power off; preserve evidence and protect backups and identity
• Eradicate fully, then recover on a clean network from trusted backups
• Treat exfiltration as a breach with legal duties; make payment a last-resort leadership decision
• Rehearse the plan so recovery takes days, not weeks

Course complete: you can prevent, detect, and recover from ransomware.