The computers are disconnected, and now everyone wants to know when they come back.

1. How far it reached

CISA’s ransomware guide starts with identifying which systems are affected and isolating them. With many computers or more than one network segment involved, it recommends disconnecting at the switch instead of computer by computer. Powering a device off is the fallback for one you can’t disconnect, because it loses what is in memory.

Make three lists: encrypted, not encrypted, and not sure. The third list is the one that matters, because a computer in it is a computer you don’t restore onto yet. CISA also points to the systems and accounts used for the first break-in, including email, and to anything that gives continued access: remote access, VPN, and sign-in services.

2. What comes back first

CISA says to rank systems against a list of critical assets in four groups: anything people’s well-being depends on, revenue, other critical services, and their dependencies. Write the order down before anyone starts restoring.

Most offices will rank by what stops money or work: the system that holds jobs and orders, the one that bills, then email. A computer can look unimportant and still be a dependency, like the one that holds the license file for the system above it. Keep the list of unaffected systems too, so they move to the bottom and stay untouched.

3. What you keep as evidence

Before anything is wiped or reinstalled, CISA says that if mitigation isn’t possible, take a system image and a memory capture of a sample of affected devices, and collect the logs and any samples of the malware. It names Windows Security logs and firewall log buffers as short-lived evidence. The FTC says not to turn machines off until forensic experts arrive and not to destroy evidence during repair.

• Keep the encrypted drives. Don’t reinstall over them until whoever is investigating says imaging is done.
• Keep the ransom note, the photographs, and the time you first noticed.
• Ask federal law enforcement about decryptors, even if you expect to restore from backup. CISA lists that step in its guide.

4. Before the first restore

CISA says to find and remove the dropper malware before rebuilding from backups, and to restore from offline, encrypted backups in priority order. Add only clean systems to a new recovery network so a restored computer isn’t exposed again the moment it comes up. Once the environment is clean, passwords are reset on affected systems.

Where the answer to “are the backups usable” is still unknown, settle that first, because it decides how long all of this takes.

5. Who decides what

• You, as the owner: what can wait, what you spend, and what you tell customers and staff. The FTC suggests naming one person to release information.
• Whoever runs IT or the investigation: which systems are affected, the clean-up, and, under CISA’s guide, declaring the incident over.
• Your insurer: whether you must use its responders, and what it needs to hear and when. CISA lists the cyber insurer among those to notify.
• Your lawyer: whether notice to customers, employees, or a state is required. The FTC notes that every state has a breach notification law, and it advises consulting counsel first.
• Law enforcement: CISA says to report to CISA, your local FBI field office, the FBI’s Internet Crime Complaint Center at ic3.gov, or the Secret Service.

What we do with you

We help you build the three lists, the restore order, and the evidence log. If your insurer requires its own responders, we work alongside them. A person reads what we find and reports it with dates, including what we couldn’t determine.

The first hour stops the spread, and these four decisions decide whether the restore holds.

Related

• Can Your Backups Actually Be Restored? A Test You Can Run
• Keeping Evidence Before You Clean Up a Computer
• Who to Tell After a Security Incident, and in What Order
• Cyber Insurance Claim: What to Do Before You Call Anyone

Sources

• CISA: #StopRansomware Guide (Ransomware response checklist and prevention best practices)
• FTC: Data Breach Response: A Guide for Business