Ransomware Attacks: Incident Response in the Crucial First Hour

Incident response to ransomware attacks starts with three priorities that can shape recovery from the outset.

The first hour after discovering a ransomware attack determines the effectiveness of an organization’s response and recovery. Leaders and technical teams must make critical decisions under pressure, often with limited information about the scope of the attack.

Organizations can prepare for those moments by establishing response procedures, defining roles and escalation paths, and training employees before an incident occurs. With that foundation in place, teams can focus their initial response on three priorities: escalation and communication, containment, and preservation.

The discovery no one wants to make

Imagine an IT professional arriving at the office early after getting an employee report that internal services are inaccessible and documents will not open. A quick look at an affected server reveals unfamiliar file icons.

Then a ransom note appears. The note makes alarming claims. Attackers say they have stolen data, threaten to contact regulators, warn against involving law enforcement or incident response professionals, and demand immediate contact.

What seemed like a routine technical problem has become a ransomware incident, and the organization faces a series of urgent questions: Should the IT team shut down servers? Should the team disconnect the network or restore the system from backups? Should the organization contact the attackers? Answers to these questions determine the course of the response, and organizations need to make them quickly, but not impulsively.

Responding in high-stress scenarios

Speed matters during a ransomware incident, but panic can lead teams toward actions that complicate investigation and recovery. Stress narrows attention and makes it harder to assess competing risks, particularly when responders face an unfamiliar situation with incomplete information.

The first hour after awareness of an incident is especially consequential. Organizations might need to stop an attack that remains in progress, protect viable backups, preserve evidence, and engage outside resources – all at nearly the same time. Some seemingly logical actions, such as immediately rebuilding an affected server, can destroy forensic evidence or eliminate recovery options.

Planning and training help organizations manage those pressures. Most IT and security professionals have limited firsthand experience responding to ransomware, and organizations cannot depend on experience alone. An established incident response plan gives employees and leaders a framework for making decisions before the pressure of an active incident affects their judgment.

The goal during the first hour is not to solve the incident. Organizations should instead establish control over the response, limit additional damage, and preserve the information and systems that incident responders will need.

Planning and training help reduce panic-driven decisions during a ransomware incident. Because many IT and security professionals have never managed a ransomware attack, organizations should establish response procedures and practice them before an incident occurs.

Priorities for the first hour of ransomware response

An organization’s actions during the first hour generally fall into three related workflows: escalation and communication, containment, and preservation. Teams will often pursue the workflows simultaneously rather than sequentially.

Each serves a different purpose. Escalation and communication bring the appropriate internal and external parties into the response. Containment limits an attacker’s ability to cause additional harm. Preservation protects evidence that can help responders determine what happened and support recovery decisions.

Escalation and communication

The person who discovers a suspected ransomware incident should follow the organization’s established escalation process and notify the appropriate IT or information security team. The organization should then alert designated leaders and contact its cyber insurance carrier, when applicable.

Cyber insurers often connect policyholders with breach counsel and an incident response firm that specializes in such events. Organizations without cyber insurance should consider contacting legal counsel with experience handling data breaches. Counsel can help organizations assess legal and regulatory obligations and coordinate subsequent response activities.

Organizations should also control communications about the incident. Employees who know about the attack should limit discussions to people directly involved in the response. Broad internal communications should provide employees with only the information they need to act safely, such as confirmation that the IT team is addressing an issue and instructions not to open or modify affected files.

Organizations generally should avoid making public statements during the initial response before leadership and counsel have assessed the available facts and relevant obligations. Early assumptions about the scope, cause, or effects of an attack can prove inaccurate as investigators gather evidence.

IT and security teams do not need to wait for every external resource to engage before taking other appropriate response measures. While leadership, insurers, counsel, and incident responders establish communication channels, technical teams can begin containment and preservation work.

Containment

Containment aims to limit an attacker’s ability to spread through the environment, access additional systems, exfiltrate data, or cause further damage. Organizations are unlikely to confirm full containment during the first hour, but technical teams can take targeted steps while incident responders mobilize. Those teams should prioritize actions that limit additional harm without unnecessarily destroying evidence or compromising recovery options.

Protecting backups is among the most time-sensitive priorities in a ransomware response, particularly when an organization discovers an attack before encryption has finished. Protecting backups from ransomware before an incident can give organizations more options during recovery. When an organization stores backups on premises, the IT team can isolate the backup storage from the network through logical or physical controls and shut down the server that manages backups when appropriate. Teams should focus on protecting viable backups rather than immediately using them. Restoring affected servers during the initial response can overwrite forensic evidence, and attackers might retain access to the environment.

Organizations should also isolate affected portions of the network from systems that remain unaffected. Network segmentation allows teams to disconnect an affected segment at a switch or router rather than unplugging large numbers of individual devices. Site-to-site virtual private network (VPN) connections also might require isolation when responders believe attackers could use them to move between environments.

Flat networks present additional challenges because teams have fewer boundaries available for isolating affected systems. Endpoint detection and response tools provide logical device isolation in some environments. Physical disconnection is another option for high-value systems when logical isolation is unavailable.

Teams should avoid powering off servers unless no practical isolation method exists or encryption is actively occurring on the device. Shutting down a system eliminates volatile data stored in memory, which investigators might need to understand attacker activity. Similarly, teams should avoid disconnecting large numbers of individual devices by removing their ethernet cables, as doing so could result in delays in recovery and visibility into endpoint activity. It could also give attackers more time to pivot if they notice machines going offline one by one. Instead, organizations should focus on easily reversed logical isolation or physical disconnection of whole network segments.

Organizations should also address potential attacker entry points and command-and-control and data exfiltration channels. Depending on the circumstances, technical teams might disable remote-access VPNs, revoke active sessions, and block internet access for affected network segments. If responders believe an attacker has compromised much of a flat environment, the organization might need to disconnect the environment from the internet through firewall rules or a physical wide area network disconnection.

A complete internet disconnection will not suit every environment. When business or operational requirements make such a step impractical, teams can block known attacker infrastructure, persistence mechanisms, or exfiltration paths through firewall and endpoint security controls. Teams should generally keep firewalls powered on. A shutdown can eliminate volatile VPN or traffic logs stored in memory and remove information investigators could need.

Preservation

Preservation protects forensic information that can help incident responders reconstruct an attack, identify affected systems, determine how an attacker entered the environment, and assess what the attacker did. Many preservation decisions concern actions organizations should avoid. Teams should not immediately delete and rebuild affected servers, unnecessarily power off devices, or delete or modify files on compromised systems. Such actions can alter or destroy evidence before investigators collect it.

Organizations also need to identify information at risk of disappearing on its own. Some systems retain logs for only a limited period before overwriting older records. Firewall traffic logs, for example, might cover only several hours in some configurations while VPN authentication records might remain available for days or weeks. Organizations that do not send those logs to a security information and event management platform or another centralized repository should export relevant records as soon as practical.

Simple observations are also valuable. If an employee or IT professional sees an unfamiliar command prompt, suspicious application, ransom note, or other unusual activity on an affected device, a screenshot or photograph can preserve information for investigators. Teams should document what they observe without unnecessarily interacting with the affected system.

Preservation can sometimes appear to conflict with containment. Powering off a system might protect the broader environment but alter the evidence available to investigators. Leaving a system running might preserve volatile information but create additional risk if encryption remains active. Established response procedures and early involvement from incident response professionals can help organizations balance those competing priorities.

Coordinated handoff to incident response

By the time an organization completes the initial escalation and communication, containment, and preservation steps, an internal or external incident response team often will have assumed a larger role in managing the technical investigation. The organization should brief the incident response team on what employees observed, when they observed it, what actions teams have already taken, and what information they preserved. Accurate records of early decisions can help investigators understand changes to the environment and distinguish responder activity from attacker activity.

From there, the incident response team can begin developing a clearer picture of the attack. Investigators will work to determine how the threat actor gained access, which systems and accounts the attacker compromised, what activity occurred in the environment, and whether the attacker accessed or exfiltrated sensitive data. Those findings can help the organization assess the scope of the incident and identify additional investigative priorities.

The incident response team can also help coordinate technical decisions as the investigation progresses. Recovery often must proceed alongside investigative work, which requires teams to consider when systems can return to service without destroying evidence or reintroducing risk. Incident responders can help establish priorities and provide technical findings to organizational leaders, legal counsel, and other parties involved in the response. A coordinated handoff gives the organization a more reliable basis for decisions as the incident moves beyond the critical first hour.

Why proactive preparation is critical

The first hour will not answer every question about a ransomware attack. Organizations can, however, use the time to establish an orderly response, reduce opportunities for additional damage, and protect evidence and recovery options. Preparation before an incident gives leaders and technical teams a framework for making those decisions when time and information are limited.

Proactive preparation also clarifies roles, approval authority, contact information, and decision thresholds before an emergency creates confusion. Organizations should confirm those details with internal stakeholders, legal counsel, cyber insurance providers, and external response partners and then test the arrangements through exercises. Regular reviews can account for changes in personnel, technology, vendors, and business operations so that the response plan remains usable when an incident occurs.