Ransomware & Incident Response: Questions and Answers
Preventing ransomware, backups, what to do first in an incident, breach notification and how security operations work.
What is ransomware and how does it get in?
Ransomware is malware that encrypts or steals an organization’s data and demands payment to restore or not publish it. It usually gets in through phishing, stolen passwords for remote access, or unpatched internet-facing systems, and attackers often spend days inside before launching it.
Full answer and next stepsHow can a small business prevent ransomware?
Require MFA on email and every remote access path, patch internet-facing systems quickly (especially those in CISA’s Known Exploited Vulnerabilities catalog), limit admin rights, keep offline or immutable backups, and use endpoint protection that alerts someone who will act.
Full answer and next stepsShould you pay a ransomware ransom?
Law enforcement agencies, including the FBI and CISA, advise against paying. Payment does not guarantee working decryption or deletion of stolen data, it funds further attacks, and in some cases paying sanctioned groups is illegal. Report the attack and get professional incident response help.
Full answer and next stepsWhat should I do first if ransomware hits my business?
Isolate affected devices from the network (unplug or disable Wi-Fi) without powering them off, protect your backups by disconnecting them, contact your incident response provider or insurer, and report to law enforcement. Do not wipe systems before evidence is collected.
Full answer and next stepsWhat should a small business incident response plan include?
At minimum: who leads during an incident and how to reach them, who to call outside (IT provider, insurer, lawyer, police), how to isolate systems, where backups are and how to restore them, and who must be notified and by when. Keep it short and printable.
Full answer and next stepsWhat is the 3-2-1 backup rule?
Keep three copies of important data, on two different types of storage, with one copy off-site. Against ransomware, also make sure at least one copy is offline or immutable, so an attacker with access to your network cannot delete or encrypt it.
Full answer and next stepsHow quickly must a business report a data breach?
It depends on the law and sector. Under the EU GDPR, organizations must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach that poses a risk to individuals. Other countries, states and industries set their own deadlines.
Full answer and next stepsWhat is an indicator of compromise (IOC)?
An indicator of compromise is a piece of evidence that suggests a system was attacked, such as a malicious IP address, domain, file hash or unusual process. Defenders share IOCs so others can search their own logs and block known threats.
Full answer and next stepsWhat does a security operations center (SOC) do?
A SOC monitors an organization’s systems for signs of attack, triages alerts, investigates suspicious activity and coordinates the response. Analysts work from logs and tools such as a SIEM and EDR, deciding which alerts are real and what to do about them.
Full answer and next stepsWhat is a cybersecurity tabletop exercise?
A tabletop exercise is a discussion-based rehearsal where the team walks through a realistic incident scenario, such as ransomware or a fake invoice payment, and talks through who does what. It tests the plan and contacts without touching real systems.
Full answer and next stepsCan ransomware affect OneDrive?
Yes, ransomware can affect data in cloud storage services like OneDrive if files connected to an infected system become encrypted. When ransomware executes, it scrambles files across reachable systems, rendering data unusable. Because connected file stores can reflect these modifications, guidance from CISA recommends maintaining offline, encrypted backups rather than relying solely on continuously connected cloud storage.
Full answer and next stepsGo deeper
Step-by-step articles on this subject are in the Incident Response guides.
- Backup (3-2-1 rule)
- Business email compromise
- EDR (endpoint detection and response)
- GDPR
- HTTPS and TLS
- Incident response
- Indicator of compromise
- Known Exploited Vulnerabilities (KEV)
- Least privilege
- Malware
- MITRE ATT&CK
- Multi-factor authentication
- NIST Cybersecurity Framework
- Patch management
- Phishing
- Ransomware
- SIEM
- SOC (security operations center)