How to Reduce the Impact of a Ransomware Attack

If there’s anything organisations should have learnt within the past year, it’s that cyber defences can, and likely will, fail. Despite having all the necessary safeguards in place, ransomware attacks are bound to occur.

This is a guest blog originally posted by eSentire.

While ransomware gangs and their tactical playbooks have certainly evolved to become much more sophisticated, the driving force behind the occurrence of the attacks have also changed. Gone are the days of threat actors targeting organisations to chase a payout – the cyber attacks of today are ideologically motivated, designed and orchestrated to instil chaos within society.

The repercussions of an attack are significantly higher than they were five, ten years ago. While there will always be a financial element tied to these attacks, organisations are undergoing increased scrutiny over maintaining compliance standards for data security & privacy. Should an attack occur, if they are unable to demonstrate they were compliant with these regulations, not only would organisations face significant fines but they also open themselves up to a lawsuit (or two!).

As a result, CISOs don’t have the luxury of assuming they can thwart cyber-attacks. While you should be well-equipped to prevent a ransomware attack, we recommend adopting the “assume breach” mentality, wherein you assume that your organisation will eventually get breached.

It’s critical that security leaders understand how to reduce the impact of a ransomware attack. Here are some of our recommendations:

  • Store encrypted backups of your data offline and ensure that your team performs backups on a consistent basis. Moreover, your team should regularly test your backups to see how long data restoration efforts will take and prioritise restoring all critical systems and data first.
    • Maintain regularly updated “gold images” of critical systems in the event they need to be rebuilt.
    • Backup copies are not limited to just data. Your team must retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred.

  • Implement a company-wide policy that corporate data should not be stored locally on any device. If a device is infected, you can lose all locally stored data, compared to if the data is stored on the cloud.

  • Isolate the infected device immediately to limit the spread of ransomware across the rest of the network.

  • Identify the type of ransomware and/or the threat actors behind the attack, if possible, to determine if there is a possible decryption key already available. If you don’t have the expertise to conduct this investigation in-house, engage an external Incident Response provider that also has Digital Forensics capabilities to lead the charge.

  • In addition to system images, your team should have the applicable source code or executables backed up (or escrowed, have a license agreement to obtain, etc.) so that if the ransomware infection impacts the application code, you don’t lose it entirely.

  • Most importantly, create, maintain, and exercise a strong cyber incident response plan and associated communications plan that includes response and notification procedures for a ransomware incident.

Ransomware is one of the biggest threats to any organisation today – period.

As such, organisations must do everything in their power to reduce the impact of an attack. As long as there is a clear directive and plan in how your team will act in the event of an attack, you may be able to limit the operational disruption or the financial and legal repercussions that could ensue.

To learn how Incident Response can help your organisation act fast to reduce the impact of an attack, connect with a Tecala specialist for a personalised Security Assessment by completing the form below.

Assess your vulnerability to attack. Protect your reputation.

Working to a risk assessment matrix, we’ll clearly identify where your business is most susceptible to breach or attack.

Our assessment follows 3 Steps:

  1. Where and how your business operations create your potential for risk.
  2. We’ll explain the two primary security frameworks and how to apply them to your organisation 
  3. Define next steps: Achieve peace of mind with a tailored Strategic Security Roadmap for your business 

Don’t be tomorrow’s headline. Book your session today.  

Tecala and eSentire – creating a leading-edge security partnership across APAC

Tecala and eSentire have come together in an exclusive partnership across the APAC region. As eSentire’s sole MDR solution provider in Australia and New Zealand, Tecala will be augmenting its cyber security practice to offer clients a powerful, all-in-one cyber security service which detects, disrupts, and remediates known and unknown cyber threats.

Tecala is Australia’s #1 mid-market-focused Managed Service Provider (MSP). Coming from a consulting and advisory heritage, we have a tried and tested approach to delivering IT that ensures your technology environment is aligned with your business objectives and is continually optimised.

Our fully integrated suite of managed services includes cloud, voice and data interconnectivity, intelligent automation, and business continuity. These services are delivered by our local teams of senior consultants, architects, and engineers, who are supported 24/7 by our Australian-based SOC team of support staff.

With over 1,000 customers in 70 countries around the world, eSentire is recognised as the industry’s leading Managed Detection and Response service provider. By partnering with eSentire, Tecala are delivering an end-to-end cyber security services portfolio to customers across Australia and New Zealand, that is designed to hunt, investigate, and stop cyber threats before they become business disrupting events.


How Your Organisation Can Prevent a Ransomware Attack

With ransomware attacks now more common than ever, having established steps that your organisation can take to prevent a ransomware attack, are now a measure you can’t afford to live without.


Tactical Experts Driving Success for Ransomware Gangs

We enter a new cybercrime world as cooperative cybercrime experts become far more efficient than what most organisations are prepared for.