Key takeaways

  • Ransomware usually arrives through a short list of doors: exposed services, stolen credentials, phishing, earlier malware and weak third-party access. Closing those doors is the cheapest defense.
  • Keep encrypted backups offline or immutable, and test restores. A backup nobody has restored is a hope, not a control.
  • Write the response plan, print it, and exercise it. During an attack the email system and the shared drive may be the first things you lose.
  • Isolate first, preserve evidence second, and talk by phone. Do not power machines off if you can disconnect them instead.
  • Know your reporting duties before the incident: insurer, law enforcement, regulators and affected clients.

What the guide is, and why it is a good starting point

The #StopRansomware Guide is a joint publication of CISA, the FBI, the NSA and the Multi-State Information Sharing and Analysis Center (MS-ISAC). It is written for IT staff and for the people who plan incident response. It has two parts. Part 1 covers prevention and preparation. Part 2 is a response checklist for the day an attack is found. Because it comes from the agencies that see these incidents, it is a useful yardstick for any business, not only for government offices.

This article turns the guide into a working outline for a firm of ten to a few hundred people. It does not replace the guide. Read the original, and use the version on the CISA site, because the agencies update it.

Part 1: Get ready before anything happens

The guide opens with preparation, and the first item is backups. It recommends keeping encrypted backups offline and testing restores regularly. It also asks you to keep "golden image" templates so you can rebuild machines quickly, and to keep infrastructure-as-code templates, source code and software licenses offline. Spare hardware that can host restored systems is on the list as well. Immutable storage is mentioned, with a note to use it carefully. The reason is simple. Many ransomware operators try to find and delete or encrypt backups before they announce themselves. If your only backup is reachable with the same admin account that was stolen, it is reachable by the attacker.

The second item is the incident response and communications plan. The guide says to write it, maintain it and exercise it, and to keep hard copies and offline copies. It suggests templates for holding statements, an agreement on what you will tell staff and the public, and written approval of the plan by the CEO or equivalent. That last point matters. In a real incident someone will have to decide quickly to take systems offline, and the plan is the permission slip.

The third item is breach notification. The guide tells you to know your state notification laws, to check FTC and HHS rules if you hold health data, to notify affected people when personal information is exposed, and to notify other businesses whose data you hold. For Florida firms, see our article on the Florida Information Protection Act. For health data, see our HIPAA Security Rule checklist.

Finally, build relationships early. The guide suggests joining a sector information-sharing group, and establishing a point of contact with CISA and your local FBI field office before you need one. A phone number you already have is worth more than a web form at 2 a.m.

The doors ransomware uses, and how to close them

Part 1 organizes prevention by the way attackers get in. Each group below follows the guide's own headings.

  • Internet-facing vulnerabilities. Do not expose services such as Remote Desktop Protocol to the internet. Scan regularly and patch quickly, starting with vulnerabilities known to be exploited. Retire the old SMBv1 file-sharing protocol, block the Windows file-sharing ports at the perimeter, and require MFA on VPNs.
  • Compromised credentials. Use phishing-resistant MFA everywhere, especially on email, VPNs and critical systems. Require unique passwords of at least 15 characters, lock accounts after repeated failures, and give administrators a separate account for admin work. Our companion article on MFA and passkeys explains the difference between MFA types.
  • Phishing. Train people to spot and report suspicious messages. Mark external email, filter at the gateway, restrict risky attachment types, publish a DMARC policy, and disable macros in Office files that arrive by email.
  • Precursor malware. Use centrally managed endpoint protection with automatic updates, and consider application allowlisting so unknown programs cannot run.
  • Social engineering. Train staff on current tactics, and consider protective DNS, which blocks lookups of known malicious domains.
  • Third parties and managed service providers. Assess their security, limit their access to what they need, and write security requirements into contracts. A vendor with broad remote access is a doorway to every client it serves, including you.

General hardening that pays off in every scenario

The guide adds a list of habits that do not belong to one door. Keep an asset inventory and a ranked list of critical systems. Segment the network so that office computers, servers and any industrial or building equipment are not all on one flat network, and keep current network diagrams. Harden virtualization hosts. Restrict and log PowerShell, and keep those logs for at least 180 days. Limit what is installed on domain controllers, block their internet access and restrict who can administer them. Control remote monitoring and management tools, because attackers like to use the same tools your own IT staff use. Centralize logs and keep critical ones for at least one year, so you can see what normal looks like and what changed.

In the cloud, turn on logging and alerts, and use delete protection, object lock and versioning on storage that holds backups. Those three features are what make a cloud backup survive a stolen administrator login.

The big clouds each name these features differently. Amazon S3 Object Lock and AWS Backup logically air-gapped vaults, Google Cloud Storage bucket lock and the Backup and DR Service, Azure Blob immutable storage and Azure Backup immutable backup, and Oracle Cloud Infrastructure (OCI) Object Storage retention rules with rule lock all aim at the same goal: a copy that a stolen administrator login cannot erase.

Part 2: The first hours of an attack

The response checklist begins with detection and analysis. The guide's immediate steps are worth memorizing.

  • Identify the affected systems and isolate them. The guide's preference is to take the affected network segment offline at the switch, so isolation is quick and complete.
  • Snapshot cloud volumes for later forensics.
  • Coordinate isolation and communicate out of band, for example by phone. If the attacker is reading your email, a message that says "we found you" can speed up the damage.
  • Power a device down only if you cannot disconnect it from the network. Powering off destroys volatile evidence held in memory.
  • Triage using your critical-asset list, and keep a record of the systems that are not affected.

Then investigate. The guide lists what to look for: precursor malware that may have opened the door weeks earlier, new or escalated directory accounts, suspicious VPN logins, misuse of built-in Windows tools that delete shadow copies or backups, unexpected remote-management or PowerShell activity, tools used to dump credentials, unusual traffic between workstations, and abnormal outbound data transfers that suggest theft. The last point is important. Many attacks now combine encryption with data theft, so restoring from backup does not end your legal duties.

Next, notify. Under your plan, tell IT, any managed security provider, your cyber insurer and company leadership, and keep them updated. The guide says to report the incident to CISA, to your local FBI field office or the FBI Internet Crime Complaint Center, or to a U.S. Secret Service field office. Coordinate public messages with whoever handles communications. If data was stolen, follow the breach-notification rules that apply to you. Check your insurance policy now for notice deadlines and for any requirement to use the insurer's approved responders.

Containment, eradication and evidence

Once the first isolation is done, the guide moves to containment and eradication. Preserve evidence first: image and capture memory from a sample of affected devices, collect logs, and save malware samples and indicators of compromise. Ask federal law enforcement whether a decryptor exists, even if you think you can recover on your own. The guide does not give advice on paying a ransom. That decision has legal, financial and ethical sides, so make it with counsel, your insurer and law enforcement, and make it only after you know your recovery options.

Then contain. Disable known ransomware files and related registry entries. Identify the accounts and systems used in the first breach. If VPNs, remote access, single sign-on or public-facing assets allow continued access, disable them. Look for the machine that is writing the encrypted files by checking sessions, open files, remote desktop logs, Windows security logs and network captures.

Attackers rarely rely on one foothold, so hunt for persistence. Look from the outside in: rogue accounts, backdoors, exploited perimeter flaws. Look from the inside out: implants, tools that live off the land, and remote execution utilities. Rebuild priority systems from standard images or code, reset passwords for every affected account, patch and close the gaps, and rotate customer-managed encryption keys. The guide says the IT or security authority should declare the incident over, based on criteria you set in advance.

Recovery and lessons learned

Recovery follows your priority list. The guide says to restore from offline, encrypted backups in order of critical-service priority, and to add only systems you have verified as clean to the recovery network, for example on a new VLAN. This is where untested backups fail. Teams discover that the restore takes days, that a key was stored on the encrypted server, or that nobody has the installation media. Test a full restore of your most important system at least once a year, and time it.

After recovery, document what happened. Update the plan, policies and procedures. Share indicators of compromise and lessons learned with CISA or your sector group so that others can defend themselves. Treat the review as a fix list with owners and dates, not a report that sits in a folder.

A one-page readiness check

Use these questions in a leadership meeting. A "no" is a task, not a failure.

  • Do we have at least one backup that an attacker with our administrator password could not delete, and have we restored from it this year?
  • Is MFA, ideally phishing-resistant, on email, VPN, remote access and every administrator account?
  • Is anything on our network reachable from the internet that does not need to be, such as remote desktop?
  • Do we have a printed incident response plan with out-of-band phone numbers for staff, our IT provider, our insurer, counsel, the FBI field office and CISA?
  • Has the plan been approved in writing by leadership, and have we run a tabletop exercise on it?
  • Do we know which systems come back first, and how long each one takes?
  • Do we know which laws and contracts require us to notify clients or regulators, and by when?
  • Do our vendors and managed service providers have only the access they need, and is that written into the contract?

How Clayton Cybernetics can help

Our team designs and operates defensive programs for businesses: hardening and monitoring, backup design and restore testing, identity and MFA rollouts, and incident response planning. We can run a tabletop exercise, or review your current plan against the CISA guide. If you are in an active incident right now, call (305) 404-9404 and isolate affected systems from the network while you wait. Do not wipe machines.

Sources

This article is general information, not legal advice or a substitute for an incident response retainer. Notification duties depend on your industry, contracts and state law. Confirm them with your counsel and insurer. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity