Dealing with the aftermath of a ransomware attack often involves determining whether or not data has been stolen. If client personal information has been taken or could have been taken, it changes the focus of the response, as the clients and staff now become victims of the attack in addition to the business itself.
To answer the question of whether data was stolen, the business needs to understand what data exists on its systems and where that data is located. IT must also have a detailed understanding of the systems, how they are structured, and whether they have the ability to monitor and analyse network activity.
Signs of data theft can include a large upload taking place at or just before the ransomware was executed, as well as activity detected by tools or systems specifically designed to detect data theft. In some cases, it may not be possible to answer the question until the systems have been restored from a backup or through negotiations with the threat actors.
All businesses are at risk of a ransomware attack. To protect against such threats, businesses should consider the potential consequences of a breach, take steps to prevent breaches from occurring, and have a cyber incident response plan in place. Employee education on cyber security best practices is also essential. A business should also ensure that its IT systems are logging all relevant activity and that logs are retained for at least one year.
The takeaway from this blog?
1. Prepare for an event. Don't wait for it to happen.
2. Understand what information is being logged by your IT systems.
3. Have a working cyber response plan.
4. Know who your key contacts are (incident response, insurance, lawyers).
5. Understand if you have additional reporting requirements because of your contracts.
Forensic IT provides a range of services to help businesses protect against and respond to ransomware attacks. These services include security reviews to identify potential vulnerabilities and incident response planning to ensure that businesses are prepared to handle a crisis. We have the expertise and experience to help businesses understand the risks they face and take the necessary steps to protect against them. If you would like to learn more about our services or discuss your specific needs, please do not hesitate to contact us on 1300 018 114.
Comments