Learning Ransomware Response & Recovery

Chapter 5. Minimize the Blast Radius

Imagine you’re sitting at your desk, going about your day, when you begin to notice your desktop files change before your eyes. Then when you try to open them, it appears you don’t have access! Then a ransom note fills your screen and demands payment in exchange for your data. It’s a nightmare scenario and one that’s becoming all too common. It finds its way into environments where users don’t have proper awareness training, technical defenses are weak or outdated, security gaps have been overlooked, and attackers can exploit vulnerabilities without being detected. It also finds its way into environments that do all the right things.

The difference between a bad day and a bad month is preparation. This chapter is about doing what you can in your environment to minimize how much damage the ransomware attack can do. Another way to say that is to minimize the blast radius.

This chapter assumes compromise (i.e., the user clicked something they shouldn’t have, the vulnerable system was compromised, etc.) and focuses on implementing the controls that will diminish the impact of the attack while also slowing the attack down so you can react. Those include technical strategies, such as access controls, endpoint hardening, network segmentation, real-time monitoring, and threat detection. We’ll also discuss practical tips for isolating infections, mitigating lateral movement (i.e., attackers moving around inside your network), and building long-term ...