Ransomware and Cyber Extortion: Response and Prevention

Chapter 5

Containment

Doing the best at this moment puts you in the best place for the next moment.

—Oprah Winfrey

Learning Objectives

• Understand the goals of containment, and recognize why containment is important

• Know strategies for making effective decisions in the containment phase

• Learn tactics for reducing the risk of data exfiltration, halting file encryption/deletion, and resolving denial-of-service attacks

• Gain familiarity with techniques for rapidly locking the adversary out of the victim’s environment

When a cyber extortion attack hits, you need to act quickly and contain the damage by halting any malicious activities such as encryption, unauthorized access, lateral movement, data exfiltration, denial-of-service attacks, command-and-control ...