Ransomware Protection Playbook

Index

• 3X3 Security Control Pillars, 59–61

• A
• A Data-Driven Computer Security Defense (Grimes), 237
• AD (Active Directory), recover/restore, 231–233
• AES (Advanced Encryption Standard), cryptography, 23
• AI defense, 268–269
• AIDS Cyborg trojan, 17
• algorithms, hashes, 117
• anomalous network connections, 164–166
• antivirus programs, 73–74
  • AV/EDR (antivirus/endpoint detection and response detection), 159–160
  • detection and, 155–156
  • EDR (endpoint detection and response) comparison, 163
  • ransomware auto-updates and, 37–38

• APIs (application programming interfaces), securing, 68–69
• application control, 70–71, 164
  • AppLocker (Microsoft), 72
  • enforcement mode, 73
  • Flu-Shot!, 71
  • Tripwire, 71
  • Windows Defender Application Control, 72

• Application Identity (Windows), 172–173
• AppLocker (Microsoft), 72
  • Application Identity and, 172
  • Audit Only mode, 171–172
  • baseline rules, 172–173
  • event log warning, 173
  • opening, Local Group Policy, 170
  • rule types, 171

• APT (advance persistent threat) adversaries, 160
• assets, recovery and, 224
• asymmetric key encryption, 44
• attacks
  • Colonial Pipeline attack, 19
    • bitcoin ransom tracking, 120–121
    • RaaS (ransomware-as-a-service) and, 31–32
  • DDoS (distributed denial-of-service) attacks, 29
  • second, 58
  • timing, 178
• authentication, MFA (multifactor authentication), 68
• automatic malware, 17–18
• auto-payload, 39
• auto-update, antivirus programs and, 37–38
• AV/EDR (antivirus/endpoint detection and response detection), 159–160

• B
• backups, 16–17
  • damage assessment, ...