This Guide is an update to the Ransomware Guide published in 2020 by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). It was developed through the so-called Joint Ransomware Task Force and forms part of the #StopRansomware effort.
Ransomware is a kind of malware designed to encrypt files on a device, rendering them and the systems that depend on them unusable. Subsequently, malicious actors demand a ransom in exchange for decryption.
Over time, malicious actors have adjusted their ransomware tactics to be more destructive and impactful and have also taken advantage of obtaining data from victims by pressuring them to pay with threats to release illicitly obtained data to the public. When these tactics are carried out hand in hand with cybercriminals, this is known as double extortion. In some cases, malicious actors may exfiltrate data and threaten to disclose it as the only form of extortion without using ransomware.
These ransomware and associated data breach incidents can severely impact, for example, business processes or medical management, leaving organisations or entities stranded and unable to access data needed to manage and deliver basic or essential services.
Moreover, the economic and reputational impact of ransomware and data extortion has proven to be very costly and challenging for organisations of all sizes during the initial disruption and, at times, has led to a very complex recovery.
This guide to combating ransomware includes two main resources:
- Part 1: Best practices for ransomware and data extortion prevention.
This part provides guidance for all organisations to reduce the impact and likelihood of ransomware and data extortion incidents, including best practices for preparing for, preventing and combating these incidents. Best prevention practices are grouped by common initial access vectors.
- Part 2: Ransomware and data extortion response checklist.
Part 2 includes a checklist of best practices for responding to these incidents. These best practices and recommendations for preventing and responding to data extortion and ransomware are based on operational insights from CISA, MS-ISAC, the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI).
The audience for this guide would include IT professionals, as well as others within an organisation involved in the development of cyber incident response policies and procedures.
_____
Aquest apunt en català / Esta entrada en español / Post en français
