Ransomware attacks have dramatically increased over the last several years and the threat is continuing to evolve. Researchers now refer to ransomware by the actions it takes: Lock, Encrypt, Delete, Steal, or LEDS. Cyber criminals use the threat of disclosure to force victims into paying the ransom. This E-Focus is the third of four articles we will present on Ransomware Readiness – this article is focused on recovery.

Building off the second article on detecting and eradicating ransomware, whether one or hundreds of systems are impacted, the recovery process begins. Recovery may be as simple as recovering a few files, but more often, it requires system and application recovery. Assuming a wide spread impact, the recovery process needs to bring up systems and solutions in a prioritized manner designed to get the organization back in operating condition. The following are key areas to consider as part of the recovery processes:

• Business Impact Analysis – a major event may disrupt all operations and processes.  The organization needs to identify critical business processes, supporting computing solutions, and potential impact of significant downtime. IT uses the information to plan recovery priorities and the business uses the information to develop manual processes as a stopgap. 
• Business Continuity Plan – a major event may force the entire computing environment to be shut down or disconnected. The plan defines the critical processes to keep the organization functioning, the manual processes used, and alternatives in case it is a lengthy disruption. 
• Backup solution – the technology solution used to backup critical data and restore it. The backup solution should be closely aligned and integrated with the Disaster Recovery Plan for restoration requirements. Remember backups need to be regularly tested to make sure the data can actually be recovered when needed.
• Disaster Recovery Plan – the plan IT uses to restore the computing environment to meet business requirements. The plan uses the Business Impact Analysis to guide the restoration of the critical processes (identified in the Business Continuity Plan) wrapped tightly around the backup and recovery solution. Ideally these plans perform a tabletop and/or single solution recovery test annually.

As we discussed with the previous E-Focus articles, the details for every organization will be unique, but all will include the elements above. Cyber attacks resulting in downtime are extremely stressful for everyone. Planning ahead and then testing the plans will reduce that stress so the organization can focus on restoring operations.

As always, if you need information or assistance with cyber security, please feel free to contact the RubinBrown’s Cyber Security teams at any time.

^{Readers should not act upon information presented without individual professional consultation.}

^{Any federal tax advice contained in this communication (including any attachments): (i) is intended for your use only; (ii) is based on the accuracy and completeness of the facts you have provided us; and (iii) may not be relied upon to avoid penalties.}