I85PREP
⌘ K
CTSF study materials
CTSF study resources

The Ransomware Scare

CTSF · Put your knowledge to work in context.

All case studies

The Ransomware Scare

An employee in the finance department receives an email that appears to be from a known vendor with an attached invoice (PDF). The employee opens the attachment, and soon after, files on the shared drive begin to be renamed with .encrypted extension. The employee alerts you immediately. You are the sole IT support person. The company has 30 employees, a Windows Server 2012 R2 domain controller, and a file server. Backups are performed nightly to an external USB drive connected to the file server. The USB drive is always connected. You have antivirus software (Symantec Endpoint Protection) but it did not detect the threat. The CEO is asking for an update.

1. Outline your immediate incident response steps to contain and mitigate the ransomware attack.

Read the worked answer
  1. Isolate: Disconnect the infected computer from the network immediately (unplug Ethernet, disable Wi-Fi). Do not power off, to preserve evidence.
  2. Contain: Disconnect the file server from the network to prevent further encryption. Disconnect the USB backup drive.
  3. Identify: Check other machines for signs of infection; scan all with updated antivirus.
  4. Notify: Inform management and key stakeholders; consider legal/regulatory reporting if data breach.
  5. Preserve evidence: Take notes, screenshots, and do not delete files.
  6. Eradicate: Run full scans, remove malware, and rebuild infected systems from clean images.
  7. Recover: Restore data from backups after verifying they are clean. Test restore on isolated network.
  8. Communicate: Update CEO with status, estimated recovery time, and next steps.
  9. Review: After recovery, analyze how the attack happened and improve defenses.

2. What are the weaknesses in the current backup strategy, and how would you improve it to better protect against ransomware?

Read the worked answer

Weaknesses:

  • USB drive is always connected: ransomware can encrypt backups.
  • Only nightly backups: up to 24 hours of data loss.
  • No offsite or offline copy: vulnerable to physical damage or theft.
  • No testing of restore procedures.

Improvements:

  • Implement 3-2-1 backup rule: 3 copies, 2 different media, 1 offsite.
  • Use network-attached storage with immutable snapshots or cloud backup.
  • Disconnect USB drive after backup or use a drive that rotates offsite.
  • Increase backup frequency (e.g., hourly incremental).
  • Test restores quarterly.
  • Apply least privilege: restrict access to backup drives.
  • Enable ransomware protection features in antivirus and Windows.

Present plan to CEO with cost estimates and timeline.