Contain or Eradicate Under Uncertainty
At 02:10 on a Tuesday, ransomware is detected on 2 of roughly 400 servers. The encryptor is slow and appears to be driven by a stolen domain administrator account that also runs the nightly backup service. Your EDR console can disable that account in one click, which stops the spread but also breaks the ERP-to-warehouse integration two days before month-end close, when $12M of invoicing is scheduled. Backups exist, but the last verified restore test was 11 months ago; RTO is 24 hours and RPO is 4 hours. Legal says do not notify anyone yet because exfiltration is unconfirmed, but the encrypted file share held records on about 3,000 EU customers and the 72-hour clock may already be running. The CFO asks whether you are overreacting.
1. Walk through your first six hours. What do you do, in what order, and what do you deliberately not do?
Read the worked answer
Do, in order:
- Declare the incident and start the log. Named incident commander, scribe, timestamped decisions. Everything below depends on someone recording why, because legal and regulators will ask.
- Scope before you act broadly. Two of 400 is a snapshot, not a scope. Pull authentication logs and EDR telemetry for the domain admin account - where has it authenticated in the last 48 hours?
- Assume full domain compromise. A stolen domain admin account means every credential in the directory should be treated as the adversary's. Plan for a double krbtgt reset and staged credential rotation. This is not optional and it drives your timeline.
- Isolate the two known hosts at the network layer - do not power them off, do not reimage. Memory holds the keys, the persistence mechanism, and possibly the operator's tooling.
- Break the false dilemma on the service account. The choice presented is "spread or break invoicing." Spend 45 minutes creating a replacement service account scoped to only the ERP-to-warehouse path, cut over, then disable the compromised account. Now you get containment without the $12M consequence. Escalating a binary choice into a third option is the actual skill being tested.
- Call the backup owner and start a restore test now, in parallel, on a clean network segment. An 11-month-old restore test is an assumption, and your RTO depends on it being true.
Deliberately do not: reimage hosts before imaging them, shut down the estate wholesale (destroys evidence, guarantees the business loss), or state that no data left the environment. You cannot know that yet and saying it will be quoted back at you.
2. How do you handle the notification decision while the facts are still incomplete?
Read the worked answer
You manage it as a decision with a clock and an owner, not as a conversation that ends with "legal says wait."
- Separate the questions. GDPR notification turns on whether there is a risk to personal data - not on confirmed exfiltration. A ransomware operator who encrypted a share containing 3,000 EU records has, at minimum, denied availability of that data, and availability is in scope. Start the 72-hour assessment clock from the moment you had reasonable awareness (02:10, not the moment you finish forensics) and document that you did.
- Write down the reasoning. A short dated note: what is known, what is unknown, what the notification threshold analysis concluded, who decided, and when the decision will be revisited (e.g., 24-hour checkpoints). This is what makes a "not yet" position defensible later and an indefinite one indefensible.
- Treat "not yet" as a deferral, never a closure. Legal's advice is one input; the decision owner is the accountable executive, and the decision must have an expiry.
- Prepare in parallel. Draft the regulator and customer communications now. If the facts turn, you will not have time to start writing, and a prepared-but-unused notification costs nothing.
- Check the contracts too. Customer agreements frequently have their own shorter notification windows that run independently of any statutory clock.
The failure mode is the scenario where day four arrives, the forensic report shows exfiltration, and nobody can explain why day one was quiet.
3. How do you answer the CFO's "are you overreacting?"
Read the worked answer
Translate into their numbers and give them a decision to make, not a feeling.
- What is actually at risk right now: the $12M invoicing run in two days, plus the standing value of the ERP and warehouse data. Two hosts are encrypted; a slow encryptor with domain admin is designed to be discovered late, which means the current count is the floor, not the total.
- What containment costs: a few hours of integration work if we route it through a new scoped account - and I have already started that. The cost of not containing is a month-end close done on encrypted systems.
- What I am not asking for: a shutdown, a declaration to customers today, or a spend approval. Those may come; today I am asking for two decisions: (a) authority to disable the compromised domain admin once the replacement path is live, and (b) a named business owner for the close who can decide by 18:00 whether to run invoicing on the fallback process.
- What would change my position: a completed scope check showing the domain admin was only used on the backup service and nothing else authenticated with it since. If that evidence appears, I will say so, in writing.
"Overreacting" usually means the CFO has not been given a bounded decision and a way to check your work. Give them both, and put the checkpoints in the incident log.