The Shared Drive Ransomware Scare
You are the IT administrator at a small marketing firm with 25 employees. On Monday morning, several users report that files on the shared network drive (S:) have been renamed with a .locked extension and cannot be opened. A text file named README_DECRYPT.txt appears in each affected folder, demanding payment in Bitcoin. You check the file server logs and see that the files were modified starting at 2:00 AM on Saturday. The server runs Windows Server 2016, and backups are performed weekly on Friday nights, with the most recent successful backup from Friday at 11:00 PM. The backup is stored on an external hard drive that is connected to the server only during the backup window. You also notice that one employee, Jane, had her laptop connected to the network over the weekend and her antivirus alerted on a suspicious file on Friday afternoon, but she ignored it. The shared drive is mapped automatically for all users. The company has no incident response plan.
1. What are the first three actions you should take to contain the ransomware incident, and why?
Read the worked answer
- Disconnect the infected server and Jane's laptop from the network to prevent the ransomware from spreading to other devices or backups. Isolating the server stops further encryption of files and prevents the malware from reaching other shared resources. Disconnecting Jane's laptop is critical because it is the likely initial infection vector and may still be communicating with the attacker or spreading laterally.
- Do not pay the ransom; instead, preserve evidence by taking a forensic image of the affected server and Jane's laptop before any cleanup. This helps in understanding the attack and may aid recovery without paying.
- Restore from the most recent backup (Friday 11:00 PM) after ensuring the backup is clean and the malware is removed. Verify that the backup drive was not connected during the attack (it wasn't, since it's only connected during backup window) and scan it for malware before restoration. This minimizes data loss (only weekend changes) and avoids paying criminals.
2. What security measures could have prevented or mitigated this incident? List at least four.
Read the worked answer
- User awareness training: Jane ignored an antivirus alert; training would emphasize reporting suspicious alerts immediately.
- Endpoint protection: Ensure antivirus is up-to-date and configured to automatically quarantine threats; consider next-gen antivirus with behavioral detection.
- Network segmentation: Separate critical servers from user workstations to limit lateral movement.
- Backup strategy: Keep multiple backup versions offline and test restores regularly; use the 3-2-1 rule (3 copies, 2 media, 1 offsite).
- Incident response plan: Having a plan would speed up containment and recovery.
- Patch management: Keep systems updated to prevent exploitation of known vulnerabilities.
- Least privilege: Restrict write access to shared drives to only those who need it, reducing the impact of encryption.