The Ransomware Incident Response
On a Friday evening, a mid-sized SACCO's core banking system is encrypted by ransomware. The attacker demands KES 4 million in cryptocurrency. The IT manager discovers the backup server was on the same network and is also encrypted; the last off-site backup is 11 days old. Customers cannot transact, and the SACCO has 60,000 members. The CEO wants to pay the ransom quietly to restore service by Monday and avoid regulatory scrutiny. The data protection officer notes member data may have been exfiltrated. Kenya's Data Protection Act and CBK guidance apply.
1. Advise the CEO on whether to pay the ransom, giving reasons.
Read the worked answer
Recommendation: do not pay.
Reasons:
- No guarantee of restoration - paying does not ensure decryption; attackers often re-extort or fail to provide working keys.
- Funds criminal activity - payment may breach anti-money-laundering and counter-terrorist-financing obligations; facilitating a criminal enterprise is a legal risk.
- Regulatory breach - CBK guidance and the Data Protection Act require prompt notification of incidents affecting member data; paying 'quietly' to avoid scrutiny is itself a compliance failure.
- Reputational and trust damage - a SACCO's core asset is member trust; concealment, if discovered, is worse than the incident.
- Encourages further attacks - payment marks the organisation as a willing payer.
Instead: activate the incident response plan, restore from the 11-day-old backup (accepting some data loss), rebuild clean systems, and engage law enforcement and a forensic firm.
2. Outline the incident response and notification steps, and identify the root-cause controls that failed.
Read the worked answer
Incident response steps:
- Contain - isolate affected systems, disable compromised accounts, block attacker access.
- Preserve evidence - image systems before rebuilding; do not destroy forensic data.
- Assess - determine scope, whether member data was exfiltrated, and the data-loss window from the 11-day-old backup.
- Notify - inform the Data Protection Commissioner and affected members without undue delay where personal data is compromised; notify CBK per supervisory expectations; consider law enforcement.
- Recover - restore from clean backup, verify integrity, rebuild with patched systems.
- Communicate - transparent member communication to manage trust.
- Review - post-incident review and remediation plan.
Root-cause control failures:
- Backup design - backups were network-connected, not isolated/immutable; no 3-2-1 rule (3 copies, 2 media, 1 off-site/offline).
- Backup frequency - 11-day gap means unacceptable data loss; should be daily or continuous.
- Segmentation - production and backup on the same network allowed lateral movement.
- Detection - ransomware was only discovered when systems failed; no monitoring/EDR.
- Testing - no evidence backups were tested for restore.
- Access control - likely compromised credentials; MFA and least privilege needed.