Ransomware and the Missing Detection Layer
A 200-person engineering firm is recovering from a ransomware incident that encrypted 60% of its file shares and the backup catalog. Immutable cloud backups survived, but restoration took nine days. The investigation found initial access through a phishing email opened 23 days before encryption. Endpoint protection was licensed but not installed on 78 of 200 laptops. Windows event logs rolled over after about four hours, and no one had reviewed SIEM alerts for months because the analyst had left. The incident response plan was last updated three years ago and still names a former CISO as the contact. The CEO wants to buy a next-generation firewall and asks for a review of what failed and what to prioritize with a modest budget.
1. Classify the failed controls as preventive, detective, or corrective, and explain why the firewall purchase alone would not address the root causes.
Read the worked answer
Preventive controls reduce likelihood: malware protection (8.7), secure authentication (8.5), awareness (6.3), vulnerability management (8.8), network segregation (8.22). Detective controls find incidents: logging (8.15), monitoring (8.16), event reporting (6.8). Corrective controls recover: backup (8.13), incident response (5.26), ICT readiness (5.30). The phishing email succeeded because prevention and awareness were incomplete; the 23-day dwell time persisted because detection was absent; recovery took nine days because restore had not been tested. A next-generation firewall is mainly a preventive network control. It would not install endpoint protection on 78 laptops, restore log retention, or fix the stale IR plan, so it would not address the main failures.
2. Prioritize remediation using ISO/IEC 27002:2022 controls and justify the order.
Read the worked answer
Prioritize by risk reduction and time to detect and respond, not by product category. First: deploy endpoint protection to all 200 laptops and verify coverage (8.7); extend and centralize log retention beyond four hours (8.15); restore 24/7 alert monitoring or a managed service (8.16). Second: update the IR plan, contacts and call tree, and exercise it (5.24 to 5.26); test immutable backup restoration (8.13); introduce phishing simulation and reporting (6.3, 6.8). Third: MFA for remote and privileged access (8.5), vulnerability management (8.8), and segmentation (8.22). Record lessons learned (5.27). The firewall can be considered later if risk assessment still justifies it.
3. What metrics or evidence should be reported to the CEO to show improvement?
Read the worked answer
Report leading and lagging indicators: endpoint protection coverage (target 100%), mean time to detect and mean time to respond, log retention days, successful backup restore test rate, phishing simulation click and report rates, percentage of staff trained, number of open high-severity vulnerabilities, MFA coverage, and IR exercise completion. Also report risk treatment status against the plan and any accepted residual risks. These metrics show whether detection and response improved, not just whether money was spent.