Ransomware at a Regional Bank: Containment vs. Evidence
A regional bank's endpoint detection system flags ransomware behavior on 14 teller workstations across three branches. The malware encrypts local files and displays a ransom note. The incident response team's first instinct is to immediately reimage all affected machines to restore service before branch opening in 4 hours. However, the bank's security lead notices that one workstation had a mapped network drive to a file server containing customer loan documents, and the ransomware note includes a countdown timer. The bank is subject to a 72-hour breach notification regulation. Backups were last verified 9 days ago, and the backup server is on the same network segment. The incident manager must decide the order of containment, evidence preservation, and communication. The CEO wants a statement to customers within 2 hours.
1. What should the incident response team do first, and why? Address containment versus evidence preservation and the risk to the file server.
Read the worked answer
The first action should be network isolation of the affected workstations, not reimaging. 27035 response principles prioritize containing the incident to prevent spread while preserving evidence. Reimaging destroys volatile data (memory, running processes, network connections) and may violate legal and regulatory obligations. The team should: (1) isolate the 14 workstations from the network at the switch or endpoint level, leaving them powered on for memory capture; (2) immediately check the file server for signs of encryption or unauthorized access, and if necessary isolate it too; (3) capture forensic images of at least one workstation and the file server logs before any wipe; (4) verify backup integrity in an isolated environment, because the backup server is on the same segment and may be compromised. The countdown timer increases urgency but does not justify destroying evidence. Containment can be achieved without reimaging. Reimaging can happen later, after evidence is secured and the root cause is understood.
2. How should the incident manager handle the 72-hour notification deadline and the CEO's demand for a customer statement within 2 hours?
Read the worked answer
The incident manager must separate legal notification from public communication. The 72-hour deadline applies if a personal data breach is confirmed; the team must assess whether loan documents were actually accessed or exfiltrated. That assessment requires forensic review, which takes time. The manager should engage legal counsel and the data protection officer immediately, document the assessment, and prepare a notification if the threshold is met. For the CEO's 2-hour demand, the manager should explain that a customer statement before facts are known risks inaccuracy and legal exposure. A holding statement can be prepared-acknowledging an ongoing investigation and promising updates-without admitting a breach. 27035 emphasizes coordinated, accurate communication; the incident manager should control the message with legal and communications, not rush to meet an arbitrary deadline. If regulation requires customer notice, that should be done as soon as feasible, but not before the facts are sufficiently established.
3. What lessons-learned activities should follow, and how would you measure improvement?
Read the worked answer
A post-incident review per 27035 should be conducted within a defined period, involving all stakeholders. It should examine: why backups were 9 days old and unverified; why the backup server was on the same segment; how the ransomware entered; whether segmentation and least privilege were effective; and how communication decisions were made. Corrective actions might include daily backup verification, network segmentation for backups, endpoint detection tuning, and tabletop exercises. Metrics: time to detect, time to contain, time to restore, backup restore success rate, and percentage of critical assets with isolated backups. Also measure whether the 72-hour notification decision was made within the required timeframe. Lessons learned should be tracked to closure, not just documented.