Cyber Defense eMagazine August Edition for 2021

But how can leaders prepare for a ransomware attack that could take an entire organization’s system
offline? While CISA’s ransomware checklist is a great place to start, organizations should ready a
comprehensive ransomware preparedness strategy ahead of time that be adapted depending upon the
severity of an attack. Here are four steps leadership should follow in developing a ransomware response
strategy.
1. Evaluate the Levels of Risk Ransomware Could Pose to Operations Ahead of Time and
Conduct Tabletop Exercises
Organizations need to understand where they are most vulnerable, from their most critical operations to
other seemingly innocuous areas like HR or business records.
In the case of Colonial, although the ransomware attack took down its payment system, company
leadership also decided to shut down the pipeline’s oil production to mitigate damage. While some
business operations may not be top of mind when thinking about potential ransomware impact, any
business operation relying upon internet access is vulnerable. Organizations need to secure their most
critical networks and think through how other business operations could be hampered by ransomware. If
one segment of the business is compromised, it can have ripple effects across the entire enterprise.
2. Develop a Business Continuity Plan
It is critical to create a business continuity plan (BCP) and a disaster response plan (DPR) before any
cyber incident, particularly a ransomware attack. These plans are critical to ensuring an organization can
move quickly to get business up and running in the aftermath of an attack and mitigate damage. What
systems could be held up by ransomware? Is valuable organization data backed up and encrypted
regularly?
In high-stakes situations like ransomware attacks, company decision-makers must be involved from the
get-go. Which leaders should be interested in these early-stage conversations? How will customers, key
stakeholders, and the public be notified of the attack? Which entities should be engaged to help mitigate
any additional risk?
Having plans in place is imperative but practicing them is also equally as important. Tabletop exercises
are critical to helping business leaders and managers get acquainted with the protocol beforehand.
Knowing exactly who is responsible for what and what strategies should be deployed when is vital. Plans
should be easily accessible, saved in a secure location, and even physically printed if an attack results
in a total system compromise.
Cyber Defense eMagazine – August 2021 Edition 57
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.