Cyber Defense eMagazine February Edition for 2022

Decision Trees in Case of a Ransomware Attack
Does Your Organization Have a Procedure to Handle a Ransomware? Is It Worth Paying the
Attackers?
By Zsolt Baranya, Information Security Auditor, Black Cell Ltd.
The number of ransomware attacks is growing from day to day, as mentioned many of the publications
and reports. The ransomware kill chain, describes the phases of a ransomware attack, and each phases
the security trams can implement some actions to mitigate the probability of occurrence. For example,
the first phase of the ransomware kill chain is the campaign, where the security team can reduce the
success of the campaign with awareness trainings. The second phase is the infection, where the security
team can handle the situation with restricted file downloading methods and so on.
But if the chain reaches the encryption phase, the preventive actions were not effective. In this case, only
a few organizations have a playbook specified to handle the consequences of ransomware attacks. A
decision tree had been created to help organizations where this type of playbook is missed.
Consider actions for ransomware attack event
Firstly, all the affected devices and systems that have been attacked have to be identified and must be
disconnected from the network as soon as the detection occurred. This is the most important action
before the incident handling starts!
Cyber Defense eMagazine – February 2022 Edition 39
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.