Ransomware hits the calendar, not just the computers
The outcome is decided before the attack, by backups, segmentation, and a plan on paper.
The call tends to come at the worst possible hour. Friday evening, the start of a long weekend, the week the office manager is out. That isn't bad luck. Attackers schedule around your staffing, because a quiet office buys them time. source
By the time a ransom note shows up on a screen, the encryption is the last step of the job, not the first. The quiet part came earlier: a stolen password or an exposed remote-access port, then days of looking around, collecting more credentials, and in the worst cases finding and deleting the backups. The note is the receipt, not the robbery. source source
So the result of a ransomware incident is mostly settled before it starts, and three things do the settling.
Backups that sit somewhere the attacker can't reach, and that someone has actually restored from recently. A backup nobody has tested is a hope, not a backup. A backup on the same network, behind the same passwords, is just more inventory for the intruder.
Segmentation. When the bookkeeping machine, the shop floor, and the camera recorder all share one flat network, a single infected laptop can touch everything. Walls inside the network turn a building fire into a kitchen fire.
And a short list of decisions made ahead of time. Who can pull a machine off the network without asking permission. Who calls the insurer, and what the policy requires before anyone touches anything. Who tells clients, and when. These are miserable calls to make for the first time at 2 a.m. with the files locked.
On whether to pay: that's a business decision, and it gets made under the worst conditions a business ever sees, with partial information and a countdown running. We'd rather you settle the other three early so that one stays hypothetical.
A readiness review takes an afternoon. We walk the attack on paper, find which of the three walls is missing, and fix that one first. It's the cheapest incident response you'll ever buy.
Castle Haven Solutions does security assessments, hardening, and fractional CISO work, including incident response planning, for businesses and homes across South Florida and remotely. If this raised a question about your own setup, that's the conversation to have.
Schedule a call