Forensic technicians can ensure systems aren’t compromised in other ways, gather information to better protect organisations going forward, and try to track down the attackers. Ĭryptolocker ransomware attacks are a crime, and organisations should call law enforcement if they fall victim. That decision should be based on the type of attack, who in your network has been compromised, and what network permissions the holders of compromised accounts have. Only the IT security team should attempt a reboot.Ĭentral to your response is whether to pay the ransom. If possible, they should physically take the computer they’ve been using to their IT department. It cannot be stressed enough that maintaining good, encrypted, incremental backups on a regular basis is not just a good idea, but critical for any business.Once your users detect a ransomware demand or virus, they should immediately disconnect from the network. Users should be compartmentalized to access only what is necessary to perform their job function. The last thing you want is for a weekend book keeper to take down all of your data because they had access to more than just the accounting network share. Organizations should review their business critical data, and ensure that access is limited to key individuals, rather than globally through group policy. Also, turn off any preview options within Outlook to prevent accidental selection of emails from automatically opening bad attachments. Only open attachments which you are clearly expecting to receive from an individual, and even better, contact the individual who sent the attachment to verify they sent one. The most important is awareness and common sense when handling email attachments. Prevention, as most risks in the virus landscape, involves layers of preventative measures.

What is a crypto locker risk assessment