Ransomware is the biggest cyber and continuity risk in 2017. It’s not just the NHS and small businesses – everyone is vulnerable. We’re even seeing global enterprises with big security investments and dedicated security teams get infected. Importantly, you have more options than to either pay the ransom or lose your data. It’s possible to recover without any significant data loss, zero downtime and in some circumstances – without your users even knowing there was a problem. How ransomware works and why it is breaching organisational defences The best methods for prevention The Incident and crisis management and escalation process A step-by-step guide to recovery

1. How to recover from
ransomware 2017

2. www.databarracks.com | 2www.databarracks.com | 2
INTRO &
AGENDA
Duration: 30 mins
(including Q&A)
Type questions on
the right
Q
• What it is and how it works
– How ransomware works and why it is breaching
organisational defences.
• Prevention & mitigation
– Methods
– The Incident and crisis management &
escalation process
• Recovery
– A step-by-step guide to recovery
*Slides will be made available and sent out following this session

3. www.databarracks.com | 3www.databarracks.com | 3
WHAT IS
RANSOMWARE
AND HOW
DOES IT
WORK?

4. www.databarracks.com | 4www.databarracks.com | 4
KEY FACTS
• The encryption is to all intents unbreakable so
backup data copies are the only guarantee to
limit data loss
• There is a deadline for payment – which forces
action –recovery or payment

5. www.databarracks.com | 5www.databarracks.com | 5
WANNACRY
• How it spreads
– Installed by a worm
– Uses Eternalblueexploit for
Server Message Block (SMB)
• US$300 ransom in bitcoins
• Ransom doubled after 3 days
• Files deleted after 7 days
What’s different?What’s the same?

6. www.databarracks.com | 6www.databarracks.com | 6
HOW MANY
DATABARRACKS
CUSTOMERS
WERE AFFECTED?
1

7. www.databarracks.com | 7
WHO IS BEING TARGETED AND WHY IS IT SO
SUCCESSFUL?
Why? Who?

8. www.databarracks.com | 8www.databarracks.com | 8
HOW DOES RANSOMWARE WORK -
BACKGROUND

9. www.databarracks.com | 9www.databarracks.com | 9
HOW DOES RANSOMWARE WORK -
BACKGROUND
Installation Contact with
command and
control
Search Encryption Ransom

10. www.databarracks.com | 10www.databarracks.com | 10
INCIDENT RESPONSE AND CRISIS
MANAGEMENT ESCALATION
Preparation Identification Containment Eradication Recovery
Lessons
learned
Creatinga written
policy and defining
severity
Identifyingwhether
somethingis, or is
notan incident
The steps to limit
the spread of
ransomware
Restorationof clean
data from before the
incident
Bringingthe
recoveredsystems
back online
How do we improve?

11. www.databarracks.com | 11www.databarracks.com | 11
HOW TO RECOVER
vs
Backup Disaster recovery

12. www.databarracks.com | 12www.databarracks.com | 12
HOW TO RECOVER
• Increase the frequency of
backups
• Review (and extend) retention
policies
• Optimise connection speed
between target and recovery
environment (general)
• Improvespeed of finding most
recent clean backup
Improving the Recovery Point
Objective
Improving the Recovery Time
Objective

13. www.databarracks.com | 13www.databarracks.com | 13
RECOVERY
Time to recover:
1 restore
24 hour RPO
3 days

14. www.databarracks.com | 14www.databarracks.com | 14
RECOVERY
Time to recover:
1-2 restores
12 hour RPO
2.5 days

15. www.databarracks.com | 15www.databarracks.com | 15
RECOVERY
Time to recover:
4-6 restores
4 hour RPO
2 days 4 hours

16. www.databarracks.com | 16www.databarracks.com | 16
RECOVERY
Time to recover:
6+ restores
Zero RPO
2 days 2 hours

17. www.databarracks.com | 17www.databarracks.com | 17
HOW TO
TEST?
Tutorial SAN Failure Cyber-Attack
http://www.databarracks.com/resources/tools/

18. www.databarracks.com | 18www.databarracks.com | 18
IF YOU REMEMBER NOTHING ELSE!
1. Have a specific incident response plan for
ransomware
2. Review backup schedules and retention policies
3.The only way to guarantee that you don’t lose your
data is with historic copies of your data in backup or DR

19. www.databarracks.com | 19
RESOURCES
• The Business Continuity Podcast
– http://www.thebcpcast.com/
• Tabletop testing simulator
https://tools.databarracks.com/dr-
tabletop-simulation/index.html
• History of ransomware
– https://heimdalsecurity.com/blog/what-is-
ransomware-protection/
• Ransomware definitions
– http://www.trendmicro.com/vinfo/us/security/defini
tion/ransomware
• SANS Institute, IncidentHandler's Handbook
– https://www.sans.org/reading-
room/whitepapers/incident/incident-handlers-
handbook-33901
• CryptoLocker DGA
– https://blog.fortinet.com/2014/01/16/a-closer-
look-at-cryptolocker-s-dga

20. www.databarracks.com | 20www.databarracks.com | 20
THE BCPCAST
http://www.thebcpcast.com/

21. QUESTIONS?