As ransomware attacks persist, the federal government is developing recommendations for companies on how to respond to an attack. The Cybersecurity and Infrastructure Security Agency recommended hospitals to follow these seven steps:
- Determine which systems have been affected and isolate them immediately.
- If unable to disconnect devices from the network, turn them off to avoid further spread.
- Triage affected devices for restoration.
- Document what has occurred, based on initial analysis.
- Get help from a third-party incident response provider.
- If mitigation prospects look slim, take a system image and memory capture of a sample of affected devices. Be mindful of preserving evidence. Collect relevant logs and samples of malware binaries.
- Consult federal law enforcement regarding decryptors available as researchers have broken encryption algorithms for some ransomware variants.