Roger A. Grimes - Ransomware Protection Playbook

1 Cover

2 Title Page Ransomware Protection Playbook Roger A. Grimes

3 Introduction Who This Book Is For What Is Covered in This Book? How to Contact Wiley or the Author

4 Part I: Introduction Chapter 1: Introduction to Ransomware How Bad Is the Problem? Types of Ransomware Summary Chapter 2: Preventing Ransomware Nineteen Minutes to Takeover Good General Computer Defense Strategy Understanding How Ransomware Attacks Preventing Ransomware Beyond Self-Defense Summary Chapter 3: Cybersecurity Insurance Cybersecurity Insurance Shakeout Did Cybersecurity Insurance Make Ransomware Worse? Cybersecurity Insurance Policies The Insurance Process What to Watch Out For Future of Cybersecurity Insurance Summary Chapter 4: Legal Considerations Bitcoin and Cryptocurrencies Can You Be in Legal Jeopardy for Paying a Ransom? Is It an Official Data Breach? Preserve Evidence Legal Defense Summary Summary

5 Part II: Detection and Recovery Chapter 5: Ransomware Response Plan Why Do Response Planning? When Should a Response Plan Be Made? What Should a Response Plan Include? Practice Makes Perfect Summary Chapter 6: Detecting Ransomware Why Is Ransomware So Hard to Detect? Detection Methods Example Detection Solution Summary Chapter 7: Minimizing Damage Basic Outline for Initial Ransomware Response Stop the Spread Initial Damage Assessment First Team Meeting Determine Next Steps Summary Chapter 8: Early Responses What Do You Know? A Few Things to Remember Major Decisions Early Actions Summary Chapter 9: Environment Recovery Big Decisions Rebuild Process Summary Recovery Process Summary Summary Chapter 10: Next Steps Paradigm Shifts Improve Overall Cybersecurity Hygiene Summary Chapter 11: What Not to Do Assume You Can't Be a Victim Think That One Super-Tool Can Prevent an Attack Assume Too Quickly Your Backup Is Good Use Inexperienced Responders Give Inadequate Considerations to Paying Ransom Lie to Attackers Insult the Gang by Suggesting Tiny Ransom Pay the Whole Amount Right Away Argue with the Ransomware Gang Apply Decryption Keys to Your Only Copy Not Care About Root Cause Keep Your Ransomware Response Plan Online Only Allow a Team Member to Go Rogue Accept a Social Engineering Exclusion in Your Cyber-Insurance Policy Summary Chapter 12: Future of Ransomware Future of Ransomware Future of Ransomware Defense Summary Parting Words

6 Index

7 Copyright

8 Dedication

9 About the Author

10 About the Technical Editor

11 Acknowledgments

12 End User License Agreement

1 Chapter 2Table 2.1 Ransomware Root Causes by Report

1 Introduction Figure I.1 Picture of disk that AIDS PC Cyborg trojan arrived on Figure I.2 Picture of AIDS PC Cyborg Trojan disk program instructions Figure I.3 Picture of AIDS PC Cyborg Trojan ransomware screen instructions...

2 Chapter 1 Figure 1.1 Example scareware screenshot Figure 1.2 Screenshot of NotPetya activated and claiming to be ransomware... Figure 1.3 Screenshot of immediate action Cryptic ransomware Figure 1.4 A real-world ransom data extortion demand Figure 1.5 A real-world ransom extortion demand on the regular webFigure 1.6 Cerberus trojan network logical diagram

3 Chapter 2Figure 2.1 3×3 Security Control PillarsFigure 2.2 Example Microsoft AppLocker configuration

4 Chapter 3Figure 3.1 Percentage increases in cybersecurity insurance premiums over tim...Figure 3.2 Example services offered by AIG cybersecurity insurance product f...

5 Chapter 4Figure 4.1 Graphical representation of a common blockchain formatFigure 4.2 The bitcoin address used by NotPetyaFigure 4.3 Elliptic's graphical representation of the ransom paid via bitcoi...Figure 4.4 Start of OFAC memo stating that paying ransomware could be illega...

6 Chapter 6Figure 6.1 Logical flow of process anomaly detectionFigure 6.2 Logical flow of network anomaly detectionFigure 6.3 Opening AppLocker using Local Group PolicyFigure 6.4 AppLocker rule typesFigure 6.5 Enabling Audit Only mode in AppLockerFigure 6.6 Baseline rules about to be created in AppLockerFigure 6.7 Partial example of resulting AppLocker baseline rulesFigure 6.8 Example 8003 AppLocker event log warning

7 Chapter 7Figure 7.1 Basic ransomware initial tasksFigure 7.2 Rebuild vs. repair recovery risk decision

8 Chapter 10Figure 10.1 Number of newly publicly announced vulnerabilities by year

9 Chapter 12Figure 12.1 YouTube video showing television ransomware event

1 Cover Page

2 Title Page Ransomware Protection Playbook Roger A. Grimes

3 Copyright

4 Dedication

5 About the Author

6 About the Author

7 Acknowledgments

8 Introduction

9 Table of Contents

10 Begin Reading

11 Index

12 WILEY END USER LICENSE AGREEMENT

1 iii

2 xxi

3 xxii

4 xxiii

5 xxiv

6 xxv

7 xxvi

8 xxvii

9 xxviii

10 xxix

11 xxx

12 xxxi

13 xxxii

14 xxxiii

15 xxxiv

16 xxxv

17 xxxvi

18 xxxvii

19 xxxviii

20 1

21 3

22 4

23 5

24 6

25 7

26 8

27 9

28 10

29 11

30 12

31 13

32 14

33 15

34 16

35 17

36 18

37 19

38 20

39 21

40 22

41 23

42 24

43 25

44 26

45 27

46 28

47 29

48 30

49 31

50 32

51 33

52 34

53 35

54 36

55 37

56 38

57 39

58 40

59 41

60 42

61 43

62 44

63 45

64 46

65 47

66 48

67 49

68 50

69 51

70 52

71 53

72 54

73 55

74 57

75 58

76 59

77 60

78 61

79 62

80 63

81 64

82 65

83 66

84 67

85 68

86 69

87 70

88 71

89 72

90 73

91 74

92 75

93 76

94 77

95 78

96 79

97 80

98 81

99 82

100 83

101 84

102 85

103 86

104 87

105 88

106 89

107 90

108 91

109 92

110 93

111 94

112 95

113 96

114 97

115 98

116 99

117 100

118 101

119 102

120 103

121 104

122 105

123 106

124 107

125 108

126 109

127 110

128 111

129 112

130 113

131 114

132 115

133 116

134 117

135 118

136 119

137 120

138 121

139 122

140 123

141 124

142 125

143 126

144 127

145 128

146 129

147 130

148 131

149 133

150 135

151 136

152 137

153 138

154 139

155 140

156 141

157 142

158 143

159 144

160 145

161 146

162 147

163 148

164 149

165 150

166 151

167 152

168 153

169 154

170 155

171 156

172 157

173 158

174 159

175 160

176 161

177 162

178 163

179 164

180 165

181 166

182 167

183 168

184 169

185 170

186 171

187 172

188 173

189 174

190 175

191 177

192 178

193 179

194 180

195 181

196 182

197 183

198 184

199 185

200 186

201 187

202 188

203 189

204 190

205 191

206 192

207 193

208 195

209 196

210 197

211 198

212 199

213 200

214 201

215 202

216 203

217 204

218 205

219 206

220 207

221 208

222 209