Ransomware Incident Response Guide

Contents

Why the First 30 Minutes Determine Everything
Immediate Actions — First 30 Minutes
Containment — Hours 1 to 4
Assessment — Hours 4 to 24
Recovery — Hours 24 to 72
Post-Incident: Prevent Recurrence

Why the First 30 Minutes Determine Everything

Ransomware incidents don't announce themselves. You discover them when files are encrypted, a ransom note appears, or systems become inaccessible. By that point, the attacker has typically been inside your environment for hours or days. The damage is already done.

The first 30 minutes after discovery are critical. The actions you take — or fail to take — in this window determine how contained the damage is and how quickly you recover.

The businesses that recover fastest have a documented incident response plan they practiced before the incident happened. The ones that struggle are making decisions under crisis pressure without a playbook.

Immediate Actions — First 30 Minutes

DO these immediately

✓Disconnect affected devices from the network — unplug ethernet, disable Wi-Fi. Do not power off unless the device is still actively encrypting and you have no other option

✓Notify your IT provider or De4sec immediately: support@de4sec.technology | AU: +61 451 500 909 | KE: +254 741 777 681

✓Preserve logs — do not delete or modify any logs, even suspicious-looking ones. They are forensic evidence

✓Document everything — take photos of ransom notes, unusual screens, error messages

✓Notify leadership — incident response is a business decision, not just an IT decision

DO NOT do these

✗Do not pay the ransom without professional advice — payment does not guarantee decryption

✗Do not attempt to decrypt files yourself with random tools — this can permanently corrupt data

✗Do not delete suspicious files — they are evidence

✗Do not communicate with attackers directly

✗Do not attempt to 'clean' infected systems yourself before forensic imaging

Containment — Hours 1 to 4

Network containment

✓Identify the blast radius — which systems are affected, which appear unaffected

✓Isolate affected network segments — if you have VLANs, isolate them now

✓Check backups immediately — are they intact and accessible? Are they connected to the affected network?

✓Disable compromised user accounts — not just the one you think was breached, but all accounts that had access to affected systems

✓Block malicious IPs and domains identified by your IT provider or MDR service

Communication

✓Internal staff notification — keep messaging factual, avoid panic, tell staff what they can and cannot use

✓Client notification — prepare a holding statement if operations are disrupted

✓Cyber insurer notification — call your insurer immediately, they have incident response support included

✓Legal counsel — if personal data may be involved, legal advice is required for notification obligations

Assessment — Hours 4 to 24

Forensic investigation

✓Identify the initial attack vector — phishing, RDP, unpatched vulnerability?

✓Determine the scope of lateral movement — how far did the attacker travel?

✓Identify the encryption timeline — when did encryption start, which backups are clean?

✓Collect forensic images of affected systems before rebuilding

✓Determine if data was exfiltrated before encryption — attackers often steal data for double extortion

Backup assessment

✓Verify backup integrity — are they in the recovery environment or connected to encrypted systems?

✓Identify the clean restore point — what's the most recent backup before compromise?

✓Calculate data loss — the gap between last clean backup and the encryption event

✓Test restore of a non-critical system to validate the backup is functional

Recovery — Hours 24 to 72

Rebuild, don't restore infected systems

Do not attempt to clean infected operating systems. Rebuild from scratch or from a known-good image. Ransomware frequently leaves persistent backdoors that survive remediation attempts.

✓Rebuild systems from clean OS images — not from backup of the infected system

✓Restore data from verified clean backups to rebuilt systems

✓Reset ALL credentials — every user password, every service account, every API key. Attackers frequently capture credentials during dwell time

✓Apply all outstanding patches before reconnecting to production

✓Re-enrol devices into Intune/MDM before reconnecting

Priority restoration order

✓Critical infrastructure: DNS, email, authentication

✓Core business systems: ERP, practice management, POS

✓Productivity: file shares, communication tools

✓Non-critical: analytics, reporting, secondary systems

Post-Incident: Prevent Recurrence

Recovery is not complete when systems are back online. The incident exposed gaps. Those gaps must be closed before the next attack — and there will be a next attack.

✓Deploy EDR if not already present — Microsoft Defender for Endpoint or equivalent

✓Implement SIEM monitoring — Microsoft Sentinel for proactive threat detection

✓Review and enforce MFA and Conditional Access policies

✓Implement network segmentation — limit lateral movement

✓Conduct security awareness training — the attack likely started with a phishing email

✓Review and test backup strategy — implement immutable offsite backup

✓Update and practice the incident response plan

De4sec provides post-incident security uplift engagements covering all of the above. Contact support@de4sec.technology.

// NEXT STEP

Ready to implement this in your environment?

De4sec provides hands-on implementation, not just advice. Book a free discovery call — we assess your current environment against this guide at no cost, no obligation.

Book a Free Discovery Call →or visit de4sec.technology

© 2026 DE4SEC TECHNOLOGY. ALL RIGHTS RESERVED.