Ransomware Frontline Report

13. Role-Based Practice Guide: Turning the Same Facts Into Role-Specific Action

V2 | English | Full Report

In ransomware response, giving everyone the same training does not align their actions. Management, business owners, infrastructure, applications, cloud, the help desk, procurement, legal, public relations, and outsourcing partners each need different decisions and evidence. This chapter presents the minimum boundary of responsibility each role should hold.

13.1 Management and Business Owners

Responsibilities

Decide which operations must be protected and the allowable downtime.
Accept or remediate the residual risk that comes with exceptions, technical debt, and recovery capability.
Make clear decision-making authority, budget, outside support, and responsibility for external explanation during an emergency.
Continuously review exercise results and improvement status.

Quarterly Reports to Receive

Question	Desired report
Can the most critical operation be restored?	Date of the most recent restoration exercise, measured time, unresolved assumptions
What is the biggest entry point?	Unowned exposed assets, overdue critical exceptions, remediation plan
Is the management plane protected?	Trend in privileged identities, emergency identities, outsourcing-partner privileges, MFA exceptions
Can the organization explain itself during an incident?	Exercise results for the contact network, initial report, legal, and outside support
Has improvement stalled?	Overdue improvement items, accepted residual risk

Instructions to Avoid

Instructions that short-circuit technical, legal, and business-continuity judgment, such as “never stop it under any circumstances,” “just pay the ransom,” or “don’t inform anyone until it’s reported in the press.” Instead, establish that “priorities are set among safety, customers, the law, and business continuity, and decisions are made on confirmed facts.”

13.2 Business Units and Service Owners

Responsibilities

Make clear what causes trouble if it stops, whom it affects, and in what order things should be restored.
Realistically design manual workarounds, alternative services, and handling of priority customers.
Sign off on whether a restored system is usable for business.
As the data owner, explain the necessity of retention, sharing, and external provision.

Practical Questions

If it stops on Friday night, what can be sustained manually through Monday morning?
In what order, and through which channels, is the situation communicated to business partners and customers?
Who confirms that restored data is correct, and using which reports, transactions, or balances?
If an outsourced business partner stops, are there alternate procedures or priorities?

13.3 Infrastructure and Network Staff

Responsibilities

Manage assets, reachability, network boundaries, administrative pathways, DNS, certificates, and time synchronization.
Maintain patching and logs for the externally exposed surface, perimeter devices, and remote access.
Understand the procedure for stopping segments and connections in a compromise, and its business impact.
Provide the network, name resolution, monitoring, and administrative pathway for the recovery environment.

Practical Checklist

The pathways among production, administration, backup, outsourcing partners, and general endpoints can be explained with a diagram.
There is an operation and approval route for emergency shutdown of external exposure or VPNs.
Backup and restoration of perimeter-device configuration has been tested.
Log time synchronization and the retention location remain accessible even during a shutdown.
Exception traffic and excessively broad administrative reachability are reviewed periodically.

13.4 IAM and Cloud Staff

Responsibilities

Manage the lifecycle of human, service, privileged, outsourcing-partner, and emergency identities.
Design MFA, conditional access, privilege elevation, audit logging, and app consent.
Observe cloud configuration changes and data sharing, and invalidate sessions and privileges in an emergency.
Prepare, on independent grounds, a trust-recovery procedure for when the identity infrastructure is suspected.

Practical Checklist

All privileged identities can be enumerated in full, with their purpose and owner explained.
The existence, storage, conditions of use, and logging of emergency accounts are confirmed.
Conditional-access exclusion rules have an expiration, an owner, and a reason.
Identity deletion upon resignation or contract termination is sample-audited.
Anomalies in MFA registration, OAuth consent, and mail delegation/forwarding can be monitored.

13.5 Application and Data Staff

Responsibilities

Manage application dependencies, data classification, recovery order, and data integrity.
Minimize privileges for secrets, service accounts, APIs, and external integrations.
Document application-specific considerations for backup and restoration, and participate in exercises.
Ensure auditability of external sharing and data export.

Practical Checklist

The identities, DNS, certificates, external APIs, and databases that restoring the application depends on are understood.
The business transactions to be checked after restoration, and the party who signs off, are decided.
No secrets remain in source code, shared folders, or personal devices.
External sharing and export of critical data can be audited.

13.6 SOC, Help Desk, and CSIRT

Responsibilities

Connect reports from users and technical alerts by severity, asset, identity, and business impact.
Separate fact, hypothesis, and unconfirmed items, and maintain the response timeline.
Execute containment decisions promptly, or escalate them, within defined authority.
After an incident, track improvements to detection, procedures, and communication.

Initial-Report Template

Subject: [Preliminary/High] Security Event — Investigation Initiated

Confirmed: Time, the affected identity/endpoint/service, and the facts observed.

Unconfirmed: Scope of impact, data exfiltration, reachability of the management plane and backups.

Actions taken: Isolation, account deactivation, evidence preservation, etc., and their business impact.

Next decision: Time of next update, approvals needed, whether outside support is required.

The initial report is not “a determination of cause.” It is a document that, without hiding uncertainty, enables the organization to mobilize the resources it needs.

13.7 Procurement and Outsourcing-Partner Management

Responsibilities

Track, through contracts and operations, the data, privileges, connections, notification, and termination of critical outsourcing partners and SaaS.
Establish conditions for alternatives and joint response in the event a supplier is compromised.
Do not fix safety at a single review; reflect it in contract renewal, significant changes, and exercises.

Contractual and Operational Questions

Are the definition of an incident, initial notification, continued reporting, and the duty to cooperate clear?
Can logs, evidence, and scope of impact be shared?
Can subcontracting, data location, access rights, and retention period be ascertained?
Can data deletion and access deactivation be verified after contract termination?
Is there data migration, an alternative service, and priority contact in the event the provider goes down?

13.8 Legal, Privacy, and Public Relations

Responsibilities

Maintain the boundary between fact-finding and external explanation.
Organize notification obligations, contracts, preservation, sanctions/law, insurance, and coordination with investigative authorities.
Compose messages to customers, business partners, employees, and the press using confirmed information and a schedule for updates.
Preserve a record of decisions that can be explained later.

Expressions to Avoid

“There is absolutely no leak”: Do not assert this while the investigation is incomplete.
“Everything has been safely recovered”: Do not say this if the scope of recovery and verification conditions cannot be shown.
“The attacker is X”: Do not attribute this without an official or investigative basis.

A Preferred Form of Wording

“We became aware of an anomaly involving [X] on [date], and are proceeding with investigation and recovery, having isolated the affected systems. What has been confirmed at this time is [X]. The impact on data is under investigation, and we will provide an update by [date] as additional facts are confirmed.”

13.9 All Users

Users are not the last line of defense — they are an important sensor for early detection. Keep what is asked of them simple.

If you see a suspicious email, authentication request, file, screen, or phone call, report it rather than continuing to handle it on your own judgment.
Do not hand over a password, MFA code, or an approval action on someone else’s instruction.
Verify an unexpected payment change, sharing invitation, app-consent request, or administrator request through a separate channel.
If a device is abnormally slow, a file won’t open, or a warning appears, disconnect from the network if necessary and contact the point of contact.
Do not hide a mistake or a wrong action. Early reporting reduces damage.

13.10 Check Questions for Being Able to “Teach Others”

Question 1

Backups succeed every night. Why can this not be said to be sufficient as a ransomware countermeasure?

Key points of the answer: Because the backup management plane may depend on the same identities, network, and administrators as production; a generation predating the encryption or alteration may not remain; restoration may not have been verified as a business operation; and peripheral elements such as identity, configuration, and keys may not come back.

Question 2

MFA has been deployed. Why does the design of privileged identities need to be considered separately?

Key points of the answer: Because privileged identities have a wide reach, and if exceptions, sessions, tokens, shared operations, or emergency identities remain, the impact is large. Separation from everyday identities, strong authentication, time limits, auditing, and dedicated administrative endpoints need to be combined.

Question 3

There is no trace of encryption. Is a response to information leakage unnecessary?

Key points of the answer: It cannot be said to be unnecessary. Extortion based on data theft alone, or exfiltration before encryption, is possible. Nor should this be settled by the attacker’s claim alone; confirm it through access logs, sharing history, data classification, and outside investigation.

Question 4

What should be isolated first?

Key points of the answer: There is no single fixed answer. Evaluate safety, business impact, evidence preservation, and the spread of the attack, and prioritize reachability into identities, endpoints, connections, and the management plane suspected of compromise. A uniform response such as powering everything off can inflict separate damage on evidence or business operations.

Question 5

What is the problem with the proposal that one should simply pay the ransom?

Key points of the answer: It does not guarantee decryption, deletion of data, or prevention of recurrence. It is a management decision encompassing law, sanctions, insurance, investigation, contracts, ethics, and business continuity, and it is not a substitute for a backup and recovery plan. [S01]