Why they attack when you are on vacation
Jul 2nd, 2020 by Jesper Kråkhede
I have written about it before but it bears repeating. The attackers love holidays. Christmas, Easter and here in Sweden especially July, when half the country is at the summer house.
It´s not a coincidence. A ransomware group that has been inside your network for weeks can choose when to strike, and they choose when the defenders are away. Fewer people watching the alerts, slower decisions because the managers are on vacation, and admins who don´t want to touch anything until August.
Technically, there are a few things you can do before the vacation starts. Make sure someone actually reads the alerts every day, not just that the SOC ‘exists’. Have a clear on-call schedule with phone numbers that work, and test it. Lower the threshold for automatic actions, like isolating a device that shows ransomware behaviour, so you don´t have to wait for a human. Check that the backups ran and that the immutable copy is in place. And look for the signs that someone is preparing: new admin accounts, remote access tools that shouldn´t be there, logons at strange hours.
The attackers often spend weeks preparing. That is your window to find them.
The best time to catch a ransomware attack is before it starts.