I have written about it before but it bears repeating. The attackers love holidays. Christmas, Easter and here in Sweden especially July, when half the country is at the summer house.<\/p>\n
It\u00b4s not a coincidence. A ransomware group that has been inside your network for weeks can choose when to strike, and they choose when the defenders are away. Fewer people watching the alerts, slower decisions because the managers are on vacation, and admins who don\u00b4t want to touch anything until August.<\/p>\n
Technically, there are a few things you can do before the vacation starts. Make sure someone actually reads the alerts every day, not just that the SOC \u2018exists\u2019. Have a clear on-call schedule with phone numbers that work, and test it. Lower the threshold for automatic actions, like isolating a device that shows ransomware behaviour, so you don\u00b4t have to wait for a human. Check that the backups ran and that the immutable copy is in place. And look for the signs that someone is preparing: new admin accounts, remote access tools that shouldn\u00b4t be there, logons at strange hours.<\/p>\n
The attackers often spend weeks preparing. That is your window to find them.<\/p>\n
The best time to catch a ransomware attack is before it starts.<\/p>\n","protected":false},"excerpt":{"rendered":"
I have written about it before but it bears repeating. The attackers love holidays. Christmas, Easter and here in Sweden especially July, when half the country is at the summer house. It\u00b4s not a coincidence. A ransomware group that has been inside your network for weeks can choose when to strike, and they choose when […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[71,42,30],"class_list":["post-1215","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-detection","tag-ransomware","tag-soc"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1215","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1215"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1215\/revisions"}],"predecessor-version":[{"id":1243,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1215\/revisions\/1243"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1215"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1215"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1215"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}