AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 14 of 33 Given the usual secrecy involved in most malware incursions, the following description of this IT manager's actual experience is instructive since it offers an example of "best practices" that can guide others anticipating or facing a Ransomware threat.20 This organization suffered two serious breaches less than two months apart and successfully recovered both times. In the first breach, within 45 minutes of a user clicking on an email attachment, the Crypto virus had spread to 12 of the organization's 23 servers. The IT Manager was alerted to the problem both by the user whose PC was locked with the Ransomware demand on his screen and an auto alert from the network scanning software that reported unusual activity. The IT Manager's first action was to rapidly shut down the entire server network. This of course stopped the spread of the virus, but also prevented users from performing their jobs. Fortunately, their backup strategy implementation worked well as they were able to fully recover within hours. The major components of the protection strategy employed included: • Separating the network into discrete departments or segments (creating subnets) which restricted individuals' access to only servers containing their department's software and network storage. This limited the spreading of the virus across various departments within the organization. The analogy is a modern ship with rooms and decks that can be completely closed off from each other in the event of a fire or explosion. • Taking snapshots (copies) of their Storage Area Network (SAN) twice a day. • Completing full nightly backups of their SQL databases and incremental backups of the databases at five-minute intervals. • Performing server backups with a commercial external backup appliance and/or service. See Appendix D for examples of companies in this market.21 • Regularly testing the restore process to ensure the successful recovery of critical server hardware. Without testing, there is no assurance that the Cybersecurity plan will work. Moreover, even if it works once, that is no assurance it will work again, without periodic re -testing. • Conducting weekly backups of critical personnel's full PC hard drives. • Use the "3-2-1 strategy"22: do three backups into two different media including one offsite. Having all of these Cybersecurity plan components was a good start but it took much more to affect a recovery. First a commercial Virus Removal Software Tool was used which did not work (in this case). Therefore, the IT team used the snapshot copies to replace corrupted data on infected server units followed by the application of the incremental backups of the database to complete the restore. 20 Grand Jury Interview 21 These services include onsite and offsite backup and recovery services which are usually located outside the immediate locale. 22 Management Wire, The 3-2-1 Backup Rule and Effective Cybersecurity Strategy, January 7, 2020. 2019-2020 San Mateo County Civil Grand Jury 6 135