Ransomware readiness
Ransomware readiness is a set of facts
We write three lines for the systems the week depends on: who would notice they are down, who can disable accounts and keys, and whether anyone has restored a backup onto a system they can show. If a line is blank, that blank is the finding. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
What the assessment covers
We also write the call order specific to this incident type. Ransomware is not a lost laptop. The first hour includes a decision about whether systems stay online, who is told, and who is forbidden from talking to an attacker. Those names have to be current employees, not a distribution list from a template.
Identity sits in the same picture. An account that still belongs to someone who left, or a shared login nobody will admit to using, is a ransomware fact. We need access to the identity record and to the person who can revoke it. We do not accept a screenshot from six months ago as a substitute.
Restore before the event
A backup product that reports success has not proven a restore. The backup and recovery test is part of this assessment when the scope says so: one system, one restore, one owner, one elapsed time. If the restore fails, we write the failure. We do not estimate how long a future restore might take.
We will not tell you a percentage of data you should expect to get back. Anyone who opens with that number, before they have seen a restore, is guessing. The assessment names the last restore that worked, or it names that there isn’t one.
Offline or immutable copies matter only if someone besides a single administrator can reach them. If the only person who knows the passphrase is on leave, that is the finding. We need that person, or a documented way the company already uses, before we will call the control real.
Decisions that stay yours
Whether to pay an attacker is your decision. It belongs to a named person in your company, with your counsel and your insurer if you use them. REKKY Sec Ops Consulting will not contact an attacker, will not carry a message, and will not recommend payment or refusal. The playbook’s only job is to stop everyone else from making that decision in a side channel.
Whether to keep systems online, whether to tell customers before counsel has spoken, and whether to call a response firm are also yours. We help you write who holds each decision. We do not hold them for you.
If a ransomware event is already underway, this assessment is the wrong engagement. Say so in the first note. We do not take the keyboard during an active incident, and we do not quote a response time.
What this is not
This is not a penetration test and not a claim that ransomware is unlikely. We do not grade your tools against a product list. We grade the path your people can actually walk.
This is not insurance advice. We can write who would call the insurer and what facts that call needs. We cannot tell you the policy will pay.
We work around your normal operations, and we'll need access to the right areas and the right people while we do. Once you approve it, we'll need access to the right areas and people. Those people and those systems are the work. A questionnaire filled in without them is not an assessment.
Questions
What is included in a ransomware readiness assessment?
We look at who can disable accounts and keys, whether a backup has been restored onto a real system, who would be called, and which decisions remain with your company. We need access to those systems and those people. We do not quote a recovery percentage.
Will you negotiate a payment?
No. Payment is your decision, made with your counsel and your insurer if you have one. We will not contact an attacker, and we will not tell you to pay or not to pay. The assessment names who in your company is allowed to make that decision.
Contact
Task us before you need the restore.
Name the system the week cannot lose. If you need a negotiator, we will say we are not one. We work around your normal operations, and we'll need access to the right areas and the right people while we do.