Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable 部落格


Ransomware Preparedness: Why Organizations Should Plan for Ransomware Attacks Like Disasters

Ransomware Preparedness: Why Organizations Should Plan for Ransomware Like Disasters
Ransomware Preparedness: Why Organizations Should Plan for Ransomware Like Disasters

As ransomware has cemented itself as one of the biggest cybersecurity threats to companies around the globe, it has become increasingly important that organizations treat ransomware attacks like they would a natural disaster and establish a robust preparedness plan.


In 2020, Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency (CISA) called ransomware the “most visible, disruptive cyber threat” as he saw it then. Nearly two years later, Lindy Cameron, the chief executive of the National Cyber Security Centre (NCSC) in the United Kingdom calls ransomware the “biggest global cyber threat” today.

Over the last four years, CISA, NCSC and other global agencies including the FBI and the Australian Cyber Security Centre (ACSC) have issued multiple warnings about the risk of ransomware, yet it remains the most dominant threat facing organizations today.

In a recent survey of chief information security officers, nearly 70% expect to be impacted by a ransomware attack within the next year, with nearly a quarter of companies saying they were impacted by ransomware attacks on more than one occasion.

Despite the prevalence of these attacks, many organizations are not adequately prepared to respond to ransomware incidents. Organizations should ready themselves for ransomware like they do for any other emergency.

The Federal Emergency Management Agency (FEMA) in the United States has outlined the four phases of emergency management for disasters and emergencies as: mitigation, preparedness, response and recovery. This same framework can be applied to ransomware attacks.

Mitigation is the natural first step in defense

For any organization looking to defend against ransomware attacks, their primary focus should be placed on mitigation. You are likely familiar with the mitigation steps you and your organization have taken to prepare for the sorts of disasters covered by FEMA’s guidance: evacuation maps around the office in the case of a fire, maintaining insurance, battening down the hatches.

When it comes to ransomware, we know many of the tactics and techniques used by the key members in the ransomware ecosystem, from spearphishing and targeting Remote Desktop Protocol (RDP) to exploiting unpatched and zero-day vulnerabilities. Mitigation relies on identifying and securing these known attack paths, whether it’s through the use of antivirus or anti-malware and email gateways, user awareness training and vulnerability management solutions. However, even with this wealth of knowledge, organizations continue to fall victim to ransomware attacks.

Organizations should prioritize preparedness

Regardless of the emergency for which you are preparing, having a plan is critical. Most organizations likely already have incident response plans for events like natural disasters; mature organizations likely also have technology or cybersecurity focused incident response plans. As FEMA notes in one of its sample emergency management documents, it’s not just about writing the plan, but about drilling the plan and refining it.

Preparedness is an often overlooked element in the emergency management of ransomware attacks. It is not just about focusing on the various mitigation measures as a form of preparation, it is also imperative for organizations to prepare by conducting simulated attacks against their networks to test incident response plans with various stakeholders. CISA has published a variety of CISA Tabletop Exercise Packages (CTEPs) that can be the foundation for your organization’s preparedness. Walking through a simulated ransomware attack enables an organization to identify gaps in their incident response plans. Additionally, being prepared makes the various stakeholders within your organization feel confident that in the event of a real ransomware attack, the response will be measured instead of chaotic.

Response and recovery is sometimes chaotic

Response is when you put your tested plans into practice and see whether your mitigations meet their intended purpose. According to FEMA, “business and other functions do not operate normally” during these phases. The focus is on understanding and limiting the disaster’s scope of impact, shaping public perception of the incident and beginning the process of returning to “business as usual.”

How an organization responds to a ransomware attack has become more important over the last few years, as ransomware groups not only encrypt files within a company’s network, but also exfiltrate and threaten to publish these files on leak websites hosted on the dark web. This tactic creates a sense of urgency, as ransomware groups provide little time for negotiations. So while an organization is tasked with trying to recover from an attack and restore network operations, they also face the added pressure of reputational harm from the leak of confidential information.

Because of the public nature of leak websites and the ardent tracking by reporters, ransomware response is often done in the public eye. This means that response operations are not limited to security and IT teams. Teams including customer support, legal, public relations and investor relations may all end up involved in the response. Those groups should also be part of preparedness efforts.

A challenge when responding to a ransomware attack is that organizations must negotiate with individuals or groups that weren’t responsible for attacking them. In the ransomware ecosystem, third parties such as ransomware affiliates and initial access brokers are the ones gaining a foothold within an organization before selling that access or partnering with ransomware groups directly. This distributed involvement can complicate negotiations and the investigations necessary for recovery.

Several moving parts are involved in the response and recovery process, but organizations don’t need to operate from a reactive position. They can be proactive through preparedness.

A global preparedness initiative is needed

In the United States, the Department of Homeland Security’s ready.gov resource provides low cost and free preparedness guides. We believe a similar resource should be created for ransomware preparedness and made available for organizations around the world, since ransomware is a global threat, as the NCSC’s Cameron has pointed out.

Steps you can take right now to be more prepared

  • Review your incident response plans (or start developing one) and confirm it’s sufficient to address a ransomware attack.
  • Conduct tabletop exercises with various stakeholders within your organization at least once a year if not more often.
  • Cut off known attack vectors by patching known, exploited vulnerabilities and addressing Active Directory misconfigurations. Tenable Research has produced scan templates and dashboards for Tenable.io, Tenable.sc and Nessus that can help identify known vulnerabilities used by ransomware affiliates and IABs.
  • Establish visibility for your organization’s full attack surface and how attackers may seek to breach your defenses.


加入 Tenable Community 的 Tenable 安全回應團隊

深入瞭解 Tenable,這是用於全面管理新型攻擊破綻的首創 Cyber Exposure 平台。

Get a free 30-day trial of Tenable.io Vulnerability Management.



輸入您的電子郵件地址,以便收到最新 cyber exposure 警示。



您的 Tenable.io Vulnerability Management 試用版也包含 Tenable Lumin、Tenable.io Web Application Scanning 和 Tenable.cs Cloud Security。

tenable.io 購買

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

65 項資產



免費試用 Nessus Professional

免費試用 7 天

Nessus® 是現今市場上功能最全面的弱點掃描工具。Nessus Professional 能協助自動化弱點掃描程序、節省您達到合規性的時間並讓您的 IT 團隊合作。

購買 Nessus Professional

Nessus® 是現今市場上功能最全面的弱點掃描工具。Nessus Professional 能協助自動化弱點掃描程序、節省您達到合規性的時間並讓您的 IT 團隊合作。

購買多年期授權,節省更多。新增 365 天全年無休 24 小時全天候可使用電話、社群及對談的進階支援。






您的 Tenable.io Vulnerability Management 試用版也包含 Tenable Lumin、Tenable.io Web Application Scanning 和 Tenable.cs Cloud Security。

Tenable.io 購買

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

65 項資產



試用 Tenable.io Web Application Scanning

享受我們專為現代應用程式而設計,屬於 Tenable.io 平台一部分的最新 Web 應用程式掃描產品的所有功能。不需耗費大量人力或中斷重要 Web 應用程式,即可高度準確且安全地掃描您整個線上產品系列中是否含有任何弱點。 立即註冊。

您的 Tenable Web Application Scanning 試用版也包含 Tenable.io Vulnerability Management、Tenable Lumin 和 Tenable.cs Cloud Security。

購買 Tenable.io Web Application Scanning

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

5 個 FQDN



試用 Tenable.io Container Security

享受整合至弱點管理平台中的唯一容器安全產品的完整功能。監控容器映像中是否有弱點、惡意軟體及政策違規的情形。與持續整合和持續部署 (CI/CD) 系統整合,以支援 DevOps 作法、加強安全性並支援企業政策合規性。

購買 Tenable.io Container Security

Tenable.io Container Security 整合了建置程序,能提供包含弱點、惡意軟體和政策違規等容器映像安全性的能見度,讓您無縫並安全地啟用 DevOps 流程。

試用 Tenable Lumin

透過 Tenable Lumin,能夠以視覺方式呈現 Cyber Exposure 並加以探索,長期追蹤風險降低狀況,以及對照同業進行指標分析。

您的 Tenable Lumin 試用版也包含 Tenable.io Vulnerability Management、Tenable.io Web Application Scanning 和 Tenable.cs Cloud Security。

購買 Tenable Lumin

聯絡業務代表,瞭解 Lumin 如何協助您獲得整個企業的深入洞見,並管理網路風險。

試用 Tenable.cs


您的 Tenable.cs Cloud Security 試用版也包含 Tenable.io Vulnerability Management、Tenable Lumin 和 Tenable.io Web Application Scanning。

聯絡業務代表購買 Tenable.cs

聯絡業務代表,以深入瞭解 Tenable.cs Cloud Security 如何輕鬆讓您的雲端帳戶上線,以及如何在數分鐘內輕鬆取得雲端錯誤設定與弱點的能見度。

免費試用 Nessus Expert

免費試用 7 天

Nessus Expert 是專為現代攻擊破綻所打造,它能讓您從 IT 到雲端洞察更多資訊,並保護貴公司免於弱點危害。

您已擁有 Nessus Professional 嗎?
升級至 Nessus Expert,免費試用 7 天。

購買 Nessus Expert

Nessus Expert 是專為現代攻擊破綻所打造,它能讓您從 IT 到雲端洞察更多資訊,並保護貴公司免於弱點危害。


促銷價格延長至 2 月 28 日截止。