It's every security pro's nightmare: Your company has been hit with ransomware, and every machine and server has been encrypted.
Shocked? Likely, but security experts say the warning signs were there all along. Misdirected DNS requests, bad VPN reboots, and Active Directory login failures should have been setting off alarms that a ransomware attack was in progress.
It doesn't have to be this way. According to Tarik Saleh, a senior security engineer and malware researcher at DomainTools, mitigation efforts begin with evaluating how vulnerable your company is to exploits. For example, are you leaving databases exposed on the public Internet?
"You first have to ask yourself how your business stands in the eyes of the attackers," Saleh says.
And once attackers are in your network, you have anywhere from 48 hours to 12 days before they pull the trigger, says Mike Hamilton, CISO of CI Security.
What key warning signs should you be on the lookout for as you develop a ransomware mitigation plan? Keeping reading.