Recovery
Backups and incident response for AI-assisted ransomware
The NCSC lists protecting backups and rehearsing incident response among the immediate priorities. Faster attacks leave less room to improvise.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
Priorities
What the NCSC lists
Reporting of the review gives the immediate priorities as maintaining an accurate view of systems, patching exposed services, controlling account access, protecting backups and rehearsing incident response [7]. Reporting of the NCSC chief's advice adds that organisations should invest in monitoring so failures are detected early [8].
A rehearsal
Steps to test the plan
-
1
Name the incident lead and a deputy, and record how to reach them out of hours. -
2
Decide who can authorise taking systems offline. -
3
Check that a backup exists that your administrator accounts cannot delete. -
4
Restore one important system from backup and record what went wrong. -
5
Agree who tells staff, customers, regulators and insurers, and in what order.
Limits
What insurance cannot do
Insurance cannot be your plan. Reporting of the NCSC's advice says organisations should not rely on insurance to cover the consequences of an attack on essential services [8].
Speed is the point
The NCSC says AI is making attacks faster, cheaper and easier to carry out [7]. A plan that depends on working things out during the incident will be slow.
After the test
Close the gaps
A rehearsal is only useful if its findings are fixed. Share the results with senior leaders in plain language, covering what worked, what failed and what it will cost to correct. Record each gap with an owner and a date, and repeat the exercise when systems or suppliers change. Include your suppliers, since the NCSC asks organisations to be able to deploy fixes across their supply chain [4] and to understand their supplier dependencies [7].
Related
Where this fits
Recovery is the last of the steps in what to do. The routes that make recovery necessary are in the four routes attackers use.
Keep reading
Read next
Questions
Short, sourced answers on the NCSC's warning of AI-powered ransomware against UK critical infrastructure by 2028 and what organisations should do.
Read the guide
Who is affected
Which UK organisations the NCSC's AI warning points at, from critical infrastructure to small businesses, and how to tell where you sit.
Read the guide
Key dates
The dates that matter in the NCSC's AI warning, from the May patch wave advice to the 3 November review and the 2028 horizon.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.