Ransomware Recovery

5 automated security scanners

Disaster Recovery Testing

Purpose: The Disaster Recovery Testing Scanner evaluates a company’s disaster recovery and system restoration processes by analyzing publicly available security documentation, policies, and compliance certifications. It helps to identify gaps in recovery execution and system restoration capabilities, ensuring robust security practices are in place.

What It Detects:

Security Policy Indicators: Identifies the presence or absence of formal security policies and checks for specific keywords related to incident response, data protection, and access control.
Maturity Indicators: Evaluates compliance with industry standards such as SOC 2 and ISO 27001, looking for evidence of penetration testing and vulnerability assessments.
Incident Response Documentation: Searches for detailed incident response plans or procedures and checks for specific language indicating preparedness and response strategies.
Data Protection Measures: Identifies data protection policies and practices, verifying the presence of encryption, backup, and recovery mechanisms.
Access Control Policies: Examines access control measures and protocols, looking for evidence of role-based access controls and regular audits.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com). This is crucial for scanning the company’s website to gather relevant security documentation.
company_name (string): Company name for statement searching (e.g., “Acme Corporation”). This helps in identifying and locating specific documents related to the company’s policies and practices.

Business Impact: The effectiveness of a company’s disaster recovery and system restoration processes directly impacts its security posture, ensuring that critical systems can be restored quickly and securely after an incident. This is particularly important for maintaining customer trust, regulatory compliance, and overall business continuity.

Risk Levels:

Critical: Conditions where there are significant gaps in formal security policies or absence of documented procedures for critical incidents like data breaches or system failures.
High: Situations where compliance with industry standards such as SOC 2 is lacking, potentially leading to high risks in terms of unauthorized access and potential data loss.
Medium: Where certain aspects of disaster recovery are partially covered by policies or there are gaps in the maturity level of incident response plans.
Low: Informal security practices without documented procedures but with minimal risk to critical systems.
Info: General compliance with basic cybersecurity standards, indicating a baseline level of preparedness that still needs improvement for more robust recovery capabilities.

Example Findings:

A company lacks a formal security policy document, which is crucial for incident response and data protection.
The company’s website does not mention any penetration testing or vulnerability assessments in its compliance certifications, indicating potential weaknesses in identifying and fixing system vulnerabilities.

Cyber Insurance Adequacy

Purpose: The Cyber Insurance Adequacy Scanner evaluates the adequacy of a company’s cyber insurance coverage by detecting relevant policy indicators, maturity indicators, and specific requirements such as coverage limits, exclusions, and necessary security measures. This ensures that organizations have appropriate protection against ransomware attacks and other cybersecurity threats.

What It Detects:

Policy Indicators: Security policy mentions, incident response procedures, data protection policies, and access control measures are detected in the company’s documentation.
Maturity Indicators: Compliance with SOC 2, ISO 27001 certification, penetration testing activities, and vulnerability scanning or assessment are identified within the insurance policy documents.
Coverage Limits: Specific coverage limits mentioned in the policy documents are extracted for analysis.
Exclusions: Any exclusions listed in the insurance policy that may affect ransomware recovery are noted.
Requirements and Standards: The scanner checks for adherence to specific security standards and best practices required by the insurance policy.

Inputs Required:

domain (string): Primary domain to analyze, which helps in searching company site for relevant security and policy documents.
company_name (string): Company name for statement searching, aiding in locating necessary documentation related to cyber insurance coverage.

Business Impact: Ensuring that organizations have appropriate protection against ransomware attacks is crucial as these attacks can lead to significant financial losses, operational disruptions, and damage to reputation. This scanner helps in evaluating the adequacy of cyber insurance coverage, ensuring that companies are adequately prepared for potential cybersecurity threats.

Risk Levels:

Critical: Findings that indicate a severe lack of necessary security measures or exclusions directly affecting critical aspects of cyber insurance coverage.
High: Issues that significantly compromise the completeness and effectiveness of cyber insurance policies in addressing key risks, potentially leading to substantial financial losses if not covered adequately.
Medium: Vulnerabilities that may be mitigated through improvements but still pose a moderate risk to the organization’s security posture without comprehensive mitigation strategies.
Low: Informal or non-critical findings that do not significantly impact the overall adequacy of cyber insurance coverage, generally considered less severe risks.
Info: General compliance markers indicating basic adherence to industry standards and practices but lacking in specific critical areas requiring immediate attention.

Example Findings:

A company’s security policy does not mention incident response procedures, which could be a critical issue as it affects the organization’s ability to respond effectively to cyber threats.
The insurance policy excludes coverage for certain types of ransomware attacks, posing a high risk if such an attack occurs without adequate recovery support from other sources.

Business Continuity Planning

Purpose: The Business Continuity Planning Scanner evaluates a company’s business continuity planning by identifying recovery priorities and alternative processing capabilities through an internal assessment of security documentation, public policy pages, trust center information, and compliance certifications.

What It Detects:

Security Policy Indicators: Identifies the presence of comprehensive security policies.
Incident Response Plans: Looks for detailed incident response procedures.
Data Protection Measures: Detects data protection strategies and protocols.
Access Control Policies: Evaluates access control mechanisms and procedures.
Compliance Certifications: Checks for SOC 2, ISO 27001, penetration testing, and vulnerability assessments.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps in assessing the robustness of a company’s security measures and compliance with industry standards, which directly impacts its resilience against cyber threats and regulatory compliance.

Risk Levels:

Critical: Conditions that lead to severe vulnerabilities or non-compliance with critical regulations, potentially causing significant business disruption or legal penalties.
High: Conditions that pose a high risk of data breach or system compromise, affecting key operations and sensitive information.
Medium: Conditions that may lead to moderate risks such as partial compliance or less severe security breaches.
Low: Informal or non-critical findings that do not significantly impact the company’s security posture but are still important for awareness and improvement.
Info: Findings of a purely informational nature, providing basic insights without significant risk or impact on operations.

Example Findings:

A company lacks a detailed incident response plan despite being required to comply with SOC 2 standards.
The access control policies are overly restrictive and fail to accommodate necessary business functions during emergencies.

Ransomware Playbook Development

Purpose: The Ransomware Playbook Development Scanner evaluates the presence and quality of containment procedures and communication plans within a company’s security documentation to ensure readiness against ransomware attacks. It helps identify gaps in preparedness that could lead to prolonged recovery times and increased financial impact.

What It Detects:

Containment Procedures: Identifies specific steps outlined for isolating affected systems and preventing the spread of ransomware.
Communication Plans: Assesses the presence and clarity of communication strategies for internal teams, external stakeholders, and law enforcement during a ransomware incident.
Policy Indicators: Looks for references to security policies that address ransomware threats and response measures.
Maturity Indicators: Checks for compliance certifications and maturity models (e.g., SOC 2, ISO 27001) that indicate robust security practices.
Incident Response Documentation: Evaluates the availability and detail of incident response plans specifically addressing ransomware scenarios.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: This scanner is crucial as it helps organizations proactively prepare for and mitigate the impact of ransomware attacks, which can lead to significant financial losses, data breaches, and operational disruptions if not contained effectively.

Risk Levels:

Critical: Failures in containment procedures or lack of comprehensive communication plans that could hinder immediate response and recovery efforts.
High: Inadequate policy updates addressing ransomware threats or missing maturity indicators such as SOC 2 or ISO 27001 compliance, which may lead to increased vulnerability.
Medium: Partially covered containment procedures or incomplete communication strategies that might still allow for some level of ransomware spread before intervention.
Low: Minimal presence of relevant policies and documentation but no immediate risk identified in current operations.
Info: Presence of basic security practices without specific focus on ransomware, which is generally considered informational regarding the primary purpose of the scanner.

Example Findings:

A company lacks a detailed incident response plan specifically addressing ransomware scenarios, posing a critical risk as it could lead to ineffective recovery efforts in case of an attack.
Insufficient communication channels are defined for internal teams and external stakeholders during a ransomware incident, resulting in potential delays in information sharing and coordination, which is rated high due to its impact on response speed.

Backup Verification

Purpose: Ensures the completeness and reliability of backup systems by detecting gaps in backup coverage and verifying the feasibility of data restoration processes. Inadequate backups can lead to significant data loss during ransomware attacks, hindering recovery efforts.

What It Detects:

Backup Policy Compliance: Checks for the presence of a comprehensive backup policy and verifies that it includes regular backup schedules and retention policies.
Data Coverage Verification: Identifies critical data sets mentioned in the security documentation and ensures these are included in the backup strategy.
Restoration Testing Documentation: Looks for evidence of periodic restoration testing, validating that tests cover various scenarios including full system recovery and partial data restores.
Compliance Certifications: Searches for references to compliance certifications such as ISO 27001 or SOC 2, ensuring these are relevant to backup and disaster recovery processes.
Incident Response Plan Inclusion: Checks if the incident response plan includes procedures for data restoration, specifically addressing potential ransomware attack scenarios.

Inputs Required:

domain (string): Primary domain to analyze (e.g., acme.com)
company_name (string): Company name for statement searching (e.g., “Acme Corporation”)

Business Impact: Ensuring robust backup and disaster recovery processes is crucial as it directly impacts the ability to recover from ransomware attacks, minimizing potential data loss and operational disruption.

Risk Levels:

Critical: Inadequate or non-existent backup policies that do not include regular backups or retention policies. Lack of comprehensive incident response plans specifically addressing ransomware scenarios.
High: Partial coverage in backup strategies for critical data sets, insufficient restoration testing leading to potential gaps in recovery capabilities.
Medium: Policies exist but are lacking details such as specific schedules or detailed test scenarios. Missing compliance certifications that could enhance trust and security posture.
Low: Minor deviations from recommended practices with minor impact on overall risk if not addressed immediately.
Info: General statements about backup procedures without concrete evidence of implementation or testing, generally having minimal direct impact unless exacerbated by other factors.

Example Findings:

“The company’s backup policy lacks a detailed schedule for quarterly backups and does not specify retention periods beyond the standard legal requirements.”
“There are no documented restoration tests that cover the full system recovery from a ransomware attack, only partial data restore scenarios have been performed.”

This structured documentation provides a clear understanding of the scanner’s purpose, what it detects, the critical inputs needed for analysis, and potential risk levels based on findings.