When a business nearby gets hit with ransomware, the owners down the street all ask the same thing within a day: could that happen to us? Most don’t know. Your client probably expects you to have a view, even though you are not their IT department.
You don’t need a view. You need five questions and the ability to tell a real answer from a hopeful one.
Start With What They Share
The first useful fact about a nearby incident is whether your client shares anything with the company that was hit: the same IT provider, the same software vendor, the same remote access tool. The federal agencies behind CISA’s joint ransomware guidance note that managed service providers have been an infection route for ransomware affecting many of their clients. A neighbor’s bad week matters most when the neighbor and your client use the same outside help.
Five Questions to Ask This Week
- Do we use the same IT provider, software vendor, or remote access tool as the company that was hit? A good answer names the vendors and confirms by phone or in writing that day. “I’m not sure” is the answer to chase.
- If our systems went dark on Monday morning, how would we run the business, and where are our backups? CISA recommends keeping backups offline and testing them regularly, because many ransomware variants look for backups they can reach and delete or encrypt them. A good answer says where the backups live and when someone last restored from them.
- Does everyone who uses email or logs in remotely need a second step to sign in? CISA calls for multifactor authentication on email, VPNs, and accounts that reach critical systems. A good answer is “yes, everyone.” Hear “most people” as a gap.
- If email were down or untrusted, how would leadership reach each other, and is the plan on paper? CISA advises keeping a hard copy and an offline version of the incident plan, and using phone calls rather than email during an incident so the attackers don’t learn they’ve been spotted. A good answer includes a call list and a named person in charge.
- Who do we call first, and does our cyber insurance policy name a number? CISA’s contact table lists the insurer alongside the IT team and security providers. A good answer names who holds the policy and where the number is.
What You Don’t Need to Do
You don’t need to understand how any of this works, and your client doesn’t expect you to. Ask the questions, then listen for specifics: a name, a date, a place. If the answers are all “I think so,” that is the finding, and it is worth a conversation with someone who does this work.
Line for the Email
General version (default for “general advisors”):
“Given what happened to a company near us, I’m asking my clients five questions this week: whether we share a vendor with them, where our backups are and whether anyone has tested them, whether email and remote logins need a second sign-in step, how we’d reach each other if email were down, and who we’d call first. If any answer is ‘I think so,’ let’s talk, and I can introduce you to people who do this work.”
Banker variant:
“Before anyone else asks, call me first if you get a ransom note or a payment request you didn’t expect, because wires route through us. And if you can’t answer these five questions, let’s talk now rather than after.”
CPA variant (no first-call claim):
“If you can’t answer these five questions, loop me in before you close the loop with your IT provider, so I can help you find people who check them properly.”
References
- CISA, FBI, NSA, and MS-ISAC, #StopRansomware Guide (September 2023 version, as listed on the CISA page): https://www.cisa.gov/stopransomware/ransomware-guide
- CISA, I’ve Been Hit By Ransomware!: https://www.cisa.gov/stopransomware/ive-been-hit-ransomware