How and what to do with CSIRT-led ransomware exercises

Translated from 日本語 • View original

菊池

Hello, I'm Kikuchi, an analyst at Colorkrew Security. In recent years, cyberattacks have become increasingly sophisticated, and it is impossible to prevent intrusions 100%. The important thing is "how quickly can it be detected after an intrusion and respond appropriately?" To do this, it is essential to enhance the responsiveness of the entire organization through practical exercises, not just on paper. In this article, we'll show you how to proceed with a CSIRT-led ransomware exercise.

Purpose of the exercise

Enhanced detection: Can abnormal behavior be detected early?
Verify responsiveness: Is the incident response procedure working?
Check the linkage: Is the CSIRT working well with the IT department, management, public relations, etc.
Identify areas for improvement: Identify issues after the exercise and connect them to the next measure.
BCP in practice: Try to recover from backups and verify the effectiveness of your business continuity plan (BCP)

Points for Scenario Creation

Assuming realistic cases
- Example: Infection from an email attachment received by an employee
- Example: VPN credentials leaked and infiltrated from the outside
Progressing step by step
- Initial intrusion → lateral deployment → encryption → ransom demand
Use pseudo-malware and simulation tools for exercises
- No actual malware, instead scripts that simulate file encryption or "dummy files that notify you of infection"

Building a Regime

CSIRT leads the exercise
Division of roles for participants
- Attacking side (red team)
- Defenders (Blue Team)
- Observer and evaluation role (white team)
Participation of the Information Systems Department (or department managers)
- Try the recovery procedure from a backup in practice
- Validate recovery times and procedures
Involve management and public relations
- Assuming actual crisis response, we also check the flow of decision-making and external announcements.

Determine the output

Exercise Report
- Time required for each step
- Timing of detection and response
- Improvements and Reflections
Checklist
- Use it for next exercise or actual incident response

Example of a detailed procedure list

Scenario Explanation (10 minutes)
Initial Intrusion Mock Execution (20 minutes)
Detection phase (30 minutes)
Response phase (40 minutes)
Recovery from backup exercise (40 minutes)
Presentation exercise to management (20 minutes)
Reflection and reflection meeting (30 minutes)

Record the time required, the quality of the response, and the improvement points for each item.

Ideas to Start Without Real Malware

Mock encryption script: Set the file name to "LOCKED_〇〇. txt"
Dummy Infected Files: Automatically generate the text "Infected" in a specific folder
System log pseudo-generation: Simulate suspicious login attempts and abnormal communications
Desk exercises: No technical execution, scenarios on paper or whiteboard
Using Eicar : Download the Eicar file and actually generate an alert from the EDR.
Fileless : Execute external communication commands by Powershell to verify whether fileless attacks are detected.

Conclusion

The key to CSIRT-led ransomware exercises is to conduct them in a "close to reality but secure environment." By defining objectives, realistically designing scenarios, and defining structures and outputs, the exercise becomes not just a training but a place to cultivate an organization's security culture. In addition, the ability to verify the effectiveness of BCP by incorporating recovery from backups is a great value.