Chronology of a response

The chronology

Industrial company, 2,800 staff, six sites. Detection on a Sunday at 04:12.

The three decisions

Decision 1 — Isolate

The trade-off: isolating stops propagation but destroys in-memory evidence and interrupts services that are still healthy.

The rule: isolate first. Encryption in progress spreads to several thousand machines an hour; in-memory evidence is useful to the investigation, not to survival. Forensics can work on snapshots taken before the cut if the tooling allows.

To prepare in advance: the isolation procedure must exist, be tested, and be executable without the directory — since the directory may be compromised.

Decision 2 — The backup

The 05:40 finding is the most frequent and the most decisive: the backup console sits in the compromised domain, so it is unusable or itself encrypted.

This is where the difference is made between recovery in days and rebuilding in weeks. An organisation holding an immutable or offline copy, administered outside the domain, still has an option. The other has none.

Decision 3 — Shut production down

The trade-off: a service that keeps running may be exfiltrating data or silently encrypting. A stopped service costs immediately.

The criterion: if the directory is compromised, no authentication is trustworthy any more. Continuing means operating a system whose access you no longer control.

The restoration point

The choice is a trade-off between two losses:

• Restoring closest to the incident minimises data loss but risks reintroducing the attacker's implant, often present for weeks;
• Restoring further back guarantees a clean state but loses more work.

The data that settles it is the date of initial compromise, established by investigation. Without it, any restoration is a gamble. That is why retaining logs for a sufficient period — often six to twelve months — is a resilience investment, not an abstract compliance requirement.

Notifications

An incident of this kind usually triggers several simultaneous obligations: notification to the sectoral authority, personal data breach notification if exfiltration is likely, informing affected clients, filing a criminal complaint.

These streams have different deadlines and do not substitute for each other. The obligations table must be in the plan, not reconstructed at 10 a.m. by somebody who has not slept.