On an employee's PC, file extensions start changing one after another and a screen demanding a ransom appears. What is the most appropriate first action for this employee?

Answer: A. Disconnect the PC from the network, for example by unplugging the LAN cable and turning off wireless LAN, record what is on screen and other details, and immediately report to the designated contact point (such as the CSIRT)

When ransomware infection is suspected, first disconnect the PC from the network so that damage does not spread to other PCs or file servers. Then record the screen shown, the time it was noticed, the emails or files opened just before and so on, and promptly report to the contact point designated by the organization (the CSIRT or IT department). Whether to turn off the power should follow the organization's procedures or the contact point's instructions, since clues for investigation in memory can be lost. Wiping immediately destroys the clues (logs and traces in files) needed to find the intrusion route and what else was stolen, leaving the risk of another intrusion through the same route. Delaying the report lets the damage spread in the meantime. Because an investigation reconstructs what happened in chronological order by matching logs from each device, it is important in normal times to keep the clocks of all devices synchronized (with NTP, for example) and to keep logs for a set period in a separate place where they are hard to tamper with.

• A. Correct. Stop the damage from spreading, record the situation and report immediately to the designated contact point.
• B. Wiping immediately destroys the clues for tracing the intrusion route and similar, leaving a risk of another intrusion with the cause still unknown.
• C. Trying to handle it alone delays the report, and the damage may spread within the organization in the meantime.