coulomb/disaster-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
disaster-control/IncidentPlaybooks/ransomware.md
tegwick d011073e16 Start DISCTL-WP-0002: policies, registers, runbooks, playbooks 
Expand AssetRegister and DataRegister with T0/T4 stack assets.
Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five
incident playbooks. Update README with mirror status. Mark T02-T05,
T07-T08 done; T01 and T06 in progress.
2026-07-07 20:04:54 +02:00

1.7 KiB
Raw Blame History

Playbook: Ransomware / Hostile Access

Triggers: suspicious encryption, unknown admin sessions, altered repos, exfiltration indicators.
Tier: L2 / I5 — treat as breach until proven otherwise.

Steps

  1. Isolate — disconnect affected hosts from network; disable compromised accounts; preserve VM/disk snapshots for evidence.
  2. Preserve evidence — do not wipe logs; capture auth logs, k8s audit, Gitea/Forgejo access logs, firewall logs.
  3. Revoke credentials — rotate all tokens/passwords that may be exposed: OpenBao, Stripe, API keys, backup tokens, Gitea/Forgejo admin, SSH certs.
  4. Assess backup integrity — verify offsite backups (Nextcloud) were not deleted; check .last-backup stamps; assume on-node backups on compromised host are untrusted.
  5. Build clean environment — new machines; fresh OS; Ansible from known-good Git refs. Never restore into compromised host.
  6. Restore known-good data — from backups timestamped before compromise; age-decrypt from offsite only.
  7. Rotate all secrets — full rotation, not selective; update OpenBao paths; re-issue warden certs.
  8. Force resets — user sessions, MFA re-enrollment where applicable.
  9. Validate — smoke tests; compare restored repos against known-good SHAs.
  10. Document — State Hub progress event; TestEvidence/ incident note; update AssetRegister.yaml if exposure changed posture.

Do not

  • Pay ransom without executive decision recorded.
  • Restore production DB over live data without identifying last good point.
  • Paste secrets into incident notes.

References

BackupPolicy.md §8 · RestoreRunbooks/01-full-server-loss.md · PanicSheet.md §4