tegwick
d011073e16
Expand AssetRegister and DataRegister with T0/T4 stack assets. Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five incident playbooks. Update README with mirror status. Mark T02-T05, T07-T08 done; T01 and T06 in progress.
27 lines
No EOL
1.7 KiB
Markdown
27 lines
No EOL
1.7 KiB
Markdown
# Playbook: Ransomware / Hostile Access
|
|
|
|
**Triggers:** suspicious encryption, unknown admin sessions, altered repos, exfiltration indicators.
|
|
**Tier:** L2 / I5 — treat as breach until proven otherwise.
|
|
|
|
## Steps
|
|
|
|
1. **Isolate** — disconnect affected hosts from network; disable compromised accounts; preserve VM/disk snapshots for evidence.
|
|
2. **Preserve evidence** — do not wipe logs; capture auth logs, k8s audit, Gitea/Forgejo access logs, firewall logs.
|
|
3. **Revoke credentials** — rotate all tokens/passwords that may be exposed: OpenBao, Stripe, API keys, backup tokens, Gitea/Forgejo admin, SSH certs.
|
|
4. **Assess backup integrity** — verify offsite backups (Nextcloud) were not deleted; check `.last-backup` stamps; assume on-node backups on compromised host are untrusted.
|
|
5. **Build clean environment** — new machines; fresh OS; Ansible from known-good Git refs. **Never restore into compromised host.**
|
|
6. **Restore known-good data** — from backups timestamped **before** compromise; age-decrypt from offsite only.
|
|
7. **Rotate all secrets** — full rotation, not selective; update OpenBao paths; re-issue `warden` certs.
|
|
8. **Force resets** — user sessions, MFA re-enrollment where applicable.
|
|
9. **Validate** — smoke tests; compare restored repos against known-good SHAs.
|
|
10. **Document** — State Hub progress event; `TestEvidence/` incident note; update `AssetRegister.yaml` if exposure changed posture.
|
|
|
|
## Do not
|
|
|
|
- Pay ransom without executive decision recorded.
|
|
- Restore production DB over live data without identifying last good point.
|
|
- Paste secrets into incident notes.
|
|
|
|
## References
|
|
|
|
`BackupPolicy.md` §8 · `RestoreRunbooks/01-full-server-loss.md` · `PanicSheet.md` §4 |