Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If ransomware may have reached your cloud environment, do not begin by deleting encrypted files or shutting down every server. Activate your approved incident-response plan, move communications off potentially monitored channels, isolate affected systems, preserve logs and volatile evidence, then investigate identity compromise before rebuilding and restoring services.
This checklist follows the response sequence in CISA’s joint #StopRansomware Guide. It is designed for IT and security teams coordinating an organizational response; provider consoles, legal duties and notification deadlines still require separate review.
What to do in the first hour
Use the sequence below as an operating order, not as a substitute for your organization’s approved plan. Assign an incident commander, a technical lead, a communications lead and a business decision-maker. Record decisions and timestamps in a location that the suspected attacker cannot alter.
Recommended Free Tools
- Declare the incident under your response plan. Open the incident record, identify decision authority and contact your response, legal, insurance and managed-security resources listed in the plan.
- Switch to trusted communications. Use phone calls or another out-of-band channel for sensitive coordination if email, chat or single sign-on accounts may be monitored.
- Identify the blast radius. Determine which cloud accounts, subscriptions, projects, regions, workloads, storage locations and identities show encryption, deletion, unusual access or extortion activity.
- Isolate affected systems. Remove compromised hosts and services from network paths and revoke the access that enables continued changes. Do not destroy evidence while doing so.
- Preserve evidence and telemetry. Capture cloud and network logs, endpoint data, identity events and volume snapshots where feasible, especially data with short retention or volatile characteristics.
- Protect the recovery path. Separate clean administration, backup and recovery systems from the suspected environment before attempting restoration.
CISA’s response checklist puts the first technical priority plainly: “Determine which systems were impacted, and immediately isolate them.” The same guide warns that visible containment actions can prompt an attacker to react, which is why coordination and trusted communications matter.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
1. Activate the incident and communications plans
Use the approved chain of command
Ransomware response involves more than the team that sees an encrypted volume. Bring in security operations, cloud administrators, identity administrators, infrastructure owners, business continuity leaders, legal counsel, privacy staff and executive decision-makers according to the plan. If the organization has a cyber-insurance or incident-response retainer, use the contact and evidence-handling procedures already agreed to.
Coordinate before making noisy changes
Mass password resets, disabling an identity provider or taking a shared network offline can stop an intrusion, but can also destroy evidence or cut off responders. The incident commander should approve the order and scope of disruptive actions. Keep a contemporaneous log of who authorized each action, what changed and what the team observed afterward.
Assume ordinary channels may be observed
An attacker with access to mailboxes, collaboration tools or single sign-on can watch containment plans. Use phone calls or another trusted out-of-band method for sensitive instructions until those services are assessed. Do not publish detailed containment steps in a channel that compromised accounts can read.
2. Identify and isolate affected cloud systems
Map the affected scope
Start with observable indicators: ransom notes, changed file extensions, failed or mass encryption operations, deleted snapshots, unusual storage API calls, new administrator accounts, disabled logging, suspicious regions and unexpected outbound traffic. Map each finding to an account, project or subscription, region, workload, storage resource and identity. Include development, backup and management accounts; attackers often use trusted paths rather than touching only the first encrypted server.
Choose containment actions that preserve evidence
Depending on the environment and your plan, containment can include removing a compromised instance from load balancers, restricting security-group or firewall paths, quarantining an endpoint, disabling a stolen access key, suspending a workload identity or blocking a malicious egress destination. Apply the narrowest control that stops continued access while investigators collect evidence.
When a broad outage is necessary
If multiple systems or subnets are affected, CISA says taking a network offline at the switch level may be necessary. In cloud environments, an equivalent broad restriction may involve isolating a virtual network, account or project. Treat that as a deliberate business-impact decision: preserve an emergency management path for responders, document the scope and verify that backup and logging services are not being cut off accidentally.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
Capture cloud volume snapshots when feasible
Take snapshots of affected volumes for later forensic review when your provider and response plan support it. Record the snapshot identifier, time, region, source volume and chain of custody. A snapshot is evidence, not proof that a system is clean; preserve it before remediation changes the disk state.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →3. Preserve evidence and inspect telemetry
Collect the data that disappears fastest
Preserve volatile or short-retention evidence first: memory or endpoint collections where available, active process and network information, identity-provider events, cloud control-plane logs, object-access logs, firewall and DNS records, intrusion-detection alerts and administrative audit trails. Export or copy data to a protected location with restricted write access. Note the time zone and clock source used for every collection.
Do not power down by default
Avoid powering down affected systems unless other disconnection options are unavailable. Shutdown can destroy volatile-memory evidence and alter timestamps. If an emergency power-off is required to stop destructive activity, record who made the decision, why it was necessary and what evidence was collected first.
Look backward, not only at encrypted data
Review endpoint and intrusion-detection or prevention tools for the earliest suspicious activity. Correlate cloud audit events with identity, VPN, remote-access, email and network logs to find the initial compromise and any additional systems. Preserve logs from services with short retention before routine rotation removes them.
4. Find initial access, stolen credentials and persistence
Investigate identities as aggressively as hosts
List every account, role, service principal, API key, token and email identity used on affected resources. Look for impossible travel, new access keys, unfamiliar locations, privilege changes, newly trusted devices, consent grants, mailbox rules and authentication-method changes. A clean-looking server can still be controlled through a stolen administrator session.
Contain continued access
Based on evidence and the approved plan, disable or rotate compromised credentials, revoke active sessions, remove unauthorized keys and review federation or single sign-on trust. Containment may require disabling VPNs, remote-access services, single sign-on resources or public-facing assets. Sequence these actions so responders do not lock themselves out of clean management accounts.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Check persistence and lateral movement
Search for scheduled tasks, startup scripts, unauthorized cloud functions, modified deployment pipelines, backdoored images, altered firewall rules, new DNS records and changes to backup policies. Examine cross-account roles and service-to-service permissions. Ransomware operators may retain access for extortion or reinfection even after the obvious encryption stops.
5. Decide what can be trusted before rebuilding
Do not treat an online backup, a recent machine image or an untouched region as clean merely because it was not encrypted. Verify when each copy was created, which identities could modify or delete it, whether its logs show suspicious access and whether it contains persistence. Keep clean recovery systems separated from the compromised environment so they cannot be reinfected.
Use standard images and infrastructure as code
Rebuild from maintained golden images where possible. Recreate cloud resources from reviewed infrastructure-as-code templates rather than copying unknown configuration from compromised systems. Keep template backups offline, store code in version control, require review for changes and audit the history before using it for recovery.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Reset secrets and address vulnerabilities
After the environment is cleaned and rebuilt, reset affected passwords and credentials, remove persistence, patch exploited vulnerabilities and review privileged access. Update customer-managed encryption keys when the response plan and evidence indicate key exposure or when rebuilding requires new trust boundaries. Coordinate key changes with application owners so encrypted data is not made unrecoverable.
6. Restore services in business-priority order
Use a critical-asset and dependency list
Restore according to a predefined list of critical services and their dependencies, not according to which server is easiest to recover. Identify identity, DNS, networking, databases, storage, security tooling and application tiers that must come online in a safe order. Record recovery objectives and validation owners for each service.
Restore from tested offline, encrypted backups
CISA recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster-recovery scenario. Backups that remain reachable by compromised production identities may also be reachable by ransomware. Before importing data, scan the recovery source, verify its creation time and integrity evidence, and confirm that its administration account is separate from production.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Validate each tier before opening access
Bring up the clean management plane first, then foundational services, data stores and applications. Test authentication, authorization, network boundaries, logging, backup jobs and monitoring at every stage. Keep restored systems isolated until owners confirm that expected files, records, integrations and security controls work. Reconnect user and public access gradually, watching for renewed encryption or anomalous calls.
Cloud recovery design choices
When reviewing or redesigning recovery, compare options using the same operational criteria rather than assuming that a storage feature alone makes a backup safe.
| Decision axis | Questions to answer | Risk to document |
|---|---|---|
| Offline versus online access | Can compromised production identities reach, alter or delete the copy? | Online copies are easier to restore but easier for ransomware to reach. |
| Identity and account separation | Are backup administration and recovery accounts separate from production? | A shared administrator path can turn one stolen credential into total loss. |
| Restore-test evidence | When was the last full restore test, and what recovery time did it demonstrate? | An untested backup may be incomplete, corrupted or operationally unusable. |
| Immutability and deletion protection | Can retention locks, object lock or delete protection resist the threat model? | Misconfiguration can create exposure or significant cost; immutable storage may not satisfy every regulatory requirement. |
| Regulatory fit | Do retention, location, encryption and access controls meet applicable obligations? | A technically recoverable copy can still violate legal or contractual requirements. |
| Provider concentration | Would compromise of one cloud account or vendor remove both production and recovery? | A multi-cloud or cloud-to-cloud arrangement can reduce concentration risk but adds design and operating complexity. |
Cloud controls to prepare before an incident
Logging and abnormal-use alerts
Enable control-plane, identity, network and storage logging, define retention that matches investigative needs and alert on unusual administrator use, mass deletion, encryption-key changes, logging changes, new regions and large-scale object access. Send security logs to a protected destination that production administrators cannot silently rewrite.
Delete protection and versioning
Consider delete protection or object lock for critical storage resources. Versioning can preserve earlier object variants after malicious or accidental changes. Test how these controls behave during a real restore, including who can remove a retention lock and how costs grow as versions accumulate.
Shared responsibility
Document which controls the cloud provider operates and which your organization must configure. Provider-managed physical security does not remove your responsibility for identities, permissions, data, logging, backup policy or recovery testing. Exact console procedures differ by provider and service, so use the relevant provider’s current official documentation rather than applying a universal click path.
Golden images and recovery templates
Maintain known-good images, dependency maps and infrastructure-as-code templates outside the primary failure domain. Version-control the code, review changes, audit who can publish images and periodically deploy a test environment from the stored artifacts. This turns rebuilding into a repeatable operation instead of an improvised reconstruction.
Common mistakes that make cloud ransomware worse
- Shutting everything down immediately: this can destroy volatile evidence and remove the visibility responders need.
- Resetting credentials without sequencing: responders may lose access to clean management paths while an attacker retains another session or key.
- Restoring directly into the compromised account: hidden persistence, altered permissions or reachable backup identities can reinfect the recovery.
- Trusting the newest backup automatically: the newest copy may contain encrypted data, attacker changes or corrupted metadata.
- Relying on immutability alone: retention settings can be misconfigured, costly or unsuitable for a regulatory requirement.
- Ignoring business dependencies: restoring an application without identity, DNS, databases or integrations produces an apparent recovery that users cannot operate.
- Discussing containment in monitored channels: exposed plans can help an attacker evade isolation or destroy evidence.
Communications, notifications and the post-incident review
Preserve a factual timeline of detections, containment decisions, evidence collections, rebuilds and validation results. Communications and legal teams should determine which customers, regulators, insurers, law-enforcement contacts and contractual partners require notice; the applicable duties depend on jurisdiction, sector, data involved and contractual terms. The CISA guide is a response framework, not a substitute for advice from counsel or a regulator.
After services stabilize, conduct a formal review. Identify the initial access path, the permissions that enabled spread, the controls that delayed detection, the backups that were or were not usable and the decisions that increased downtime. Update the incident-response and communications plans, recovery priorities, logging retention, identity controls and exercises. Run another restore test after changes so the documented process reflects what the team can actually perform.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
