SP 1800-26Final2020

Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events

At a glanceA practice guide on the 'during' phase of ransomware and other destructive attacks: spotting, containing and limiting damage to databases, files and configurations as an attack happens. Volume A gives leaders the overview; the other volumes are for technical staff.

Reading level: Technical
Length: about 40 min for the key parts
Best for: IT staff and service partners, Technology directors
CSF 2.0: Detect, Respond

Read it on NIST DOI 10.6028/NIST.SP.1800-26 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

NIST's National Cybersecurity Center of Excellence built and tested candidate tool sets and response strategies with industry collaborators. The guide follows the standard SP 1800 three-volume layout.

How it is organized

Volume A: executive summary
Volume B: approach, architecture and security characteristics
Volume C: how-to guides

What a school district should take from it

Fast containment depends on knowing in advance who can isolate systems and how.
Integrity monitoring helps show what changed, which speeds recovery.

How to use it in your district

Document how to isolate a server, a building network and a cloud account quickly.
Practice containment steps in a tabletop exercise.
Compare your detection coverage with the capabilities in Volume B.

Common misconceptions

Detection is only about preventing the attack.: Detecting early limits how much must be restored afterward.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

DE.CMContinuous Monitoring
DE.AEAdverse Event Analysis
RS.MAIncident Management
RS.MIIncident Mitigation

Tools in the program portal

Tabletop exercisesRun a scenario and capture after-action improvements
Incident respondersLine up outside response help before you need it
Incident DeskDeclare an incident and track reporting clocks

Related publications

SP 1800-25Ransomware: identify and protect
SP 1800-11Ransomware: recover
IR 8374 Rev. 1Ransomware risk management profile

Citation and source

SP 1800-26, Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events. National Institute of Standards and Technology. 2020. https://doi.org/10.6028/NIST.SP.1800-26.

Topics: Ransomware, Logging and detection, Incident response. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.