Data Integrity Recovering from Ransomware and Other Destructive Events: NIST SP 1800-11c

by National Institute of Standards and Technology

Businesses face a near-constant threat of destructive malware, ransomware, malicious insider activities, and even honest mistakes that can alter or destroy critical data. These data corruption events could cause a significant loss to a company’s reputation, business operations, and bottom line. These types of adverse events, that ultimately impact data integrity, can compromise critical corporate information including emails, employee records, financial records, and customer data. It is imperative for organizations to recover quickly from a data integrity attack and trust the accuracy and precision of the recovered data. Organizations must be able to quickly recover from a data integrity attack and trust that any recovered data is accurate, complete, and free of malware. Data integrity attacks caused by unauthorized insertion, deletion, or modification of data have compromised corporate information including emails, employee records, financial records, and customer data. Some organizations have experienced systemic attacks that caused a temporary cessation of operations. One variant of a data integrity attack–ransomware–encrypts data and holds it hostage while the attacker demands payment for the decryption keys.

The National Cybersecurity Center of Excellence (NCCoE) at NIST built a laboratory environment to explore methods to effectively recover from a data corruption event in various Information Technology (IT) enterprise environments. NCCoE also implemented auditing and reporting IT system use to support incident recovery and investigations.

This NIST Cybersecurity Practice Guide demonstrates how organizations can implement technologies to take immediate action following a data corruption event. The example solution outlined in this guide encourages effective monitoring and detection of data corruption in standard, enterprise components as well as custom applications and data composed of open-source and commercially available components.

Why buy a book you can download for free?

First you gotta find a good clean (legible) copy and make sure it’s the latest version (not always easy). Some documents found on the web are missing some pages or the image quality is so poor, they are difficult to read. We look over each document carefully and replace poor quality images by going back to the original source document. We proof each document to make sure it’s all there – including all changes. If you find a good copy, you could print it using a network printer you share with 100 other people (typically its either out of paper or toner). If it’s just a 10-page document, no problem, but if it’s 250-pages, you will need to punch 3 holes in all those pages and put it in a 3-ring binder. Takes at least an hour.

It’s much more cost-effective to just order the latest version from Amazon.com

This book is published by 4th Watch Books and includes copyright material. We publish compact, tightly-bound, full-size books (8 ½ by 11 inches), with glossy covers. 4th Watch Books is a Service Disabled Veteran-Owned Small Business (SDVOSB). If you like the service we provide, please leave positive review on Amazon.com.

For more titles published by 4th Watch Books, please cybah.webplus.net

A full copy of all the pertinent cybersecurity standards is available on DVD-ROM in the CyberSecurity Standards Library disc which is available at Amazon.com.

NIST SP 800-31 Intrusion Detection Systems

NIST SP 800-35 Guide to Information Technology Security Services

NIST SP 800-39 Managing Information Security Risk

NIST SP 800-40 Guide to Enterprise Patch Management Technologies

NIST SP 800-41 Guidelines on Firewalls and Firewall Policy

NIST SP 800-47 Security Guide for Interconnecting Information Technology Systems

NIST SP 800-61 Computer Security Incident Handling Guide

392 pages, Paperback

Published September 12, 2017