[F]Unicorn Ransomware

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup.

To reduce the likelihood of infection by ransomware, NHS Digital advises that:

• Secure configurations are applied to all devices.
• Security updates are applied at the earliest opportunity.
• Tamper protection settings in security products are enabled where available.
• Obsolete platforms are segregated from the rest of the network.
• IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
• Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
• Administrative accounts are only used for necessary purposes.
• Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
• Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

To limit the impact of a ransomware infection, NHS Digital advises that:

• Critical data is frequently saved in multiple backup locations.
• At least one backup is kept offline at any time (separated from live systems).
• Backups and incident recovery plans are tested to ensure that data can be restored when needed.
• User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
• Infected systems are disconnected from the network and powered down as soon as practicable.
• Any user account credentials that may have been compromised should be reset on a clean device.
• Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.