The First 72 Hours of Ransomware: Why 'Restored Isn't Recovered' Changes Your Incident Response Plan

The moment backups are restored and systems come back online is not the moment the incident is over. It’s the moment the second, longer phase of the incident begins.

“Restoring the servers gets the technology running again. Recovering the business requires much more.” That framing from Datadog’s 72-hour framework is the most useful shift in how to think about ransomware response planning — and it has direct implications for how you staff, instrument, and structure the first three days.

Day 1: Contain and Understand

Declare emergency and activate the incident response plan. The first hours are about scope, not remediation. Engage forensic partners immediately to determine how wide the breach is before making any decisions about what to restore. Restoring an infected system from a clean backup before fully understanding the attack surface can reintroduce the compromise.

Secure crisis documentation. Architecture diagrams, runbooks, credential stores, access logs — ensure these are accessible in a clean environment, not on potentially compromised systems. Incident response that depends on infrastructure that may itself be compromised is unreliable at the worst possible moment.

Begin isolating affected systems while preserving evidence. The sequence matters: isolation before evidence preservation destroys forensic data. Both need to happen, but evidence comes first.

Day 2: Eliminate and Notify

Network isolation to prevent lateral movement. Once scope is understood, enforce network segmentation aggressively. Ransomware spreads during the window between initial compromise and full isolation — the goal is minimizing that window.

Review identity providers for unauthorized admin accounts. Attackers frequently create persistent access accounts during the dwell period before encryption begins. Identity review should treat all admin access as suspect until verified.

GDPR 72-hour notification window. For organizations with EU data subjects, the regulatory clock starts at discovery, not at the moment of encryption. Day 2 often requires beginning the notification process while the technical response is still underway — the compliance timeline and the technical timeline run in parallel.

Day 3: Restore in Order

Restore from clean backups in dependency order. “Dependency order” is the phrase most IR plans underspecify. Restoring an application before its database, or a database before its authentication system, creates cascading failures that lengthen recovery. Map the dependency graph before the incident, not during it.

Validate restored data and system functionality. Restoration from backup is not the same as recovery. Each restored system requires validation that the data is intact, the application functions correctly, and integrations with dependent systems are healthy.

Address business backlogs. The transaction queue, the support ticket backlog, the customer communications, the manually deferred work — this is the recovery phase that organizations underplan for. Technical recovery can complete while business recovery lags by days or weeks.

Datadog’s Role: Detection Before Spread

Datadog’s 72-hour framework emphasizes that the investigation tooling matters most before the encryption begins, not after. Cloud SIEM capabilities reduce detection time by combining related signals, risk-scoring entities, and mapping activity to MITRE ATT&CK frameworks in real time.

The Bits Security Analyst automatically reviews logs and historical signals to flag suspicious activity — behavioral drift from baseline that might not trigger a signature-based alert but indicates early-stage attacker activity. Bits Threat Hunting enables hypothesis-driven investigation without requiring preexisting detection rules, which matters for novel attack patterns.

The pattern Datadog identifies: ransomware incidents are detectable earlier than most organizations discover them. The gap between initial compromise and encryption ranges from hours to weeks. Better detection instrumentation during that dwell period is more valuable than optimized restoration procedures after the encryption event.

Source: Datadog

Content created with AI assistance and reviewed for accuracy.