{"id":8714,"date":"2023-12-05T01:00:23","date_gmt":"2023-12-05T09:00:23","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=8714"},"modified":"2023-12-06T10:34:04","modified_gmt":"2023-12-06T18:34:04","slug":"why-microsoft-uses-a-playbook-to-guard-against-ransomware","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/","title":{"rendered":"Why Microsoft uses a playbook to guard against ransomware"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"alignright wp-image-7436 size-medium\" style=\"margin-top: 0px;\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/ms-digital-stories-300x122.png\" alt=\"Microsoft Digital stories\" width=\"300\" height=\"122\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/ms-digital-stories-300x122.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/ms-digital-stories.png 400w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/>When Microsoft\u2019s Digital Security and Resilience (DSR) division set out to defend the company against human-operated ransomware, it faced several formidable challenges. In this form of ransomware, highly organized and sophisticated attacks by cybercriminals put major businesses, healthcare organizations, universities, and governments in their crosshairs for their visibility and potential payout. Human operated ransomware\u2019s targeted strategy requires a holistic and comprehensive response, which comes in the form of the Ransomware Elimination Program (REP), our centralized and collaborative cross-company effort.<\/p>\n<blockquote class=\"quote-body\"><p>Attackers are more focused and targeted, they\u2019re on a mission. It\u2019s not a phishing email that spreads out to a bunch of random addresses and hopes someone clicks. That only nets you random targets. Human-operated ransomware aims for an enterprise and tries for big returns.<\/p>\n<p class=\"source\">\u2014Henry Duncan, senior security program manager, Digital Security and Resilience<\/p>\n<\/blockquote>\n<p>As we discussed <a href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/sharing-how-microsoft-protects-against-ransomware\/\">in our previous ransomware post<\/a>, REP was purpose-built atop the philosophy of <a href=\"https:\/\/aka.ms\/ZTatMSFT\">the philosophy of Zero Trust<\/a> to give Microsoft a way to centralize defense, recovery, and resilience against ever changing cyberthreats. Core to the program is the ransomware playbook, our internal guide to ensure teams across the company take the right action to respond, recover, and remediate in the event of an attack. Adherence to the playbook limits the opportunity for attacks and minimizes the potential reward that criminals seek.<\/p>\n<p>\u201cAttackers are more focused and targeted, they\u2019re on a mission,\u201d says Henry Duncan, a senior security program manager on REP, part of DSR, the team responsible with protecting our enterprise so that we can deliver and operate secure products and services to our customers. \u201cIt\u2019s not a phishing email that spreads out to a bunch of random addresses and hopes someone clicks. That only nets you random targets. Human-operated ransomware aims for an enterprise and tries for big returns.\u201d<\/p>\n<p>The longer threat actors are active in an environment and can move around, the greater the risk to the target. Each passing moment presents an opportunity to acquire more access to data through compromised accounts, or tamper with security and backup systems\u2014and that means a higher likelihood of data being compromised and a larger ransom demand. Time is of the essence.<\/p>\n<p><em>[<a href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/sharing-how-microsoft-protects-against-ransomware\/\">Read blog one in our ransomware series: Sharing how Microsoft protects against ransomware.<\/a> | <a href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/building-an-anti-ransomware-program-at-microsoft-focused-on-an-optimal-ransomware-resiliency-state\/\">Read blog three in our ransomware series: Building an anti-ransomware program at Microsoft focused on an Optimal Ransomware Resiliency State.<\/a> | <\/em><a href=\"https:\/\/docs.microsoft.com\/en-us\/security\/compass\/human-operated-ransomware\" target=\"_blank\" rel=\"noopener\"><em>Learn more about human-operated ransomware.<\/em><\/a><em> | <\/em><a href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/implementing-a-zero-trust-security-model-at-microsoft\"><em>Discover how Microsoft\u2019s Zero Trust effort keeps the company secure.<\/em><\/a><em>]<\/em><\/p>\n<h2><strong>Writing the<\/strong> book<strong> on ransomware<\/strong><\/h2>\n<p>When conceptualizing what it wanted the playbook to achieve, the REP team knew it needed to facilitate excellence in operational response readiness, have the flexibility and scope to address cyberattacks of any scale, and to align response processes across the company.<\/p>\n<p>\u201cWe needed the playbook to articulate and visualize what everyone\u2019s role in a process is,\u201d Duncan says. \u201cIt\u2019s not just a security thing; we have to get other teams involved, like legal, finance, and enterprise business continuity.\u201d<\/p>\n<p>Engaging with stakeholders from those organizations allowed the REP team to better understand the different methods used across the company to triage, contain, and escalate events. Such conversations and interviews were a vital learning opportunity, and when combined with industry and internal best practices, illuminated gaps and weaknesses and generated ideas to bridge them. Collaborative cross-team dialogue shaped the framework the team used to develop key processes, including what is used to recover critical services.<\/p>\n<p>With this information synthesized, the REP team began structuring the ransomware playbook around addressing these four key questions:<\/p>\n<ul class=\"c-list\">\n<li>How prepared are we for a cyber event?<\/li>\n<li>What controls are in place to detect and identify malicious activity in our environment?<\/li>\n<li>What is the appropriate response from various teams to contain and recover from threats?<\/li>\n<li>How should a post-incident and root-cause analysis be performed?<\/li>\n<\/ul>\n<p>The resulting document provides a unified and holistic response to cyberthreats for the company to use.<\/p>\n<h2>Walking the walk<\/h2>\n<p>\u201cFor a playbook to work, you need to test,\u201d Duncan says. \u201cIt\u2019s easy to think you\u2019ve captured everything on the page, but we need to see what happens in practice.\u201d<\/p>\n<p>Performing simulations for a variety of scenarios demonstrated what might happen if an attack were to occur at Microsoft.<\/p>\n<blockquote class=\"quote-body\"><p>It\u2019s hard to measure the significance and when to escalate events; are we talking about a handful of machines or a large critical system? Now we have processes to have a consistent plan for triaging and triggering events.<\/p>\n<p class=\"source\">\u2014Henry Duncan, senior security program manager, Digital Security and Resilience<\/p>\n<\/blockquote>\n<p>Security professionals and stakeholders were put to the test. Detection and prevention systems were put through the wringer. Backup and restore functions were reviewed, ensuring the resiliency and recovery precautions needed to circumvent the leverage of cybercriminals were in place.<\/p>\n<p>Not only did these live drills verify steps within the ransomware playbook, they also allowed the REP team to gather additional feedback, including ways to better categorize and triage ransomware.<\/p>\n<p>\u201cIt\u2019s hard to measure the significance and when to escalate events; are we talking about a handful of machines or a large critical system?\u201d Duncan says. \u201cNow we have processes to have a consistent plan for triaging and triggering events.\u201d<\/p>\n<p>Because ransomware continues to change, so must Microsoft\u2019s response. The playbook is a living document, updated with regular reviews of testing and stakeholder engagement, enabling it to stay current with the quickly changing tactics of threat actors.<\/p>\n<h2>The benefits of playing it by the book<\/h2>\n<p>While the primary function of the ransomware playbook is to ensure Security Operation Centers (SOCs) and engineering teams across Microsoft have a documented process for responding to and recovering from ransomware, the playbook\u2019s design has additional built-in benefits.<\/p>\n<figure id=\"attachment_8721\" aria-describedby=\"caption-attachment-8721\" style=\"width: 300px\" class=\"wp-caption alignleft\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-8721 size-medium\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_image001-300x295.jpg\" alt=\"Duncan smiles in a portrait photo.\" width=\"300\" height=\"295\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_image001-300x295.jpg 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_image001.jpg 600w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><figcaption id=\"caption-attachment-8721\" class=\"wp-caption-text\">Henry Duncan is a senior security program manager in Microsoft\u2019s Digital Security and Resilience division.<\/figcaption><\/figure>\n<p>For instance, its detail clearly outlines who is responsible for what, creates visibility at the appropriate time, and clarifies escalation. The right process owners get the right information at the right time.<\/p>\n<p>\u201cYou need visibility into how an event surfaces,\u201d Duncan says. \u201cNow we have a predictable mechanism to trigger incident response. Those definitions bring leadership into appropriate major events.\u201d<\/p>\n<p>In practice, Duncan and the REP team found the playbook to be a useful tool for continuous improvement. Regularly run internal tabletop exercises help DSR and the REP team measure Microsoft\u2019s ability to effectively respond to specific types of attacks. Simulations and tests provide vital opportunities to expose issues, refine internal processes, and close the gap in eliminating ransomware. In using the playbook, Microsoft isn\u2019t just more prepared against ransomware, but against security attacks in general.<\/p>\n<p>This also happens to make the ransomware playbook a valuable training tool. Its adoption across the company is essential to a successful and holistic response to an attack. With training, the knowledge of roles and responsibilities, combined with muscle memory of the right actions to take ensures those involved are ready when put on the spot.<\/p>\n<p>\u201cWe\u2019ve also found that teams love the playbook as an onboarding tool,\u201d Duncan says. \u201cAnyone who joins Microsoft can know what the expectations are and loop that into their training. They\u2019ll know how they fit into the ransomware equation.\u201d<\/p>\n<h2>There\u2019s a plan in place<\/h2>\n<p>Having the Ransomware Elimination Program along with the playbook gives teams across the company more visibility into the importance of ransomware. Microsoft now has a platform to share knowledge across organizations and centralize efforts to reduce the opportunity and reward for cybercriminals.<\/p>\n<blockquote class=\"quote-body\"><p>Human-operated ransomware is a full-time job for cybercriminals. None of us are perfect but being aware, having the right technology in place, and putting a plan in place reduces the likelihood and impact of an attack on the environment.<\/p>\n<p class=\"source\">\u2014Henry Duncan, senior security program manager, Digital Security and Resilience<\/p>\n<\/blockquote>\n<p>\u201cWe can champion how people protect the environment while also involving them to improve response procedures,\u201d Duncan says. \u201cREP is the frontline of what an optimal ransomware resilience state should look like. That\u2019s going to happen by working with different teams throughout Microsoft to research and understand the greatest risks.\u201d<\/p>\n<p>With a playbook at hand, there\u2019s more confidence than ever that Microsoft\u2019s people are prepared to detect and respond appropriately to malicious activity. The structure provided by REP and its playbook empowers Microsoft to capture important insights about its own resiliency, helping to drive future improvements. That\u2019s critical, especially as ransomware continues to evolve.<\/p>\n<p>\u201cHuman-operated ransomware is a full-time job for cybercriminals,\u201d Duncan says. \u201cNone of us are perfect but being aware, having the right technology in place, and putting a plan in place reduces the likelihood and impact of an attack on the environment.\u201d<\/p>\n<p>While the ransomware playbook is internal to Microsoft, the REP team is investigating the best way to share its learnings so others can build their own.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"74\" class=\"alignnone size-medium wp-image-7448\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/key-takeaways-300x74.png\" alt=\"Key Takeaways\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/key-takeaways-300x74.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/key-takeaways.png 500w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/p>\n<ul class=\"c-list\">\n<li>The ransomware playbook serves as a single source of truth for detecting, responding, and recovering to ransomware. It helps identify the strategy and preparation approach for resiliency<\/li>\n<li>Leverage your existing resources; you don\u2019t have to start from scratch when developing a ransomware playbook<\/li>\n<li>Invite stakeholders to participate in the development of your ransomware playbook. It will create a more comprehensive and inclusive document, and will improve adoption<\/li>\n<li>Clarity of documentation is essential. Be sure to define expectations, roles, and responsibilities. Create diagrams and process flows whenever possible<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"81\" class=\"alignnone size-medium wp-image-7482\" src=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/related_links-300x81.png\" alt=\"Related links\" srcset=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/related_links-300x81.png 300w, https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2021\/10\/related_links.png 500w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/p>\n<ul class=\"c-list\">\n<li><a href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/sharing-how-microsoft-protects-against-ransomware\/\">Read blog one in our ransomware series: Sharing how Microsoft protects against ransomware.<\/a><\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/building-an-anti-ransomware-program-at-microsoft-focused-on-an-optimal-ransomware-resiliency-state\/\">Read blog three in our ransomware series: Building an anti-ransomware program at Microsoft focused on an Optimal Ransomware Resiliency State.<\/a><\/li>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/security\/compass\/human-operated-ransomware\" target=\"_blank\" rel=\"noopener\">Learn more about human-operated ransomware.<\/a><\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/insidetrack\/implementing-a-zero-trust-security-model-at-microsoft\">Discover how Microsoft\u2019s Zero Trust effort keeps the company secure.<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>When Microsoft\u2019s Digital Security and Resilience (DSR) division set out to defend the company against human-operated ransomware, it faced several formidable challenges. In this form of ransomware, highly organized and sophisticated attacks by cybercriminals put major businesses, healthcare organizations, universities, and governments in their crosshairs for their visibility and potential payout. Human operated ransomware\u2019s targeted [&hellip;]<\/p>\n","protected":false},"author":80,"featured_media":8716,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"_hide_featured_on_single":false,"_show_featured_caption_on_single":true,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[95,419],"coauthors":[442],"class_list":["post-8714","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-security","tag-zero-trust","program-ms-digital-stories","m-blog-post"],"jetpack_publicize_connections":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Microsoft&#039;s Anti-Ransomware Playbook<\/title>\n<meta name=\"description\" content=\"Find out how Microsoft\u2019s Ransomware Elimination Program (REP) playbook guides teams to take the right action in the event of a human-operated attack.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft&#039;s Anti-Ransomware Playbook\" \/>\n<meta property=\"og:description\" content=\"Find out how Microsoft\u2019s Ransomware Elimination Program (REP) playbook guides teams to take the right action in the event of a human-operated attack.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"Inside Track Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-12-05T09:00:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-12-06T18:34:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2300\" \/>\n\t<meta property=\"og:image:height\" content=\"1293\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Josh Krenz\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Josh Krenz\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/\",\"name\":\"Microsoft's Anti-Ransomware Playbook\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg\",\"datePublished\":\"2023-12-05T09:00:23+00:00\",\"dateModified\":\"2023-12-06T18:34:04+00:00\",\"author\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/7324508b769f74142e6e1e73419840d3\"},\"description\":\"Find out how Microsoft\u2019s Ransomware Elimination Program (REP) playbook guides teams to take the right action in the event of a human-operated attack.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg\",\"width\":2300,\"height\":1293,\"caption\":\"Microsoft uses a playbook to help it fight ransomware.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why Microsoft uses a playbook to guard against ransomware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/\",\"name\":\"Inside Track Blog\",\"description\":\"How Microsoft does IT\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/7324508b769f74142e6e1e73419840d3\",\"name\":\"Josh Krenz\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/image\/b203e24b19a279b45e4eeccee1f84433\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/867ac57b48ab51650a4989aa144741dc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/867ac57b48ab51650a4989aa144741dc?s=96&d=mm&r=g\",\"caption\":\"Josh Krenz\"},\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/author\/jkrenz\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft's Anti-Ransomware Playbook","description":"Find out how Microsoft\u2019s Ransomware Elimination Program (REP) playbook guides teams to take the right action in the event of a human-operated attack.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/","og_locale":"en_US","og_type":"article","og_title":"Microsoft's Anti-Ransomware Playbook","og_description":"Find out how Microsoft\u2019s Ransomware Elimination Program (REP) playbook guides teams to take the right action in the event of a human-operated attack.","og_url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/","og_site_name":"Inside Track Blog","article_published_time":"2023-12-05T09:00:23+00:00","article_modified_time":"2023-12-06T18:34:04+00:00","og_image":[{"width":2300,"height":1293,"url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg","type":"image\/jpeg"}],"author":"Josh Krenz","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Josh Krenz","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/","name":"Microsoft's Anti-Ransomware Playbook","isPartOf":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg","datePublished":"2023-12-05T09:00:23+00:00","dateModified":"2023-12-06T18:34:04+00:00","author":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/7324508b769f74142e6e1e73419840d3"},"description":"Find out how Microsoft\u2019s Ransomware Elimination Program (REP) playbook guides teams to take the right action in the event of a human-operated attack.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#primaryimage","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg","contentUrl":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg","width":2300,"height":1293,"caption":"Microsoft uses a playbook to help it fight ransomware."},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/why-microsoft-uses-a-playbook-to-guard-against-ransomware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/insidetrack\/blog\/"},{"@type":"ListItem","position":2,"name":"Why Microsoft uses a playbook to guard against ransomware"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/","name":"Inside Track Blog","description":"How Microsoft does IT","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/7324508b769f74142e6e1e73419840d3","name":"Josh Krenz","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/image\/b203e24b19a279b45e4eeccee1f84433","url":"https:\/\/secure.gravatar.com\/avatar\/867ac57b48ab51650a4989aa144741dc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/867ac57b48ab51650a4989aa144741dc?s=96&d=mm&r=g","caption":"Josh Krenz"},"url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/author\/jkrenz\/"}]}},"jetpack_featured_media_url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2022\/10\/10436_wordpress_hero.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9hcZA-2gy","_links":{"self":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/8714"}],"collection":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/users\/80"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/comments?post=8714"}],"version-history":[{"count":11,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/8714\/revisions"}],"predecessor-version":[{"id":11558,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/8714\/revisions\/11558"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/media\/8716"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/media?parent=8714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/categories?post=8714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/tags?post=8714"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/coauthors?post=8714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}