Theory: Availability Threats & Ransomware
Week 7 asked “Who may see the data?” and Week 8 asked “Can we trust the data?” Week 9 asks the last CIA question: “Can we use the data when we need it?” That is availability, the “A” in the CIA triad.
Picture Monday, 07:00 at MediCare Plus. Every screen shows YOUR FILES ARE ENCRYPTED. The EMR is down, so doctors cannot see allergies or patient history, and the pharmacy cannot check medication orders. The note says: pay within 72 hours, or the stolen data is published. The IT team is three people, with no night shift and no security team. This lesson explains how a hospital ends up there; 9.2 and 9.3 explain how to survive it.
Availability Revisited
Availability means authorized users can use systems and data when they need them.
Note the two parts: the right people (authorized users) and the right time (when they need them). A system that is “up” but too slow to use during a ward round, or that only works after the emergency is over, is not available in any useful sense.
Why it matters: three kinds of impact
| Impact | What happens when availability fails | Hospital example |
|---|
| Patient safety | Slower or wrong treatment | A doctor prescribes a drug without seeing the allergy list |
| Operations | Staff fall back to paper; visits are cancelled | Outpatient clinics are closed for the day |
| Money & trust | Revenue loss, recovery cost, damaged reputation | Patients choose another hospital after the news story |
In a hospital the first row dominates: an availability failure can harm people, not just budgets.
Common Threats to Availability
| Threat | Deliberate? | Example |
|---|
| Hardware failure | No | A disk or power supply in the EMR server dies |
| Power / network failure | No | A fibre cut isolates the hospital from its cloud services |
| Human error | No | An admin deletes the wrong virtual machine |
| Natural disaster | No | A flood fills the basement server room |
| Denial-of-service (DoS) attack | Yes | The appointment website is flooded with traffic |
| Ransomware | Yes | All servers are encrypted overnight |
Different threats need different defences: RAID handles a failed disk (9.2), backups handle deleted or destroyed data (9.3), and a copy in another place handles a disaster that destroys the whole room.
What Is Ransomware?
Ransomware is malware that makes your data unusable, then demands payment to give it back. It works in up to three moves:
- Encrypt: files and systems stop working.
- Extort: pay (usually in cryptocurrency) for the decryption key.
- Threaten: publish the stolen data if you do not pay. Stealing the data before encrypting it, so the victim can be pressured twice, is called double extortion.
Why is ransomware an availability attack?
Ransomware does not need to destroy or leak anything to hurt you: the data still exists, but nobody can use it. That is exactly a loss of availability.
The MITRE ATT&CK knowledge base (which catalogues real attacker behaviour) lists this as technique T1486 – Data Encrypted for Impact, under the tactic Impact. “Impact” is the tactic for actions that disrupt availability or integrity to hurt the business.
With double extortion, one incident hits two CIA properties: encryption attacks availability, and publishing the stolen data attacks confidentiality. A good backup fixes the first, but cannot undo the second: data that has been copied out stays copied out.
How a Ransomware Attack Unfolds
Encryption feels like a single moment, but it is the last step of a process that usually takes days.
Diagram loads as you scroll.
| Stage | What the attacker does | Chance for the defender |
|---|
| 1. Get in | Phishing email or a stolen password (often on VPN or remote access) | MFA, phishing training, alert on unusual logins |
| 2. Become admin | Steals administrator rights | Protect admin accounts; alert on new admin logins |
| 3. Spread | Moves from the first machine to servers | Network segmentation; alert on unusual server access |
| 4. Steal data | Copies patient data out of the network | Watch for large outbound transfers |
| 5. Kill defences | Deletes backups, stops security tools and logging | Immutable backups; alert when backup jobs stop |
| 6. Encrypt | Locks every system at once | Too late: now you can only recover |
Encryption is the last step. Attackers often stay inside for days (the dwell time). Every earlier stage is a chance to detect and stop the attack before any file is encrypted.
Common mistake: thinking “the attack happened at 07:00 on Monday.” 07:00 is when the attack was noticed. The attacker may have logged in a week earlier. This matters for recovery: a backup taken after the attacker got in may already contain their backdoors (see 9.3).
Why Attackers Target Backups and Admin Accounts
Backups. Ransomware only works if the victim has no other way back. If good backups survive, the victim restores and does not pay. So, in stage 5, attackers delete or encrypt the backups before they encrypt production.
Admin accounts. An administrator account can reach every server, the security tools and the backup jobs. One admin account can open the whole hospital. If backups are managed with the same domain admin accounts as everything else, stealing one account gives the attacker the power to destroy the backups too.
Exam summary: protect the backups (copies that admins cannot delete, kept away from the main network) and the admin accounts (few, closely watched, separate from backup administration), and ransomware loses most of its power.
Worked Examples
Exercise 1
For each event at MediCare Plus, name the availability threat category and the main type of impact (patient safety, operations, or money & trust).
- (a) A cleaner unplugs the network switch for the pharmacy floor.
- (b) The appointment website is flooded with fake requests and stops responding.
- (c) A storm floods the basement server room.
- (d) The EMR database server’s disk controller fails.
Show solution ↓Hide solution ↑
Solution
Match each cause to the six common threats, then ask who is hurt first.
| Event | Threat category | Main impact |
|---|
| (a) Switch unplugged | Human error (also a network failure) | Patient safety: the pharmacy cannot check medication orders |
| (b) Website flooded | DoS attack | Operations (patients must phone; staff book on paper) and money & trust |
| (c) Server room flooded | Natural disaster | Patient safety: every system in that room is gone at once |
| (d) Disk controller fails | Hardware failure | Patient safety: no allergies or history in the EMR |
Note that only (b) is deliberate. Most availability incidents are accidents, which is why availability planning is about more than attackers.
Exercise 2
A ransomware group encrypts the hospital’s file server and also uploads 40 GB of patient records to its own server. It demands payment for the key and threatens to publish the records.
- (a) Which two CIA properties are attacked? Map each to an action.
- (b) What is this extortion pattern called?
- (c) Which MITRE ATT&CK technique and tactic describe the encryption?
- (d) If the hospital restores everything from good backups, which problem is solved, and which is not?
Show solution ↓Hide solution ↑
Solution
(a) Encrypting the files makes the data unusable → availability. Uploading the records lets outsiders read them → confidentiality.
(b) Stealing data before encrypting it, so the victim is pressured twice (pay for the key, pay to keep the data private), is double extortion.
(c) T1486 Data Encrypted for Impact, under the tactic Impact.
(d) Backups solve the availability problem: the hospital can work again without the key. They do not solve the confidentiality problem: the 40 GB is already on the attacker’s server, so the breach still has to be handled (for example, notification under PDPA, Week 7).
Answer: availability (encrypt) and confidentiality (steal and threaten); double extortion; T1486 / Impact; backups restore availability but cannot undo the leak.
Exercise 3
The following events from a real-style incident are listed out of order. Put them into the six stages of a ransomware attack and name one control that could have stopped the attack at each stage.
- P: Backup jobs are deleted and the antivirus service is stopped.
- Q: A nurse enters her password on a fake “HR survey” page.
- R: Every server shows a ransom note.
- S: The attacker uses the nurse’s account to log in to the file server, then the EMR server.
- T: 30 GB of data is sent to an unknown cloud storage account.
- U: The attacker dumps a domain administrator’s password from memory.
Show solution ↓Hide solution ↑
Solution
Use the stage order: get in → become admin → spread → steal data → kill defences → encrypt.
| Stage | Event | One control that could stop it |
|---|
| 1. Get in | Q (phishing) | MFA, so a stolen password alone is not enough |
| 2. Become admin | U (admin password stolen) | Admins never log in to ordinary machines; alert on admin logins |
| 3. Spread | S (moves to servers) | Network segmentation; a nurse account should not reach servers |
| 4. Steal data | T (30 GB out) | Alert on large outbound transfers (DLP, Week 7) |
| 5. Kill defences | P (backups deleted, AV stopped) | Immutable backups; alert when backup jobs or security tools stop |
| 6. Encrypt | R (ransom note) | Too late to prevent; only recovery is left |
Order: Q → U → S → T → P → R. Five of the six stages happen before encryption, so there are five chances to detect the attack.
Exercise 4
An attacker logs in with a stolen VPN password on Monday 09:00. The hospital’s systems are encrypted on Friday 02:00.
- (a) How long was the attacker inside before encryption (the dwell time)?
- (b) Why does this number matter when choosing which backup to restore servers from?
Show solution ↓Hide solution ↑
Solution
(a) Count whole days first, then adjust.
- Monday 09:00 → Friday 09:00 = 4 days = 4×24=96 h.
- Friday 02:00 is 7 h earlier than Friday 09:00, so the dwell time is 96−7=89 h.
89 h=3 days 17 hCheck: Mon 09:00 + 3 days = Thu 09:00; + 17 h = Fri 02:00 ✓.
(b) Anything the attacker could touch during those 89 hours may contain a backdoor (a new admin account, a hidden scheduled task, malware). A system backup taken after Monday 09:00 may restore the attacker along with the server. Server images should come from before Monday 09:00, or the servers should be rebuilt clean and only the data restored.
Answer: (a) 89 h = 3 days 17 h; (b) backups after the break-in may be infected, so restore servers only from before Monday 09:00 (or rebuild clean).
Exercise 5
The IT manager says: “We have backups, so ransomware is not a big risk for us.” The backups are on a NAS managed with the normal domain administrator accounts. Explain why the manager is wrong, and suggest two changes.
Show solution ↓Hide solution ↑
Solution
Why the claim fails:
- Attackers know that backups let victims recover without paying, so in stage 5 (kill defences) they delete the backups first.
- To reach the NAS they need admin rights, and they get those in stage 2. Because the NAS uses the same domain admin accounts as everything else, one stolen admin account opens the production servers and the backups.
- So the backups are likely to be gone exactly when they are needed.
Two changes:
- Store backups on immutable (WORM) storage, which nobody can change or delete before the retention period ends, not even an admin (see 9.2).
- Separate backup administration from the domain: different accounts with MFA, and a backup system that is not domain-joined, so a stolen domain admin cannot reach it.
Answer: backups only protect you if the attacker cannot reach them; make them immutable and manage them with separate, non-domain admin accounts.
Exercise 6
It is Monday 07:00 and the ransom note is on every screen (the opening scenario). You are the IT manager. What do you do first, and what should you not do first?
Show solution ↓Hide solution ↑
Solution
First: contain and keep patients safe.
- Isolate: disconnect the affected systems from the network and stop replication, so the encryption cannot spread to standby servers or any backups still reachable.
- Start the downtime procedures: paper forms for orders, medication checks and notes, so care continues safely.
- Then check which backups survived and plan the restore (the full procedure is in 9.3).
Not first:
- Do not pay as the first move: payment does not guarantee a working key, funds the attackers, and the stolen data may be published anyway.
- Do not restore immediately onto the same servers: the attacker may still be inside with admin rights and will simply encrypt again.
Answer: isolate (cut network, stop replication) and switch to paper downtime procedures; only then assess backups and restore onto clean systems.