Threat Resilience

Threat names describe different failure modes. Use a separate detection and response plan for each one, while sharing the same asset inventory, identity controls, telemetry, and recovery process.

DDoS

DDoS protection must exist upstream of the saturated resource. A host firewall cannot recover bandwidth that is already exhausted.

Prepare

• Put public HTTP services behind a provider with network and application-layer DDoS protection.
• Define which endpoints are essential and which can be degraded, cached, queued, or disabled.
• Set bounded timeouts, connection limits, request-size limits, and rate policies at the edge.
• Protect the origin so traffic cannot bypass the edge service.
• Pre-arrange provider escalation and test it during an exercise.

Monitor

• requests, connections, packets, and bits per second;
• source and destination distribution, protocols, and response codes;
• edge blocks and challenges, origin saturation, queue depth, and dependency health; and
• user-visible availability from more than one network.

Respond

Confirm the constrained layer, contact the upstream provider early, apply narrow mitigations, preserve legitimate access, and communicate service impact. Scaling may help with application load but is not a complete defense against volumetric attacks. See the joint CISA, FBI, and MS-ISAC DDoS guidance.

Malware

Prepare: minimize software, restrict execution and administrative access, scan incoming artifacts, protect build systems, centralize endpoint telemetry, and segment services by trust.

Watch for: an unexpected process tree, execution from temporary or writable directories, disabled security tooling, new persistence, mass file changes, unusual DNS, or unexplained outbound connections.

Respond: isolate the host, preserve evidence, block confirmed indicators, rotate exposed credentials, determine the entry path, and rebuild from trusted artifacts. Deleting the first suspicious file does not prove the system is clean.

Ransomware and destructive activity

Ransomware can combine encryption, deletion, credential theft, and data extortion.

• Separate routine production administration from backup administration.
• Keep protected, versioned, and offline or logically isolated recovery copies.
• Alert on bulk deletion, backup-policy changes, snapshot deletion, unusual encryption activity, and security-control changes.
• Rehearse restoring identity, configuration, data, and dependencies in the correct order.
• Decide in advance who coordinates legal, privacy, insurance, law enforcement, customer, and executive communications.

Do not assume that paying will restore systems or prevent disclosure. Follow the company’s legal and incident leadership process. The CISA StopRansomware guide and NIST ransomware profile cover prevention, response, and recovery as one program.

Newly disclosed and zero-day vulnerabilities

A zero-day has no guaranteed preventive control. The objective is to know exposure quickly, apply trustworthy mitigations, detect exploitation, and restore a patched or replaced service.

Prioritize vulnerabilities with evidence of active exploitation, but continue addressing serious weaknesses before they reach the CISA Known Exploited Vulnerabilities Catalog.

A useful operations dashboard

Show service health and security context together:

• public availability, latency, errors, saturation, and dependency health;
• edge traffic, blocks, connection patterns, and origin reachability;
• privileged access, identity-policy changes, and failed-to-successful logins;
• endpoint health, suspicious processes, file-integrity changes, and sensor gaps;
• patch age, internet exposure, known exploited vulnerabilities, and expiring exceptions; and
• last successful backup, last restore test, recovery time, and unresolved recovery gaps.

Every panel should have an owner, a decision it supports, and a runbook link. A dashboard nobody uses during an incident is decoration.