The outage was caused by a ransomware actor exploiting a remote-access exception that should have expired, then using unsegmented administrative access to disable recovery controls and encrypt critical systems. This ransomware policy review postmortem found that the organization had adequate written policies, but no reliable process for testing whether the business was actually complying with them. The result was a three-day operational outage that began with one overlooked VPN account and ended with unavailable file shares, application servers, and backups.
This is a composite incident based on patterns I have seen while advising mid-market organizations as a vCISO. The organization, which I will call Northstar Manufacturing, had approximately 900 employees, multiple acquired locations, Microsoft 365, Fortinet remote access, VMware infrastructure, Veeam backup, and a small internal IT team supported by a managed service provider. Its information security policy required multifactor authentication for remote access, quarterly privileged-access reviews, and protected backup administration. Its ISO 27001 program also identified Annex A control 5.36: compliance with information security policies, rules, and standards must be regularly reviewed.[1]
What happened during the outage timeline?
The intrusion was not sudden from a control perspective. The technical encryption event was fast, but the conditions that enabled it had accumulated over more than a year.
| Time | Event | Control signal missed |
|---|---|---|
| Monday, 07:42 | An attacker authenticated to the FortiGate SSL-VPN using a former acquisition-era contractor account, svc-vpn-backup. |
The account had been granted an MFA exception during a migration in 2024. The exception had no owner, expiration date, or quarterly review evidence. |
| Monday, 08:09 | The attacker connected through RDP to a backup administration jump host using stored credentials from a shared operations vault. | The backup policy prohibited shared administrator credentials, but the annual policy attestation did not test vault membership or credential use. |
| Monday, 09:18 | Veeam console access was used to delete recent restore points and disable scheduled jobs. | Immutable storage was documented as a target-state requirement but had been deferred after a storage-refresh project was delayed. |
| Monday, 10:03 | Microsoft Defender for Endpoint generated alerts for credential dumping and remote service creation on two servers. | The MSP received the alerts, but the escalation procedure had not been exercised and the after-hours contact list was outdated. |
| Monday, 23:41 | The attacker deployed ransomware using compromised domain administrator credentials and Group Policy. | Domain admin accounts were used for routine server administration, contrary to the privileged-access standard. |
| Tuesday, 00:17 | File servers, ERP application servers, print services, and virtual machine datastores became unavailable. | The incident response plan existed, but recovery priorities had not been reconciled with the actual dependency map. |
| Tuesday, 06:30 | Northstar declared a major incident and disconnected the primary site from the network. | Leadership learned that the most recent viable backup was nine days old and incomplete for several application servers. |
| Thursday, 18:20 | Core ERP and file services were restored from clean infrastructure and surviving offline media. | Recovery required manual rebuilding because backup and configuration-management controls had not been verified. |
Production resumed in stages on Friday, but the business impact extended beyond the three-day encryption window. Customer shipments were delayed, payroll processing required manual workarounds, and finance spent weeks reconciling transactions entered outside the ERP system.
What did the ransomware policy review postmortem identify as the root cause?
The root cause was not simply “a compromised VPN credential.” Credentials are compromised routinely; resilient organizations assume that will happen and prevent a single credential from becoming enterprise-wide control. Northstar’s root cause was a failure to verify compliance with its own security requirements after systems, staff, and business operations changed.
The VPN exception was initially reasonable. During an acquisition, a backup vendor needed temporary access while identity systems were integrated. The security team created a FortiGate local account, exempted it from MFA, and assigned it to a group that could reach the backup jump host. The request ticket said the exception would be removed within 60 days.
It was never removed. The infrastructure engineer who owned the migration left. The account remained because the backup team feared interrupting nightly jobs. The vendor relationship changed, but no one formally revalidated the account, the exception, its network access, or the reason it still existed.
The attacker’s initial access succeeded because the account password had been reused in an older vendor-support process and was available through a criminal credential collection. The actor did not need to bypass MFA; Northstar had deliberately exempted the account. Once inside, the attacker encountered a series of additional departures from policy: shared backup administration, broad network reachability, privileged accounts used interactively, and recovery storage that was not immutable.
In other words, the threat actor exploited a chain of control debt. The post-incident review of policy compliance showed that every link in that chain had either been documented as an exception, accepted informally as an operational shortcut, or assumed to be covered by another team.
Why did ISO 27001 control 5.36 fail in practice?
Northstar treated policy review as a document-management activity rather than a compliance-verification activity. The information security policy was reviewed annually, approved by leadership, and distributed through the learning-management system. Those actions created evidence that the policy existed, but not evidence that its requirements were operating.
ISO 27001 Annex A 5.36 is more demanding than collecting annual acknowledgments. It requires regular review of compliance with the organization’s policies, rules, and standards. At Northstar, the quarterly access review was performed as an email-based manager attestation. It did not include VPN local accounts, privileged service accounts, firewall exceptions, backup console users, or dormant vendor credentials. The scope had quietly narrowed as responsibility became fragmented among internal IT, the MSP, and the backup vendor.
The review also lacked independent challenge. The infrastructure manager who maintained the exceptions was asked to attest that the exceptions were justified. No security owner compared the exception register against FortiGate configuration, Entra ID groups, Veeam roles, or network firewall rules. The control therefore measured whether people completed a form, not whether systems complied with the standard.
There was a second failure: exceptions were not managed as temporary risk decisions. The policy required an owner and review date, but the exception register was a spreadsheet in a departed employee’s SharePoint folder. It had no automated expiration, no escalation for overdue reviews, and no connection to change management. A disciplined review of security-policy compliance would have exposed that the exception had survived four quarters without a valid business justification.
Which corrective and preventive actions mattered after containment?
During the first 72 hours, Northstar focused correctly on containment, clean recovery, credential resets, and evidence preservation. The more important work began after systems were restored: turning the incident into measurable control changes rather than issuing another policy reminder.
| Finding | Corrective or preventive action | Owner | Evidence of completion |
|---|---|---|---|
| VPN account had an indefinite MFA exception. | Disabled all FortiGate local accounts; moved remote access to SAML authentication with Microsoft Entra ID and required phishing-resistant MFA for privileged VPN groups. | Infrastructure Director | FortiGate configuration export, Entra Conditional Access policy, and monthly exception report showing zero unmanaged exclusions. |
| Privileged accounts were shared and routinely used. | Implemented separate named administrator accounts, Microsoft Entra Privileged Identity Management for eligible roles, and CyberArk vault checkout for emergency credentials. | Identity Lead | Quarterly access certification, PIM activation logs, and vault audit report. |
| Backups could be altered from the production network. | Rebuilt Veeam Backup & Replication with separate backup administration, hardened Linux repositories, and 14-day immutable retention. | Backup Manager | Veeam immutability report, successful isolated restore test, and repository access-control review. |
| Endpoint alerts were not escalated. | Updated the MSP runbook so Microsoft Defender for Endpoint alerts for credential dumping, ransomware behavior, and mass file encryption generate a 15-minute escalation. | Security Operations Manager | Signed runbook, ticket samples, and quarterly tabletop results. |
| Policy reviews relied on self-attestation. | Created a control-testing calendar that tests configuration evidence against policy requirements, with overdue findings reported to the risk committee. | vCISO and Internal Audit | Control test workpapers, exception register, and quarterly management review minutes. |
The most consequential change was not a new technology purchase. It was assigning each policy requirement a test method, evidence source, control owner, frequency, and escalation path. For example, “MFA is required for remote access” became a monthly test of all FortiGate and Entra remote-access identities, with any exclusion requiring a named executive risk owner and a maximum expiration date.
What lessons generalize to other organizations?
First, written policy is not a control unless someone tests the environment against it. An approved policy, employee acknowledgment, and annual document review do not demonstrate conformity with ISO 27001 control 5.36.
Second, exceptions deserve more scrutiny than standard configurations. They are deliberate departures from a protective baseline, often created during high-pressure projects and forgotten when the project ends. Every exception should have a business owner, compensating controls, a defined expiry, and evidence of renewal by someone independent of the person benefiting from it.
Third, ransomware resilience depends on whether identity, administrative access, and backup controls fail independently. Northstar’s attacker should have encountered MFA, restricted jump-host access, separate backup credentials, immutable recovery points, and rapid alert escalation. Instead, each weak control made the next weak control more valuable.
Finally, a policy-compliance review should sample reality, not just paperwork. As a vCISO, I ask clients to trace a requirement from policy statement to system configuration, operating evidence, exception record, and management oversight. If any link is absent, the organization has a finding before an attacker turns it into an outage.
Next step: Schedule a focused 5.36 compliance review that tests your remote-access exceptions, privileged accounts, and backup-administration controls against their actual configurations.
