Recommended Free Tools
A useful ransomware threat model connects the business services you cannot afford to lose with the assets, identities, attack paths and recovery decisions that protect them. Build it in this order: define scope and owners, map critical services and dependencies, draw realistic attacker paths, estimate operational impact, attach controls to each path, then document detection, containment and restoration decisions. Treat the model as a living resilience document and exercise it; it is not a guarantee that an attack will be prevented.
What the model must answer
Ransomware can make data unavailable by encryption and can also involve theft followed by demands to disclose it. CISA warns that these incidents can leave organizations unable to access data needed to operate and deliver mission-critical services. NIST IR 8374 Rev. 1 defines ransomware as an attack in which adversaries encrypt an organization’s data and demand payment to restore access, while recognizing the broader extortion pattern.
As an Amazon Associate I earn from qualifying purchases.
Your finished model should let an executive answer five questions quickly:
- Which services, sites and processes are critical to safety, revenue or mission delivery?
- Which systems, identities, vendors and data stores support each service?
- How could an attacker enter, gain privilege, move laterally, reach backups and steal or encrypt data?
- Which safeguards interrupt each step or limit the blast radius?
- Who makes containment, notification and restoration decisions, and in what order are services rebuilt?
1. Set scope and governance before drawing attack paths
Write a one-page scope statement covering business units, physical sites, legal entities, cloud tenants, remote-work environments and critical services. State exclusions explicitly; an unexamined subsidiary or tenant can become the route into an otherwise protected environment.
#1 Best Overall
Assign named people, not generic departments. The executive owner accepts risk and authorizes major decisions. System owners describe technical dependencies. A security lead coordinates the threat model. A continuity lead defines service priorities and tolerable downtime. Legal and privacy contacts assess obligations, while communications decision makers prepare internal, customer and regulator messaging.
NIST IR 8374 Rev. 1, published June 11, 2026, organizes ransomware outcomes through the six CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond and Recover. Use those functions as a governance checklist, not as a substitute for your service and dependency map.
2. Inventory assets and dependencies around services
Start with a service catalogue rather than a device list. For every critical service, record the components that make it work and the dependencies that must be restored first. CISA guidance emphasizes knowing which systems are critical for safety, revenue or mission services and documenting their interdependencies.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems| Record for each asset or dependency | Why it matters in a ransomware scenario |
|---|---|
| Business service and owner | Sets accountability and restoration priority. |
| Asset type and location | Identifies endpoints, servers, identity providers, SaaS, cloud resources, operational technology and data stores that may require different controls. |
| Authentication path and privileged accounts | Shows where stolen credentials could provide a high-value route. |
| Network zone and trust relationships | Reveals whether compromise can cross into critical segments. |
| Data sensitivity and legal relevance | Distinguishes operational outage from potential disclosure harm. |
| External exposure and vendor connection | Highlights internet-facing services, remote access and third-party entry points. |
| Backup source, retention and recovery dependency | Shows whether restoration is independent of the production identity and management planes. |
Include management consoles, software-distribution tools, hypervisors, domain or directory services, cloud control planes and backup administration systems. These often have more reach than ordinary servers and therefore deserve separate paths in the model.
Rank #2
3. Define attacker objectives and plausible entry paths
Model both the attacker’s objective and the route to it. Typical entry or escalation scenarios include:
- Phishing, help-desk manipulation or other social engineering that captures a user or administrator session.
- Exploitation of an internet-facing application, appliance or unpatched remote service.
- Abuse of remote-access tools, stolen VPN credentials or weak remote administration.
- Malicious removable media or unauthorized software on an endpoint.
- Privilege escalation after initial access, followed by credential theft and lateral movement.
- Compromise of a supplier, managed service connection or shared administration account.
For each scenario, write the objective in business terms: stop payroll, disable production, encrypt file shares, steal customer records, or reach backup administration. Include a data-theft branch even when encryption is the primary concern; modern extortion may demand payment to prevent disclosure rather than to restore access.
4. Draw attack paths and mark trust boundaries
Represent each scenario as a chain that a responder can test:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Initial access through a user, exposed service, removable medium or supplier.
- Identity takeover or session theft.
- Privilege escalation and discovery of critical systems.
- Lateral movement across workstations, servers, cloud accounts or operational technology.
- Access to backup, virtualization, security or management planes.
- Data exfiltration, encryption, extortion and service disruption.
Draw trust boundaries around identity providers, administrative networks, production segments, cloud tenants, backup repositories and third-party links. Mark shared credentials, flat segments, internet-facing systems and management paths. A path that crosses several boundaries should show the control expected at each crossing, such as phishing-resistant MFA, a jump host, a separate administrator account or a firewall policy.
5. Estimate business impact and rank scenarios
For every path, record the maximum tolerable downtime and the effects of losing the service. Consider safety, revenue, contractual commitments, regulatory exposure, customer harm, disclosure of sensitive data, recovery labor and cascading dependency failures. A payroll outage, for example, may depend on identity, email, finance software and a payment provider; restoring only the payroll server would not restore the service.
| Impact dimension | Question to document |
|---|---|
| Time | How long can the service be unavailable before harm becomes unacceptable? |
| Operational and safety effect | Could people, facilities or essential operations be put at risk? |
| Financial effect | What direct loss, recovery cost or contractual penalty is plausible? |
| Information effect | What would theft or public disclosure change? |
| Dependency effect | Which other services fail if this one is unavailable? |
Rank scenarios using your risk appetite and the evidence available from asset owners, incident history, downtime estimates and dependency analysis. CISA and NIST do not prescribe one universal probability or loss formula, so do not insert a generic ransomware percentage or average ransom into the model. Record assumptions and confidence so leaders can see where better evidence is needed.
6. Map controls to specific attack-path steps
A control is useful in the model only when its location and expected effect are explicit. NIST states, “Employ zero trust principles in all networked systems.” It also states, “Back up data, secure backups, and test restoration.”
| Control | Path step addressed | How to verify it |
|---|---|---|
| MFA, preferably phishing-resistant, and separate standard and administrator accounts | Credential theft and privileged takeover | Review coverage, exception accounts and recovery methods. |
| Least privilege and just-in-time elevation | Privilege escalation and tool abuse | Check role assignments, approval records and elevation expiry. |
| Application allow-listing and software controls | Malicious payload execution | Test blocked binaries and the process for approving legitimate changes. |
| Endpoint and email detection | Phishing, execution and early discovery | Run alert simulations and confirm analyst ownership and escalation times. |
| Secure VPN and zero-trust access | Remote-access abuse | Validate device posture, MFA, session limits and logging. |
| Network segmentation | Lateral movement and blast-radius growth | Test permitted flows between user, server, management, operational and backup zones. |
| Immutable, offline or isolated backups | Backup targeting and destructive recovery | Confirm that production administrators cannot erase every copy. |
| Vendor security requirements | Third-party entry and shared administration | Review access scope, notification duties, logging and termination procedures. |
Do not label a control “implemented” merely because a product is installed. Record coverage, exceptions, dependencies, operating owner and the evidence that the control works.
7. Define detection, containment and communications decisions
Turn the paths into decision rules before an incident. Specify which alerts trigger a high-severity response, who may isolate an endpoint or subnet, how volatile evidence is preserved and when legal, privacy, executive, insurer, regulator or law-enforcement contacts are engaged. CISA’s response checklist begins with determining impacted systems and immediately isolating them; your playbook should name the authority and method for doing that safely.
Prepare out-of-band communications that do not depend on the potentially compromised email, identity or collaboration tenant. Maintain current contact details, an alternate meeting method, approved situation-report fields and a rule for authenticating urgent instructions. Include decisions about shutting down systems, blocking privileged accounts, suspending vendor connections and preserving potential evidence; each action should have an owner and an approval threshold.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Design recovery around service order, not server order
List mission-critical services in restoration order and identify the clean recovery environment, restoration owners and validation checks for each. A recovery network or clean room may be required when production identity, management tooling or software distribution is suspected to be compromised.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Recovery design choice | What to compare |
|---|---|
| Offline or isolated backup copies | Independence from production identity, resilience to deletion and operational effort to retrieve them. |
| Immutable storage | Protection against alteration, retention configuration and the process for authorized expiry. |
| Clean recovery environment | Ability to rebuild identity, management and critical workloads without reintroducing the attacker. |
| Restoration validation | Time to recover, achievable restoration point and checks that data and business functions are correct. |
Keep encrypted backups and test restoration regularly. A backup that has never been restored is an assumption, not a recovery capability. Reconnection criteria should include malware-free validation, credential resets, logging coverage, vulnerability remediation and owner sign-off.
9. Exercise and maintain the model
Run both tabletop and technical exercises. A tabletop should force executives to make containment, notification and service-priority decisions with incomplete information. A technical exercise should test isolation, evidence handling, identity recovery, backup retrieval and restoration validation.
Review the model after incidents, major architecture or identity changes, acquisitions, new cloud tenants, critical vendor changes and exercises. Refresh owners, contact details, asset dependencies, trust boundaries, backup assumptions and recovery times. CISA provides a Ransomware Readiness Assessment, cybersecurity advisers and exercise packages that can support this review.
Minimum deliverables for a defensible model
- A signed scope statement and role roster.
- A service-to-asset-and-dependency inventory with owners and recovery requirements.
- Attack-path diagrams covering identity, lateral movement, backup targeting, encryption and data theft.
- A scenario register with impact assumptions, risk ranking and control evidence.
- Detection, containment, legal, communications and evidence-preservation decision rules.
- A prioritized recovery plan with isolated backup sources, restoration tests and reconnection criteria.
- An exercise calendar and change triggers that keep the model current.
A model is doing its job when a leader can identify the first services to protect, a responder can isolate the right systems without guessing, and the recovery team can restore a clean, validated service without relying on the compromised production environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
