When a digital disruption brings a global operation to a halt
In June 2017, A.P. Møller-Maersk was among the organizations hit by NotPetya, destructive malware disguised as ransomware. The incident took on global proportions and showed how system downtime can directly affect supply chains, port operations, customers, and financial flows.
According to reporting by Wired, NotPetya spread from a compromised Ukrainian accounting software package, reaching corporate networks in several countries. The publication described the episode as an attack of exceptional reach, with damage extending beyond organizations directly connected to the initial context.
A Maersk divulgou que precisou reinstalar cerca de 45 mil computadores, 4 mil servidores e 2.500 aplicações em aproximadamente dez dias. A informação foi reportada pela BleepingComputer, while the company estimated losses between US$ 250 million and US$ 300 million. Terminals operated by the company in several countries also experienced disruptions.
The internal technical details of the incident have not been made public in enough depth to determine which controls worked, which failed, or how each environment was affected. Even so, the case offers a clear lesson for any decision-maker: the ability to restore operations under pressure must be planned before a crisis, tested regularly, and aligned with the financial impact of downtime.
Which vectors tend to amplify destructive incidents?
Although the internal details of the incident are not public, attacks like this one typically exploit vectors such as compromised digital supply chains, unpatched vulnerabilities, and lack of network segmentation. These vectors deserve attention because they turn an initial point of compromise into a large-scale disruption.
Compromised digital supply chain. A software vendor, a legitimate update, or a widely used integration can become a distribution channel for malicious code. In practice, a company may receive a seemingly trustworthy file through an application the business has already approved. That is why third-party risk management needs to map critical software, privileges granted to vendors, and validation processes for updates.
Unpatched vulnerabilities. Delayed patches create opportunities for automated code to find servers, workstations, or exposed services with known flaws. An incomplete inventory makes it hard to know which assets require priority remediation. For the decision-maker, the relevant question is simple: can the company prove which systems are up to date, which have exceptions, and what the operational risk of each outstanding item is?
Lack of network segmentation. When administrative and operational environments, servers, and user devices share excessive access, an initial incident can spread more quickly. Network segmentation limits communication between zones according to business needs. This control reduces the surface for lateral movement and protects critical areas when part of the environment needs to be isolated.
What can be done to protect your infrastructure?
Layered protection combines prevention, detection, containment, and recovery. No single layer eliminates every risk, but a well-defined architecture reduces the likelihood of spread and makes recovery more predictable. The goal is to sustain business continuity even in the face of an incident that compromises part of the environment.
Endpoint detection and containment. EDR, short for Endpoint Detection and Response, is an endpoint detection and response capability that identifies suspicious behavior on computers and servers. Combined with continuous proactive monitoring with intelligent alerts, EDR helps investigate anomalous activity, isolate affected assets, and reduce the time between a risk signal and technical action. A managed cybersecurity strategy organizes these capabilities into recurring processes for visibility and prioritization.
Recovery independent of the affected environment. Isolated, encrypted, and regularly tested backups reduce reliance on copies connected to the same network as the operation. Recovery must account for applications, configurations, identities, and data, not just files. A backup and disaster recovery framework should establish recovery point objectives, which define how much data can be lost, and recovery time objectives, which define when priority services need to be back up.
Continuous attack surface reduction. Patch and vulnerability management should be continuous, based on a reliable inventory and asset criticality. Multi-factor authentication, or MFA, adds a verification step beyond the password and reduces the risk associated with compromised credentials. Ongoing user training, network segmentation, and a documented, tested incident response plan round out a practical foundation for fast decisions during containment.
Questions every decision-maker should be asking right now
- Would my backups actually work in a disaster like this? How long would it take for my operation to be back up and running?
- Does my team have the right tools to immediately identify and block an attack like this before it causes full-scale disaster? How am I investing in preparing my technical team?
- How long would my company survive without access to its systems and files?
Would my backups actually work in a disaster like this? How long would it take for my operation to be back up and running?
A copy of data only becomes a reliable backup when it is isolated, encrypted, monitored, and restored in documented tests. The organization needs to know the recovery order for applications, databases, identities, and shared files, because restoring volumes without reestablishing dependencies can prolong downtime.
Recovery objectives should be defined for each business process, taking into account billing, logistics, customer service, and contractual obligations. An incident response plan needs to specify who decides on restoration, what evidence is preserved, and how to validate that the recovered environment is secure before resuming operations.
Does my team have the right tools to immediately identify and block an attack like this before it causes full-scale disaster? How am I investing in preparing my technical team?
EDR, continuous proactive monitoring, and intelligent alerts provide the visibility to identify behaviors such as unusual execution, privilege escalation, and lateral movement. These capabilities need to be tied to clear investigation, isolation, and escalation procedures so that critical alerts trigger actions proportional to the risk.
Continuous patch management reduces exposure to known vulnerabilities, while recurring training prepares users and technical staff to recognize social engineering attempts and carry out the defined protocols. Preparedness also requires incident simulations, reviews of privileged access, and updates to the technology inventory as the infrastructure evolves.
How long would my company survive without access to its systems and files?
This answer should come from a business impact analysis, with hourly downtime costs, dependencies between departments, and acceptable thresholds for each process. Companies that understand this scenario can prioritize investments in network segmentation, MFA, redundancy, and recovery based on the actual effect on revenue, customers, and reputation.
The incident response plan needs to bring together leaders from technology, operations, legal, and communications, with responsibilities assigned in advance. Isolated backups, EDR, and continuous monitoring help limit the extent of the impact, but continuity depends on the ability to make coordinated decisions and restore critical services in a validated sequence.
Frequently asked questions
Why can network-connected backups pose a risk?
Backups that can be reached from the same compromised environment can be deleted, encrypted, or altered by an attacker. Isolated, regularly tested backups improve the ability to restore clean data after a destructive incident.
What role does EDR play in a protection strategy?
EDR is an endpoint detection and response capability that monitors suspicious behavior on computers and servers. It helps investigate events, contain affected assets, and provide evidence for incident response.
How does network segmentation reduce the impact of an attack?
Network segmentation separates systems and areas based on their communication needs and criticality. This separation makes lateral movement harder and allows affected zones to be isolated with less impact on essential services.
If your company does not yet have an integrated layered protection strategy, consider scheduling a no-obligation Strategic IT Assessment to identify vulnerabilities before they make headlines.