fsi-ransomware-overview

Files (2)

• SKILL.md
• SKILL_ja.md

SKILL.md (first lines)

---
name: fsi-ransomware-overview
description: >-
  Entry point for ransomware-countermeasure consultations on AWS for financial services organizations. Explains the 5-phase skill package (Protect, Detect, Respond, Recover, Organization) and guides users to the right phase. Activates broadly when the user does not know where to start, wants an overview, or cannot tell which phase (Protect/Detect/Respond/Recover/Organization) applies. Also activates on general mentions of ransomware countermeasures, where to start, or financial-institution ransomware countermeasures. Does not itself perform design/assessment (backup design, detection-posture assessment, etc.); these are handled by fsi-ransomware-protect, fsi-ransomware-detect, fsi-ransomware-respond, fsi-ransomware-recover, and fsi-ransomware-organization respectively. Recommended to use before those skills so consultations are triaged accurately.
license: MIT No Attribution
metadata:
  author: aws-jp-fsi-sa
  version: "1.0"
---

# Ransomware Countermeasures for Financial Institutions: Overview

## Overview

The areas covered by ransomware countermeasures range widely, from prevention to post-intrusion response. This skill package aims to **support resilience against ransomware attacks and the design of system recovery infrastructure (recovery-oriented workload design)**. Because preventing intrusion 100% is not realistically achievable, how effectively an organization can contain damage and recover its business swiftly, on the premise that intrusion may occur, determines a financial institution's credibility.

Because the areas to address (Protect, Detect, Respond, Recover, and Organization) range widely, this package supports users either by producing a systematic design proposal or by assessing an existing workload and translating the findings into improvements. Users can receive guidance in the following forms:

- Interactive guidance through chat-style conversation with the AI agent
- Confirmation of design proposals / assessment results through automatically generated reports (HTML / Markdown)
- Presentation of an adoption roadmap (short-term / mid-term / long-term) for realizing countermeasures step by step

Through these, ransomware countermeasure designs grounded in AWS best practices and knowledge accumulated by Solutions Architects can be adopted effectively.

This skill (Overview) serves as the entry point to this support. Any ransomware-related consultation is first received by this skill, which presents the overall picture and provides guidance to the appropriate phase. Using this skill, the user can obtain the following kinds of dialogue and outcomes:

- If unsure "what to consider, in which phase" regarding ransomware countermeasures in general, an explanation of the overall 5-phase structure and what each phase concretely covers
- If the consultation content is already decided (e.g., backup design, detection with GuardDuty), guidance to the corresponding specialized skill (fsi-ransomware-protect, etc.) along with a brief overview
- If interested in Respond, Recover, or Organization, information about their future planned content (it is also made clear that these are currently not available for substantive consultation)

What this skill provides:

- An overview explanation of the entire skill package (5-phase structure: Protect, Detect, Respond, Recover, Organization)
- Guidance to the appropriate phase (triage) based on the user's consultation content and issues
- Clarification of the current availability status of each phase (available / planned for future release)

The scope this skill covers:

- Focuses on being the entry point / triage role for ransomware-countermeasure consultations
- The concrete design, assessment, and implementation work for each phase (chat-based dialogue, report generation, roadmap presentation, etc.) is handled by the respective specialized skill (Protect: fsi-ransomware-protect, Detect: fsi-ransomware-detect, Respond: fsi-ransomware-respond, Recover: fsi-ransomware-recover, Organization: fsi-ransomware-organization). This skill only guides the customer toward using those skills, and does not itself delve into concrete work such as backup design or detection-posture assessment

## Current Availability Status

As of the initial release in July 2026, this skill is a provisional version. Triage to the Protect and Detect phases is actually functional, but the three phases Respond, Recover, and Organization are not yet released, so consultations corresponding to these are limited to guidance that they are "planned for future release." See the table in the Ransomware Resilience Framework section for detailed availability status.

## Ransomware Resilience Framework (Overall Package Structure)

This package consists of 6 skills, including this skill (Overview). Overview serves as the entry point / triage role, and the actual countermeasure work is handled by the following 5 phase skills.

| Phase | Skill name | Availability |
|---|---|---|
| Protect | fsi-ransomware-protect | Available |
| Detect | fsi-ransomware-detect | Available |
| Respond | fsi-ransomware-respond | Planned for future release |
| Recover | fsi-ransomware-recover | Planned for future release |
| Organization | fsi-ransomware-organization | Planned for future release |

### Protect: fsi-ransomware-protect

Performs architecture design and existing-environment assessment for backup/data-protection environments. Covers a multi-account role-separation strategy, an AWS Backup-centered backup architecture, immutabilization (Vault Lock / S3 Object Lock) and encryption, policy design via IAM / KMS / SCP, malware scanning strategy (including AWS Backup malware protection and ECR container protection), log collection/protection in preparation for forensic response, monitoring/auditing of backup operations, and on-premises backup integration (AWS Backup Gateway / DataSync / Storage Gateway).

### Detect: fsi-ransomware-detect

Handles detection of damage/threats and analysis of detected events. Covers detection of service impact (resource, service, synthetic, and business-metric monitoring), detection of security attacks (Amazon GuardDuty protection plans, third-party products), alert-triggered root-cause triage, log-based analysis/investigation leveraging already-collected logs (Amazon Detective, SIEM on Amazon OpenSearch Service), aggregation/delegated administration of detection and analysis, and advance preparation for engaging forensic vendors when the analysis bar is high.

### Respond: fsi-ransomware-respond

Envisioned to cover isolation, evidence preservation, and bridging to full-scale forensic analysis for detected events (concept stage).

### Recover: fsi-ransomware-recover

Envisioned to cover restoration procedures from backups, infection checks during recovery, and phased service restoration (concept stage).

### Organization: fsi-ransomware-organization

Envisioned to cover organizational-operation considerations such as organizational structure during an incident, internal/external communication flows, and reporting to regulators and relevant authorities (concept stage).

## Reference Foundations

The 5-phase structure presented by this skill is organized based on the concepts of the NIST Cybersecurity Framework (CSF), adapted into a breakdown suited to the practice of ransomware countermeasures for financial institutions. Detailed authoritative sources for each phase are found in the Reference Foundations section of the respective phase skill (fsi-ransomware-protect / fsi-ransomware-detect, etc.).

## Common Tasks

### Workflow A: Entry-Point Guidance

This skill consists of a single workflow (entry-point guidance). Any ransomware-related consultation is first received by this workflow.

#### Trigger conditions

Handles ransomware-countermeasure consultations in general. This includes vague questions such as "I don't know where to start" or "I want to know the overall picture," as well as topics close to a specific phase (backup, detection, etc.); in all cases, this skill first presents an overview and then bridges to the appropriate phase as the entry point.

#### Goal

Upon completing Workflow A, the user has obtained either of the following:

1. Identification of the phase corresponding to their consultation, or an understanding of the overall picture
2. An overview explanation of the corresponding phase and guidance toward using it, or, for Respond/Recover/Organization, notice that it is planned for future release

#### Processing steps

1. **Initial confirmation (conditional; verbatim output required)**: If the user's first question already states one of the phase names (Protect/Detect/Respond/Recover/Organization) or an equivalent concrete service/topic (e.g., "I want to ask about backup Vault Lock design"), skip this confirmation and proceed directly to Step 3. If not stated (including a vague consultation such as "I want to consider ransomware countermeasures"), output the following confirmation text **verbatim, preserving the Markdown list structure (including line breaks and indentation)**, at the beginning of the first response. Do not provide an overview explanation, a summary, or a paraphrase, and do not output any other content (such as the Ransomware Resilience Framework table) before this confirmation text. Do not collapse the list into a single plain-text paragraph.

   > Thank you for using the AWS-provided ransomware countermeasures Skill package for the financial industry, "fsi-ransomware-resilience." To make use of this skill, please choose one of the following depending on your purpose.
   >
   > - **A.** I want to start with the overall picture of this skill / I want an explanation and guidance on what it can do
   > - **B.** My consultation content is already decided, so please directly guide me to the skill that covers the corresponding phase
   >     - **B-1. Protect** — Architecture design/assessment of backup and data protection (multi-account structure, immutabilization, encryption, malware scanning, log collection/protection, etc.)
   >     - **B-2. Detect** — Detection and analysis of service impact/attacks (monitoring design, GuardDuty, investigation using Detective/SIEM, etc.)
   >     - **B-3. Respond** — Isolation and evidence preservation after detection, bridging to forensic response (currently unavailable, planned for future release)
   >     - **B-4. Recover** — Restoration procedures from backups, infection checks, phased service restoration (currently unavailable, planned for future release)
   >     - **B-5. Organization** — Organizational structure during an incident, internal/external communication, reporting to regulators, etc. (currently unavailable, planned for future release)

2. **If A: Presentation of the overall picture (verbatim output required)**: Output the following overall-picture explanation text **verbatim, preserving the Markdown structure (headings, paragraphs, lists, tables, and line breaks)**. Do not summarize, paraphrase, or omit any part.

   > The areas covered by ransomware countermeasures range widely, from prevention to post-intrusion response. This skill package aims to support resilience against ransomware attacks and the design of system recovery infrastructure (recovery-oriented workload design). Because preventing intrusion 100% is not realistically achievable, how effectively an organization can contain damage and recover its business swiftly, on the premise that intrusion may occur, determines a financial institution's credibility.
   >
   > Because the areas to address (Protect, Detect, Respond, Recover, and Organization) range widely, this package supports users either by producing a systematic design proposal or by assessing an existing workload and translating the findings into improvements. Guidance can be received in the following forms.
   >
   > - Interactive guidance through chat-style conversation with the AI agent
   > - Confirmation of design proposals / assessment results through automatically generated reports (HTML / Markdown)

From aws-samples/sample-fsi-reference-architecture-jp, MIT-0.

More from aws-samples/sample-fsi-reference-architecture-jp