How to build a robust lights-out checklist

This advisory explains how attackers exploit holidays and major events to maximize leverage, detailing common techniques such as ransomware, phishing, DDoS, compromised remote access, and supply-chain intrusions, then provides actionable defenses: a core checklist (validated IR plans and contacts, pre-holiday patching, access audits/MFA, monitoring and alerting, comprehensive/offline backups with restore testing, remote access hardening, firewall log reviews, and third‑party readiness), Zero Trust practices (deny-by-default, segmentation, continuous verification), and ThreatLocker-specific controls. It also outlines immediate response steps—rapid isolation, IR notification, log preservation, stakeholder communications, law enforcement engagement as required, and recovery from verified backups—emphasizing preparation, continuous monitoring, and practiced incident response to minimize downtime and ransomware impact.