Ransomware Response Consulting Services in Edison

Overview of Progent's Ransomware Forensics Investigation and Reporting in Edison
Progent's ransomware forensics consultants can save the system state after a ransomware assault and perform a detailed forensics analysis without disrupting the processes required for operational resumption and data restoration. Your Edison business can use Progent's post-attack forensics documentation to block subsequent ransomware attacks, validate the cleanup of lost data, and comply with insurance and regulatory requirements.

Ransomware forensics investigation involves determining and describing the ransomware assault's storyline across the targeted network from start to finish. This audit trail of how a ransomware assault progressed through the network assists you to evaluate the damage and uncovers vulnerabilities in security policies or processes that should be corrected to prevent later breaches. Forensics is usually assigned a high priority by the insurance carrier and is often required by government and industry regulations. Since forensics can take time, it is vital that other important activities such as business resumption are pursued in parallel. Progent has a large roster of IT and security professionals with the knowledge and experience needed to carry out the work of containment, operational continuity, and data restoration without interfering with forensic analysis.

Ransomware forensics analysis is complicated and requires intimate cooperation with the groups assigned to file recovery and, if needed, settlement discussions with the ransomware attacker. Ransomware forensics typically involve the review of logs, registry, GPO, Active Directory, DNS, routers, firewalls, schedulers, and basic Windows systems to detect variations.

Activities associated with forensics analysis include:

• Detach without shutting off all possibly impacted devices from the system. This may require closing all Remote Desktop Protocol (RDP) ports and Internet facing NAS storage, modifying admin credentials and user PWs, and implementing 2FA to protect backups.
• Capture forensically valid duplicates of all suspect devices so your data restoration team can get started
• Save firewall, virtual private network, and other key logs as quickly as possible
• Establish the variety of ransomware involved in the assault
• Inspect each machine and storage device on the system as well as cloud storage for signs of compromise
• Inventory all encrypted devices
• Determine the kind of ransomware used in the assault
• Review log activity and user sessions in order to establish the timeline of the ransomware assault and to spot any possible lateral movement from the first compromised machine
• Identify the attack vectors exploited to carry out the ransomware attack
• Search for new executables surrounding the original encrypted files or network breach
• Parse Outlook PST files
• Examine email attachments
• Separate URLs from messages and determine whether they are malicious
• Produce extensive attack documentation to meet your insurance carrier and compliance requirements
• List recommendations to shore up cybersecurity gaps and enforce workflows that lower the risk of a future ransomware exploit

Contact Progent about Ransomware Forensics Analysis Services in Edison
To learn more about ways Progent can assist your Edison organization with ransomware forensics analysis, call 1-800-462-8800 or visit Contact Progent.