Ransomware Response Consulting Experts

Progent's Ransomware Forensics Investigation and Reporting
Progent's ransomware forensics experts can save the evidence of a ransomware attack and perform a comprehensive forensics investigation without slowing down the processes related to business resumption and data recovery. You can utilize Progent's post-attack forensics documentation to counter subsequent ransomware assaults, assist in the cleanup of encrypted data, and comply with insurance and regulatory reporting requirements.

Ransomware forensics analysis is aimed at tracking and describing the ransomware assault's progress throughout the targeted network from beginning to end. This audit trail of how a ransomware attack travelled through the network helps your IT staff to assess the impact and highlights gaps in rules or work habits that should be rectified to avoid future break-ins. Forensic analysis is typically given a top priority by the insurance carrier and is typically required by government and industry regulations. Since forensic analysis can be time consuming, it is vital that other key activities such as operational resumption are executed in parallel. Progent maintains an extensive team of information technology and data security professionals with the knowledge and experience required to carry out the work of containment, operational resumption, and data restoration without disrupting forensic analysis.

Ransomware forensics analysis is complex and requires close cooperation with the teams focused on file recovery and, if needed, payment talks with the ransomware attacker. Forensics typically require the examination of logs, registry, GPO, Active Directory, DNS servers, routers, firewalls, schedulers, and basic Windows systems to check for anomalies.

Activities involved with forensics include:

• Isolate but avoid shutting down all possibly suspect devices from the network. This can require closing all RDP ports and Internet facing network-attached storage, changing admin credentials and user PWs, and setting up two-factor authentication to secure backups.
• Copy forensically valid digital images of all exposed devices so your file recovery team can proceed
• Save firewall, VPN, and other critical logs as quickly as feasible
• Establish the strain of ransomware used in the attack
• Inspect each machine and data store on the system as well as cloud-hosted storage for indications of encryption
• Inventory all encrypted devices
• Establish the type of ransomware involved in the attack
• Study log activity and user sessions in order to establish the time frame of the assault and to identify any possible sideways movement from the originally infected system
• Identify the security gaps exploited to perpetrate the ransomware assault
• Search for new executables surrounding the original encrypted files or system breach
• Parse Outlook PST files
• Examine email attachments
• Separate URLs from email messages and determine if they are malicious
• Produce extensive incident documentation to satisfy your insurance and compliance requirements
• Suggest recommendations to close cybersecurity vulnerabilities and improve workflows that reduce the exposure to a future ransomware exploit

Contact Progent about Progent's Ransomware Forensics Analysis Services
To find out more about ways Progent can assist you with ransomware forensics analysis, call 1-800-462-8800 or visit Contact Progent.