Ransomware Response Consulting Services in Atlanta

Overview of Progent's Ransomware Forensics Investigation and Reporting in Atlanta
Progent's ransomware forensics consultants can preserve the system state after a ransomware assault and carry out a detailed forensics investigation without disrupting the processes required for operational resumption and data recovery. Your Atlanta business can utilize Progent's forensics report to combat subsequent ransomware attacks, validate the restoration of lost data, and meet insurance and governmental mandates.

Ransomware forensics analysis involves determining and documenting the ransomware attack's progress throughout the targeted network from beginning to end. This audit trail of how a ransomware attack travelled through the network helps your IT staff to assess the damage and highlights shortcomings in rules or work habits that need to be rectified to prevent later break-ins. Forensic analysis is usually assigned a high priority by the insurance provider and is typically required by state and industry regulations. Because forensics can be time consuming, it is critical that other important activities such as business continuity are pursued concurrently. Progent has an extensive roster of information technology and security experts with the knowledge and experience required to carry out the work of containment, operational continuity, and data restoration without interfering with forensics.

Ransomware forensics investigation is time consuming and requires close interaction with the groups responsible for file recovery and, if necessary, settlement negotiation with the ransomware attacker. Ransomware forensics typically involve the review of logs, registry, Group Policy Object (GPO), Active Directory, DNS servers, routers, firewalls, schedulers, and core Windows systems to look for variations.

Services involved with forensics investigation include:

• Disconnect but avoid shutting down all possibly suspect devices from the network. This may involve closing all RDP ports and Internet connected NAS storage, changing admin credentials and user passwords, and setting up two-factor authentication to protect backups.
• Capture forensically complete digital images of all suspect devices so the file recovery team can proceed
• Save firewall, VPN, and additional key logs as quickly as feasible
• Determine the kind of ransomware involved in the assault
• Inspect every computer and storage device on the network as well as cloud-hosted storage for indications of encryption
• Catalog all compromised devices
• Establish the type of ransomware used in the assault
• Review log activity and user sessions to determine the timeline of the ransomware attack and to spot any possible sideways migration from the first compromised system
• Understand the attack vectors exploited to perpetrate the ransomware attack
• Search for new executables associated with the original encrypted files or network compromise
• Parse Outlook PST files
• Examine email attachments
• Extract any URLs from email messages and check to see if they are malware
• Provide detailed attack documentation to meet your insurance carrier and compliance regulations
• Document recommended improvements to close security gaps and enforce processes that reduce the exposure to a future ransomware breach

Contact Progent about Ransomware Forensics Analysis Expertise in Atlanta
To find out more information about how Progent can help your Atlanta organization with ransomware forensics, call 1-800-462-8800 or visit Contact Progent.