Ransomware Response Services in Edison

Progent's Ransomware Forensics Analysis and Reporting in Edison
Progent's ransomware forensics experts can capture the system state after a ransomware attack and perform a detailed forensics analysis without impeding the processes required for operational resumption and data recovery. Your Edison organization can utilize Progent's ransomware forensics documentation to counter future ransomware attacks, validate the recovery of encrypted data, and comply with insurance carrier and regulatory reporting requirements.

Ransomware forensics involves tracking and documenting the ransomware assault's storyline across the targeted network from start to finish. This audit trail of the way a ransomware attack travelled through the network assists you to assess the impact and brings to light weaknesses in policies or processes that should be rectified to avoid future break-ins. Forensic analysis is typically given a top priority by the insurance provider and is often mandated by government and industry regulations. Since forensic analysis can be time consuming, it is vital that other key recovery processes such as business continuity are performed in parallel. Progent has a large team of information technology and cybersecurity experts with the knowledge and experience required to perform activities for containment, business resumption, and data recovery without interfering with forensic analysis.

Ransomware forensics investigation is complex and calls for close cooperation with the groups responsible for file recovery and, if needed, payment discussions with the ransomware attacker. Ransomware forensics typically require the examination of all logs, registry, Group Policy Object, Active Directory, DNS servers, routers, firewalls, scheduled tasks, and basic Windows systems to check for variations.

Activities involved with forensics analysis include:

• Detach but avoid shutting off all potentially affected devices from the system. This may involve closing all RDP ports and Internet facing NAS storage, changing admin credentials and user PWs, and configuring two-factor authentication to guard your backups.
• Preserve forensically valid digital images of all suspect devices so the file recovery group can get started
• Save firewall, virtual private network, and other critical logs as soon as feasible
• Determine the type of ransomware used in the attack
• Examine every computer and storage device on the network including cloud storage for indications of encryption
• Inventory all encrypted devices
• Establish the kind of ransomware used in the assault
• Review logs and sessions to determine the timeline of the ransomware assault and to spot any potential sideways migration from the first infected machine
• Understand the attack vectors exploited to perpetrate the ransomware attack
• Search for new executables surrounding the original encrypted files or system compromise
• Parse Outlook PST files
• Examine attachments
• Separate URLs from email messages and determine whether they are malware
• Provide extensive incident reporting to meet your insurance and compliance requirements
• List recommendations to close cybersecurity gaps and improve workflows that reduce the exposure to a future ransomware breach

Contact Progent about Ransomware Forensics Services in Edison
To learn more about ways Progent can assist your Edison organization with ransomware forensics analysis, call 1-800-462-8800 or see Contact Progent.