Ransomware Response Consulting Experts

Overview of Progent's Ransomware Forensics Investigation and Reporting Services
Progent's ransomware forensics consultants can preserve the system state after a ransomware attack and perform a comprehensive forensics investigation without impeding activity required for operational resumption and data restoration. You can use Progent's post-attack forensics report to counter subsequent ransomware assaults, assist in the recovery of lost data, and comply with insurance carrier and governmental reporting requirements.

Ransomware forensics is aimed at determining and documenting the ransomware attack's storyline across the targeted network from start to finish. This history of the way a ransomware attack progressed through the network helps your IT staff to evaluate the impact and brings to light vulnerabilities in security policies or processes that should be corrected to avoid later breaches. Forensics is commonly assigned a top priority by the cyber insurance carrier and is often mandated by state and industry regulations. Since forensic analysis can take time, it is critical that other key activities such as business continuity are pursued concurrently. Progent has a large roster of IT and data security professionals with the skills required to perform activities for containment, operational resumption, and data restoration without interfering with forensics.

Ransomware forensics is complicated and calls for intimate interaction with the groups responsible for file recovery and, if necessary, payment negotiation with the ransomware adversary. Forensics typically involve the review of all logs, registry, GPO, Active Directory, DNS servers, routers, firewalls, schedulers, and basic Windows systems to look for variations.

Services involved with forensics investigation include:

• Isolate but avoid shutting off all possibly impacted devices from the system. This can require closing all Remote Desktop Protocol (RDP) ports and Internet facing network-attached storage, changing admin credentials and user PWs, and configuring 2FA to secure backups.
• Copy forensically valid images of all suspect devices so your file recovery group can proceed
• Save firewall, virtual private network, and other key logs as soon as feasible
• Identify the type of ransomware involved in the attack
• Survey each computer and data store on the system as well as cloud storage for indications of encryption
• Inventory all encrypted devices
• Establish the type of ransomware used in the assault
• Review logs and sessions to determine the time frame of the assault and to spot any potential lateral movement from the first compromised machine
• Understand the attack vectors exploited to carry out the ransomware assault
• Look for the creation of executables associated with the first encrypted files or system breach
• Parse Outlook web archives
• Analyze email attachments
• Separate any URLs embedded in email messages and determine whether they are malicious
• Produce extensive attack documentation to meet your insurance and compliance mandates
• Suggest recommended improvements to shore up cybersecurity gaps and improve processes that reduce the exposure to a future ransomware breach

Contact Progent about Progent's Ransomware Forensics Services
To find out more about how Progent can help you with ransomware forensics, call 1-800-462-8800 or see Contact Progent.