• 4 Posts
  • 408 Comments
Joined 1 year ago
cake
Cake day: June 18th, 2023

help-circle

  • Quite a lot, actually. This is really a summation and not comprehensive.

    • Evaluate an environment after incident:
      • looking for IOCs, determine spread
      • Determine backup status and restore if possible
      • Return environment to healthy state (AD restore, replication, networking, etc.,)
      • Lockdown of security holes
      • Advise on best practices going forward
    • Decrypt environment if client pays ransom

    etc., etc.

    Depending on the complexity of the environment, this can take a lot of time and effort: much bigger than most internal teams are capable of doing. A client I had in Feb-Mar lasted a total of 3200 hours of work between 12 people on my team across 34 locations to unfuck the situation.