• 0 Posts
  • 76 Comments
Joined 1 year ago
cake
Cake day: June 18th, 2023

help-circle



  • Quite a lot, actually. This is really a summation and not comprehensive.

    • Evaluate an environment after incident:
      • looking for IOCs, determine spread
      • Determine backup status and restore if possible
      • Return environment to healthy state (AD restore, replication, networking, etc.,)
      • Lockdown of security holes
      • Advise on best practices going forward
    • Decrypt environment if client pays ransom

    etc., etc.

    Depending on the complexity of the environment, this can take a lot of time and effort: much bigger than most internal teams are capable of doing. A client I had in Feb-Mar lasted a total of 3200 hours of work between 12 people on my team across 34 locations to unfuck the situation.