🔴 Active Ransomware Incident Response Day in the Life

Показать описание

Want to know what its really like when you get called into a business that is fully owned by #Ransomware ?

Who do you talk to first?
What's the first question you'd ask?
How do you deal with the adrenaline of being on the clock against cyber criminals?

Join #SimplyCyber as we welcome Eric Taylor, CEO of Barricade Cyber Solutions and Senior Incident Response Engineer who lives his life in the FIRES of ransomware.

Live engagement, ask your questions, leave with knowledge

#cybersecurity

Рекомендации по теме

Комментарии

What a great conversation. I wish I didn't have to sleep, I just can't learn this fast enough. Thanks so much for the great content!

CyberFraudDawg

Just 1.7K views? Fk, this information is amazing and that should viral.

diegoperez

I would be very careful advising clients on their cyber coverages as a non-insurance professional (licensed and whatnot).

It’s one thing to unofficially, non-professionally discuss the policy but can end up falling back on you as the cyber expert if the client assumed their policy provided coverage that the insurer denied because you told them it would be covered. Ofc it’s all dependent on your relationship w/ the client but just be wary Especially in this area of insurance that’s still sort of being worked out by carriers. It’s all kinda wonky rn.

jbrandona

incident response sounds dreadful i dont want anything to do with it if possible

trblmkr

What if you pay and the attacker don’t send you the key?

fetz

I find this IR response is severely lacking. At no point did he talk about hardening the active directory and evicting the attacker from persistence in active directories such as the SD holder or plethora of other ways the attackers maintain persistence. There was no talk about hardening using tiering and implementing laps or anything of that sort. And why in God's name would you remote directly into the customer's domain controller? You want to find a domain controller that has not been compromised if possible and do a complete Forest build from that domain controller and then reset the rid 500 account multiple times and reset the identities for all service accounts and reset the password for literally every account. None of this was talked about in this incident response Day in the life of. I say skip these guys and call Microsoft dart team. They do all of this stuff routinely.

AlienWarTycoon

🔴 Active Ransomware Incident Response Day in the Life

🔴 Active Ransomware Incident Response Day in the Life

Handling Ransomware Incidents: What YOU Need to Know!

Ransomware Attack Simulation

Ransomware Incident Response - The Real-World Story of a Ransomware Attack

Strategies for Active Defense against Pre-Ransomware and Ransomware Attacks

Learning to Combat Ransomware

Detecting & Hunting Ransomware Operator Tools: It Is Easier Than You Think!

SANS 2021 Ransomware Detection and Incident Response Report

How to Investigate a Ransomware Attack

Incident Response for Ransomware Attacks

AusCERT2023 - Ransomware Crisis Simulation with You in Control - Gavin Brown

Top 5 ICS Incident Response Tabletops and How to Run Them

SOC 101: Real-time Incident Response Walkthrough

Dealing with a Ransomware Attack: A full guide

Ransomware incident response plan | Cybersecurity leadership

Threat Detection & Active Response With Wazuh

Hunting Human Operated Ransomware Operators | 2020 Threat Hunting & Incident Response Summit

What You Should Know About Ransomware and Developing Incident Response Plans

The Truth about Ransomware: Its not Complicated!

Cyber Alerts & Tips - Active ransomware campaign leveraging remote access technologies

Living with Ransomware - The New Normal in Cyber Security

How the Arctic Wolf® Platform Stops Active Ransomware

Cybersecurity Threat Hunting Explained

Incident Response: What should you do when hit with Ransomware?