← See all services
Ransomware response and analysis
After encryption or an intrusion, the decisions taken in the first hours shape what can be determined later. The analysis establishes what happened, how they got in and how far they reached — both to restore operations and to answer to clients, insurers or the data protection authority.
What can be established
- — The entry vector and when the initial compromise happened
- — The scope: which systems and which information were affected
- — Whether data was taken as well as encrypted
- — Remediation measures and how to prevent a repeat
What I need to start
- — The affected systems, powered down or isolated but not reinstalled
- — Logs from the servers, the firewall and the mail system
- — A timeline of what the internal team observed