Anatomy of a Ransomware Attack Richard Sneed,
Description: Anatomy of a Ransomware Attack Richard Sneed, Principal Chief Bill Travitz, Director, EBCI Office of Information Technology The Attack- December 7, 2019 EBCI Ransomed by Sodinokibi Ransomware Timeline of Attack Initial Steps to Prevent
Related Topics
Download Presentation
"Anatomy of a Ransomware Attack Richard Sneed," is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Presentation Transcript
slide1. Anatomy of a Ransomware Attack Richard Sneed, Principal Chief
Bill Travitz, Director, EBCI Office of Information Technology<br>
slide2. The Attack- December 7, 2019 EBCI Ransomed by Sodinokibi Ransomware
Timeline of Attack
Initial Steps to Prevent Further Damage<br>
slide3. Assessment Phase Damage Assessment Process
Notification to Affected Parties
E 911 CAD Restoration
Discovery of Accounts used to carry out attack<br>
slide4. Evidence Preservation Phase Isolation and Mothball Existing Network
Backups of “Current State”
Restoration of Emergency Services<br>
slide5. Ransom Negotiations & Remediation Cyber Insurance Carrier Negotiation
Payment of Ransom
Forensic Analysis
Decryption Process<br>
slide6. Remediation Parallel Restoration
End User Device Clean-Up & Restoration
Full Cloud Implementation
Utilization of Azure<br>
slide7. Silver Lining Outdated Network Completely Replaced
State of the Art Network
Identity Centric Security
SaaS Deployment<br>
Bill Travitz, Director, EBCI Office of Information Technology<br>
slide2. The Attack- December 7, 2019 EBCI Ransomed by Sodinokibi Ransomware
Timeline of Attack
Initial Steps to Prevent Further Damage<br>
slide3. Assessment Phase Damage Assessment Process
Notification to Affected Parties
E 911 CAD Restoration
Discovery of Accounts used to carry out attack<br>
slide4. Evidence Preservation Phase Isolation and Mothball Existing Network
Backups of “Current State”
Restoration of Emergency Services<br>
slide5. Ransom Negotiations & Remediation Cyber Insurance Carrier Negotiation
Payment of Ransom
Forensic Analysis
Decryption Process<br>
slide6. Remediation Parallel Restoration
End User Device Clean-Up & Restoration
Full Cloud Implementation
Utilization of Azure<br>
slide7. Silver Lining Outdated Network Completely Replaced
State of the Art Network
Identity Centric Security
SaaS Deployment<br>