Handling Ransomware Incidents: What YOU Need to Know!

Handling ransomware incidents is different from handling other types of incidents. What do you need to know and/or verify as you scope the incident? Have you established both an Incident Response Team team AND a Business Incident Response Team (BIRT)? Did you identify the threat actor pre-encryption or post-encryption? If pre, what steps do you take to avoid encryption? What steps do you take NOW to avoid further damage? Do you use a wait-and-see approach, or do you kick the actor out of your environment immediately? Join SANS FOR528: Ransomware for Incident Responders (sans.org/FOR528) course author Ryan Chapman in this conversational-style talk to discuss the how, what, and when when it comes to handling ransomware incidents.

[@itguy1]

Awesome speaker, learned a lot and laughed my butt off quite a few times 😂😂

[@PtolemyPetrie]

It's actually very simple. Pull the drive of the affected machine, and plug into known good machine as a non booting drive, point your scanners at the affected drive, probably labeled e: or f: remove the ransomware once detected by your scanner. Alternatively you can boot a malware removal disc like Dr web, and point it at scanning the drive.

[@TheRaghav12345678910]

??? You do know that ransomware encrypts the files right? Do you want to remove all the encrypted files? That defeats the whole purpose

[@PtolemyPetrie]

doesn't matter, you're not booting the drive. there are tools you can run to remove the infection, i have removed ransomware and free av and many scareware this way. The encrypted files are not removed.

[@user-se1pt3mk3z]

Absolutely Fantastic !! Learnt a lot.

[@kacatley9258]

Tremendous work... great info and entertaining! Thanks!

[@ByteBudsBites]

❤thank you

[@MISTYEYED.]

❤🎉