RE: https://infosec.exchange/@pwr2/116956792232667129
#Pwr2 #LiveWargame #Solution ⚔️
Solution from last week:
-
In practice: often crisis board is established while the administrators secure logs and backups. Common pitfalls are that backups are restored immediately and there is no documentation. Such a measure destroys evidence and brings no benefit because systems are encrypted directly again.
-
The incident could also be reported to the authorities. While this is a valid point, maybe it is better to first gather more information what happened.
-
As for paying ransom: please do consult a legal expert before paying ransom. Ransom payments itself could already be illegal and bring more trouble.
🛡️ Stay secure.