Cybersecurity
Ransomware readiness
Ransomware is mostly an identity, backup and recovery problem. We look at the paths attackers use to reach domain control, whether backups survive them, and whether your team knows what to do on the first morning.
The problem this service solves
Ransomware crews often spend days or weeks in a network before encrypting anything. They harvest credentials, find backups, disable security tools and then deploy at a time of their choosing. Organizations that recover well have backups the attacker could not reach, limited administrative paths, and a rehearsed decision process.
We look at each stage of that chain, test your recovery assumptions and walk leadership through the decisions that come up.
What is in scope
-
Initial access paths
Exposed remote access, phishing resistance, multi-factor authentication coverage and vulnerable edge devices.
-
Privilege and identity
Active Directory tiering, privileged access, service accounts and credential exposure.
-
Segmentation
Whether an infected workstation can reach servers, backups and management systems.
-
Backups
Isolation, immutability, credentials, restore testing and recovery time for critical systems.
-
Detection and response
Endpoint coverage, tamper protection, alerting on precursors and the first-response playbook.
-
Decision exercise
A tabletop for executives covering isolation, communication, legal, insurance and payment questions.
How the work runs
Assess
Find the weak links.
-
1
Control review
Examine identity, network, endpoint and backup configuration.
-
2
Attack path analysis
Show how an attacker could get from a workstation to domain control and backups.
Test
Check recovery.
-
3
Restore test
Restore a representative system from backup and measure the time and effort.
-
4
Tabletop
Walk leadership through a ransomware scenario.
Plan
Prioritize.
-
5
Readiness plan
Sequence fixes: quick wins first, then structural changes.
What you receive
- Readiness assessment by control area
- Attack path analysis to domain control and backups
- Restore test results
- Tabletop findings and decision checklist
- Prioritized action plan
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Backup architecture documentation and read access to consoles
- Active Directory read access
- Executives available for a tabletop
What this service is not
- A ransomware negotiation service
- A guarantee against ransomware
What changes afterwards
- Backups survive a domain compromise
- Administrative paths are reduced
- Leaders know their first decisions
Questions people ask
Are immutable backups enough?
They help a lot, but only if you can restore from them in an acceptable time, and if the attacker cannot reach the backup management plane. We test both.
Do you help with insurance questionnaires?
We can provide technical facts about controls to support your answers. We do not complete questionnaires on your behalf.
Related
-
Tabletop exercises
Facilitated discussions where executives and technical teams work through a realistic incident, find gaps and agree changes.
-
Active Directory security
Find attack paths to domain control: delegation, ACLs, Kerberos, certificate services, legacy protocols and tiering.
-
Privileged access management
Design and implement controls for administrator, service and cloud privileged accounts: vaulting, just-in-time access and session control.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response