RE: https://infosec.exchange/@pwr2/116956792232667129 #Pwr2 #LiveWargame #Solution ⚔️ Solution from last week: - In practice: often crisis board is established while the administrators secure logs and backups. Common pitfalls are that backups are restored immediately and there is no documentation. Such a measure destroys evidence and brings no benefit because systems are encrypted directly again. - The incident could also be reported to the authorities. While this is a valid point, maybe it is better to first gather more information what happened. - As for paying ransom: please do consult a legal expert *before* paying ransom. Ransom payments itself could already be illegal and bring more trouble. 🛡️ Stay secure. #Cybersecurity #Infosec #DFIR