Battle-Tested Incident Recovery: Lessons from the Front Lines
summary
Unit 42 reports that 86% of incidents cause business impact and offers a tested recovery path that chooses between remediating the estate or rebuilding it, using a practical Sheep Dipping methodology to sanitize systems in an isolated environment, deploy EDR/XDR and immutable backups, and verify Indicators of Compromise before restore. Case specifics: attackers exfiltrated two terabytes and returned AI‑generated extortion notes; rapid intrusions can occur in 72 minutes, so staged, instrumented recovery is essential.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 4:13Ransomware trends
- 9:12Response frameworks gaps
- 16:55Ransomware crisis
- 21:06Incident recovery method
- 27:48Research call
- 28:11Q&A
related talks
40mIncident Response – How to Give the Advantage to the Hackers!
41mMore Than Backups and Hope
44mCyber Recovery: Your Power-Up in the World of IT Security
27m“Why are they asking me to do this?” or Adventures in IR Land
54mExperience a simulated ransomware event: Learn now to prevail later
49mTraining for Incident Response: The Red, the Blue, and the Ugly
06mA Battle Plan for Disaster Recovery in the Wake of Ransomare
20mCalcifying Crisis Readiness