Panel | Going Dark: DOS’ing Yourself for the Better
Panelists: Ryan Chapman, Certified Instructor and Author, SANS Institute
Michael Rogers, Sr. Director Technical Advisory Services, MOXFIVE
Chris Brewer, Director, Unit42
Allan Liska, CSIRT, Recorded Future
Through this discussion I plan on leverage lessons learned and examples from having the opportunity to be responsible for these decisions for a large amount of ransomware incidents from a forensics and recovery viewpoint. The debate over whether to cut off internet access during a ransomware investigation is complex and depends on various factors, including the nature of the attack and the organization's security posture. Real-world examples show how leaving the internet open during an investigation can lead to continued exfiltration and compromise, while cutting off internet access can enable more rapid investigation and provide valuable intelligence. The discussion should focus on what level of maturity companies need to properly maintain internet access during an attack and what scenarios warrant cutting off access. Adequate visibility and basic controls, such as segmented backups, active directory backup, and EDR coverage, are essential for making informed decisions. Ultimately, the decision requires careful consideration and planning to mitigate the risks and protect sensitive data.
6