This presentation will cover the different techniques that attackers have used to leverage initial access to a network. We will use data from recent cases that Sophos has investigated to show that a lack of preparedness in getting the foundational defence basics (such as MFA, Patch Management, IR plan, Asset management) in place is a key factor in the likelihood and impact of a serious attack.

The “prepare” aspect of a cyber defence strategy is imperative, so we will discuss how some of these can be addressed and how they can positively impact the recovery and remediation process in the event of an attack.

We will also provide walkthroughs and demonstrate how a ransomware attack actually affects an IT network, what to expect, what to plan for, how to react and what evidence to preserve so that an Incident Response engagement can effectively investigate.