Ransomware and Cyber Extortion: Response and Prevention

Chapter 6

Investigation

Knowledge itself is power.

—Sir Francis Bacon

Learning Objectives

• Understand the purpose of investigating a cyber extortion attack

• Gain strategies for identifying an adversary and using this knowledge to inform the response

• Articulate techniques for scoping an attack, including identifying indicators of compromise, tracking down “patient zero,” and developing a timeline

• Understand how and why to preserve evidence in cyber extortion cases

• Learn the fundamentals of data breach investigations and how they relate to cyber extortion attacks

As soon as a cyber extortion attack is discovered, the investigation begins—at least informally, if not formally. Investigation refers to the process of systematically uncovering facts ...