Implementing the Lessons Learned From a Major Cyber Attack
summary
Maersk recounts that NotPetya knocks out most services within seven minutes and does the bulk of damage in an hour, wiping online backups and all but one Active Directory node, forcing a rebuild that takes Active Directory back in nine days and prompting a policy to aim for 24 hour AD recovery. Response builds 2,000 laptops, uses CrowdStrike and CyberArk for endpoints and privileged access, formalizes WhatsApp-based incident teams, runs continual forensics and red teams, and applies a risk‑triangle for selective standby recovery.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 2:05Overview
- 3:23Maersk
- 5:54The Golden Hour
- 8:17NotPetya
- 11:46Active Directory
- 16:40Recovery
- 18:36Logistics
- 20:30Changing threat landscape
- 28:12Applying the lessons
- 30:52Resilient Active Directory
- 32:37Target Operating Models
- 33:43OT Frameworks
- 37:29Security Operating Principles
- 39:43The TwoWay Process
- 41:03How did the person who brought the malware come forward
- 42:54Why did you choose the cloud
- 45:27The danger of fighting the last war
- 48:51Riskbased approach
related talks
21mRansomware Attack: Lessons Learned
32mRansomware, Risk, & Recovery: Protecting and Creating Resilience for Hybrid Active Directory
45mResilience Under Fire: Lessons from Cyber Defense in Ukraine
39mBattle-Tested Incident Recovery: Lessons from the Front Lines
10mBehind the Next Destructive Attack
54mExperience a simulated ransomware event: Learn now to prevail later
40mIncident Response – How to Give the Advantage to the Hackers!
52mHow to prevent cyber-attack, & what to do when attacked?