Incident Response: Stopping a Live Ransomware Attack

A 30-user law firm suffered a ransomware attack, encrypting client files and disrupting operations. I quickly isolated the infected workstations within 30 minutes and restored 100% of data using Veeam backups, avoiding any ransom payment. To prevent future incidents, I implemented SentinelOne EDR and DNS filtering to block malicious traffic. The firm was fully operational within 8 hours, with no data loss, and increased cybersecurity training participation by 50%.