Creative IT
020 7394 2529Report an incident

RANSOMWARE RESPONSE / STEP 04

Post-Incident Hardening

Recovering the data is only half the job — if the gap that let the attacker in is still open, you're just waiting for a repeat. Hardening looks at how the compromise happened and closes that specific route, rather than offering generic advice.

01

Identify the entry point

We work out how the attacker actually got in — a VPN without MFA, an exposed remote-desktop port, a phishing email — rather than assuming.

02

Review your backup strategy

We check whether backups are isolated from the systems they protect, and recommend changes so a future incident can't reach them too.

03

Tighten access controls

Multi-factor authentication, VPN configuration and least-privilege access get a practical review, focused on the gap that was actually used.

04

Set up monitoring

We recommend monitoring and alerting so early signs of a repeat incident get caught in minutes, not weeks.

This is scoped to the incident we just handled, not a generic security audit — closing the specific door that was used to get in. Start a case on the contact page, or see the full ransomware response overview.

THE REST OF OUR RANSOMWARE RESPONSE

Also covered

01

Rapid Triage & Containment

We help isolate affected systems and stop the spread while we assess what's actually been encrypted or destroyed.

02

Ransomware Data Recovery

Recovering encrypted files from shadow copies, partial backups, unaffected volumes and the encrypted data itself, wherever possible — often without paying the ransom.

03

Compromise Assessment

Not sure if you've actually been breached? We check for signs of unauthorised access, malware and data exfiltration.