Case Study: Emergency IT Services for a Law Firm Under Ransomware Attack
Overview
A prominent law firm faced a severe ransomware attack that brought their operations to a halt. The incident originated from an inexperienced technician’s installation of a multifunction printer driver on a business-critical server, exposing vulnerabilities in their computer system. The technician’s oversight led to the creation of an administrative account with a simple password, which became the entry point for the cyber attack.
Nettology stepped in to resolve the crisis, secure the network against further security breaches, and implement robust solutions to prevent future incidents, safeguarding against human error and potential threats like natural disasters or cyber attacks. Additionally, they bolstered the firm’s defenses against potential breaches through cloud services and ensured the protection of sensitive data accessed through mobile devices. Throughout the process, Nettology provided exceptional customer service and collaborated closely with the firm’s team members to mitigate the impact of the attack and fortify their operating system’s security.
The Challenges
Firewall Vulnerability and Account Compromise
The law firm’s network was compromised due to a firewall vulnerability, which allowed attackers to exploit the weak administrative account created during the printer driver installation. This account was then used to inject ransomware into the system.
Encrypted Data and Operational Standstill
All data on the client servers was encrypted, rendering the firm unable to access client information for 15 days. This inability to process legal work resulted in the loss of clients and significant operational disruptions.
How Nettology Helped
Rapid Response and Diagnosis
Nettology acted swiftly to diagnose and troubleshoot the breach. Our team identified the source of the attack, locked down the firewall, and disabled the compromised and other rogue accounts that had been created.
Data Recovery and Server Rebuilding
Due to the firm’s inadequate file-level cloud backup and the absence of an image-level backup, data recovery was a lengthy process. Nettology managed to restore the client data, but the recovery took considerable time as the servers had to be rebuilt and applications re-installed.
Implementing Best Practices and Robust Security Solutions
To prevent future incidents, Nettology instituted several key measures:
- Vendor Management: Established best practices and procedures for vendors accessing the network to ensure tighter control and security.
- Firewall Replacement: Replaced the vulnerable firewall with a Cisco ASA, providing enhanced security features and better protection against future attacks.
- Business Continuity Solution: Implemented a Datto Business Continuity solution, which backs up the entire image of the servers multiple times a day and stores it in a secure data center. This ensures that, if another disaster recovery-level event occurs, data can be quickly and reliably restored.
The Outcome
Enhanced Security and Data Protection
The law firm now benefits from a much stronger security posture. The new Cisco ASA firewall and Datto Business Continuity solution provide robust protection and quick recovery capabilities, significantly reducing the risk of future disruptions.
Operational Resilience
With the implemented best practices and procedures, the firm is better equipped to handle vendor interactions and maintain secure network access. The continuous image-level backups ensure that, even in the face of a disaster, data recovery will be swift and comprehensive.
Improved Client Trust and Confidence
By swiftly addressing the ransomware attack and implementing these enhancements, Nettology helped the law firm regain client trust and confidence. The firm is now positioned to deliver reliable and uninterrupted legal services, bolstering their reputation and client retention.
Conclusion
Nettology’s rapid response and comprehensive solutions transformed a crisis into an opportunity for significant improvements in IT security and operational resilience for the law firm. This case underscores the importance of robust security measures and the value of having an experienced IT partner to navigate and mitigate complex challenges.
Interested in learning more? Give us a call today to schedule a chat.
