A New Capability for Incident Responders: Deny Privileged Access

For a fire to spread, it needs oxygen. For a ransomware infection to spread, it needs privileged access. In this webinar, we’ll detail how several organizations stopped ransomware attacks by revoking administrator access from their Windows servers and workstations. In one example, the IR practitioners were able to revoke administrator rights across ~6000 servers in under six hours — without disrupting ongoing business operations. Learn how containing it so quickly allowed the organization to downgrade the intrusion from a major breach to a minor incident. Join Paul Lanzi, Co-founder and COO of Remediant as he discusses, in the context of the real incidents he has worked on, the role of privileged access (specifically 24x7 administrator rights) in the spread of attacks and how revoking these rights can be the fastest path to containment and attacker eviction. The webinar will cover the technical aspects of this new approach, but is equally useful for those without a deep background in Windows security.