.png){kind=logo}
From Ransomware to Resilience
A city government's incident response success story.
​
Project Information
THE CHALLENGE
The city experienced a live ransomware attack, encountered without the benefit of a prior tabletop exercise. Ransomware entered through a phishing email, then spread and encrypted systems across city and county government networks, disrupting core business operations. With operations down and the scope of the compromise still unclear, the city needed an experienced outside team to lead the response rather than improvising one under pressure.
THE CLIENT
A midsize city government in the Southeast that shares network infrastructure with its county, serving city and county residents on the same systems. It's a common setup in the public sector, where IT staff and budgets are stretched thin and an incident response plan often exists but has never been tested.
THE SECURANCE SOLUTION
Ran the incident response war room, coordinating the city's internal IT staff and other responders through a single command structure.
Directed containment and forensic evidence preservation for law enforcement and insurance, in parallel with recovery planning.
Determined which systems could be restored from clean backups versus which required rebuilding from scratch, and directed the reimaging of the affected servers and workstations.
Sequenced restoration by service criticality rather than simply by what was fastest to bring back online, to avoid reintroducing risk onto a still-compromised network.
Stayed on after recovery as the city's VCISO to turn the incident's lessons into a lasting security program.
CLIENT SUCCESS
Core city systems were back online within about a week. Securance has served as the city's VCISO ever since, helping it build a formal incident response program and stand up a virtual security operations center (vSOC). Together, those steps moved the city from crisis response to continuous monitoring and readiness. The city hasn't been hit by ransomware again.