Incident Response and Digital Forensics

Cyber Incident Response

We work with your team during a cyber incident. We preserve evidence, remove the attacker and restore your systems safely.

Schedule a Meeting All services in this area

What it is

Cyber incident response covers the period from detection of the attack until systems are safely restored. Evidence collection, containment, eradication and recovery follow a single plan. Disorganized or rushed response can alert the attacker and destroy evidence. Each step is sequenced based on what the evidence reveals about the attacker's path.

Scope

Collecting memory, disk images and logs from affected systems without alteration
Tracing the attacker in endpoint, identity and cloud logs
Containing accounts, systems and network connections
Removing persistence points and compromised credentials in a single coordinated action
Regular status updates for management, legal and communications teams
Technical input for regulatory notifications

The need

When organizations need it

When your SOC reports unknown software running with admin rights on a server.
When a business partner reports suspicious traffic reaching their systems from your network.
When an unexplained new administrator account appears on a critical system.

Method

How we work

Initial assessment

In the first call we clarify what was observed, which systems are affected and who will make decisions.
Preserving evidence

We collect memory, disk images and logs with hash values and record them in the chain of custody.
Containment

We determine the attacker's path from the evidence. We isolate accounts and systems along this path, according to your business priorities.
Eradication and recovery

We remove persistence in a single action. We restore systems in dependency order, under monitoring.

Outcome

What you have at the end

You see from the evidence that the attacker is removed and their access path is closed. You have the incident timeline and technical input for notifications.

Frequently asked questions

Should we shut down suspicious systems?

If possible, do not shut them down, but isolate them from the network. Shutting down erases evidence in memory. If isolation is not possible and encryption is ongoing, shutting down may be necessary.

Who reports the breach?

Your organization, as the data controller, is responsible for notification. Under GDPR and similar laws, notification is usually required within 72 hours of learning of the breach. We prepare the technical findings for the notification based on the evidence within this period.

How long does a response take?

It depends on the scope of the incident and how far back the logs go. The incident is contained first. Root cause analysis and full recovery follow.

Incident Response and Digital Forensics