Service

The Incident Response process includes:

Identification
Identifying factors related to the incident and clarifying the attack vector through digital forensics.

Containment
Implementing temporary containment measures and isolating affected assets, followed by long-term measures such as patching and configuration remediation.

Remediation
Resolving the incident, including malware removal, security vulnerability patching, and data backup.

Recovery
Restoring affected systems and monitoring them to ensure the incident has been fully resolved.

Lessons Learned
Compiling a detailed report, proposing preventive solutions, and drawing insights for future incidents.

a. Intake

• Receive information regarding the time of attack, consequences, and current system status
• Assess the situation: past attack, ongoing attack, or altered system state
• Determine the scope of the incident: entire system, specific computer, or data

b. Incident Classification

• Phishing attacks
• Ransomware attacks
• Sabotage attacks
• Other forms of attacks

c. Evidence Collection

• Contact information
• System network diagram
• Affected targets
• System access accounts
• System logs
• Memory and network connection status
• Samples of compromised data
• Malware samples

d. Analysis

• Analyze vulnerabilities in servers, network devices, and software
• Analyze log samples
• Construct a timeline of events before, during, and after the incident
• Analyze malware

e. Reporting

• Compile a comprehensive investigation report based on digital evidence
• Determine the root cause and remediation results
• Propose information security improvements regarding processes, hardware, and software

• Respond to incidents with speed and precision
• Conduct investigations using consistent procedures
• Minimize data loss and reputational damage
• Strengthen existing security protocols and processes
• Ensure rapid recovery and limit business disruption
• Support the prosecution of threat actors through evidence and documentation