Regardless of the security measures implemented, there is always a possibility of an attacker getting access to the environment. In case such event happens it is key to make quick and resolute decisions on how to proceed.

Approach

Depending on the situation the following activities can be performed:

• Get the systems running again as soon as possible;
• Identify the systems that are affected and any backdoors that might be installed;
• Identify the way the attacker managed to compromise the network or system;
• Collect forensic evidence of the attack;
• Perform forensic analysis on any malware identified.

At our first moment of contact we will decide which activities are relevant to your situation.

Experience

In my career I have been working on a variety of incidents ranging from infected workstations at a bank to a malfunctioning PLC in an industrial network. At these incidents I was both involved from a management perspective as well as in the deep technical investigations.

If your organization is currently experiencing an incident, don’t hesitate to call me right now to discuss the situation and take the appropriate next steps!