Incident Response

A SIEM collects the logs from firewall, servers, endpoints and cloud in one place and compares them. A single failed login means nothing. Two hundred of them in four minutes, followed by a successful one, are the start of an incident.

Typical sequence: at half past two in the morning the correlation reports an unusual data outflow. Minutes later the on-call engineer is at the screen and first checks whether this is a backup job or not.

First we stop the spread. Depending on the situation we isolate infected systems, lock user accounts or adjust firewall rules.

Typical sequence: in a ransomware attack we cut the affected systems off from the rest of the network before the encryption spreads beyond the first server. How much can be saved depends on how early detection kicks in, so we do not promise a recovery rate in advance.

Using forensic methods we establish where the attack started, how far it reached and what it did.

Typical sequence: after a database breach we go through the logs for the period, identify the vulnerability that was used and record which data sets were affected. This is the basis for a notification under Article 33 GDPR and also settles whether a notification is needed at all.

The analysis turns into a plan: what has to come off the network at once, what gets rebuilt and which credentials count as compromised. The order follows what costs your operations the least.

Typical sequence: if an attacker has held access for months, we remove it in stages. First we close the ways in, then we remove the tools, and finally all credentials are renewed. Doing it in a different order tells the attacker that they have been found.

We restore the affected systems and close the gap the attack came through.

Typical sequence: after a successful phishing attack, resetting the affected accounts is not enough. It also takes a second factor, a stricter filter and training on exactly the pattern that worked.

At the end there is a report covering what happened, the affected systems, the gap where it started and the measures that close this route for good.

Typical sequence: you receive a timeline of the incident, an assessment of the weaknesses that were exploited and a list of measures sorted by effort and effect, so you decide what happens first.