Get Help with Incident Response

What is Incident Response? Get Help

Incident Response can help get you through a Data Breach involving, encryption, ransomware, viruses, and other business outages. For that, you need an experienced and responsive team that will understand how your company operates and restores services.

Do you have an Incident Response Plan?

If the answer is “I don’t know” or “No” then we need to immediately talk.

Have you recently tested your Incident Response Plan?

If you answered no, then there is a high probability that it’s out of date and at this time you should consult with an Incident Response Professional.

Do you have to pay the Ransom?

Short answer is, no. If you have good backups your job is safe for now.

Are your critical servers or data encrypted by ransomware?

If yes, then let’s hope you have good backups. If not, you will need to pay the ransom or start rebuilding everything. Decrypting Ransomware is an almost impossible task.

Did you know a Data Breach occurs every 40 seconds? Most companies will never recover or suffer enormous economic losses.

50% of Breached Companies will not recover from a Ransomware or Cyber Attack, and almost 80% don’t know how to implement an Incident Response plan.

Most companies are left with common questions like:

• What does an Incident Response do?
• How can I improve my Incident Response?
• What are the steps to build an Incident Response Plan?

First let’s start with the obvious question. An Incident Response Plan will help you think about the steps to take in restoring business systems post data breach or incident. It is the precursor of critical thinking on how you restore systems, what systems should be restored first, who will need to be involved to help execute that work, and how you will prevent another incident from happening again.

In most cases, you don’t know if your process is good, bad, or needs to be improved until you actually run through it. Unfortunately, most companies either don’t have a plan, and if they do it’s most likely outdated or irrelevant, because people, process, or technology changes over time. As a result, it’s important to perform dry-runs by simulating an incident so you can rinse and repeat the procedures.

Like, we mentioned above, an Incident Response Plan should be built with several main categories that are outlined below. The important factors to prepare you for an incident is to test these processes and procedures, and refine them. Leverage your technology partners, vendors, suppliers on how their technology can help. It’s critical to know your strengths and weaknesses in case of crisis. 

Incident Response Plan Example

This IR Plan is an example of a standard industry process. Each organization and industry has different Incident Response steps. This is ONLY an example of common IR Plans. As a result, please ensure you consider all internal and external dependencies required to restore system services and data availability post Data Breach or Incident.

1. Detection

• Incident Engagement Kickoff
• Assign Incident Technical Lead
• Assign Communications Lead
• Assess What is Known Facts
• Evaluate Incident (categorize by severity levels)
• Triage – Control and Prevent

2. Response

• Engage Incident Response Teams (Internal and External)
• Provide Known Facts
• Evaluate Response effort

3. Resolution

• IR Team Investigation
• Engage Additional Resources (if needed)
• Isolate/Limit Incident Issues
• Deploy Cyber Defense Countermeasures
• Begin Remediation & Mitigation Process
• Establish and Initiate Scans & Detection Technologies
• Restore Services

4. Communication

• Evaluate & Document New Known Facts (including Timelines)
• Consult with General Counsel
• Determine Required Communications

5. Close

• Establish Lessons Learned Document
• Open Discussion “Cause and Effect”
• Open Internal Audit Tracking Item for 12-month Remediation Status Report
• Improve or Change IR Process
• Assign Long-term Remediation Effort

5 Immediate Steps Recommendations after a Cyber Incident / Data Breach

Our Incident Response Team is available to help restore your business operations after a data breach or cyber security incident. However, your immediate action will directly impact out ability on how fast we can help restore your critical business applications and services. Any delays will further complicate efforts and costs.

1.

Shutdown Network or LAN Segment Connectivity

1.  In some cases, disconnect or shutdown the WAN cable, interface, or Internet Service Provider (ISP).
2. If Ransom note is discovered DO NOT contact them.

2.

Isolate, Quarantine Infected or Suspicious Host(s)

3.

Do Not Delete Systems, Files, Logs

• Preserving will only help expedite restoration and post forensic analysis.

 

4.

Start assessing if Data Backups from Tape, Snapshots, or Cloud are valid and not corrupt.

5.

Immediately Engage DefendEdge Incident Response Team.

Top Data Breach or Cyber / Information Security Incident causes:

• Stolen Credentials
• Social Engineering
• Application Vulnerabilities
• Malware
• Insider Threat
• System Configuration

Get Help with Incident Response