The preparation phase refers to the preparation of all actors involved for a cyber security incident. We distinguish between internal and external preparation. The internal preparation refers to all preparations to be made within the DFIR team of SECUINFRA (documentation of customer information, training/certification, further development of tools and technologies, research of new attack methods/groups, …). 

The external preparation happens with you as a customer, optimally before the occurrence of a Cyber Security Incident. If you choose our DFIR framework contract, we will prepare you for a Cyber Security Incident during the onboarding process. In addition, we offer and recommend an annual service review, among other things, to prepare your organization for changing threat conditions. If you have already been affected by a cyber security incident, we are also prepared to provide you with professional ad-hoc support.

The aim of the Identification Phase is to identify deviations in your infrastructure. In this context, we determine whether such deviations represent a cyber security incident for you as a customer. This also includes the classification of the incident into the corresponding criticality.

Among others, the following elements can serve to identify Cyber Secuirty Incidents or will be considered in consultation with you:

• Establishment of monitoring to monitor and detect deviations in IT systems and IT infrastructure.
• Identification of compromised systems using Compromise Assessment.
• Analysis of events from various sources such as log files, error messages or warnings from security tools.
• Identification of a cyber security incident by correlating data from multiple sources.

Containing the damage but also preventing further damage from the current Cyber Security Incident occurs in the Containment Phase. Several steps are required to fully contain the Cyber Security Incident and at the same time prevent the destruction of evidence that might be needed for law enforcement.

In this context, we distinguish between short-term and long-term containments.

Short-term containments limit damage before the Cyber Security Incident worsens. Typically, this is done by isolating network segments and/or compromised assets, routing them to failover* , or shutting down the compromised assets. The latter should only be considered if other containment steps are not possible or take too long and could cause too much damage.

*Failover is a backup mode of operation that automatically switches to a standby database, server or network when the main system fails or is shut down for maintenance.

Long-term containment includes applying temporary fixes to bring production systems back online. The main focus is on eliminating user accounts or backdoors that attackers may have left on the systems. Another main focus is on the elimination of the root cause, e.g., fixing a defective authentication mechanism or fixing a vulnerability that led to the attack.

In the eradication phase, the aim is to actually remove malware or other artifacts introduced by attacks. If possible, the systems are completely cleaned up or a secure recovery is prepared. All possible measures for eradication are discussed and implemented with involved contacts.

The following elements, among others, may be applied as Eradication Steps during a Cyber Security Incident or will be considered in consultation with you:

• Re-imaging of compromised assets ensures complete deletion of all malicious content.
• Elimination of root cause such as patching the vulnerability exploited by the attacker.
• Applying basic security best practices such as updating old software versions or disabling unused services.
• Scanning for malware or remaining IOCs using security solutions such as antivirus, EDR, and/or IOC scanners to ensure that all malicious artifacts have been removed.

After the complete cleanup, we support you in the recovery phase to restore your system landscape. Together with you, we create a sustainable recovery plan. A recovery plan provides, for example, for the secure setup of the systems in a partitioned network area, which is only migrated to a productive network once the cleanup is complete.

The following elements, among others, can be implemented as recovery measures in consultation with you as the customer:

• Setting a time and date for restoring operations.
• Testing and Verification – Testing and verification is intended to ensure that systems are clean and fully functional when they go live.
• Monitoring – Ongoing monitoring for some time or permanently (this is more recommended) after the Cyber Security Incident to observe operations and check for abnormal behavior.
• Further measures to prevent a recurrence of a Cyber Security Incident We can offer you our managed or co-managed services with 24/7 monitoring in this framework. Please contact us.

After the security incident has been completed, all relevant information about the security incident is summarized in the final phase and lessons learned are derived for future incidents and measures.

If required, all relevant results are presented and discussed with you in a final workshop. If desired, lessons learned can be fed back into the preparation phase in order to trigger the Incident Response Lifecycle again for continuous improvement.