Cyber attacks are a reality for organizations large and small. Attacks frequently compromise personal and business data, so it’s crucial to respond quickly and effectively when security breaches occur. Organizations without an adequate incident response plan struggle to control and minimize damage, preserve evidence, provide quick and efficient recovery, prevent similar future events and gain insight into the threats. Responding to modern day information warfare requires exceptional technical expertise to detect and respond to the latest cyber threats originating from an incomprehensible amount of attack vectors.

38North routinely handles and responds to cyber incidents for federal, commercial and international organizations. We shut down attacks through disciplined preparation, delicately manage the aftermath and offer the detail-oriented expertise necessary to enforce the chain of custody and coordinate with law enforcement.

Incident Response page picOur approach to incident response planning adheres to the incident response lifecycle recommended by NIST Special Publication 800-61 Computer Security Incident Handling Guide:

  • Preparation: We set the foundation by developing a robust incident response capability for your organization based on an incident response plan that’s complete with supporting policies and procedures. Existing infrastructure, technology and resources are utilized to the greatest extent possible, ensuring a cost effective incident prevention strategy.
  • Detection & analysis: We develop step-by-step instructions for your personnel to routinely detect, prioritize and analyze security events for signs of incident. We also equip you with detailed checklists that are tailored to your existing infrastructure environment.
  • Containment, eradication & recovery: Based on the severity of potential incidents, we develop containment strategies to minimize the impact on your resources and minimize damage. Remediation approaches may also call for the preservation of an evidence trail to support investigations from forensic and/or law enforcement teams. Eradication may be necessary to eliminate all malicious sources of the incident while also mitigating any vulnerability exploited. Recovery protocol and procedures are created to ensure systems can return to normal operations.
  • Post-incident activity: Learning from incidents is critical to ensure your business can improve and evolve its incident response capability. We provide the necessary tools to conduct post-activity review while gaining better insight into your incident handling process.

Whether you need assistance with an incident response plan or incident training exercises, our incident response experts are ready to offer their assistance. Contact us today!

What’s the benefit of an incident response capability?

An Incident Response capability allows organizations to respond to incidents systematically so that appropriate action can be taken to help minimize loss or theft of information and disruption of services caused by incidents. Another benefit of incident response is the ability to use information gained during incident handling to better prepare for handling future incidents and to provide stronger protection for systems and data. An incident response capability also helps with dealing appropriately with legal issues that may arise during incidents.