Digital Forensics and Incident Response (DFIR)

• Host- based Compromise Assessment utilizing malware identification software
• Option 1: Selected critical endpoints
• Option 2: All endpoints across the enterprise
• Log analysis on selected endpoints applications and endpoints utilizing data analytics techniques
• Network Deception with decoys across landscape

• Analysis of endpoints and network traffic utilizing forensics and third party analysis tools
• Malicious activities profiling based on selected log files (for example proxy logs)
• Malicious communication identification
• Command and control analysis
• Sandboxing on detected executables for Malware Analysis
• File processing (e.g. file uploads) analysis
• Creation of Indicators of Compromise (IOC) and perform enterprise-wide sweep for similar compromise
• Further analysis such as digital forensics investigations if required
• Recommendations for immediate containment and eradication
• Recovery of systems and network to bring back operation at normal capacity

• Executive Summary
• Detailed analysis
• Threat intelligence (If any malware found)
• Recommendations on what further actions need to be taken in order to prevent similar attacks in near future
• Briefing sessions to discuss the findings & results

• Pre onboarding to clear pre engagement process, in order to be able to act swiftly when required
• Workshop: 2/4/8/ hour workshop to understand infrastructure and get to know team members and key contacts

• Incident Notification by Hotline or Email
• Get service level agreement (SLA) details for Remote and Onsite consulting. 1 hour/2 hour/4 hour/8 hour SLAs are available.

• Cyber Team on Standby 24x7
• Prepaid hours with discounted per hour rate
• Unused hours: Don't lose the hours your paid for, can be used for other Proactive Cyber Security Services

Our investigators create an exact duplicate of the media in question using a hard drive duplicator or specialized softwares. To prevent tampering, the original media is secured in a safe place and only the duplicate copy is used for analysis

The duplicated files or evidence are then analysed by our forensic specialists, who keep track of any evidence that supports or refutes a hypothesis. Continuous analysis is carried out to reconstruct events and actions as happened during the incident, in order to create a timeline and conclude on what has occurred and how hackers gained access to the systems

Once a digital forensics investigation is completed, the findings and conclusions uncovered by analysts are presented with an executive summary in the form of a report that is easy to understand by executives and non-technical personnel.