Incident Response and Forensics
When something goes wrong, work from a plan. We help contain the incident and remove the threat, investigate how it happened, and support recovery, working alongside your own team.
What it covers
How it typically runs
-
Describe the situation in general terms.
Result The situation understood
-
Limit the spread and remove the threat.
Result Threat contained
-
Establish origin, methods and impact.
Result Origin, methods and impact
-
Support restoring normal operations.
Result Support restoring operations
-
Recommendations to prevent a repeat.
Result Actionable recommendations
At a glance
Where it applies
Situation Unusual account activity points to a possible compromise.
What we would look at How the intruder got in, what they reached and how to close the gap.
Situation Important systems become unavailable and staff cannot reach records.
What we would look at What happened, what was affected and the safest route back to normal operations.
Situation A customer-facing system behaves unexpectedly after a change.
What we would look at Whether it was an attack, how far it spread and what to change.
Situation A production line stops after a suspected intrusion.
What we would look at The origin and impact of the incident, and a plan to restore operations and prevent a repeat.
Illustrative scenarios describe typical situations. They are not CyberWhy client engagements.
Continue the journey
Cyber Security Consulting
Security strategy, risk assessment and policy, with guidance toward standards such as ISO 27001 and GDPR requirements.
Talk to a specialist about incident response and forensics.
Tell us what you are working on and what you need to protect. For an incident, describe the situation in general terms. Please do not send logs, evidence or credentials through the website form.