Our cyber defenses against cybercriminals continues to improve due to the awareness created by recent news. However, the cyber threat landscape evolution’s pace is higher than ever, and that frequently undermines our effort to prevent attacks. The question is not IF you are going to be hacked, but WHEN?
Taking that into consideration, is your organization and incident response team prepared and ready to fight against any kind of unexpected event?
Our Cyber Security Incident & Emergency Breach Response Team services are comparable to an insurance. We are always nearby to support you during an unfortunate emergency, accident, or negative unforeseen event. Our team is composed of cyber security experts with long-lasting experience in both cyber security defense and offense.
Having worked on hundreds of security assessments and penetration tests, incident responses, and breach root cause analysis for companies in various sectors, wizlynx group is the perfect partner to rely on and ensure your critical systems are recovered in the shortest time possible.
wizlynx group’s Cyber Security Incident Response Team (also known as Cyber SWAT Team) can be called to investigate and handle various type of cyber security incidents & attacks, including, but not limited to:
Our Cyber SWAT Team can investigate cyber security incidents onsite or remotely, as well as in any type of environments including Industrial Control System (ICS) and Supervisory Control and Data Acquisition (SCADA).
wizlynx group is focused on helping organizations recover from cyber security incidents, while minimizing the impact of the incident on the organization, and ensuring the initial attack vector is not re-used at a later stage. That is why wizlynx group uses a proven and vetted methodology inspired by the SANS Institute’s Incident handling procedure.
Through an initial onsite assessment performed at the start of the subscription, our specialists get to know your team, processes, and infrastructure, gathering any information needed by the SWAT Team to promptly respond to an incident. This phase will give the proper reconnaissance to our SWAT Team to be ready to handle incidents. The initial onsite assessment is strongly recommended but optional - and is available as add-on service. Our initial onsite assessment can be supplemented by a quarterly check-in call service which ensures we are staying up-to-date about your circumstances.
This phase is called “stop the bleeding” phase, since its primary goal is to prevent the attacker from getting more information from the compromised system, from causing further damage, or spreading to other systems. Containment methods can vary based on the attack scenario and availability requirements of the affect system.
The determination of the cause and symptoms of the breach will greatly help during this phase to ensure appropriate measures are taken and to prevent the vector of compromise from being reused at a later point. We will also ensure any cybercriminal’s artifacts are properly removed from the machine. This phase may include:
- Vulnerability analysis
- Restore from backup
- Malicious software removal
- Defense improvement
- And more
The purpose of this final phase is to put the affected systems back into production in a safe manner. It also includes monitoring of the system for suspicious activities that may indicate the return of the attacker. Finally, indications about mid- and long-term remediation are provided to the owner of the attacked system. During all incident phases, the wizlynx group SWAT Team will be coordinating all incident response tasks, with the objective of restoration to normal state. The exact scope of the responsibility is agreed upon upfront with the customer and dependent on the individual business model. We typically coordinate all internal and external subject matter experts, with the supreme objective of resolving the incident as fast as possible, while minimizing damage to the business. Supporting resources may include the customer’s subject matter experts for the various departments, but also our partner network of:
- Lawyers specialized in IT laws and data privacy
- Forensic Specialists
- Media and Press Specialists for Reputation Management
These partners are included situationally after consultation with the customer.
wizlynx group Cyber SWAT Team will document each step of the investigation in a report in the attempt to answer the following questions:
- What was the attack vector(s)?
- Which systems or applications were com-promised?
- What malicious actions were performed?
- What are the damages?
- What lessons learned must be applied to ensure such incident does not reoccur?
Our final testing report will include the following sections:
