Our services

Incident Response and Forensics

Nowadays, a cyberattack is no longer a question of “if”, but of “when”. We provide different services suited to your needs.

You need immediate assistance?

If you are in a crisis and quickly need assistance, you can find all relevant information and contact details on our web page for [Immediate Assistance in the Event of a Cyberattack].

You are looking for long-term support?

We offer SLAs with guaranteed reachability and response times so that you do not lose time looking for help in an emergency. You can find the details about our 24/7 Incident Response Service below.

You want to be prepared for an incident?

In an Exercise to Ensure Proper Response, you can test how well-prepared you are for an incident; or obtain our estimation in a Compromise Assessment.
We are also happy to assist you with the creation of Concepts or Playbooks. In addition, you can upskill individually in our Trainings.

24/7 Incident Response and Forensics Service

We offer our customers throughout Germany and beyond 24/7 availability of our experts for incident response and forensics with guaranteed response times as well as a comprehensive range of services to handle targeted attacks and other IT security incidents.

Due to our expertise, we have been listed as a qualified APT response service provider by the BSI.

In case of a hacker attack or an infection with ransomware, our experts provide advice and assist you in:

Selecting suitable immediate actions
Our experts can take charge of investigation management
Providing communication channels
Processing and follow-up
Restore

This allows you to react quickly and in a suitable way, so that the incident can be limited as soon as possible and be processed afterwards in order to reduce the impact to a minimum.

Forensic Investigations

In a forensic investigation, our specialists use professional tools on site or in our forensics and malware laboratory to examine affected systems and networks as well as malware that has been found.

Thus, we can reconstruct both the attack path and the sequence of events that took place and identify traces typical of the corresponding attack. This also makes it possible to find hints about other systems, user accounts and data that are affected and examine a potential data leakage.

Typical procedures can include:

Reconstructing the sequence of events that took place or the infection path by analyzing logs and images of hard disks and main memories
Targeted search for files and contents on endpoints and drives in case of a suspected data leakage
Identifying the vulnerabilities having caused the successful attack
Live analysis of systems to collect further traces or determine the scope of an incident
Malware analysis of files and programs

We use tools that are common in the industry to process and analyze the artifacts. The results of the analysis are summarized in a detailed report, and we can also create a forensic expert report if required.

You fell victim to a cyberattack? Contact us at +49 7131 59455-0

Consulting On and Preparing of Concepts for Incident Handling

Whether you want to rely on cirosec as your incident response provider or build your own incident response team, CERT, CSIRT or even SOC, defining responsibilities and processes and creating response plans is essential.

We consult and assist you with this to ensure that you are well prepared and can keep calm and respond effectively in case of an emergency.

Our experienced consultants create concepts and preparatory measures in close coordination with you.

We assist you with defining processes, choosing tools as well as specifying responsibilities and instructions for action.

In this regard, we adhere to the recognized standards in this regard.

Readiness Assessment

The goal of a readiness assessment is to identify weaknesses within existing incident response processes and the tools used for detecting attacks. Therefore, it serves as a solid foundation to further develop already existing incident response strategies to effectively prepare for security incidents.

In a workshop, we will use a questionnaire to conduct a structured analysis of your existing processes according to established frameworks (e.g., ISO/IEC 27035). Among others, the following topics will be examined:

Analysis of existing processes:
Assessment of the current incident response plans, emergency handbooks, escalation paths and communication strategies.

Capabilities of the IR team:
Assessing whether the members of the IR team have the necessary capabilities to effectively deal with security incidents. This concerns the technical capabilities as well as the necessary knowledge of the employees involved.

Technical infrastructure:
Evaluating whether the tools used (e.g., malware protection, logging systems, firewalls, etc.) offer sufficient detection capability and support to detect incidents quickly and react accordingly.

Responsibilities and roles:
Examining whether the roles and responsibilities are clearly defined and distinct from each other.

Creation of IR playbooks

In case of an intrusion into your IT systems, it is usefulto have a guideline at hand to make concrete and correct decisions in an emergency.

The playbooks we created adhere to the structure of the NIST Incident Response Cycle, which consists of the following four phases:

Preparation
Detection and analysis
Containment, sanitizing and restoration
Lessons learned

Exercises to Ensure Proper Response

During a security incident, external service providers or a company’s internal incident response team have to work together with the relevant internal technical experts responsible for the respective IT systems.

Necessary roles and processes or procedures are defined beforehand for this cooperation.

To assess whether these plans also work in practice, and to establish the necessary routines for handling an incident, regular exercises are crucial.

Only then, all people involved know how to work together quickly and effectively during an emergency.

These exercises can consist of theoretical simulated situations, where all persons involved are sitting together at a table, or of practical exercises, where, for example, technical alarms are triggered and then processed together.

We assist you during the preparation for such exercises, for example with creating the script, as well as during the exercise itself. This includes, among many other things, leading the exercise, simulating the attackers and observing the actions of the persons participating in the exercise.

We can also offer the follow-up of exercises, lessons-learned workshops and preparing recommendations to improve your processes.

Compromise Assessment

A compromise assessment is an in-depth examination of individual IT systems and networks or of a large part of the IT infrastructure and accounts.

The main goal is to determine whether an attacker could have potentially compromised parts of the infrastructure. In case of a confirmed compromise, the persistence method used by the attackers is analyzed.

A compromise assessment can include different aspects to focus on different types of systems and data.

Typically, such an analysis can include the following aspects: