Are you facing unexpected events in your IT environment, such as workstations being blocked, security breaches, no longer being able to access your data, a possible data breach, ransomware or a cybersecurity attack? At your request, NFIR takes immediate action with an Incident Response team.
NFIR is available to its clients 24/7 to map out and resolve any security incident. Our Incident Response team makes every effort to be at your location within three hours. The goal of the Incident Response team is to minimize the impact of the cyber incident as quickly as possible so that your organization’s continuity is no longer at risk.
NFIR's approach to Incident Response
In conducting the security incident investigation, NFIR works according to the Incident Response procedures of NIST and SANS to conduct thorough and reliable investigations. In addition, experience and analytical skills are at the basis of every solved security incident. If your organisation already has Incident Response procedures, then NFIR follows those procedures.
During the Incident Response process, NFIR pays attention to the following three processes:
- Triage: the purpose of this step is to identify the source(s) and affected devices and/or systems, set priorities based on these and determine the plan of approach for further research. At the same time, data is safeguarded in a forensic way for possible further investigation.
- Containment: this process involves restoring the affected devices and/or systems and verifying the security so that normal operations can be resumed.
- Post incident activities: when the incident is resolved, a forensic investigation report is drawn up. The report proposes solutions to prevent a similar event from occurring in the future. NFIR can also support and/or advise in the communication towards the Data Protection Authority, attorney at law and other parties involved.
We use the existing knowledge and skills of the client in the Triage phase. The Incident Response team starts on site and creates a plan of action. Thanks to our procedures and checklists, we can take action quickly and minimise the negative effects of the cyber security incident. During this entire investigation, NFIR will work in a forensic responsible manner in order to be able to produce a forensic report later in the process. If you have suspicions of culpability or recoverability against a natural or legal person, you can also engage us to conduct an investigation. Our reports are legally valid. You can use the NFIR report as evidence in a court case or for a report to the (Dutch) Data Protection Authority (DPA) in the event of a data breach.
The Incident Response Team of NFIR
NFIR’s team consists of digital forensic investigators, ethical hackers and team leads who all have Incident Response experience. After notification of the security incident, a team is put together that expresses its opinion. The size of the team depends on the type of cyber incident. Of course, all members of the team will work forensically during this process.
Preventing security incidents is obviously better than curing them. We are convinced that companies benefit above all from good preventive measures, both technically and in terms of awareness. For this reason, NFIR conducts penetration testswe provide Security Awareness services and we offer a package of various services through the Cyber Security Support Contract.
Incident Response Plan
I have an incident. What should I do? Know what to expect in the case of a IT security incident. Read more about the Incident Response process.
The Art of Incident Response
In this blog series, join our colleague, Team Lead Incident Response, Mischa as he visits an organization facing a cyber attack. He shows what phases there are during a cyber incident, how we deal with them and how the organization is best served. This will give you an idea of what NFIR does for you if you face a cyber-attack and why it is important to work on cybersecurity preventively.
Security incident? Meet Incident Response
Our incident response team is available 24/7 to identify and resolve any cyber incident
- Triage: the aim of this step is to identify the source(s) and affected devices and/or systems, set priorities based on these and determine the plan of approach for further research. At the same time, data is safeguarded in a forensic way for possible further investigation.
- Containment:this process involves restoring affected devices and/or systems and verifying security so normal operations can resume.
- Post incident activities: When the incident is resolved, a forensic investigation report is prepared. The report proposes solutions to prevent a similar event from occurring in the future. NFIR can also support and/or advise in the communication towards the Data Protection Authority, attorney at law and other parties involved.
The number of ransomware attacks in the Netherlands is large and even increasing. In a recent survey, nearly three-quarters of Dutch companies surveyed said they would be hit by a ransomware attack by 2021. Only slightly more than a third said they had a cybersecurity strategy ready. This is while the impact of a ransomware attack on your business or organization is enormous. Your business operations are severely hampered or even made impossible. Trade secrets (can) be resold and data leaked. Your external partners no longer trust your organization and take a wait-and-see attitude. And don’t think “that won’t happen to us,” because it can happen to anyone. From large companies and organizations to SMEs employing 20 people.
Read the full article: What impact does a ransomware attack have on my organization?
Yes, we are available 24/7 for SMEs, multinationals, government bodies, educational institutions and non-profit organisations. Within three hours, an incident response (CERT) team is present at every location in the Netherlands (Wadden Islands excluded).
CERT stands for Computer Emergency Response Team. The attribute is awarded by Carnagie Mellon University to companies and teams involved in digital security incidents. In the Netherlands, there are a number of official CERTs of large organisations involved in combating cyber incidents, such as the NCSC, the IBD, the Ministry of Defence, telecom organisations and banks.
The aim of the incident response team is to minimise the impact of the cyber incident as quickly as possible so that the continuity of your organisation is no longer at stake.
NFIR’s CERT consists of digital forensic investigators, ethical hackers and team leads who all have experience with incident response. After notification of the security incident, a team is put together that expresses its opinion. The size of the team depends on the type of cyber incident. Of course, all members of the team will work forensically during this process.
The Incident Response team is always provided with the right digital forensic equipment to serve the clients directly on location. NFIR continuously invests in fast, reliable and leading equipment and tooling that allows multiple Incident Response teams to operate simultaneously.
- Incident notification and intake
- Securing and investigating
- Reporting and prevention
- Contact NFIR’s Computer Emergency Response Team (088-133 0700).
- The CERT takes action. All necessary equipment is packed and within 3 hours the CERT is on site
- On site, the intake is conducted with all stakeholders to gather all available information about the incident.
- After granting the order, triage on the affected systems will be started.
- As soon as it is clear which systems have been affected or need further investigation, data will be secured according to a digital forensic procedure.
- In the containment phase, the affected systems are restored and security is verified to prevent a recurrence of the incident
- In the post-incident phase, the secured data is further digitally forensically examined. As many answers as possible are given to the research questions and the subject matter of the research. All findings and recommendations will be included in a report that will be delivered at the conclusion of the incident. This report can be used for internal and external purposes (such as supervisors and for legal proceedings).
What are the most common types of IT security incidents that NFIR encounters in Incident Response processes?
Of all the IT security incidents handled by NFIR, the most common are compromised (e-mail) accounts and attacks on vulnerable systems that offered insufficient resistance due to a lack of software updates and security. If hackers gain unauthorized access to systems, this usually leads to data breaches, the installation of ransomware and various types of malware such as crypto miners.
This is not necessary in all cases, but often the client wants to know the extent of the incident and supervisors ask questions that can be answered by conducting an investigation. In all cases, NFIR is obliged to provide a report.
Can an organisation make arrangements with NFIR in advance to be sure to be helped quickly in case of an IT-Security incident?
That’s possible. NFIR offers the Cyber Security Support Contract. This contract includes a number of preventive and reactive services. Your organisation can then count on an annual phishing test, awareness training for MT/Board of Directors and weekly vulnerability scanning of 2 IP addresses. In addition, we guarantee that the CERT will be on site within 3 hours in case of an IT security incident, 1 intake per year is free of charge and the contract offers a 15% discount on the pentest hourly rate and 15% discount on the Incident Response hourly rate.
Know what to expect in the case of a IT security incident. Read more about the Incident Response plan.
We stand for communicating in clear language with our customers. In this way we also report our findings. In addition, we aspire to the ‘numbers tell the tale’ approach, which enables us to help you in a targeted way by means of various types of research. The approach also includes further development of our services. As a result, our services keep in line with changing practice.
NFIR stands for offering technical and organisational support, security services and training. With our knowledge and experience we can provide you with technical advice and advise you on the procedures and processes of information security. Enabling NFIR helps you to increase the resilience of your organisation’s cyber security in several areas.