• Triage: the aim of this step is to identify the source(s) and affected devices and/or systems, set priorities based on these and determine the plan of approach for further research. At the same time, data is safeguarded in a forensic way for possible further investigation.
• Containment:this process involves restoring affected devices and/or systems and verifying security so normal operations can resume.
• Post incident activities: When the incident is resolved, a forensic investigation report is prepared. The report proposes solutions to prevent a similar event from occurring in the future. NFIR can also support and/or advise in the communication towards the Data Protection Authority, attorney at law and other parties involved.

The number of ransomware attacks in the Netherlands is large and even increasing. In a recent survey, nearly three-quarters of Dutch companies surveyed said they would be hit by a ransomware attack by 2021. Only slightly more than a third said they had a cybersecurity strategy ready. This is while the impact of a ransomware attack on your business or organization is enormous. Your business operations are severely hampered or even made impossible. Trade secrets (can) be resold and data leaked. Your external partners no longer trust your organization and take a wait-and-see attitude. And don’t think “that won’t happen to us,” because it can happen to anyone. From large companies and organizations to SMEs employing 20 people.

Read the full article: What impact does a ransomware attack have on my organization?

Yes, we are available 24/7 for SMEs, multinationals, government bodies, educational institutions and non-profit organisations. Within three hours, an incident response (CERT) team is present at every location in the Netherlands (Wadden Islands excluded).

CERT stands for Computer Emergency Response Team. The attribute is awarded by Carnagie Mellon University to companies and teams involved in digital security incidents. In the Netherlands, there are a number of official CERTs of large organisations involved in combating cyber incidents, such as the NCSC, the IBD, the Ministry of Defence, telecom organisations and banks.

The aim of the incident response team is to minimise the impact of the cyber incident as quickly as possible so that the continuity of your organisation is no longer at stake.

NFIR’s CERT consists of digital forensic investigators, ethical hackers and team leads who all have experience with incident response. After notification of the security incident, a team is put together that expresses its opinion. The size of the team depends on the type of cyber incident. Of course, all members of the team will work forensically during this process.

The Incident Response team is always provided with the right digital forensic equipment to serve the clients directly on location. NFIR continuously invests in fast, reliable and leading equipment and tooling that allows multiple Incident Response teams to operate simultaneously.

1. 1. Incident notification and intake
   2. Securing and investigating
   3. Reporting and prevention

1. Contact NFIR’s Computer Emergency Response Team (088-133 0700).
2. The CERT takes action. All necessary equipment is packed and within 3 hours the CERT is on site
3. On site, the intake is conducted with all stakeholders to gather all available information about the incident.
4. After granting the order, triage on the affected systems will be started.
5. As soon as it is clear which systems have been affected or need further investigation, data will be secured according to a digital forensic procedure.
6. In the containment phase, the affected systems are restored and security is verified to prevent a recurrence of the incident
7. In the post-incident phase, the secured data is further digitally forensically examined. As many answers as possible are given to the research questions and the subject matter of the research. All findings and recommendations will be included in a report that will be delivered at the conclusion of the incident. This report can be used for internal and external purposes (such as supervisors and for legal proceedings).

Of all the IT security incidents handled by NFIR, the most common are compromised (e-mail) accounts and attacks on vulnerable systems that offered insufficient resistance due to a lack of software updates and security. If hackers gain unauthorized access to systems, this usually leads to data breaches, the installation of ransomware and various types of malware such as crypto miners.

This is not necessary in all cases, but often the client wants to know the extent of the incident and supervisors ask questions that can be answered by conducting an investigation. In all cases, NFIR is obliged to provide a report.

That’s possible. NFIR offers the Cyber Security Support Contract. This contract includes a number of preventive and reactive services. Your organisation can then count on an annual phishing test, awareness training for MT/Board of Directors and weekly vulnerability scanning of 2 IP addresses. In addition, we guarantee that the CERT will be on site within 3 hours in case of an IT security incident, 1 intake per year is free of charge and the contract offers a 15% discount on the pentest hourly rate and 15% discount on the Incident Response hourly rate.

Know what to expect in the case of a IT security incident. Read more about the Incident Response plan.

We stand for communicating in clear language with our customers. In this way we also report our findings. In addition, we aspire to the ‘numbers tell the tale’ approach, which enables us to help you in a targeted way by means of various types of research. The approach also includes further development of our services. As a result, our services keep in line with changing practice.

NFIR stands for offering technical and organisational support, security services and training. With our knowledge and experience we can provide you with technical advice and advise you on the procedures and processes of information security. Enabling NFIR helps you to increase the resilience of your organisation’s cyber security in several areas.

More information