Incident response and forensics

A ransom screen on a Monday morning. A customer receiving fake invoices sent from your own mailbox. Or just a doubt: an odd login at 3 a.m., an account whose password changed by itself. Either way, the question is the same. What happened, and is it over?

What I do

First call

We take stock on the phone: what is hit, what still works, what to cut off. That hour often prevents the expensive mistake, like reinstalling a server before knowing how the attacker got in.

Evidence preservation

Copies of logs, memory and disks from key machines, before any restoration. They serve the investigation, the police report and your insurer.

Investigation

Find the entry point, the path through the network, the accounts used and what may have left. Active Directory and Microsoft 365 are nearly always at the heart of it, and I attack them all year on engagements.

Compromise assessment

Not sure you were attacked? I look for signs of compromise on your workstations, servers and cloud accounts. Sometimes there is nothing. That gets documented too, and it reassures a customer or an insurer.

Clean-up and hardening

Close the way in, reset compromised accounts, check restored backups are clean, then harden what needs it so it does not happen again.

Report

The incident timeline, its causes, what was done and what remains. Readable by management, usable by your insurer and for your notifications.