Time is money

After a security incident, the following principle applies: every system must be considered compromised. Therefore, the most urgent task of the immediate response is to secure and isolate. Compromised systems must be disconnected from the network immediately.

Our security experts then begin to set up emergency operations to maintain critical business processes. In doing so, they establish two zones: the red and the green zone. The red zone includes all systems and networks that have been compromised or are suspected of being compromised. These are isolated to prevent the attack from spreading further. Access to this zone is strictly controlled and limited to our incident response team and your IT teams. The green zone, on the other hand, consists of secure, verified systems and networks that are required for continued business operations. These are usually systems that have been completely rebuilt with the necessary applications and data.

Our incident response team uses the systems in the red zone primarily to analyze the attack vectors. In addition, the weak points and security gaps that led to the success of the attack are investigated here. At the same time, they work in the green zone to strengthen security measures and gradually normalize operations.

Accurate identification, precise analysis

Digital forensics is an indispensable part of emergency response and a core competence of the company. Our experts leverage 20 years of experience and knowledge in digital analysis in their work. They secure evidence, investigate the causes of an incident, determine the extent of the damage and immediately initiate countermeasures. The findings from each individual analysis are incorporated into the security measures for many other IT infrastructures.

Incident analysis

After the initial assessment, @-yet’s forensic experts begin a deep forensic analysis of the incident. This incident analysis aims to capture the details of the attack and identify the attackers’ methods, techniques and tactics (TTPs). This phase is necessary to understand how the attack was successful and which vulnerabilities were exploited. A detailed analysis enables targeted measures to be taken to eliminate the immediate threat and prevent further damage. In addition, you receive valuable information that you can use to improve your existing security measures.

Find and fix security vulnerabilities

Once the evidence has been secured and the attacker’s path has been clarified, the next step is to determine the cause and implement countermeasures. In this phase, @-yet’s forensic experts determine the exact cause of the incident. Was a vulnerability in a piece of software exploited? Was it human failure? Or a combination of both?
The IT forensic experts find the answer. They identify the fundamental problems that led to the success of the attack. And they provide you with comprehensive advice on how to prevent future incidents of this kind. Eliminating the causes and implementing countermeasures not only closes the exploited vulnerability. It also improves the security of your entire IT infrastructure in the long term.

Detailed analyses for long-term security

Detailed IT forensic investigations are used to precisely determine the causes and effects. Based on this, @-yet develops individually tailored security strategies that proactively counter future attacks. This combination of rapid intervention, thorough analysis and preventive measures makes your company more resilient to cyber threats in the long term.

Thorough investigation of security incidents is necessary and important. @-yet offers you even more. In the event of a cyber attack, experienced experts take over the entire crisis management process.

@-yet DFIR – More than just reacting and analysing

Containing and investigating a security incident is an important and crucial step on the way back to normal operations. In most cases, however, more is needed. That is why @-yet’s wide range of services covers more than just IT forensics and response to cyber attacks. In an emergency, it implements comprehensive crisis management. This includes not only providing a crisis manager, but also setting up the entire crisis organisation.
Together with specialised companies and agencies, @-yet takes care of crisis communication. After all, the technical side of emergency assistance after an attack is only one aspect. Clear and thoughtful communication is just as important. Internal communication is not the only thing that plays a major role here. You also need to inform external service providers, customers and partners.

Communication is particularly important if your company is part of a supply chain. This minimises the potential impact on customers and suppliers. Through its coordinated response, @-yet ensures efficient cooperation between all parties involved and protects your company’s reputation.

In the event of a ransomware attack, experienced crisis managers conduct negotiations with the blackmailers. Legal advice and support is provided through cooperation with an international law firm. Finally, @-yet also takes care of all necessary notifications to authorities.

In the event of a ransomware attack, experienced crisis managers conduct negotiations with the blackmailers. Legal advice and support is provided through cooperation with an international law firm. Finally, @-yet also takes care of all necessary notifications to authorities and reporting centres, if required. In an emergency, concentrate on your business. @-yet will take care of the rest.

@-yet Digital Forensics & Incident Response (DFIR)

Digital Forensics and Incident Response (DFIR) is a specialised field within information security that deals with the identification, investigation and effective response to IT security incidents, IT emergencies, cyber attacks and advanced persistent threats (APTs). It also covers digital investigations (e.g. in cases of industrial espionage) and work as a private expert witness in court, among other things.

Methodology of Digital Forensics & Incident Response (DFIR)

Digital Forensics & Incident Response (DFIR) with @-yet