The first decisions influence everything else.
During a cyber incident it is necessary to limit the damage without destroying the traces necessary to understand what happened. Isolating systems, revoking sessions, preserving logs, and restoring services are interdependent tasks that require priority, accountability, and clear communications.
NESQ can support the internal team, technology suppliers and legal or privacy consultants. The technical work is organized in coherence with the company context and with any documentation or notification obligations, without replacing the client's legal assessments.
Operational phases
- Activation: collection of the first elements, classification of urgency and definition of contacts.
- Containment: selective isolation, access blocking and protection of unaffected assets.
- Analysis: timeline, initial vector, persistence, lateral movements and possible access to data.
- Eradication: Removal of accounts, malware, rules and malicious configurations.
- Restoration: gradual return to production with strengthened controls and monitoring.
- Post-incident: lessons learned, residual risk and improvement plan.
Sources and evidence
Analysis may involve endpoints, servers, firewalls, VPNs, identity providers, cloud, email, EDR/XDR and SIEM. Acquisitions are tailored to the needs of the assignment and documented, preserving integrity and traceability when a subsequent forensic evaluation is required.
Output
- register of technical activities and decisions;
- preliminary and subsequently consolidated timeline;
- indicators of compromise and perimeter of the systems involved;
- recommendations for containment, recovery and monitoring;
- final report with causes, technical impact and corrective actions.