Determine facts, perimeter and reliability of the evidence.
A data breach can result from abusive access, malware, misconfigurations, misdirects, or lost devices. The technical response must clarify what happened, when, which systems were involved and whether there are elements compatible with consultation, modification or exfiltration of information.
Technical activities
- preservation of logs and the most volatile sources;
- analysis of authentications, sessions, privileges and applications;
- reconstruction of the timeline and access vector;
- identification of repositories and datasets potentially involved;
- search for anomalous downloads, forwards, archives or transfers;
- containment of access and correction of the technical cause;
- subsequent monitoring to detect persistence or reuse of credentials.
Evaluation support
The results are presented distinguishing verified facts, clues and aspects that cannot be determined with available evidence. This distinction is essential to allow the owner, DPO and legal consultants to carry out the assessments within their competence and document the decisions.
Output
- technical chronology of the event;
- list of potentially affected systems, accounts and data;
- containment and recovery measures adopted;
- limits of the analysis and residual risk;
- technical report and preventive recommendations.
The service does not replace legal or privacy advice, but provides a solid technical basis for decisions and for the possible management of notifications.