Incident Response Retainer

Why Choose Spirity’s DFIR Retainer?

 

Cyber incidents can disrupt business operations, result in the loss of sensitive data, and create significant liabilities. Despite investments in cybersecurity measures, breaches can still occur due to sophisticated phishing campaigns, insider threats, or evolving external threats. Spirity’s DFIR Retainer provides an always-on, expert technical team ready to respond immediately, without the need to negotiate terms and conditions during a crisis.

 

Our DFIR Retainer service not only offers rapid response but also partners with your organization to thoroughly investigate incidents. We perform digital forensics to address smaller events, preventing them from escalating into larger breaches. Through our extensive experience in handling data breaches, we have observed that most catastrophic incidents begin as minor issues that were overlooked or misinterpreted. Our proactive approach encourages the investigation of these small but high-risk incidents before they escalate, effectively safeguarding your organization.

 

Key Features and Benefits

 

• Rapid Incident Response: Our service includes pre-negotiated terms and conditions and a rapid response SLA to minimize breach impact and expedite recovery. Spirity’s predefined chain-of-command, processes, pre-authorization with your internal IT or third-party suppliers, communication methods, intervention scope, and monitoring technologies will also expedite incident response.

• Comprehensive Investigations: Our expert team conducts modern forensic investigations, including dead box forensics, containment efforts, root cause analysis, and data exfiltration determinations. Our investigators lead the overall crisis management strategy from scoping call to potential litigation, including expert testimony.

• Compromise Assessment: We deploy sensors to hunt and triage all high-risk devices in your computing environment, uncovering malicious activity and attack history, enabling you to identify or confirm compromised data and initiate a proper response.

• Incident Response Readiness Engagement: This exercise discusses Incident Response investigation components, such as immediate actions, engaging legal counsel, exfiltration, data mining, and notifications, enabling your organization to assess internal IR preparedness and relevant next steps.

• Data Discovery & Validation: Our DFIR team works with your IT resources to identify and produce evidence that will be requested should an actual incident occur. Data will be reviewed to ensure proper format, delivery, and usefulness.

• Quarterly Common Vulnerabilities & Exposure (CVE) Assessment: This investigation provides domain-wide visibility into emerging security concerns by identifying both successful and unsuccessful exploitation attempts involving recently released and critical CVEs on high-value targets.

• Dedicated Incident Response Team: During onboarding, each IR retainer client is assigned a dedicated forensic investigator who will act as your incident lead and direct point of contact. Additionally, a dedicated IR Team (Commander, Intel, Ransomware/Negotiation Specialist) will augment your internal response staff during periods of high demand, such as forensic root cause analysis, log review, and O365/Azure auditing.

 

Incident Response Planning and EU Regulations

 

In light of new EU regulations, having a robust incident response plan is not just a best practice but a legal requirement. The NIS2 (Network and Information Security Directive) and DORA (Digital Operational Resilience Act) mandate that organizations must establish and maintain comprehensive incident response plans. These regulations aim to enhance the overall cybersecurity resilience of organizations across the EU by ensuring preparedness for handling cyber incidents effectively.

 

By partnering with Spirity, your organization will not only meet these regulatory requirements but will also benefit from a proactive stance against cyber threats. Our DFIR Retainer service ensures that your incident response plan is robust, compliant, and capable of mitigating the impact of potential cyber incidents.

Related service: in case your business needs Incident Response policy development, please check out our Virtual CISO service.

 

Detailed Service Description

 

• Forensic Examination Services: Our forensic examination services include creating digital forensic images of endpoints and servers, examining these images to identify indicators of compromise, and determining the extent of unauthorized access.

 

• Log Review Services: We offer comprehensive log review services, including analysis of application or network access logs from systems such as payroll, VPN, RDP, VM, Single Sign-On, and O365. This helps in identifying any unusual activity that may indicate a compromise.

 

• Email Analysis: Our email analysis services include reviewing affected mailboxes to identify spear phishing emails related to the initial compromise vector and analyzing suspicious attachments to determine their purpose, scope, and function.

 

• Real-time Compromise Assessment: Spirity provides real-time proactive incident response through continuous endpoint triage using an endpoint agent to detect, alert, and respond to ongoing cyberattacks, breaches, and virus infections that often evade traditional detection programs.

 

• Additional Forensic Investigations: We cover various forensic investigations such as employee offboarding forensic analysis, extortion/blackmail cases, law enforcement breach notifications, IP theft, M&A cyber due diligence, phishing attacks, and insider threat analysis.

 

• Quarterly Threat Briefings and Domain-Wide Breach Reports: Quarterly written threat briefings address the latest intelligence and front-line challenges. We also provide a Domain-Wide Third Party Breach and Leak report to understand the types and quantity of data available on the dark web related to your organization's email domains.