Incident Response

Organisations are facing more security challenges today than at any time in the past, traditional defences are not working, new technologies introduce new risks, and conventional security practices are unsustainable. This allied with increasingly sophisticated attack methods, constantly changing infrastructures and the struggle to attain and retain security professionals has resulted in IT security teams facing an uphill battle to identify, detect and respond to the threats they are subject to on a daily basis.

Ward Solution’s emergency incident response service is a retainer-based service designed to provide clients with additional incident response capability when preparing for, responding to, and recovering from security incidents. With our emergency incident response service we work closely with clients, acting as an extended team, developing strategies and playbooks for incident response and assisting with incident response and recovery. Investigation and escalation of security incidents is performed by our Security Analysts and Incident responders who specialise in root cause analysis and who can provide on the spot recommendations for remediation. The aim is to provide information critical to risk management, risk mitigation, and risk acceptance decisions. .

• Initial Planning and Preparation: We conduct a planning and preparation workshop where we work with you to create (revise) your security incident response plan. We work through incident severity levels and the process for raising and incident with our SOC.
• IR Readiness Services: Proactive services in the area of incident response (table top exercises, simulated attacks, training, and readiness assessment).
• 37.5 Hours Incident Response Time: We provide 37.5 hours (drawdown) of incident response; support per annum (can be increased). Support is available either remote or on-site as required.
• Access to multiple resources types: We can provide a range of consultants and engineers to assist across a broad range of platforms and technologies
• Unlimited Incident Notification: As many incidents as required can be raised as long as there is sufficient time left to be drawn down.
• Service Level Reviews: We will perform quarterly reviews and provide monthly SLA reports.
• Hours of Operation: 12*5 (8am – 8pm) response service for S2 to S4 incidents and 24*7*365 for S1 incidents.

Our incident support team is available 24x7 to swiftly respond to any reported or detected incidents. The availability and responsiveness of our team help manage and reduce the impact of an incident. Once an incident is reported the team follow incident response playbooks addressing a range of incidents such as data loss, cloud compromise, malware attacks, ransomware attacks, phishing and business email compromise.

Once alerted the team immediate take actions dependent on the incident such as:

• Investigate, Identity and classify the attack, determine the impact to the organisation: Deploy Endpoint Detect and Respond (EDR) and threat hunting tools as appropriate and Determine the source and root cause of the attack.
• Contain the attack: Contain the attack through activities such as endpoint, network, security device, server and application configuration and remediation activities
• Eradication: Remove the threat from the organisation through activities such as mitigating attack vectors by say removing infected machines or making configuration changes.
• Recovery: In the recovery phase we can assist with remediation activities and perform a post incident in-depth forensic analysis to uncover every detail and fully document the impact of the incident and lesson learned for future planning