JD&A has the real world experience to assist your company get through a computer incident in an organized, efficient and financially responsible manner. Our years of experience in responding to computer intrusions, data breaches and conducting insider abuse investigations will help you resolve your incident rapidly. Through years of writing about, training and responding to computer intrusions, JD&A has developed an excellent working relationship with many DoD, Federal and State cyber crime investigation agencies. We will use all of our experience and tested process to help you navigate through even the most complex incidents.

We frequently receive questions about what to do when an incident happens. We find that in most cases an incident response can be broken down into five general steps:

Step 1 - We sit down with everyone involved and get an idea of who is involved, what prompted the incident response, when the incident is believed to have occurred, where the systems and personnel involved are located and what your goals are for the incident response.

Step 2 - We perform live memory analysis on a selection of the involved systems. Review of the data collect from the system memory is typically the quickest way to determine what is actually happening and often the scope of the situation. Live memory analysis of systems can normally be performed quickly and with minimal or no disruption of system services.

Step 3 - If the situation warrants, and while step 2 is occurring, we may want to arrange for the placement of network traffic monitors (sniffers) at key points on the network. We normally perform both session and full content monitoring, as dictated by the situation, at the same time. Because session monitoring typically collects less data it can be quickly reviewed for possible problems and then, if required, a more exhaustive review of smaller portions of the full content data is conducted.

Step 4 - While many security companies like to make forensic images of numerous machines during an incident response, experience has taught us that this is often the least productive use of our time during the initial portion of the response. We will likely want to make forensic images of a small number of suspicious systems but only for limited review. Usually, Steps 2 & 3 have the most immediate impact on the situation and review of forensic images (which can be very time consuming) fills-in details later.

Step 5 - We will work with you and your staff to develop a phased remediation plan. Depending on your goals for the incident response we can help draft an action plan to meet your immediate, intermediate and long-term remediation goals. We then assist in the management of available staff to ensure that the response goals activities are being performed.