DIGITAL FORENSICS & INCIDENT RESPONSE

Obrela’s CSIRT carefully acquires, analyzes, and gains an understanding of artifacts related to confirmed security incidents, with a strong focus on preserving forensic evidence. To achieve this, Obrela’s DFIR experts follow a forensically sound methodology, employing accurate processes like chain of custody and thorough documentation, and using state-of-the-art technology for forensic analysis. Through these processes, DFIR experts aim to reconstruct and determine the actions of the intruder, the tactics, techniques, and procedures used by the threat actor, and identify any evasion techniques. This can be accomplished through activities such as forensic artifact analysis, reverse engineering, malware analysis, comparative analysis, and cyber attribution.

Obrela’s CSIRT provides comprehensive support for incident containment, management of damage, adversary eviction, and system recovery to minimize the current impact and assist the organization in moving to a trusted state. This includes Response Plan preparation, where our team designs a Course of Action (COA) based on business requirements and priorities, then discusses and initiates the plan with stakeholders. During containment, the CSIRT restricts the incident to the affected area, cuts off the attacker’s access, and removes any malware or tools. For recovery, Obrela CSIRT supports the customer in restoring systems by aiding rapid deployment of detection and response capabilities, network and system hardening, and vulnerability remediation.

During incident management, every second counts, and cross-functional resources must work seamlessly together. Obrela assigns an Incident Commander to oversee the response process, ensuring effective coordination, communication, and decision-making between Obrela CSIRT and the customer ecosystem. The Incident Commander maintains situational awareness, provides updates, and manages stakeholder engagement to build trust and maintain a calm environment.

When a routine emergency or major incident escalates to a crisis, the rules of the game change. A crisis requires different capabilities, expertise, and specialized protocols. Successful remediation demands a coordinated “whole-of-business” response, involving both technical and leadership teams. Obrela provides live support to technical responders, senior management, and boards during crises, offering expertise in public relations, strategic communications, shareholder management, brand reputation, and legal cooperation.

Obrela Cyber Negotiation Services are designed to expertly manage and resolve cyber extortion incidents with minimal disruption and financial impact to your organization. In strong collaboration with our partner ecosystem, we provide unique expertise and bring in sophisticated negotiation strategies that predestinate an unrivaled experience in enabling companies to recover their operations fast and with the least possible ransom.

Many organizations often focus on the rapid remediation of attacks and quickly move on to the next case, overlooking the importance of the post-incident phase. However, Obrela’s CSIRT emphasizes the significance of conducting a full incident postmortem. Our team stays actively involved in this phase to deliver the final incident report, participate in lessons learned sessions, provide feedback on technical and procedural gaps, and share recommendations to mitigate future risks. We also continue to monitor the environment to validate the trusted state of operations and prevent recurrence, such as malware or ransomware reinfection.