SCADA Emergency Incident Response
View Datasheet
You knew it would happen someday. And that someday has arrived: a security breach has been identified on your SCADA network, and the compromise could result in disruption of service, instability of control systems, or even loss of human lives. Worse yet, you realize you do not have the internal resources or expertise to investigate and determine the scope of the problem. And the CEO wants answers now! How can you reduce these risks and be prepared if such risks arrive.
Benefits
The 911 SCADA package provides a proactive approach to minimizing the effects of a security incident for the Utility industry. In the event that a breach should occur, the Foundstone Professional Services Emergency Incident Response (IR) Team is ready to provide the answers your CEO wants. Staffed with experienced first responders, we will respond immediately and help you through your crisis. Our experts will provide the knowledge and tools to determine what happened and how to recover from the incident. As a part of a holistic approach to identification, containment, and remediation we combine the expertise and experience of Foundstone’s incident response team and SCADA specialists with the world-renowned expertise of the industry’s leading malware researchers of McAfee’s AVERT group.
Methodology
Foundstone Professional Services’ proven IR methodology is current, consistent, relevant, and repeatable. We stay current on the latest threats and remediation techniques and are consistent in following proven strategies to resolve complex incidents. But we realize every business and incident is unique; so we tailor our approach so it is relevant to your environment and the crisis at hand. After each engagement we take the lessons learned and enhance our methodology and knowledgebase with the unique factors and experiences from the engagement.
The Foundstone Professional Services Emergency IR framework is based on a five-step process:
- Investigation and Assessment
- Containment
- Forensic Capture and Analysis
- Remediation
- Reporting and Follow-Up
Scope
A typical engagement ranges between three days to two weeks, depending on the scope of the security breach. During the investigation, assessment, and containment phases we collaborate with you to determine if additional services are needed for remediation. A comprehensive report of our findings will be provided to you at the end of the engagement.
Contact us for more information about this service.
