Assessment & Investigation Approach

In most cases Sontiq’s Cyberscout’s deep analysis and assessment of security incidents is completely remote. This remote approach to investigations and assessments allows for rapid deployment, investigation and resolution while minimizing disruption to your IT and Security teams. Remote investigation benefits include:

• Enhanced network visibility to investigators
• Reduced risk of transferring data outside the network
• Is third-party validated secure
• Easy deployment for technical or non-technical staff

When remote access is not appropriate, Sontiq’s Cyberscout will work with the impacted business to ship an artifact to our forensic lab to ensure a safe and secure transfer. Once the artifact has been received, we perform a full analysis of the artifact.

Breach and Data Incident Readiness

It’s been said that data breaches are the third certainty in life right behind death and taxes. Just like you wouldn’t wait until there was a fire to practice fire drills, you shouldn’t wait for a data breach to occur before planning how you will respond. Threat actors are always looking for new ways to compromise your systems, so while preventing a data breach from occurring is an important goal, knowing that your business is prepared to respond quickly and confidently is critical to ensuring damage is minimized and risk to the business is manageable.

Advanced Network Assessments

Sontiq’s Cyberscout performs a deep dive into your organization’s security posture, and provides comprehensive, actionable intelligence on a customer’s cybersecurity posture that clearly outlines relevant, exploitable vulnerabilities. We focus our report on relevant, actionable intelligence that reduces the noise that your already overwhelmed IT and IS teams experience. An Advanced Network Assessment can often provide better intelligence than traditional risk, vulnerability, or penetration assessments.

System Compromise Response

Gain an elevated understanding of your security incident with robust exfiltration analysis, determination of the manner of compromise, the actions taken by the threat actor and whether the threat actor is still within your environment. As part of our system compromise response support, Sontiq’s Cyberscout provides:

• Background details of the event
• Executive summary of findings from the analysis
• Evidence that determines whether data exfiltration occurred
• Evidence showing the manner of compromise and actions taken by the attacker

Remote Endpoint Investigations

Leveraging our proprietary Remote Access Lab Forensics (RALF) device, Sontiq’s CyberScout will scan the environment for threats such as, advanced persistent threats, active malware, active adverse activity from potentially malicious unauthorized entities, suspicious OS activity, and other indicators of an attack. The assessment will also examine any available and relevant logs that could contain intelligence related to the Incident.

Ransomware Recovery

A ransomware attack can cause tremendous disruption to your business operations. Our recovery service includes rapid support to help with data recovery and ransom payments, depending on the nature of the incident and your organization’s response strategy.

• Gather facts and explain the risks associated with paying the ransom
• Communicate or negotiate with the threat actor
• Obtain proof of decryption
• Facilitate the use of an anti-money laundering check
• Make payment from a Bitcoin wallet
• Provide the decryption key to affected client
• Support our client through the entire decryption process.

Data Mining & PII Reviews

Sontiq’s Cyberscout empowers clients impacted by a security incident to gain visibility into their event at a granular level. As part of this service, clients receive a report containing: A background summary of the event The search parameters used A results summary including the number of each type of sensitive information that was found Clients also receive raw results that contains where information was found, and the option for a full review of the raw data and results, in a notification-ready, well-organized document, clearly showing impacted individuals and their exposed data.

Business Email Compromise

Our business email compromise service includes exfiltration analysis, the manner of compromise, actions taken by the threat actor and whether the threat actor is still present in your environment. Sontiq’s Cyberscout provides clients with valuable information:

• Background details of the event
• Executive summary of findings from the analysis
• Evidence that determines whether data exfiltration occurred
• Evidence showing the manner of compromise and actions taken by the attacker