When responding to a cybersecurity incident, spending a lot of time analyzing forensic artifacts is a luxury that none of us have. Let’s say you have an incident in an organization with thousands of servers and clients, analyzing the compromised environment will take weeks, even months.
Welcome to our monthly product updates roundup! Here’s a rundown of the new features and solutions we released in the past month that you can now take advantage of.
Compromise assessment is an analysis of a network of endpoints or a single endpoint to uncover unknown security breaches, malware, and any sign of unauthorized access. The assessment seeks to discover any present and past attacker traces in the environment.
UPDATE 15.11.2021.
Microsoft patches actively exploited Exchange, Excel zero-days (CVE-2021-42321). Please refer to their site for more details.
IMPORTANT NOTICE!
When we plan our incident response strategies and forensic readiness steps, we strongly pay attention to digital evidence acquisition, storage, handling, reporting, and remediation. While these stages are of essential importance for the overall cyber posture of your organization it is more than important as well, throughout each of these steps, to include legal risks and considerations.
The purpose of an investigation is never just to find the source of damage and place a quick repair. An investigation is in place to find out how it happened, document it, and fix those circumstances so they don’t occur again.
Binalyze is delighted to announce we are joining the EU’s ECHO Network project as a vendor, making us the first Digital Forensics and Incident Response participant in this network.
Welcome to our monthly product updates roundup! Here’s a rundown of the new features and solutions we released in the past month that you can now take advantage of.
The end goal of this step is to ensure that internal training & awareness programs take place within your organization since your employees may be involved in the process of handling security incidents.
There can be many kinds of suspicious events generated either by the system or by human watchfulness. Every suspicious event (as described in step 6) needs to be checked before launching a full formal investigation. The following situation can move in two directions:
