| Incident Response Preparation

We Assess

• Create and review a detailed map of the network and enterprise attack surface
• Establish a configuration baseline for servers, workstations, and critical infrastructure components
• Review endpoint configuration, hardening standards, and asset classification standards

We Analyze

• Review logs for indicators of Compromise (IOC) and Indicators of Attack (IOA)
• Understand the possible compromises that have occurred within the environment

We Contain and Eradicate

• Breakdown and classify events to deploy resource tools
• Contain compromised hosts and gather data samples
• Remediate shortcomings based on best practices and needs of the client
• Perform full recovery of hosts and full environment status check

We Give A Recommendations Report

• Identify any compromised systems and provide an analysis of your network, endpoint, and log data
• Pinpoint any attacker activity, including a preliminary attack timeline and malware information
• Summarize findings and provide clear recommendations for next steps

We Assess

• Understand resources at your disposal in the case of an incident
• Review organizational resources
• Perform checks in data aggregation areas, such as data sources, logs, and areas of analysis
• Measure policies against current standards
• Ensure plan accounts for resources, to minimize downtime
• Ensure each area of the organization understands their role during an incident

We Recommend

• Identify resources needed for infrastructure improvements
• Demonstrate how these resources help the larger organization

We Train

• Work with First Responders in real-life scenarios
• Clarify roles and responsibilities of First Responders during an incident
• Set expectations for First Responders for responding to an incident
• Provide tabletop exercises based on your infrastructure, policies, procedures, and security risk

We Give An IR Readiness Assessment Report

• Identify gaps in the necessary systems, processes, and human resources responsible for responding to incidents
• Outlines organizational needs and requirements for properly handling incidents

We Assess

• Model cyberattacks ranging from phishing, ransomware, and denial of service
• Mimic policy violations such as copying company data and harassing emails
• Tailored Disaster Recovery and Business Continuity scenarios to ensure your organization is prepared

We Design Incident Management

• Test your ability to simultaneously coordinate with senior leadership, legal, and security teams to respond to an incident
• Practice your readiness to continuously communicate through and incident, keeping all stakeholders updated and informed

We Tailor To You

• Uniquely tailored exercises based on your specific environment
• Close and thorough analysis of your policies, procedures, security tools, and resources to identify gaps that may increase risk

We Collaborate

• We foster a no-fault, no-wrong-answer, no-blame environment
• Open lines of communication to allow teams to work closely together
• Close working relationships allow teams to work with their members and others to solve the incident

vSOC

Tevora’s virtual security operation center (vSOC) managed detection and response service gives you confidence that your entire digital footprint-whether it be in the cloud, in data centers, or on IoT devices-is well-defended against attack

Detection

• 24/7 Monitoring
• Detection of Unknown (Signature-less Attacks)
• Human Analysis by Professional Incident Responders

Response

• Full Incident Response Support
• Endpoint Isolation
• Threat Containment and Eradication
• Automation via Integrated APIs
• Quarterly Briefings and Security Recommendations

Adversary Tactics & Techniques

• Ensure coverage of common attack scenarios by mapping tests to MITRE ATT&CK framework
• Use benign test scrips to simulate a broad range of attacks
• Identify Indicators of Compromise (IOCs) and test your ability to detect and respond to them

Tevora’s Execution Engine

• Deploy our automated test execution engine with easy-to-use graphical user interface
• Use the execution engine to quickly run all attack simulation tests
• Generate test results and logging automatically as a result of test execution

Analysis & Evaluation

• Conduct manual and automated test result analysis to identify areas of improvement needed to defend against real-world threat actors and adversaries
• Identify cases where simulated attacks were missed
• Make changes to ensure detection of all attack simulations, and re-run tests to confirm the changes work

Resource Recommendations

• With an in-depth understanding of your your organization’s ability to detect and respond to simulated attacks, we’ll make recommendations on further equipping your staff and systems environments to be fully prepared for real-world external threats

Emergency Incident Response

There’s no “good” time for a cybersecurity emergency-and absolutely no time to waste. Tevora’s Emergency Incident Response services are available 24/7 to help policyholders handle an active threat, whenever it occurs

Rapid Threat Detection, Analysis, & Education

Our insurance response SWAT team jumps in quickly, using specialized skills and advanced digital tools to identify and locate the active threat, determine its scope and damage, and eradicate those threats from the environment

Quick Return To Business As Usual

After removing the threat, our team cleans up your systems and helps you quickly return to safe, full operations. We conduct a thorough review of the incident and make recommendations for security improvements if needed, so it doesn’t happen again