{"id":2754,"date":"2019-01-25T16:24:07","date_gmt":"2019-01-25T15:24:07","guid":{"rendered":"https:\/\/wordpress-348070-1639297.cloudwaysapps.com\/incident-response-specialist-24-7-availability\/"},"modified":"2025-10-20T19:44:22","modified_gmt":"2025-10-20T17:44:22","slug":"incident-response-specialist-24-7-availability","status":"publish","type":"page","link":"https:\/\/www.cyber-security-online.nl\/en\/incident-response-specialist-24-7-availability\/","title":{"rendered":"Incident Response specialist available 24\/7"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Incident Response<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Is your organization facing unexpected events in your IT environment, such as workstation lockdown, security breach, no more access to your data, a possible data breach, ransomware or cybersecurity attack?<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tNeem contact op<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"NFIR\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"NFIR\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Incident Response<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Is your organization facing unexpected events in your IT environment, such as workstation lockdown, security breach, no more access to your data, a possible data breach, ransomware or cybersecurity attack?<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Is your organization facing unexpected events in your IT environment, such as workstation lockdown, security breach, no more access to your data, a possible data breach, ransomware or cybersecurity attack? At your request, NFIR takes immediate action with an Incident Response team. <\/strong><\/p>

NFIR is available to its clients 24\/7 to map out and resolve any security incident. Our Incident Response team makes every effort to be at your location within three hours. The goal of the Incident Response team is to minimize the impact of the cyber incident as quickly as possible so that your organization’s continuity is no longer at risk.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tContact about NFIR Incident Response services<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is Incident Response (IR)<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Incident response (IR)<\/strong> refers to the process an organization follows to respond to a security incident, such as a cyber attack, data breach or other undesired event that compromises the confidentiality, integrity or availability of information or systems.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is the purpose of Incident Response (IR).<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The goal of incident response is to minimize the impact of an incident, limit damage, restore normal operations as quickly as possible and prevent future incidents<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

NFIR's approach to Incident Response<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In conducting the security incident investigation, NFIR works according to the Incident Response procedures<\/strong> of NIST<\/strong> and SANS<\/strong> to conduct thorough and reliable investigations. In addition, experience and analytical skills are at the basis of every solved security incident. If your organisation already has<\/span> Incident Response<\/strong> procedures, then NFIR follows those procedures.<\/span><\/p>

During the Incident Response process, NFIR pays attention to the following three processes<\/p>

  1. Triage<\/em><\/strong>: this step aims to identify the source(s) and affected devices and\/or systems, use it to prioritize and determine the plan of action for further investigation. At the same time, data is safeguarded in a forensic way for possible further investigation.<\/li>
  2. Containment<\/em><\/strong>: This process involves restoring affected devices and\/or systems and verifying security so that normal operations can resume.<\/li>
  3. Post-incident activities.<\/em><\/strong>: when the incident is resolved, a forensic investigation report is prepared. The report proposes solutions to prevent a similar event from occurring in the future. NFIR can also support and\/or advise in the communication towards the Data Protection Authority, attorney at law and other parties involved.<\/li><\/ol>

    We use the existing knowledge and skills of the client in the Triage phase. The Incident Response team starts on site and creates a plan of action. Thanks to our procedures and checklists, we can take action quickly and minimise the negative effects of the cyber security incident. During this entire investigation, NFIR will work in a forensic responsible manner in order to be able to produce a forensic report later in the process. If you have suspicions of culpability or recoverability against a natural or legal person, you can also engage us to conduct an investigation. Our reports are legally valid. You can use the NFIR report as evidence in a court case or for a report to the (Dutch) Data Protection Authority (DPA) in the event of a data breach.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t

    The Incident Response Team of NFIR<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    NFIR’s team consists of digital forensic investigators, ethical hackers and team leads who all have Incident Response experience. After notification of the security incident, a team is put together that expresses its opinion. The size of the team depends on the type of cyber incident. Of course, all members of the team will work forensically during this process.<\/span><\/p>

    Preventing security incidents is obviously better than curing them. We are convinced that companies benefit above all from good preventive measures, both technically and in terms of awareness. For this reason, NFIR conducts <\/span>pentesting<\/a> out, we provide <\/span>Security Awareness services<\/a> and offer a package of various services through the <\/span>Cyber Security IR retainer<\/a>.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Incident Response Plan<\/h2>

    I have an incident. What should I do? Know what to expect in the case of a IT security incident. Read more about the Incident Response process. <\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t\t
    \n\t\t
    \n\t\t
    \n\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    CERT<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    NFIR is a Computer Emergency Response Team (CERT).<\/strong> CERT is a registered trademark of Carnegie Mellon University and was awarded to NFIR in January 2020, after NFIR was found to have met all the required requirements. The allocation is based on the work carried out by NFIR, but also on the parties with which NFIR cooperates. <\/p>

    NFIR\u2019s Incident Response team is deployed in cooperation with and for private individuals, SMEs, government bodies, multinationals, educational institutions and non-profit organizations.<\/strong>
    As a CERT, NFIR is one of the major organizations involved in combating cyber incidents, such as the NCSC, the IBD, the Ministry of Defence, telecom organizations and banks. Among these CERTs, there is an overriding confidence in a sector by speaking the same language, which makes cooperation possible.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    ISO-27001, ISO-27002 and ISO-9001<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    NFIR holds an ISO-27001, ISO-27002 and an ISO-9001 certification.<\/strong> These international ISO standards set requirements for information security, aiming to ensure the confidentiality, availability and integrity of data. NFIR has been reviewed by BSI<\/a> for implementation and compliance with these standards. With its certification for the ISO-27001 standard, NFIR proves that it deals with data in a careful and confidential manner and that it controls the information processes within the organisation. With the addition of the ISO-9001 certification, NFIR demonstrates our ability to provide the services that meet information security and quality requirements and desires of our customers.<\/p>

    The scope of the certification includes limiting the consequential damage of cyber incidents and increasing the digital resilience of organizations through response and preventive IT security services.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
    <\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t
    \n\t\t
    \n\t\t
    \n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t
    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t
    \n\t\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat is the difference between proactive and reactive cybersecurity?<\/a>\n\t\t\t\t\t<\/h2>\n\t\t\t\t\t

    The crucial distinction between proactive and reactive cybersecurity is in the timing and approach relative to threats. Proactive cyber security<\/strong> focuses primarily on preventing attacks before they happen. This is done through continuous monitoring, thorough security assessments and implementation of preventive measures. In contrast, reactive cyber security<\/strong> responds to incidents after they have already occurred through detection, containment and remediation activities. <\/p>\n

    Examples of Proactive and Reactive Measures<\/h3>\n

    Proactive measures include vulnerability assessments<\/strong>, penetration testing<\/strong> (pen testing), training focused on security awareness<\/strong> and threat hunting<\/strong> (actively looking for potential threats). These efforts aim to identify and address security weaknesses before malicious actors can exploit them. <\/p>\n

    Reactive measures, on the other hand, include incident response<\/strong> (responding to incidents), digital forensics<\/strong> (digital forensics), malware analysis<\/strong> (analyzing malicious software) and remediation processes<\/strong> that kick in as soon as a breach is detected.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

    \n\t\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tCan I always contact NFIR to get help in case of an IT-Security incident?<\/a>\n\t\t\t\t\t<\/h2>\n\t\t\t\t\t

    Yes, we are available 24\/7 for SMEs, multinationals, government bodies, educational institutions and non-profit organisations. Within three hours, an incident response (CERT) team is present at every location in the Netherlands (Wadden Islands excluded).<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

    \n\t\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat are the most common types of IT security incidents that NFIR encounters in Incident Response processes?<\/a>\n\t\t\t\t\t<\/h2>\n\t\t\t\t\t

    Of all the IT security incidents handled by NFIR, the most common are compromised (e-mail) accounts and attacks on vulnerable systems that offered insufficient resistance due to a lack of software updates and security. If hackers gain unauthorized access to systems, this usually leads to data breaches, the installation of ransomware and various types of malware such as crypto miners.<\/p>\n

    Common types of incidents and response that the Incident Response team assists with.<\/h3>\n