Whether you are experiencing an active compromise by a threat actor or you are putting the pieces together after the fact: our skilled investigators and analysts can assist with investigation and recovery. Our cyber response team (CRT) is highly experienced in responding to advanced persistence threats, data extortion, business email compromise, ransomware, insider threats, and more.

Our team brings an end to end solution. After the incident is contained, we assist organizations with regulatory inquiries, law enforcement requests, and helping organizations prepare for potential litigation. We have numerous experts that regularly testify in court.

CRA has significant experience conducting data breach investigations across all industries, and we often find the lack of cyber hygiene and defense grows into a state of compromise, incompliance, and/or adverse business impact. Our strategic cyber team collaborates with organizations to comprehensively assess and improve their cybersecurity posture and defenses through the following proactive services:

• Insider threat assessment and program development
• Cybersecurity framework assessment and program development
• Data privacy/compliance assessment
• Incident Response (IR) readiness
• Cloud cybersecurity assessment

The proactive services above leverage industry leading cybersecurity standards, guidelines, and frameworks including, but not limited to NIST, ISO, FedRAMP, SANS, and CMU CERT — as well as global, national, and regional regulations including, but not limited to GDPR, HIPPA, and the California Privacy Act of 2018 — to provide a holistic approach to cybersecurity strategy.

One of the complicated aspects of managing a cyber security incident is that effective response requires participation from many different stakeholders within an organization. Major incidents frequently require coordination among legal, IT, PR/communications, the C-suite, and the board of directors. Tabletop exercises provide a no risk and easy way to get your organization on the same team. CRA uses a combination of NIST SP 800-84, threat intelligence, and case experience from over 1,000 incidents to create realistic and impactful table top exercises. Using a three-act approach, our table top exercises provide simulations which organizations can use to best prepare their organization for when the next incident occurs.

Typically, we find that determined attackers will try to re-enter an environment. Smart organizations will remain vigilant throughout the post-incident phase as operations are returning to normal. Not all incidents end after the adversary is eradicated from the environment, and many large incidents can have follow up needs lasting well beyond the incident’s lifespan. CRA is able to assist you in a number of ways outside of performing traditional incident response services. CRA can provide expertise to assist you with:

• Performing secondary investigations not performed during the initial response, such as determining whether an actor had access to Sarbanes-Oxley complaint systems
• Assessing response taken by another provider or an internal team, and providing insightful recommendations on how to improve and prepare for the next incident
• Assisting in the review of remediation efforts undertaken by an organization, helping to verify the taken actions meet the prescriptive goal
• Assisting legal counsel with expert testimony when needed

One of the best ways to prepare for your organization for an incident is to pit your security defenses against a human adversary in a penetration test. By utilizing our comprehensive penetration testing methodology, built on the SANS Institute’s methodology and the MITRE ATT&CK framework: CRA’s penetration tests work to effectively emulate the actions and techniques used by advanced threat actors, thus allowing us to flush out weakness and flaws in an organization’s environments that can often be missed by automated scanning tools.

A compromise assessment takes a holistic look at your environment, augmenting and verifying your security team’s capabilities. Our team provides insights from both a network- and endpoint perspective, hunting for known and unknown threats.

Our team will collect and analyze data from external threat intelligence sources, your endpoints and network traffic. We'll assess these data using the same analysis techniques, tools and technologies that we use during our incident response engagements.

Our report will detail our observations regarding malicious and suspicious activities in your environment, as well as your overall state of cybersecurity hygiene. During the assessment we will work side by side with your security- and operations teams. We’ll alert you immediately should we detect signs of active compromise, in which case our experts will be ready to assist you in dealing with it.