Working as a security monitoring supervisor in a highly digital company is not for the faint-hearted given current cyber threats. It's essential to prepare for various threat scenarios to minimize opportunities for attackers. At OTTO, IS4IT Group's Security Operations Center is an important part of these measures.

Cyberattacks in the nuclear energy sector must be prevented at all costs. The criticality of the facilities requires absolute security, even if they are already decommissioned or in the process of being dismantled due to the nuclear phase-out. Regular IT security checks are therefore standard for every facility operator. Independent consultants evaluated the company's implemented IT security measures positively in a 360-degree analysis in 2018. The few existing areas for improvement were consistently implemented together with IS4IT.

When an unknown domain admin suddenly appears in the Active Directory (AD) of your systems, all alarm bells ring. This happened on April 5, 2023, at a medium-sized media company (production), which initially frantically began searching for the possible cause. However, the IT manager soon contacted IS4IT Kritis, and during the first crisis meeting on Maundy Thursday, April 6, 2023, at 10:00 AM, it became clear: The IT infrastructure was severely compromised and Incident Response (IR) was essential. Within less than an hour, the order was placed and the Incident Response Team (IR Team) headed to the airport. While the planned attack was prevented, the cleanup and complete rebuild of the entire infrastructure led to an extensive hypercare project. With over 500 servers, 700 workstations, and multiple locations, this naturally takes time. The deployment is far from over. Nevertheless, the customer is very pleased that the damage remained within manageable limits.