Incident Response

Quickly intervening in an IT incident and taking countermeasures can greatly mitigate the impact of cyberattacks

In addition to quickly detecting an attack, professional and comprehensive countermeasures are critical to keeping damage low and preventing spread to additional network segments, geographic regions, plants, sites, and servers. For example, encryption can be detected frequently, but sometimes the alerts are not available (here an EDR/XDR or SIEM solution would be helpful), or the assessment of the incidents is not done correctly (internally or via an MDR or SOC service). When the attack is detected, a fast response is important to implement the restart quickly in parallel but also to do forensics to trace the attack (partly in cooperation with authorities, etc.).

Find the right IDR now with CyberCompare

An Incident Detection and Response (IDR) retainer is typically a contract with an incident response service provider and includes contractually assured support (also called a “retainer”) in the event of a cyberattack. This assures the customer of prioritised support in the event of an emergency and enables a faster response with the support of the experts – who already know the business and thus can quickly assist with containment (remote and on-site), forensics, and restart. The contract typically describes, in addition to an annual hourly volume (expandable in case of emergency), the corresponding service level agreements (SLA) for accessibility (usually a 24/7 hotline), start of remote support (e.g., after 4 hrs), and possible on-site deployment if so requested by the customer. In most cases, an agreement is also made that unused hours can be used for proactive services in the following year (e.g., assessments, penetration tests, training).