Bremen, Germany hashmat@bahadari.de bahadari.de

IT security

Analysing and containing security incidents

A structured response to suspicious accounts, unusual sign-ins or data exfiltration.

Security incident response (based on NIST SP 800-61)
Detectreview alertsassess scopeContainlock accountscut accessAnalysepreserve logsfind root causeEradicatepasswords, MFAclose gapsLessons learnedreport to mgmtaction planFindings feed back into prevention

Typical situation

Unknown accounts appear or data leaves the network. In the rush, traces get lost and important steps are forgotten.

Solution

  1. DetectReview alerts and logs, assess scope, inform management.
  2. ContainLock affected accounts, revoke sessions, cut unnecessary access.
  3. AnalysePreserve and evaluate sign-in, audit and firewall logs; determine the root cause.
  4. Eradicate and hardenReset passwords, enforce MFA, close gaps.
  5. Lessons learnedReport to management with timeline and action plan.

Benefits

  • A fast, orderly response
  • Preserved evidence instead of lost traces
  • Concrete measures against recurrence

Technical detail

Analysis of Entra ID sign-in logs and the unified audit log, review of forwarding rules and app permissions, firewall logs for outbound connections.

Let’s talk about your IT.

In a free 30-minute call we clarify where you stand and what’s worth doing.

Book an appointmentSend an email