SecurityMetrics Payment Card Industry (PCI) Forensic Investigators work with merchants in all industries. With over 20 years of experience, they lead the industry in their specialized knowledge.
SecurityMetrics' Forensic Investigators have performed over 500+ forensic investigations
Features
Quickly contain compromise
Often, organizations don't have the manpower needed to properly evaluate security incidents. This leads to gaps in security and a potential breach. That's why we work to minimize breach impact and maintain your reputation.
SecurityMetrics' Forensic Investigators have performed over 500+ forensic investigations. Using years of experience and expert tools, we provide a fast recovery solution. Forensic investigators work with you in confidence to identify all exposure points. If you experience a breach, SecurityMetrics forensic investigators offer post-incident support so you can make a full recovery.
Recover from a breach
If you have experienced a breach, you are likely worried about incurring fees/fines as well as protecting your reputation and customer card data.
SecurityMetrics can help you avoid a full PFI investigation by conducting a thorough Incident Response and communicating directly with SecurityMetrics acquirer contacts. This helps you save valuable time and money while getting back to business sooner.
Forensics solutions
If you've been notified by your card brand of a potential breach, it's important to act quickly. SecurityMetrics Forensic Packaging is a precise approach to efficiently discovering the cause of a breach and identifying what needs to be remediated. If you choose SecurityMetrics for your Forensic Packaging, you will receive a detailed report, security consultation and advice, and the training you need to prevent a future breach.
Shopping Cart Inspect
As an ecommerce business owner, you know how important it is to keep your website up and running. Use SecurityMetrics Inspect to diagnose and protect your ecommerce shopping cart from an ecommerce skimming attack.
PCI forensic investigation
If you've suffered a breach, you likely have card brand PCI obligations. SecurityMetrics Forensic Investigators are trained in PCI Forensic Investigation and will work with you, step-by-step, to remediate.
SecurityMetrics consulting
You have deadlines. We have solutions. SecurityMetrics offers timely, affordable, and comprehensive information security consultations to help your organization comply with industry mandates, secure business networks, and achieve data security goals.
Table-Top exercises
SecurityMetrics Forensic Investigators will help your organization perform table top exercises, so you can practice real-life scenarios and perfect your staff's response.
Compromise assistance forensics
SecurityMetrics helps you limit your window of compromise by containing your breach quickly and decreasing the amount of sensitive data that is captured and exfiltrated.
Post-breach training
SecurityMetrics analyzes and interprets the available forensics data to discover how, where, and when the breach occurred, as well as the vulnerabilities that allowed the breach to happen. Using this data, you will be trained on how to prevent a breach in your network again.
Save valuable time and money while getting back to business sooner
Forensics FAQs
How does a forensic investigation work?
Here are the typical actions a forensic investigator would take:
Preliminary research: Forensic investigations begin with some research on the company. The PFI needs to “scope” out the merchant’s environment, finding out where critical data resides, the systems that connect to it, and how the data flows in and out of the network.
Onsite data gathering: The forensics team then goes onsite and gathers data from identified devices.
Analysis: The investigation team brings the data back to their headquarters and analyzes it thoroughly to confirm whether a data breach actually occurred, determine what data the attacker was able to steal, and discover which vulnerabilities were exploited in the breach.
Reports: About a week after the initial data acquisition, the investigator will issue a short preliminary report that shows whether or not they’ve discovered any indicators of compromise or other overt evidence of a data compromise. After the forensic data has been fully analyzed, the investigator will submit a complete final report that includes how the attack happened, which vulnerabilities were exploited, and what data was at risk.
How much does a forensic investigation cost?
Forensic investigations can be costly. However, remember that the investigation involves one or more PFI’s examining a mountain of data.
The cost will depend on the size of your organization; the larger your organization, the more data you likely have that will need to be examined.
What is an incident response plan?
An incident response plan is a documented, written plan with 6 distinct phases that helps IT professionals and staff recognize and deal with a cybersecurity incident like a data breach or cyber attack. Properly creating and managing an incident response plan involves regular updates and training.
A well-executed incident response plan can minimize breach impact, reduce fines, decrease negative press, and help you get back to normal operations more quickly.
Here's a helpful blog that goes over the six phases of incident response.
What should I include in my incident response plan?
While every organization needs varying policies, training, and documents, there are a few itemized response lists that most organizations should include in their incident response plan, such as:
- Emergency contact/communications list
- System backup and recovery processes list
- Forensic analysis list
- Jump bag list
- Security policy review list
Check out this helpful handout here that goes into more detail about what should be included in your incident response plan.
What should I do if I'm breached?
The bare minimum of what to do when you get hacked:
- Change passwords immediately on all systems and routers.
- Disable remote access.
- Preserve firewall logs and current settings. Then restrict traffic to business critical servers and ports. Systems that process credit card data for authorization and settlement (either back office server or point of sale systems) should be restricted to only communicate outside with the payment gateway.
- If an ecommerce site is breached, preserve any altered pages.
- Update your antivirus tools and run malware scans on all devices in the card data environment. (Quarantine any findings—do not delete)
- Save log files.
- Save a copy of malware and malware log files on a quarantined external drive (if discovered).
- On Linux systems, copy as much of the bash_history files for all accounts as possible.
- Under the direction of a PFI, and only if you have the IT skill, make a forensic image of the system before wiping and installing a new system.
- Document all changes with the date and a description of the actions taken.
- If you re-image your systems or switch to new devices, only install software from known “clean” images.
- Engage a security consultant (preferably a PFI or QSA) to preserve the compromised environment for future data breach review.
You can also get more information by checking out this blog on the six phases of responding to a breach.
Resources
The following are related resources that we have prepared for you. Find more answers to your questions in our Learning Center.
.svg)