Managed security
Don’t wipe it yet.
Call us first.
Immediate containment, breach investigation and evidence gathering while the attack is still underway. Set it up as a retainer and your first call is a call, not a contract negotiation, and the cleanup won’t destroy the proof you’ll need later.
- A retainer, so hour one isn’t paperworkWhat incident response coversWatching
- ContainmentWhat incident response coversWatching
- Evidence and chain of custodyWhat incident response coversWatching
- Investigation, remote or on siteWhat incident response coversWatching
- A report outsiders will acceptWhat incident response coversWatching
- Recovery, and a door that stays shutWhat incident response coversWatching
Foothills Digital—Sentrello Premier Partner
- AWS
- Azure
- Google Cloud
- DigitalOcean
- On-premises Linux
- On-premises Windows
Every one of our people holds active certifications on the platforms they work on.
Sentrello is our only partnership. On the clouds, it's our people who hold the certifications. We don't claim a partner tier, and we'll keep saying so until that changes.
Where this usually starts
Who do you call at 11pm on a Saturday?
Nobody plans an incident. Most companies do plan the response, though, or end up with one planned for them by whoever picks up the phone first.
- Whoever got there first rebuilt the server, and took the only record of how they got in along with it.
- Every vendor is on the call, and none of them will say who’s in charge.
- Your insurer wants a timeline and a scope. What you’ve got is a group chat.
- The engagement letter shows up at the exact moment you can least afford to read it.
- Nobody knows whether the backups were touched, so nobody knows whether to trust them.
What we do instead
Contain, then preserve, then clean
In the first hour, everyone wants it stopped and wants it clean. Stopping it is right. Cleaning it before anyone has imaged the disk and pulled the logs destroys the evidence that decides whether this was a contained event or a reportable breach. So we isolate, we preserve, and only then do we rebuild, with every step timestamped and every artifact under chain of custody. The report at the end works for your insurer and your lawyer alike, because we wrote it knowing they’d read it.
How it works
How a response runs
Order matters here, and step one happens before anything goes wrong.
Sign the retainer while it’s calm
Contacts, authority, scope and terms, agreed while nothing’s on fire. Who can approve isolating a system at midnight, who talks to the insurer, and who talks to nobody. Then the first call is just a call.
Contain
Isolate what’s compromised without tipping off whoever’s inside, if they still are. Cut the access they’re using rather than every access. A blunt shutdown tells them to hurry and tells you nothing.
Preserve
Disk images, memory, and logs from every source that saw it, captured before the reboot that would wipe them. Hashed, timestamped and logged, so the chain of custody holds up if anyone ever questions it.
Investigate
How they got in, what they touched, what left, and whether they’re still there. That last answer decides whether recovery is a rebuild or a much bigger one.
Report, recover, shut the door
A written account with the timeline, scope and evidence, in the shape an insurer or regulator expects. Then recovery, and the change that closes this route in for good rather than just tidying it up.
What incident response covers
A retainer, so hour one isn’t paperwork
Terms, contacts and authority settled in advance, including what we’ll do without asking and what needs your sign-off. Quoted to your scope, one-off or recurring, like everything else we do.
Containment
Isolating compromised systems and revoking the access being used, while the rest of the business keeps running alongside the investigation.
Evidence and chain of custody
Forensic images of disk and memory, plus log exports from every source that saw the event. All hashed, timestamped and logged with who handled them, so the evidence survives a well-meaning cleanup and a hostile question.
Investigation, remote or on site
Root cause, timeline, what was accessed and what left, across Windows, macOS and Linux machines, servers and cloud control planes. Most of it happens remotely. When it needs hands in the room, we come out, routinely across Denver Metro to Colorado Springs and anywhere else by arrangement, with travel in the quote.
A report outsiders will accept
Written for the insurer, the regulator and counsel, with findings kept apart from opinions. Enough for a claim or a notification decision, and still readable by your board.
Recovery, and a door that stays shut
We rebuild from backups we’ve verified weren’t touched, restore in an order that keeps you trading, and close the route in. The change is tracked so it can’t drift open again.
Related
Managed Detection & Response (MDR)
Active threat hunting through your endpoint data for the intruder no alert caught, and a fast response the moment we find one. The SOC watches what fires. MDR goes looking, with your written permission to act.
Data Backup & Disaster Recovery (BDR)
Automated backups, one copy nobody can delete, and a recovery plan we’ve actually rehearsed. Whether the files copied was never the real question. Will the business open on Monday?
Penetration Testing
Simulated attacks on your external and internal defenses, run by our own engineers, never a subcontractor. You get the scope in writing, a report you can act on, and a retest to prove the fixes held.
If it happened tonight, who would you call?
Your current plan if you have one, who has the authority to pull the plug, and what your insurer requires.
Walk us through that and we’ll show you where the plan breaks, what a retainer would cover, and what needs preserving before anyone touches a thing.
- What we arePlan, create, launch, maintain
- What we areSentrello Premier Partner
- What we areEvery quote written for you