Coupled with computer forensics, our network forensics offering is a full service Incident Response Team that is skilled and experienced in handling real-world intrusion, attacks and incidents of not only APT, but growing threats from around the world. When identifying attacks, tools and techniques can be used to capture and inspect data packets passing through the network. These packets can be inspected live or stored for later analysis. If an attack recently happened, time is of the essence and you are encouraged to immediately contact AR Forensics staff for a consultation. Typically, our engagement might consist of any of the following:
Targeted threat actors focus on a specific target and customize and adapt their tools, tactics and procedures (TTP) to predict and circumvent security controls and standard incident response practices. This background analysis and reconnaissance is done by patient people that only have to be right once. Typical defensive tools, procedures, and controls commonly put in place to detect everyday cyber threats are often ineffective against targeted attacks as they will pinpoint a human weakness, use "white listed tools" or tools that are tested and undetected against known antivirus software and remain undetected for months to years.