Kaspersky
Incident
Response

The importance of incident
response
While your infosec team works hard to ensure that every network
component is protected, a single vulnerability could open the door
to intruders, giving them access to your information systems.
No one is immune from attacks:
no matter how effective yoursecurity controls, you too canbecome a victim.

Anything can be targeted. If a system gets hacked, it is vitalto establish how it was compromised in order to draw up an attack
mitigation plan and prevent such attacks in the future. The incidentresponse service achieves these goals.

How the service works
An incident constitutes a breach or the threat of a breach ofcomputer security policies, acceptable use policies and / or standard
security practices.
Incident response — obtains a detailed picture of the incident.
The service covers the full incident investigation and response cycle:
from early incident response and evidence collection to identifying
additional traces of hacking and preparing an attack mitigation plan.

Incident

Evidencecollection

Evidence
analysis

Report4 stages of incident response

1

Request initialization
At this stage, our experts gather information from those whoreported the incident and from IT and other personnel who may haveuseful knowledge of technical details and business processes to help
understand the incident details.
In addition, the Kaspersky team analyzes information about theincident from network and security logs for evidence of the incident.
After that, our experts provide short-term recommendations onwhat to do next.

2Evidence collection
Depending on the specifics of the incident, the following approaches
can be used:

OnsiteRemoteOur experts visit your organization andcollect evidence related to the incident
to aid the investigation

Our experts provide all necessary tools andguidance for your company’s IT employees
to collect evidence themselves

Evidence may include: log files of operating systems, applications andnetwork equipment, Internet access logs (for example, from proxy
servers), network traffic dumps, hard drive images, memory dumps
and any other types of information that may aid the investigation.

3

Evidence analysis
At this stage, our experts analyze all the available information(including malware, if necessary) to create a picture of the incident.
Throughout the analysis and investigation, we promptly share newly
discovered details so that timely action can be taken to prevent theattack from developing.
If new signs of compromise come to light during the analysis, we
provide a tool to scan the company’s information resources to detect
other compromised hosts and collect additional data.

4

Final report
We provide you with a final report containing our findings
and recommendations.
Kaspersky investigations are carried out by highly qualified
cybersecurity analysts and experts. All our global expertise in digitalforensics and malware analysis can be leveraged to resolve yourinformation security incident. The service aims to:

Isolate the threat

The service is provided
by our Global Emergency
and Response Team(GERT)GERT experts are certified in IncidentManagement, Digital Forensics,Malware Analysis, Network Securityand Risk Assessment.

Analyze malware used in the attack(if detected)

Stop the attack spreading
Analyze network and host activities

Search for and collect evidence
Eliminate the threat

Identify compromised resources
Develop guidelines for restoring a healthy
IT infrastructure and preventing arecurrence of similar attacks

Analyze the evidence and reconstruct theincident chronology and logic

Expert assistance
Depending on whether or not you have your own incident response
team, our experts can perform a full investigation cycle, simply
identify and isolate compromised machines and prevent the spreadof the threat, or perform malware analysis or digital forensics, as yourequire.

Results
The incident response service will eliminate the threat and provide
you with a detailed report of the incident, including:

DetailedreportBrief description of theincident

In-depth incident analysis witha full timeline of events

Description of vulnerabilities
used, possible attack sources,
affected network components,
results of malware analysis

Description of attacker actions
and tools

Conclusion on the presence/ absence of signs ofcompromise

Recommendations for
mitigating any consequencesof the attack and preventing
such attacks from recurring

Service provision
Subscriptions are available
for 1, 2, or 3 years

Kaspersky Incident Response is a subscription-based service andis available in two options: IR Retainer and IR Retainer Premium.

IR Retainer

IR Retainer PremiumMinimum numberof hours

4080

How many incident
responses areincluded?

Any quantity that can be worked out by the experts within the specified
number of hours

SLAStandard, 24x7

How Kaspersky
experts work

Remote is preferable, but on site is also possible

Can you use yourretainer hours for otherrelated cybersecurity
services?

No

hours

hours

Enhanced, 24x7

Repurposing is available for ThreatIntelligence services:• APT / Crimeware Intelligence
Reporting• Kaspersky Threat Lookup• Kaspersky Cloud Sandbox• Kaspersky Threat Data Feeds

If you haven’t used themduring the duration of yourcontract.

Onboarding

You will have an introductory meeting to discuss the incident response process
so that even when everything’s on fire, you’ll know exactly what to doSingle-incident request

We can also help if you have a single incident request. Our experts
will do their best to investigate the threat and prepare incident
response recommendations quickly, but without onboardingand SLA.

Price determinants
Pricing depends on:

The number of hours

Type of engagement

Subscription typeThis refers to the hours required forincident response, reflecting the level ofcomplexity and number of incidents

Onsite or remotely. The remote option
doesn’t involve travel expenses which
is why it saves time and money

IR Retainer with a standard SLA, or IR
Retainer Premium with the highest SLA

N.B. Hours needed for the service varyfrom case to case.

The level of complexity is determined by our experts at the outset.
Here is an example of the approximate time our experts spend on
incident response, not including the time for evidence collection.

Level ofcomplexity

Description

Turnaroundtime

1

One compromised machine (malware infection, data leak,financial fraud, etc.)

40-56

2Multiple compromised machines in the network (compromiseof a particular business system, massive malware infection,
compromised Active Directory domain, etc.)

56-80

3Complex attack leading to network compromise (complex
attack in distributed networks, APT attack, etc.)

80-120person-hours

person-hours

person-hours

Why Kaspersky?
GERT

The world’s largest
independent information
security company with a global
presence focused on threat
intelligence and technology
leadership

Several petabytes of threatdata collected continuously
around the world and morethan two decades of expertanalysis

Kaspersky’s Global Emergency
Response Team (GERT)
is a group of experts thathas been investigatingcomplex security incidents
for organizations in every
industry and region for morethan 10 years

Recognition
Kaspersky actively participates in independent tests and collaborates
with leading global research firms. Our technologies and products arerecognized worldwide and have won numerous international awards.

Proven to be theindustry’s mosteffective combinationof technologies andexpertise

2020

MOST TESTEDMOST AWARDED
KASPERSKY PROTECTION*kaspersky.com/top3

Gartner Peer Insights Customers’ Choicefor EDR Solutions 2020 names Kaspersky
Top Vendor

GERT

Global Emergency
Response TeamThe Radicati Group recognizes Kaspersky
as a Top Player in the Advanced PersistentThreat (APT) Protection — MarketQuadrant 2021

The service is provided by experts
with extensive practical experience
in investigating complex incidents

Kaspersky’s detection quality confirmed by
MITRE ATT&CK Evaluation

Kaspersky is Positioned as a Leader
in Forrester Wave™: External ThreatIntelligence Services, 2021 reportAbout Kaspersky
Kaspersky is one of the world’s largest providers of information
security solutions for accurate real-time threat prediction,detection, response and elimination.
We are a key member of the top four global manufacturersof software solutions to ensure end user information security.
For over 20 years, Kaspersky has been an innovator in IT security,
providing effective digital security solutions for large enterprises,SMBs and consumers.
Kaspersky's technologies and solutions protect over 400 million
users in almost 200 countries and territories around the world.

Let us help you protect yourself
We help you respond to and clean up incidents before theybecome a problem.

Learn more

www.kaspersky.com© 2022 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.