Incident Response Services

Time is of the essence when experiencing the fallout from a malicious attack or system failure. Our incident response team conducts rapid and meticulous investigations of electronic devices, networks, and systems to identify the cause, source, extent, and next steps after an incident.

Get Help Now with Incident Response

Incident Response Services: The Tetra Difference

The Tetra incident response team breaks the mold. We focus on your needs as opposed to stringent, cumbersome protocol. We customize and triage your priorities to get you back on track faster. In times of crisis, we provide unique insight and intel — giving you clarity when the unthinkable happens.

Faster Remote Response

No matter where you are, we can get to work remotely right away. We prefer getting to work on the incident rather than spending time and money to travel to you. Our active incident response services are available as soon as we’re called to action.

System Restoration

We prioritize restoration in tandem with the investigation in order to limit downtime and losses. Our team of experienced IT professionals, former law enforcement, and Digital Forensics experts offer well-rounded protection to remediate the incident.

Constant and Clear Communication

We understand how stressful and complex incidents can be – that’s why we take pride in clear, straightforward communication from start to finish. We prepare a clear, current summary of our research and keep you informed of our efforts, tools, and recommendations every step of the way.

How We Help with Incident Response

When your organization encounters a situation requiring swift and thorough action, our Incident Response team is there to help. No matter the root cause of attack, our responders offer trusted insights against these vulnerabilities:

Ransomware Response
This crippling attack thrives under the radar, but we’re here to change that. We dive in to restore operations, investigate the incident, and report our findings in a straightforward way against any and all variants of this type of extortion.
Data Breach Response
When attacks go beyond simply encrypting your files, we can resolve exfiltration and theft. We identify, contain, and investigate all types of data breaches and get you back to business in the shortest amount of time possible.
Business Email Compromise Investigation
When legitimate email accounts are used for illegitimate purposes, we research and remediate your vital communication channel. We investigate to determine if and to what extent business email accounts were compromised and work with you to reestablish security.
HIPAA Organization Compromise
Your healthcare organization is vital to your community. If you suspect your healthcare organization’s data was corrupted, stolen, or compromised in any way, our investigators can stop the incident, determine the cause and extent, and help you ensure compliance is maintained.
Wire Transfer Fraud
When a malicious actor requests a wire transfer under the guise of a trusted source, or intervenes in the middle of a valid wire transfer, funds can quickly be routed into the wrong hands. Our team investigates how it happened and shares best practices to protect yourself moving forward.
Employee Misconduct Investigations
When attacks are suspected to originate from internal sources, we offer in-depth investigation. Our incident response team responds to suspected internal incidents or misconduct to evaluate the nature and extent of the incident, and also any necessary remediation.
Intellectual Property Theft Investigations
Your unique tools, inventions, or research are valuable. We want to keep them in your trusted hands. Our team investigates suspected intellectual property theft so your organization can protect and defend what makes you, you.
Expert Testimony
When bringing attackers to justice, we offer actionable research, insights, and intelligence. Our investigators evaluate digital forensics evidence to provide clear, credible testimony in court proceedings.

Contact Us for More Information about Our Incident Response Services

Get In Touch about Incident Response Services

Incident Response Services Case Study

When a Managed Service Provider (MSP) is a victim of cybercrime, the scope of damage can be vast. Most MSPs are using Remote Management and Monitoring (RMM) tools to allow them to provide quick and effective service remotely, instead of needing to get an employee on-site for every little fix. These tools, and their function as Remote Access Tools (RATs) in particular, means that if a cyber criminal gains full access to the MSP’s RMM tool, the threat actor can have full access to every system for every client. Last year, we assisted an MSP that was the victim of cybercrime.

In this particular case, the ransomware known as “Gandcrab” was deployed to all managed systems through one of the MSP’s RMMs.

Unfortunately, all managed systems included every client production machine, every client backup server, all machines owned and operated by the MSP for their internal use, and their servers hosting remote copies of backups.

There were 36 affected clients that needed help, and every single one was down. The MSP simply didn’t have enough manpower to assist every client and was so over-worked that they had to turn off their main phone line.

After reviewing a list of clients affected by the ransomware, Tetra made the decision that we needed to engage each client individually to most efficiently remediate the problem. This allowed Tetra to get a deep understanding of each client’s setup, needs, and most critical systems. It also allowed Tetra to break the clients up into groups and assign both its employees and the MSP’s employees as the primary leads, letting the strengths of each team member work best with the unique situations of each client. Additionally, scoping each client individually allowed for rapid assessment of how many machines truly needed decryption, which gave Tetra substantial leverage in negotiating a potential ransom payment.

For some clients, the solution was simple. For more complicated clients, it could’ve taken hours to manually identify each key encrypting data on a critical system. For those clients, Tetra turned to its development team:

In less than an hour, Tetra’s developers wrote custom software to automatically identify all encryption keys on all critical systems. This dramatically reduced both Digital Forensics and Incident Response team member billable hours and the amount of time it took come to a conclusion on how many keys need to be negotiated for.

While the cyber criminal may identify thousands of keys, our programming determined only the critical keys needed. Tetra was able to keep ransom payment costs to a minimum, and helped each individual client get back up and running.

ransomware analysis

Incident Response Plan

Customized Software

Rapid Response

Check out some related incident response services content on our blog:

Cause and Effect: When a Managed Service Provider (MSP) Falls Victim to Ransomware

Cause and Effect, Incident Response

Our Incident Response Program

Our Incident Response Team is Led By Nathan Little

Vice President of Digital Forensics and Incident Response

Nathan and his team specialize in putting a stop to ongoing incidents, finding the root cause of security incidents, and determining the exact actions of malware and attackers. His leadership helps drastically lower the volume of data that needs to be included in breach notifications using forensic artifacts left behind on the network, servers, and devices involved. Some of the most common cases Nathan’s team encounters are related to HIPAA security incident investigations, business email compromise, financial data theft, insider threat investigations, employee data theft, wire transfer fraud, and more. Nathan’s unique experience writing digital forensics and data recovery software allows him and his team to find and recover data and forensic artifacts that may otherwise go unfound.

Learn about our teammates on our blog:

Incident Response Considerations

There are different trends, threats, and vulnerabilities we see that can correlate to certain industries. Here are our most recent considerations our Incident Response team takes into account when handling new cases — and when considering possible vulnerabilities based on industry.

Given the nature of HIPAA and other regulations that are required of healthcare organizations, the data is especially valuable to threat actors. Clients and patients require a higher, more regulated level of discretion when it comes to medical history and outcomes — which makes this data more costly to retrieve from the wrong hands. If a healthcare organization faces a data breach, it is estimated to cost them an average of $429 per record lost. With such a high return on investment, threat actors specifically target these organizations despite the critical healthcare they provide.

Cybersecurity for the education industry is a unique challenge. Threat actors focus on the most valuable, most protected data to extort. Institutions such as universities and research facilities (as one often accompanies the other) have always been at high risk of attacks. Higher education institutions face difficult security challenges oftentimes based on physical location — thousands of students from all over the state, country, or even the globe are not often on one campus. The data that many universities are required to have and to secure is as valuable to threat actors, and when students study from larger distances, or even bring their own personal devices to a school’s network, the data is more available to the wrong people.

Manufacturing organizations prove to be especially critical if faced with a cyberattack — there comes the added challenge of somehow remaining open for business even if technical infrastructure is compromised. This is made even more complex by the upcoming CMMC requirements that may soon apply to many manufacturing organizations. In the past, manufacturing organizations didn’t face as severe a threat from cyberattacks as other domains. Sensitive information stored by education and healthcare organizations often proved more lucrative targets. Now, due to the modern, connected nature of the Internet of Things (IoT) that ties several organizations together in a clear hierarchy, threats are more persistent than they have been in the past. Threat actors seek either money or disruption through stealing intellectual property, affecting productivity, or simply tarnishing the reputation of an organization.

Contact Us for More Information about Our Incident Response Services

Get In Touch

Incident Response Services

Incident Response Services: The Tetra Difference

How We Help with Incident Response

Contact Us for More Information about Our Incident Response Services

Incident Response Services Case Study

Check out some related incident response services content on our blog:

Our Incident Response Program

Our Incident Response Team is Led By Nathan Little

Vice President of Digital Forensics and Incident Response

Learn about our teammates on our blog:

Incident Response Considerations

Contact Us for More Information about Our Incident Response Services

HEADQUARTERS