Create Your Incident Response & Remediation Plan

Alpha Response is our Immediate Incident Response and Remediation Service. We can have hands on keyboards within an hour. We will work around the clock to get your business back up and running, fast.

The most common problem right now is ransomware, where all the company’s computers are shut down and the hackers demand a ransom. While Blue Team Alpha usually recommends not paying the ransom, there are unique cases where a ransom must be paid. In these instances, we work with a company that specializes in negotiating the ransom and facilitating the transaction to obtain the information decoder.

If the ransom is not paid and there are sufficient backups, Blue Team Alpha works with your IT team to get the company’s data restored. In either event, Blue Team Alpha partners with your team or your third party service provider to get your computers and network back up and running, usually within several days.

Download our AlphaResponse Fact Sheet: Does Your Company Have an Incident Response Plan?

The Cost of Ransomware

Lost revenue
Lost wages
Legal costs
Lost data
Reputational damage
Penalty fees

Lost revenue
Lost wages
Legal costs
Lost data
Reputational damage
Penalty fees

How AlphaResponse Works

When you enlist our Alpha Response elite force, we will:

Identify the attack
Minimize its effect
Contain the damage
Identify the origin of the attack
Make recommendations to reduce the risk of future attacks

The Blue Team Alpha Methodology

1) Discovery

Assist and support development of action plan-based business environment, business operations, business needs, resource availability, and current state of environment
Preliminary analysis of email service
Preliminary analysis of all hardware devices
Determine the logs available for harvesting, retention, and review
Determine the size and date range of logs to audit
Conduct preliminary analysis of logs
Determine adversary lateral movement vectors within the environment
Monitor Incident Response tooling to identify currently unknown adversary implants and persistence capabilities
Assist in harvesting and preservation of logs
Provide technical advice

2) Identification/Analysis

Perform analysis on email service configurations and logs
Perform analysis on hardware configurations and logs
Perform custom queries on all endpoints to identify any malicious behaviors
Perform analysis on suspicious behaviors identified using industry-vetted watchlists and threat profiles
Review current configurations for network architecture device(s) such as switches, routers, firewalls, and other identified hardware
Provide technical advice

3) Containment

Monitor tooling for malicious code and suspicious behavior
Monitor email service for attempted rouge logins
Implement white-list(s) and black-list(s) to limit or prevent adversary activity
Execute (with client authorization) necessitated password resets for network and application(s)
Maintain accurate count of hosts with threat-hunting tooling installed and compare to validated assets lists to prevent gaps
Execute approved configuration changes

4) Eradication

Manage coverage of Incident Response tooling and implement policies to prevent malicious binary from executing
Remediation of malicious binaries

5) Recovery

Assist/support rebuilding, re-imaging, bringing machines back online and connected to the network

6) Final Report

Create final report
Gather all relevant data, findings, and information related to the incident
Present to client and any other appropriate parties

A One-stop Shop for All of Your Incident Response Needs

In addition to the above services, we can also assist with:

Ransomware negotiation
Bitcoin acquisition
Forensic investigation

Not sure if you're under attack?

Possible indicators of a cybersecurity incident include:

Suspicious/unexpected money transfer
Suspicious/unexpected vendor account change request
Multiple failed login attempts (brute force)
Abnormal remote login sessions
Unauthorized email forwarding rules
Logins from an unfamiliar domain
Unopenable files
Abnormal information system behavior
Increased quantity and quality of phishing attempts
Duplicate Invoice complaints from multiple customers

Contact Blue Team Alpha to Create
Your Incident Response Plan