Emergency cyber incident response in Switzerland

An incident is under way, or you suspect one?

Contact our CSIRT

Not a client yet

Report your incident

Describe my situation

Client under contract

Your 24/7 on-call line

Use the on-call number and channel set out in your contract and on your client portal.

Ransomware, intrusion, mailbox compromise or data exfiltration: our CSIRT assesses the incident, takes the first containment measures and stays with you until the situation is back under control.

What to do first in a cyber incident

The first actions can limit the impact of an incident, but they can also destroy the traces needed to understand it. Until we take over, favour preservation and avoid anything irreversible.

Affected machines
- Where possible, isolate them from the network without shutting them down
- Do not reboot, reinstall or restore them without coordination
Logs and traces
- Preserve logs and suspend automatic purges where possible
- Do not clean up systems or delete suspicious files
Backups
- Isolate them and check they are not exposed to the compromise
- Do not restore straight away onto an environment whose integrity is unproven
Attacker
- Keep the messages, demands and contact details
- Do not reply, negotiate or make a payment without prior guidance
Communication
- Use a communication channel considered clean
- Do not share unverified information about the incident widely
Timeline
- Write down what you observe and what you do, with timestamps
- Do not rely on memory reconstructed after the fact

When in doubt, avoid anything irreversible and describe the situation to us exactly as it stands.

From the first contact

Detect. Respond. Recover.

A structured response to limit the impact of the incident, make the right decisions and secure the return to normal operations.

1
Detect & assess
Identify the signs of compromise, triage the alert, measure the affected scope and prioritise the actions to take.
2
Respond & contain
Containment of the threat, coordination of the teams, technical investigation and remediation decisions suited to the situation.
3
Recover & strengthen
Return to normal operations, verification that the threat is eradicated, reporting of the findings and lessons learned to reduce the risk of recurrence.

Before the incident

Prepare your incident response before you need it

A crisis is handled better when it has been prepared for. Knowing your environment, your contacts and your procedures before the incident lets our CSIRT act faster, and with fewer unknowns, when every minute counts.

Prepare my incident response

24/7 CSIRT on-call
A dedicated channel and priority access to the analyst on duty, all year round.
Incident response plan
Roles, procedures, contacts and decision paths prepared before the crisis.
Resilience exercises
Realistic scenarios to test your teams, your procedures and your decisions under pressure.
Knowledge of your environment
Architecture, contacts and key constraints are identified before an incident occurs.
The full range of SecuLabs expertise
CSIRT, SOC, forensics, architecture and offensive security can be called in depending on the nature of the incident.

After the incident

Forensic investigation: understanding what actually happened

Incident response contains the compromise and restores the environment. Forensic investigation goes further: it uses the available traces to reconstruct events, establish the scope of the compromise and determine which data may have been accessed, altered or exfiltrated.

The findings are documented, stated together with their limitations, and usable in your internal, insurance, regulatory or legal proceedings.

Explore our forensic investigations