Incident Response

What is Incident Response?

Incident response is a service that requires urgent response from threat response experts when a security incident or attack occurs. The goal of incident response is to handle cyber security incidents efficiently and effectively. Efforts are made to minimize damage and reduce recovery time and costs, and to learn from the incident to proactively prepare measures to prevent similar incidents in the future.

S2W's global threat analysis group, Talon, operates an incident response center to proactively respond to the recent surge in ransomware and various cyber attacks. S2W, as an official partner of Interpol, has contributed to the actual arrest of ransomware organizations that have caused significant domestic and international damage, such as Clop, GandCrab, and Sodinokibi, and continues to support many affected companies and institutions.

Additionally, Talon is an organization comprised of analysts from the National Police Agency, Financial Security Institute, Korea Financial Telecommunications & Clearings Institute, and Korea Internet & Security Agency. With years of expertise and experience gained through incident investigations, Talon supports smooth incident investigations and post-recovery. If you suspect an incident or have been breached, please request help immediately. We will respond promptly.

Learn more about CTI

Process

01
Incident Investigation Request Reception

Assign investigator and deploy to the site (within 1 day of request)
02
Initial Analysis of the Incident

Identification and collection of malware, identification of the attack group, provision of information on the attack techniques of the identified group, etc.
03
Confirmation of the Incident Damage Status

Check and track whether the data of the affected company is being leaked and sold on the deep/dark web
04
Confirmation of Intrusion Path

Support for removing vulnerabilities used for intrusion, identification of additional affected devices not identified in the initial analysis
05
Creation of Detection Policies for Attacker Tools and Malware

Support for comprehensive search and removal of attacker tools and malware
06
Removal of Residual Attacker Tools and Malware

Support for identification and removal of additional attacker tools and malware not previously discovered
07
Defense Against Similar Attacks Through Attacker Profiling

Provide methodologies that can detect unidentified attacks based on the intelligence of the attacker's previous attack techniques
08
Prevention of Additional Intrusions

Provide proactive defense methods against additional intrusion attempts by attackers