Investigation of cybersecurity incidents
Main Objective of the Service
The main objective of the service is to determine how the incident occurred, investigate the methods used by the attacker to gain access to the system, identify affected resources, prevent the incident from continuing, and provide recommendations to prevent similar incidents from recurring.
Incidents Investigated and Analysed
- Unauthorised access to an information system
- Compromise of user accounts
- Infection by malware and viruses
- Phishing messages and malicious links
- Compromise of a web resource or server
- Theft or leakage of data
- Modification, encryption, or deletion of files
- Suspicious activity within the internal network
- Unauthorised elevation of user account privileges
- Attacks aimed at disrupting service operations
- Malicious IP addresses, domains, and other indicators of compromise
Incident Investigation Process
01
Incident Identification
Initial information is collected regarding suspicious activity, signs of an attack, and affected systems.
02
Digital Evidence Collection
System logs, files, network data, and other digital evidence are collected and preserved securely.
03
Analysis and Timeline Reconstruction
The initial and subsequent stages of the attack, the methods used, and the scope of its impact are identified.
04
Recovery and Protection
Measures are defined to contain the incident, restore system operations, and prevent repeated attacks.
Final Report Contents
Brief description of the incident
Incident timeline and stages
Source of the attack and methods used
Affected systems, devices, and accounts
Identified malicious files and indicators
Potential data leakage incidents
Immediate response measures taken
Recommendations for restoring system operations
Measures to prevent the incident from recurring
Practical Recommendations
Based on the investigation results, practical recommendations are provided for blocking malicious connections, changing the passwords of compromised accounts, removing malicious files, remediating vulnerabilities, updating systems, and strengthening security configurations.
Investigation Results
Upon completion of the investigation, detailed information is provided on the causes of the incident, the stages of the attack, affected resources, identified indicators of compromise, and recommendations for securely restoring the system.
Key Service Outcomes
01
Rapid Containment
The cyber incident can be brought under control within a short period of time.
02
Limiting the Spread
The risk of the attack spreading to other systems and devices is reduced.
03
Secure Recovery
Measures are defined to restore system operations in a reliable and controlled manner.
04
Prevention of Repeated Attacks
The likelihood of similar incidents recurring in the future is reduced.
+99871 203 00 23
Report cyber incident:
incident[at]uzcert.uz
Tashkent city, Mirabad district,
Taras Shevchenko street 20
