Our Services
ONSITE • REMOTE • CLOUD
Our focus and expertise in DFIR (Digital Forensics & Incident Response) allows us to offer a wide range of solutions for our clients with an unrivaled level of specialization. We tailor our DFIR service experience to the requirements of each project and the client’s individual needs.
Our services are aimed at providing solutions in all stages of the lifecycle of a cybersecurity incident. Our portfolio is focused on detection, containment, response and forensic investigation, as well as readiness and hunting.
Emergency Incident Response
Emergency Incident Response (EIR) service provides our clients with a coordinated and structured approach, from the initial response to the resolution of an incident.
Our goal is to minimize downtime, contain the incident, and restore normal operations. To achieve this, we are always prepared to intervene in any type of incident, anytime and anywhere in the world, quickly and efficiently.
Our methodology includes rapid reaction measures and containment techniques, to minimize disruption and damage to the business, with the aim of recovering activities as soon as possible.
Once the incident is contained and the investigation process has been performed, One eSecurity’s team will produce digital forensic investigation report that will allow the client to understand the root cause and the Tactics, Techniques and Procedures (TTPs) used by the adversaries, and adopt the required corrective actions.
Digital Forensic Incident Response
Digital Forensics (DFIR) service is focused on system in-depth analysis of a specific defined scope. The goal is to obtain a traceable record of previous activity in order to answer any investigative questions with a methodological forensic investigation approach.
Our DFIR methodology is based on procedures and techniques that preserve the chain of custody (identify, gather, preserve, extract, interpret, analyze, document, and present evidence from computing equipment). This guarantees that any evidence discovered will be admissible during a legal and/or administrative process.
Threat Hunting
Threat Hunting (TH) service offers our clients a continuous and proactive threat detection process in both networks and systems, combining manual and automated analysis. We transform a reactive process into a proactive one, which provides us with the necessary tools and processes to be one step ahead of possible threats.
One eSecurity offers different modalities of Threat Hunting:
- IT Hunting
- Network and Netflow Hunting
- Managed Hunting
Our years of experience have allowed us to develop our own Hunting Framework, on which we build our service. This Framework enables the Threat Hunting service to improve and automate early detection of security incidents, increasing the client’s incident response capabilities.
Cyber Consulting
Cyber Consulting (CyCon) service provides an assessment and improvement of the client’s incident response management capabilities.
CyCon guides our clients through the decision-making processes, allowing organizations to improve their maturity, readiness, and resilience to security events.
This service applies all the experience that One eSecurity has been gathering over the years from our Emergency Incident Response, Digital Forensics and Threat Hunting departments to provide the best approach and fit for each client.
One eSecurity offers different possibilities of CyCon:
- Incident Readiness Maturity Model
- Capability Building
- MITRE ATT&CK TTPs and Datasources Visualization and Detection Mapping
- Incident Response Plan
- Ransomware and other kinds of Playbooks
- DFIR infrastructure improvement.
Cyber Exercises
Cyber Exercises (CybEx) service offers guided simulations of real cybersecurity incidents conducted by our DFIR experts.
Cyber Exercises are focused on evaluating response capabilities, identifying processes gaps, immature or incomplete Incident Readiness Plans, measuring the organization’s knowledge, and analyzing reactions.
We offer different options of cyber exercises:
- CybEx ad-hoc, customized for the client
- CybEx from One eSecurity’s repository
- Workshop with One eSecurity’s experts
- Hybrid Workshop: mix between CybEx and Workshop
Cyber Insurance
One eSecurity is a provider of incident response services for the main insurers due to the specialization of its DFIR teams and its deep knowledge on the cyber insurance sector. Through the Cyber Insurance (CybIns) service, we help companies to achieve the cyber insurance underwriting level required by insurers through preparation services such as CybEx, workshops, playbooks, maturity studies, etc.,including our own ransomware impact calculator. We know what insurers pay attention to and we offer the consultancy that the client needs to have the requested coverage.
CybIns is also the first response to a cyber incident and its forensic investigation through the customer’s insurance policy. Insurers offer their policyholders freedom of choice on the incident response provider, so we can play that role; the client only has to indicate it to their insurer during the insurance underwriting or during the incident and we take care of the entire process with the insurance company.
In addition, after an incident, we can help optimize the coverage and limits included in the policy of the insured, according to the type of incident that has occurred.