/03result

On-site and remote data acquisition was required, including significant support to the client who did not have the requisite skills or staff to manage the incident (a third-party IT provider was also contracted to assist with restoration activities). Incident management and project management was a large component of the initial phase. Containment activities were significant due to the presence of web shells, remote access trojans and the widespread nature of the incident, hampered by the absence of an asset register or understanding of the breadth and depth of the network. Senior Incident Managers and Responders were critical during the 2–3-week containment phase, which involved regular on-site meetings, business continuity planning and execution and emergence management and response.