The course of a security incident: a story

Nowadays, the question is no longer "if" a company will fall victim to a security incident, but "when" it will happen. Unfortunately, companies that have already been victims are not necessarily exempt from this. Cyber incidents are still on the rise and there is no sign of a trend that would suggest a decrease in the near future.

We know that a security incident can be nerve-wracking and overwhelming. That's why we want to help you be as prepared as possible in the event of an emergency. Using a fictitious story, we illustrate which processes will occur and which can be prepared in advance.

The story: Who chopped the fruit?

When Freddy Fritte happily enters his bistro one morning to start work, he can hardly believe his eyes. His precious fruit, which he had bought especially for today's special dish, lies destroyed on his worktop.

He realises immediately - he has been the victim of a hacker attack. And as if that wasn't bad enough, his secret recipe has also been stolen. Freddy doesn't know what to do and decides to get help. He immediately calls the office of Ivo Inspector and Annelise Annelizer. If anyone knows how to track down hackers and protect themselves from them, it's these two!

After the call, they immediately arrive at Freddy's. They carefully enter the kitchen, the scene of the crime, to secure all important traces of the hacker attack. They had already told Freddy on the phone that he shouldn't touch or change anything. This would increase the risk that he could contaminate the crime scene and they would have less chance of solving the case. All good detective work begins with securing the crime scene. Now the two of them are standing here in Freddy's kitchen, wearing the same shoes and gloves they wear on every case they work on. This is how they ensure that their own traces can be excluded from the crime scene. Because "nothing is as important for the successful investigation of an incident as the traces that every hacker leaves behind," Annelise emphasises. Ivo nods and leans over the hacked fruit: "Annelise take a look at this...". Has Ivo just found an important clue here?

As long as Ivo and Annelise are busy securing evidence and investigating the hacker attack, Freddy will not be able to continue running his restaurant. But that doesn't mean that Freddy has less to do. He now has to take care of external communication with various groups of people. First and foremost, of course, this includes his customers, who he has to sadly inform that his restaurant will unfortunately have to remain closed temporarily. He also has to inform his suppliers that deliveries have been cancelled. As he has unfortunately also lost important data from his beloved recipe as a result of the theft, he is also obliged to comply with the statutory reporting obligations and inform the "Geheimrezepte Kammer" about the loss of data. For Freddy, this not only means financial losses, but also that his reputation suffers as a result of the incident.

While Freddy is doing his communication management and clicking through his documents, he suddenly finds a strange email. When he opens it, he can hardly believe his eyes - it's a message from the hacker demanding a ransom. Otherwise he would destroy even more of Freddy's fruit. He can't let that happen! But what if the hacker doesn't stop despite the payment? Freddy is at a loss and immediately calls Ivo and Annelise. Annelise explains to him in a reassuring voice: "Ransom demands are quite normal in incidents like this. It's important that you keep calm and don't give in to the demand! That way, you'd only be giving him what he wants and you wouldn't be sure whether he's really gone and is true to his word." From the background, Freddy could hear Ivo shouting victoriously, "We'll take care of it! He won't see a cent from you!"

In order to solve the case as quickly as possible, Ivo gets straight back to work. He takes a closer look at all the evidence he has found at the crime scene: Ivo starts by examining the chopping pattern of the aubergine. He compares the cutting technique with techniques he has seen before and tries to find similarities and differences. However, the type of attack used by the hacker is completely unknown to him. The cutting pattern does not yet appear in any database. Finally, he looks at the employees' duty rosters. According to the cleaning schedule in the kitchen, the cleaning lady normally finishes her shift at 8 pm and leaves the kitchen. On the evening of the incident, however, she spontaneously fell ill, so Freddy was the last person to leave the restaurant at around 8.30 pm. That was the last time any of the staff were in the restaurant. Or was it?

Annelise Analizer is also investigating the crime and is on the trail of the perpetrator. She rummages through the secured traces and analyses them in detail. Unfortunately, the fingerprints found did not match and she was also unable to trace the ransom note. A real professional was at work here. Next, Annelise reviews all the surveillance camera footage from the last few weeks. However, the footage from the evening of the hacking attack is encrypted, so she cannot directly identify the perpetrator. But Annelise notices something else suspicious: She notices that the vegetable delivery man visits the toilet at Freddy's every day during deliveries in the week leading up to the evening of the crime. He hadn't done this once in the weeks before. Coincidence or has Annelise just identified the culprit?

After a total of two weeks of tireless work, Annelise Anelizer and Ivo Inspector are sure they have cracked the case and invite Freddy to their office to inform him of the latest results of the investigation.

First they explain to him that the attacker must have got in through the windows of the staff toilet. Suspicious footprints and surveillance footage from neighbouring shops confirm this assumption. On the day of the incident, the cleaning lady, who normally closes the windows in the evening, called in sick at short notice and Freddy had apparently forgotten about the window.

They then solve the attack pattern. While analysing the attacker's cutting technique, Ivo discovered that the attack must be both a special knife and a technique of his own. The knife and the technique used for the hacking attack are rarely used in kitchens in the area. It is a very special knife that is used by vegetable farmers when working in the fields.

Freddy looks at both of them with expectant eyes. Who was it now? Thanks to their good detective work and Freddy's correct behaviour, Ivo and Annelise were finally able to secure enough clues and gather enough evidence to convict the perpetrator.

The footprints at the crime scene, the use of the special knife and the unusual toilet passages through which the toilet window was opened leave no room for doubt. The wanted hacker is Hank Hacker. After a successful arrest, Hank finally buckles and confesses. He himself has been dreaming of his own restaurant in his beloved home town since childhood, but he would never have had a chance as long as the successful Freddy's was also open. He hoped that the attack would lead to the closure of the restaurant. But this dream has probably come to nothing. Hank is arrested and ends up behind bars.

After successfully reconstructing the case and arresting the culprit, Freddy sets about reopening his restaurant. He cleans everything thoroughly, gets new fruit and prepares everything. After the last few exhausting weeks full of ups and downs, he can finally open his business again and welcome his customers. But he knows one thing for sure: he doesn't want to go through anything like this again.

To ensure that something like this doesn't happen again, he works with Ivo and Annelise to develop a new security concept for his restaurant. Without further ado, the locks on the windows and doors are changed and new surveillance cameras are integrated for the entire premises, which Freddy can view at any time via an app. However, he is most excited about his new alarm system, which can independently recognise and report any unusual access. Even though the new security concept initially required a large investment, Freddy knows that it was worth it. Ultimately, nothing is more expensive for him than losing important recipes, his customers or, in the worst case, even his restaurant.

After successfully commissioning the new systems and precautions, Annelise, Ivo and Freddy say goodbye and head back to their office, where the next robberies are already waiting to be solved.

‍

THE END

The explanation:

Our fictional story about Freddy should help you get a rough feel for how a security incident can unfold within a company and which processes become important in the process.

Even in the real world, it makes sense to get experts on board in the event of a security incident to help you secure traces and get the systems up and running again. To do this, they look at all the affected environments on site and analyse the incident down to the smallest detail. They have various tools at their disposal to help them do this. To ensure that no traces are lost and work can be optimally resumed, we have formulated a guide on how best to behave in such a situation (see sidebar).

In addition to the chaos in the company, it is important not to forget to inform various groups of people about the incident and the next steps, such as customers and employees. In addition, there are also reporting obligations for incidents in which data has been lost, for example, so that the relevant authorities must also be informed. As Freddy's secret recipe was stolen on behalf of confidential data, he also had to report the attack to the authorities.

In the most common cases, the motivation of the attackers is to extort money, so a ransom demand is rarely absent. This is usually found as a note in various folder structures where work documents are normally stored. We do not recommend complying with such demands. The attackers will always leave a back door open and try to encrypt your company again and again. This is one of the reasons why it is so important to ensure that previous vulnerabilities are corrected and general security is increased once the systems have been restarted. Different measures can make sense here, which is why our experts will prepare a customised security package for you that is tailored precisely to your company.