SD Cyber Security Incident Response Methodology

__________________________________________________________________________________________

1 Easter Court, Suite E, Owings Mills, MD 21117

PHONE 410·902·0356 · FAX 410·902·9609 www.signalsdefense.com

©2014. ASTIC Signals Defenses, LLC. All rights reserved.

Signals Defense has a robust Incident Response (IR) and cleanup methodology that has been utilized to help multiple Federal and Civilian agencies to identify the scope of compromises, identify malicious scripts and programs, and eradicate those systems. The Signals Defense IR staff is all fully certified, and cleared personnel dealing with both classified incidents as well as unclassified but highly confidential issues. Signals Defense begins this process by working with your network and security staffs to get a complete understanding of what is known about the compromise. At this time we will review any system and security logs as well as any packet captures that have been taken of the malicious activity. We have had great success identifying the initial point of entry of the attacker during this phase if it has not already been identified. Signals Defense works with your network and security staff to determine what level of network access should be provided to identify any currently compromised systems on the network while still maintaining the appropriate level of business confidentiality for your organization. Once this has been determined we develop custom scripts and programs to identify compromised systems and anomalous behavior. All data captured and reviewed in this phase will be stored on a removable encrypted drive. All data investigations will follow industry best practices for chain of custody. This will assure that all data and findings admissible in court if the case gets to that level. During this phase we are constantly working with your internal teams to ensure that any capabilities currently in place are maximized. Signals Defense uses the information gathered during this phase to establish the scope of the compromise and determine what steps should be taken next. After the compromised systems have been identified and the scope of the compromise has been determined, we will provide a comprehensive plan to return the compromised systems to an acceptable state. This plan includes multiple options, some of which can be used to successfully eliminate the attacker from the network; others can be used to mitigate the effectiveness of the attack while systems are returned to production state in stages. Our experience resides in the following environments and industries:

• Department of Defense

• International Law Firms

• Financial Firms

• Civilian and Government Health Care

• High net worth individual clients

• The US Republican Party

• Drug Development and Research Facilities

• US Critical Infrastructure

• US Federal Agencies

• Casino and Gaming industry partners

__________________________________________________________________________________________

1 Easter Court, Suite E, Owings Mills, MD 21117

PHONE 410·902·0356 · FAX 410·902·9609

www.signalsdefense.com

©2014. ASTIC Signals Defenses, LLC. All rights reserved.

Rick Mellendick holds Top Secret (TS) clearance and is the Chief Security Officer for Signals

Defense in Owings Mills, MD with 18 years of information technology security experience. Mr. Mellendick performs the duties of technical director and chief strategist to multiple DoD, federal, intelligence, and private organizations. He provides direct support to the U.S. Critical Infrastructure. His background is in designing secure networks in multi-platform/multi-classification environments. His knowledge was gained from researching the advanced threats to critical infrastructure, as well as civilian, and federal agencies which is the basis for the Signals Defense Computer Network Defense Team and Red Teams tactics to protect our clients’ systems. Rick has extensive experience in computer network operations including developing proof of concept attacks and performing demonstrations for many federal and corporate clients. The teams that Mr. Mellendick leads regularly perform Red Team analysis specializing in wireless and RF attack and defense as well as technical surveillance counter-measure (TSCM) sweeps. He is a subject matter expert for computer network operations, wireless offensive tactics, and designing information systems to comply with federal and local regulations. Mr. Mellendick has personally completed over 200 wireless and wired penetration tests. Rick was the chief security architect for a congressionally recognized center of excellence for a multi-billion dollar hosted service data center built using non-traditional defense in depth strategies. His teams utilize offensive network techniques to better defend the network and critical infrastructures. Mr. Mellendick specializes in designing and testing wireless networks with non-traditional strategies using offensive techniques. He is a builder and breaker of RF signals, inventor of the Wireless Capture the Flag (http://wctf.us), and breaking and entering through RF is his specialty. His certifications include CISSP, ISSEP, OPSA, CEH, IEM, IAM, MCP, Certified DoD System Administrator, and Linux Security certifications.

About Us Signals Defense, LLC headquartered in Owings Mills, Maryland, specializes in providing Full Spectrum Security Solutions for Commercial and Governmental organizations. Signals Defense’s approach includes the belief that full spectrum security is derived from addressing all three disciplines of security: IT/Cyber, Technical/EMSEC, and Physical/OPSEC. Our organization has significant experience in providing products and services across all three disciplines and can develop custom security mitigation solutions based on our unique SDTVA™ (Signals Defense Threat and Vulnerability Assessment.) SD Technology is deployed in over 1000 locations including Government Intelligence agencies, DoD and Fortune 100 companies. Our technology has become the de facto standard for the US Government and anyone desiring to properly secure locations handling sensitive and/or classified information.