NIS2-Analysis: Detailed incident response report for precise evaluation of IT security incidents

NIS2 Analysis: Detailed Incident Response Report for Accurate Evaluation of IT Security Incidents

On September 15, 2024, at 14:35, suspicious network traffic was detected by our SIEM system, indicating a potential ransomware infection. This required immediate responses. Unusual activity, such as high CPU usage and file encryption, was quickly identified on several servers. This incident triggered the initiation of a comprehensive NIS2-Analysis and a precise incident response process.

Recognizing the Incident and Maintaining Control

At 14:40, the Incident Response Team was alerted and activated, beginning a coordinated approach. The affected systems, including specific servers and network segments, were quickly identified. The chronological actions were as follows: within five minutes of the initial report, the Incident Response Team was activated. Shortly after, the first containment measures were initiated, isolating the affected servers. Fifteen minutes later, the team definitively identified the attack as ransomware, and recovery and data backup procedures began. By the evening of the same day, at 20:00, the initial recovery efforts were successfully completed.

Quick Response – Effective Measures

To contain the incident, the affected systems were immediately isolated to prevent the malware from spreading further. Compromised user accounts were deactivated, and outbound data traffic was blocked to stop potential data leaks. After successfully removing the ransomware from the affected servers, data was restored using a backup from the previous day, September 14. Finally, all systems were thoroughly scanned to ensure no remnants of the malware remained.

Communication – Clarity in Crisis

Within the first hour of the incident, management and the relevant department heads were informed. Shortly afterward, an email was sent to all employees, explaining the current developments and providing guidelines for using the IT systems. By the early evening, management received a final update on the status of the incident. Since no external customers or partners were directly affected, external communication was deemed unnecessary. However, legal counsel was sought to review any potential legal obligations and to mitigate future risks.

Impact and Lessons for the Future

Thanks to the quick intervention, a temporary disruption of internal processes was resolved, and no data loss occurred due to the backups. However, despite the prompt response, there is still a potential risk of reputational damage if the incident becomes publicly known. The possibility of future attacks must also be considered, particularly if not all security gaps are sufficiently closed.
 
The primary cause of the incident was traced to a phishing email with a malicious attachment opened by an employee. A secondary cause identified was the lack of phishing awareness among the affected employee, as well as the absence of two-factor authentication for the affected user account.

Lessons Learned and Preventive Steps

As immediate corrective actions, a phishing awareness campaign was launched for all employees, and two-factor authentication was made mandatory for user accounts with elevated privileges. Email security systems were also improved. In the long term, regular phishing simulations and training will take place, critical infrastructure monitoring and alert systems will be enhanced, and the emergency plan will be reviewed and adjusted annually.

Conclusion and Approval

This report was created and approved by the Incident Response Team. It serves as both the official documentation of the incident and as a guide for future preventive measures and quick response actions. The report was approved on September 17, 2024, and clearly outlines the steps to be considered both preventively and reactively in such incidents.