Cybersecurity and incident response
We handle cyber incidents from start to finish: containment, evidence preservation, timeline, scope of the data involved, notification support and recovery. Around this, we work every day on the tools used to prevent incidents, or at least to spot them in time: SIEM, endpoint protection, exposure reduction, credentials, encryption.
We carry out our analyses on the logs, the machines and the data, and every conclusion states which evidence it rests on. We describe the incidents below by type only: the cases remain confidential.
Incident response and forensic analysis
In the face of an attack, the first rule is not to make things worse: we preserve the evidence in the right order (memory, machine snapshots, targeted collection, a disk image only if needed), compute the hashes and work on the copies. Then we reconstruct what happened, when and from where.
We always keep what the evidence proves separate from what the victim states or the attackers claim. We acquire and analyse hostile material, such as data published for extortion, only on an isolated, dedicated machine, never from the client’s systems.
Technologies and products
- Read-only targeted collection for Windows and Linux
- SHA-256 hashes and chain of custody
- Memory and disk acquisition (avml, winpmem, dd)
- MITRE ATT&CK
- OCR and personal data recognition
Examples
-
Digital services provider Delivered
Exfiltration with extortion: how much had actually got out
- The problem
- The attackers had published part of the stolen data and claimed to have much more. Deciding on the notifications required an objective measure of what had got out.
- What we did
- We acquired the published material on an isolated forensic machine, verified its authenticity with hashes and metadata and analysed it document by document, deriving only aggregate figures: data categories, the presence of special categories of data and of identity documents, validated and masked tax identification numbers. We extracted no personal data in clear text.
- Result
- A factual basis for the notifications, with an explicit boundary between what the sample proves and what remains to be verified in the server logs. In addition, an automatic hourly check of the site where the data was published, with an email alert for every change.
-
Services organisation that also processes health data In progress
Double-extortion ransomware involving special categories of data
- The problem
- Understanding which data the attackers claimed to have, how much of it and of what kind, in order to document the incident for the authorities.
- What we did
- We opened the incident case file (initial collection, investigation plan, structured request for information and evidence, evidence register, timeline) and prepared the tool that classifies the data on the isolated machine, returning only aggregate and masked values.
- Where we have got to
- Case file and tools ready: the analysis continues as the material comes in.
Email fraud (BEC)
In BEC fraud, the attacker inserts themselves into a genuine conversation between customer and supplier, usually with a domain almost identical to the legitimate one, and gets the payment details changed. We reconstruct the fraud from the messages and their headers, establish where a compromise really took place and deliver a report with the timeline, the evidence and the urgent actions.
Technologies and products
- SMTP headers, SPF, DKIM, DMARC
- Exchange mailbox access logs
- Exchange Web Services
- Lookalike domain search (Levenshtein distance)
- Correlation with authentication logs
One example
-
Industrial company Delivered
Diverted bank transfers: the breached mailbox was not the client's
- The problem
- The company had made several transfers to fraudulent bank details and feared that its own email had been breached.
- What we did
- We analysed the access logs of the internal mailboxes: no anomalous access, no hidden forwarding rules. By cross-checking the message headers we proved that the compromised mailbox was the supplier’s; the counterfeit domain came to light when we computed the distance between the names.
- Result
- Forensic report with a full timeline, indicators and actions: recall of the transfers, blocking of the lookalike domain, verification of the bank details through an independent channel, a mailbox audit and a rule against spoofing of suppliers’ domains.
Compromised internet-facing servers
When a server reachable from the internet is compromised, we identify the point of entry, the persistence mechanisms and what was read or taken, and we distinguish a security incident from a mere capacity problem. We look for the intrusion where it has left a trace, not where we expect to find it.
Technologies and products
- journald, auth.log, wtmp and btmp
- Application and web server logs
- cron and systemd
- Indicators of compromise
- Read-only checks across multiple machines
One example
-
Managed services infrastructure Delivered
Remote code execution, without a single login
- The problem
- A vulnerable web application, running with elevated privileges, had made it possible to install a malicious program and two persistence mechanisms.
- What we did
- We proved that the attacker had never logged in: the code ran through the application’s process, so the authentication logs were clean by definition. From the application logs we reconstructed which credentials had actually been read and which had only been exposed, then we removed the persistence.
- Result
- Incident scope clarified, stolen credentials replaced and verified one by one, exposure reduced.
Notifications to the Garante and ACN
We turn the technical evidence into a factual basis for the controller, the DPO and legal counsel: draft notifications, including phased ones, to the Italian Data Protection Authority (Garante) under Article 33 of the GDPR; communications to data subjects when the risk is high (Article 34); and, for NIS2 entities, the notifications to ACN, Italy’s National Cybersecurity Agency, and CSIRT Italia in the three prescribed stages.
The texts remain consistent with one another on dates, systems and data categories, and they distinguish the controller from the processor when the data is processed on behalf of others. Submission and signature rightly remain with the controller.
Technologies and products
- GDPR, Articles 33 and 34
- Legislative Decree 138/2024 (NIS2)
- CSIRT Italia notification practice
One example
-
Digital services provider Delivered
Notification package for a data processor
- The problem
- The incident concerned data that the provider processed on behalf of its clients: the communications had to take both roles into account.
- What we did
- We prepared the drafts for the Garante, for the data subjects and for the clients acting as controllers, highlighting the fields to be completed, masking the special categories of data and calculating the deadlines: 72 hours for the Garante; 24 hours, 72 hours and one month for the NIS2 stages.
- Result
- Texts ready for review and signature by the DPO and legal counsel, consistent with one another and with the evidence.
SIEM and log collection
We administer SIEM platforms and bring them back to health, extend the collection of security logs, build dashboards for the questions that matter and check that the data really arrives: a green dashboard is not enough.
Technologies and products
- Elasticsearch, Kibana, Elastic Agent and Fleet
- Elastic Common Schema
- Windows security events (4624, 4625, 4768, 4769, 4776)
- TLS certificates and internal certificate authorities
One example
-
Industrial group with multiple sites In production
The SIEM was green, but it was no longer collecting anything
- The problem
- An internal certificate had expired and all the agents had stopped sending data at the same time. The dashboard stayed green and for months nobody had noticed.
- What we did
- We found the cause and reissued the certificate from the same internal authority, so the agents did not have to be re-enrolled one by one. Then we extended the retention of the security log on the domain controllers, installed the missing agents and built a dashboard to track the use of a critical administrative account.
- Result
- SIEM receiving data again, broader coverage and two permanent checks to avoid a repeat of the silent failure: the latest data received from each source and certificate expiry.
Endpoint protection (XDR and EDR)
We manage endpoint protection platforms and next-generation firewalls from their consoles and through their APIs, install agents where they are missing and above all verify that the protection is really active. An agent installed with its engine switched off, or a ghost record in the console, is more dangerous than a visible absence.
Technologies and products
- Bitdefender GravityZone
- CrowdStrike Falcon
- Palo Alto Cortex XDR
- Palo Alto Strata Cloud Manager
- EDR, behaviour monitoring, ransomware remediation
Examples
-
Cloud infrastructure with many virtual machines In production
Virtual machines that looked protected
- The problem
- A large proportion of the machines turned out to be unprotected and some console records gave a false picture.
- What we did
- We cross-checked the real inventory against the console’s, identifying machines by a reliable identifier rather than by name; we installed the missing agents, fixed the cases of antivirus installed but switched off, tuned the policy for a server without a graphical interface and measured the CPU load.
- Result
- Complete and verified coverage, with the remaining anomalies listed one by one.
-
Public transport Delivered
EDR on the servers of a vehicle location system
- The problem
- The Linux servers of the system that locates the fleet’s vehicles had to be brought under EDR coverage, without disrupting the service.
- What we did
- Agent installed via SSH, with registration and full functionality verified in the console; we traced the false positives of the automatic check to names reconstructed from the addresses.
- Result
- Coverage of the server estate verified.
Credential rotation
After an incident, or simply as a matter of hygiene, we change credentials in a controlled way and verify the effect: the new ones work, the old ones no longer do. Before the change we map where an account is used (services, scheduled tasks, applications with a saved password), so as not to stop anything. And we take reuse into account: a compromised password is often in use on other systems too.
Technologies and products
- Automated checks via SSH and APIs
- Map of service account usage
One example
-
Managed services infrastructure Delivered
Credentials replaced and verified device by device
- The problem
- After a compromise, it emerged that the attacker had read some passwords for network devices and servers.
- What we did
- We changed the credentials of all the devices involved, with a verification round for each one: login with the new password, rejection of the old one, a check that users, scheduled tasks and keys had not been altered.
- Result
- Exposed credentials replaced and verified, and a list of the other systems on which the same passwords had to be changed.
Hardening and exposure reduction
We reduce what is reachable from the internet to the bare minimum and move administration behind VPNs. To the outside world we prefer to look like nothing: no version numbers, no product names, generic errors.
Every firewall change starts with a scheduled automatic rollback, which reopens access if the change goes wrong: anyone working remotely must never lock themselves out.
Technologies and products
- WireGuard
- nftables and ufw
- fail2ban
- WAF with OWASP CRS rules
- HTTP security headers, TLS 1.2 and 1.3, HSTS
One example
-
Cloud services infrastructure In production
From the internet, only port 443
- The problem
- The servers’ administration ports were reachable from the internet.
- What we did
- We left only port 443 open, moved administration behind three independent WireGuard tunnels with multiple paths to each machine, added automatic blocking of failed attempts with an alert on every successful login and wrote the emergency procedures for getting back in.
- Result
- Exposed surface reduced to a single service, with procedures for getting back in even if a tunnel goes down.
Encryption and secrets management
We design encryption of data at rest and the safekeeping of secrets, stating clearly what each measure protects: disk encryption protects copies, replicas and backups, not a running system; for that, application-level encryption and the closing of exit routes are needed. We measure the CPU cost before making proposals and consider durability over time, including with regard to post-quantum algorithms.
Technologies and products
- LUKS2 (AES-256-XTS, Argon2id)
- Clevis and Tang
- OpenBao
- age
- ML-KEM (evaluation)
Compliance: GDPR, NIS2, ISO 27001, Cyber Essentials
We help respond to clients’ security assessments in a repeatable way: an ISO/IEC 27001 framework, the national baseline measures as technical content and the evidence produced by the work itself (versioned documents, automatic reports, an SBOM for every release). We check data residency requirements in cloud tools and handle certifications that impose tight deadlines on updates.
Technologies and products
- ISO/IEC 27001:2022
- NIS2 (Legislative Decree 138/2024)
- GDPR
- Cyber Resilience Act and CycloneDX SBOM
- Cyber Essentials (NCSC)
One example
-
Services company with operations in the United Kingdom In progress
Cyber Essentials certification
- The problem
- Obtaining the British Cyber Essentials certification, which requires installing high-severity updates within 14 days of their release.
- What we did
- Scheme requirements, questionnaire, device inventory, security bulletin register and update procedures with evidence retention.
- Where we have got to
- Process under way, with the 14-day deadlines kept under control.
Mobile device management (MDM)
We administer fleets of company smartphones and tablets with MDM platforms: deploying applications and configurations, restoring management when it breaks down, checking the security posture (compliance, versions, on-device data protection).
Technologies and products
- Workspace ONE UEM (REST API)
- Apple Business Manager
- APNs, DEP and VPP
- pymobiledevice3
Examples
-
Distributed network of operational sites Delivered
A hundred and fifty devices responding again within an hour
- The problem
- In a fleet of about 300 supervised iPads, almost all had stopped executing management commands.
- What we did
- Active tests (the command acknowledgement, not the “last seen”), splitting the fleet by enrolment date and logs read over USB: the notification channel certificate had been replaced by one with a different topic. We re-uploaded the original, which was still valid, through an undocumented console step.
- Result
- 149 devices responding again within an hour and at least 1,587 apps installed or updated, without a single physical intervention and without data loss. Then the security posture inventory, with recommendations.
-
Distributed network of operational sites Delivered
A field kit for unresponsive devices
- The problem
- Some devices no longer responded and had to be restored on site, by non-technical staff.
- What we did
- A single executable, with no need for internet access or administrator rights, that backs up the data, erases the device and has it re-enrol automatically.
- Result
- An iPad that had been unresponsive for 28 days, re-enrolled in 23 minutes and responding to commands in 3 seconds.