Karriere
Contact
Recovery and Remediation

After a cyberattack: trustworthy IT infrastructure as base for a rapid return to operational capability.

Following a cyberattack, our primary focus is to restore technical capabilities as quickly as possible. We analyze the criticality of systems and processes and rebuild according to importance. Alongside forensic analysis, we implement a trustworthy IT infrastructure while never transferring components from the compromised environment without prior assessment. In parallel, we keep involved teams and relevant stakeholders closely in the loop to support optimal recovery.
Your Contact

Heinrich Herdt

Partner
Envelope LinkedIn
KEY CHALLENGES

Reconstruction is more than just restoration.

Business critical systems must be restored quickly.

Following a cyberattack, not everything can be restored immediately. First focusing on all business critical processes and systems, we, together with the client, prioritize business needs and technical dependencies and establish what must be operational by when. In addition, the rebuilding process provides an opportunity to make the client's IT even more resilient.

Existing IT cannot be reused without assessment.

During the rebuilding process, we must ensure clarity on which parts of the existing IT infrastructure can be reused safely. Thus, we collaborate with the forensic and specialist teams and incorporate their findings. What can be safely used is retained; components that require replacement are treated accordingly.

Operations resume quickly while rebuilding continues.

Rebuilding proceeds in stages based on agreed priorities. Once essential systems and processes are reliably available, defined focus areas can resume operations. In parallel, we continue to reinstate all IT infrastructure, including new findings from forensic analysis to make ongoing operations more resilient.
HOW WE SUPPORT YOU

From rapid return to operational capability to resilient IT infrastructure.

To resume essential operations as quickly as possible, we build new, trustworthy IT infrastructure and progressively restore prioritized systems. We incorporate findings from forensic investigation during the rebuilding process, implementing necessary technical improvements to strengthen resilience at the same time.

IT recovery planning

We develop a detailed plan for rebuilding the IT infrastructure based on business priorities and technical dependencies. We determine which systems need to be prioritized, how quickly they are required, and which technical prerequisites are necessary. We prioritize these requirements with client and stakeholders.

Designing trustworthy IT infrastructure

We establish new IT infrastructure on which prioritized systems can progressively be brought back into operation. We stay focused on recovery objectives including forensic findings in the process as needed. We do not transfer components from the compromised IT environment into the new without prior assessment. Our established process enables us to rebuild the client’s IT infrastructure in a targeted and resilient manner.

Restoring IT systems

We restore required systems to operation as quickly and securely as possible. Agreed priorities determine the sequence and speed of restoration and the initial situation defines how systems are restored, rebuilt, or adapted. In the rebuilding process we integrate new systems into the target architecture as required.

Securing identities and access

A secure IT infrastructure requires controlled access and one reliable source for all identities. We design how this identity source will be implemented in the rebuilt environment. Our work includes securing and/or rebuilding directory services such as Active Directory and Entra ID and reviewing and adjusting existing structures. If privileged access cannot be secured appropriately using existing means, we recommend suitable technical measures and implement appropriate PAM solutions where required.

Hardening and improving resilience

We use the rebuilding process to improve IT infrastructure in a targeted manner. Existing vulnerabilities and findings from forensic analysis are addressed and incorporated using our experience. We design appropriate technical improvements and hardening measures, prioritize them with the client, and implement immediately or as part of the transformation. We consistently keep the agreed scope, sequence, responsibilities, costs, and operational requirements in mind.

Remediation and project management

Following a cyberattack, internal teams, forensic specialists, existing IT service providers, and other parties are involved in the rebuilding process. Their responsibilities, interests, and priorities are, by design, not always identical. A coordinated approach brings relevant stakeholders together and ensures that necessary information and decisions are available to decision makers. We ensure that all parties involved are consistently informed of current project status and important developments.
OUR WORK IN PRACTICE

Projects and references

MECHANICAL ENGINEERING
INCIDENT RESPONSE

IT recovery after full encryption

Following a cyberattack that completely encrypted the on-premises systems, a multi-site manufacturing company faced acute emergency. Under severe time pressure, secida assumed operational responsibility for crisis coordination, restoration of business-critical systems, and design of a new cloud-based IT infrastructure in Microsoft Azure.

Client situation: Following the cyberattack, Lindermayr faced completely encrypted on-premises systems that lead to an acute emergency due to failure of business-critical systems and complete production standstill. Thus, business operations had to be restored under severe time pressure.
Our contribution: secida assumed overall responsibility for restoring Lindermayr’s IT infrastructure. This included setting up a new network, rebuilding central IT infrastructure in Microsoft Azure, and securing and coordinating the return of client devices to operation. Multiple file servers and a business-critical ERP system also needed to be restored.
Client outcome: IT and production capabilities were restored rapidly, enabling production to resume after three days. In addition, a modern, cloud-based foundation for ongoing IT operations was established.
After a ransomware attack encrypted our servers over a weekend, our ERP system and production were at a standstill. Thanks to secida's fast, highly competent, and uncompromising incident response, our administration could perform basic operational tasks, and our production could resume operation, within just three days.
The subsequent migration of most of our IT infrastructure to Microsoft Azure Cloud not only helped us limit immediate damage but also made our IT more secure, modern and future proof in the long term. We are very grateful to secida for the excellent collaboration.
Logo der Lindermayr GmbH & Co. KG
Tobias Fischer

Managing Director | Lindermayr GmbH & Co.KG

HOW CAN WE HELP?

Do you need to rebuild your IT after a cyberattack?

We support the structured rebuilding of your IT infrastructure and establish the technical foundation necessary to restore essential operations as quickly as possible. Let’s have an initial chat to clarify your current situation and discuss possible next steps.
Request a free initial consultation →

Heinrich Herdt

Partner
Heinrich Herdt brings several years of IT consulting experience in cyber security, cloud, and identity and access management to the secida team. He started out as freelancer in software development and IT projects before moving into a cybersecurity consulting role at KPMG. Heinrich joined secida in 2020 and today is one of our Partners, responsible for client projects focused on designing secure, modern, and future-ready IT architectures and solution-oriented technical consulting.
LinkedIn →
Contact Us

How can we support you?

Mandatory fields are marked with an asterisk (*).

Your information will be processed to handle your request and to contact you. For more information about the processing of your personal data, please see our Privacy Policy.