Forensic Data Recovery Experts

What is incident response?

Any online business can fall victim to cyberattacks (phishing attacks, malware, adware, ransomware). Alternatively, your security system might have certain vulnerabilities that put your business in critical danger if a hacker decides to exploit these weak chinks.

An incident response plan takes into consideration these possibilities, and incorporates the methods through which an organization deals with these cyberattacks.

At TCS Forensics, we capitalize on efficiency and instant reaction times when such events take place. Our team is available 24/7, all year long, which means we’re always available to offer security support. We will remedy any security breach, external or internal!

Perfect application of incident response tactics

There is always a good way to approach security breaches, and then there’s a bad way to do that. The former revolves around thorough documentation, a versatile and targeted counterattack, and detailed analyses of the threat. The latter, on the other hand, involves none of the above or shoddy attempts at fighting back.

The correct methodology of incident response revolves around 6 main steps, each more important than the other.


At this initial stage, an organization should put into place precise and minute response tactics for any security breach event. Employees should be instructed on the proper way to act during such events, and the security policy should be fully established. Moreover, during preparation, you should set everything clear about the documentation, tools to be used, and access control credentials.


This is when you first come into contact with a cyber threat and identify its type as well as its severity. During this stage, you must gather data (log files, firewall information, error messages) that makes your response strategies more efficient. You need to ascertain the goals and intrusion methods of the cyber threat.


During containment, the response team isolates all the affected systems and attempts to reduce overall damage. The sooner we detect a cyber threat attacking your system, the better. Moreover, we will also prepare for a thorough system backup and preserve any relevant evidence that would later be provided to the authorities.


After we have completely enclosed the contaminated systems, the next step is eradicating the virus completely. Depending on the type of cyber threat you’re dealing with, our eradication procedures will differ slightly. If a virus has infected your mainframe, we will delete all remnants from the system. If your email accounts have been contaminated, we will either clean them out or recommend deleting them altogether.

Often, hackers will wait things out if they know you’re conducting investigations on the contaminated systems. If we don’t eliminate the threat completely, thus disallowing further attacks, your organization will never be safe, be it short or long term.


After we have successfully eliminated the infection from your system, we will conduct a thorough analysis and attempt to restore operational functionalities. We must ensure that your systems are no longer contaminated, that everything works within optimal parameters, and that no unusual behaviors are identified. If necessary, we will perform a system backup, if you had one in place.

Learn from your mistakes

A perfect incident response plan is based on prior experiences with security breaches. When you successfully eliminate a threat and recover your systems’ functionality, make mental notes of all the steps you took. Moreover, observe what didn’t work, what you could improve, and how your employees handled the critical situation.

The incident response documentation relies on relevant and pertinent data from previous attacks. You need to learn from your mistakes, update your security policy, remake your response strategies, and train your employees better, if needed.

Why is incident response important?

One of the assumptions we work with is this – every business or organization will eventually face cyber threats. What we do is teach you how to better prepare and deal with it when it finally arrives.

By establishing a functional and efficient incident response plan, you arm yourself better against future threats attacking your organization. If you respond quick enough, the damage done to your resources will be minimal, allowing you to regain business functionality faster.

To make sure your incident response plan is good enough, test it out. Do routine emergency exercises that simulate cyber-attacks! It will perfectly illustrate your counterattacking capabilities, as well as the areas that you need to improve.

TCS Forensics – the best incident response plans!

Why would you choose TCS Forensics over all the other security agencies out there? That’s a perfectly valid question. The answer is simple – we use relevant response tactics to approach cyber-threats in a smart way. Moreover, our methodology is widely accepted by the FBI and the courts of law in the US, the UK, Canada, and Australia.

We have both the experience and the skills to protect your business from the most dangerous cyberwarfare incidents out there. Our threat prevention models incorporate the latest methodological methods that have proved their versatility and efficiency in high-risk situations.

Contact us for a free consultation:

Tel: (604) 370-4336


If you have any questions please complete the form below to contact us & I will be sure to get back to you.
Keith Perrin

Keith Perrin
Chief Executive Officer

Unit 125 – 3751 Jacombs Rd.
Richmond, BC
V6V 2R4
Tel: (604) 370-4336

  • This field is for validation purposes and should be left unchanged.

Our Certifications