CSIRT: Computer Security Incident Response Team

A CSIRT is a team dedicated to handling live cybersecurity incidents. Its main role is to detect incidents, analyse and resolve them while minimising their impact. Large organisations may have their own in-house team. However, many use the services of a specialist third-party partner, such as Airbus Protect. Our CSIRT team is often deployed to work on cybersecurity incidents affecting governments, public institutions and private sector businesses across Europe.

Our services:

• Diagnose the incident, establishing the root cause using advanced investigation techniques: Working quickly is essential, as it enables the CSIRT to kickstart its response. Identifying which systems are compromised and how also helps the team to understand attackers’ motives.
• Eradicate the problem while maintaining the digital chain of evidence: The first step to eradicating an incident is preventing any further damage. Incident containment is all about stopping the spread to more systems, networks and assets. After an incident is contained, the CSIRT moves fast to remove malicious code from systems and kick out any cybercriminals who’ve gained access.
• Reconstruct the system and deliver it in working order: By establishing and maintaining a digital chain of evidence, our CSIRT helps you understand emerging cyber threats and develop new, better ways to respond.
• Investigate further, providing a detailed report with recommendations for how to secure systems and support data recovery: The CSIRT isn’t just here to bring the chaos under control, but to prevent it from happening again. This means developing detailed recommendations to help organisations improve their cyber-security posture.