1. Preparation (Prior to Any Event):
1. Cybersecurity pre-plan checklist (available at https://www.nclgisa.org/page/strike-team)
2. Ongoing Shodan reviews (complete this form to sign up: https://forms.gle/R6iXGVPcgm57gkcH9 )
3. Weekly Nessus scanning (complete this form to sign up: https://forms.gle/R6iXGVPcgm57gkcH9)
4. Consultation on cyber-related questions including backup strategies, centralized logging, EDR, IDS/IPS, MFA, and specific technologies


2. Immediate and Sustained Structural Services During and Post-Breach:
1. Incident command/ITSL expertise
2. Project management
3. Cyber liability insurance expertise
4. Legal guidance related to public records/breach notification/etc.
5. Documentation support
6. Communication and coordination guidance
7. Resource identification and leverage from NCLGISA community and state of NC


3. Identification:
1. Research variant and offer insight from previous events (led by NCNG)
2. Analyze entry point and spread of breach (led by NCNG, Strike Team assists as needed)
3. Review log files (as needed if directed by the NCNG)


4. Containment:
1. Recommendations to isolate attack
2. Recommendations to preserve evidence for forensic investigations


5. Eradication:
1. Recommendations of approach and tools to assist and mitigate future attacks
1. Assist with tool deployment as needed
2. Provide recommendations on network protocols, network design/security, applications/services, backup strategies, etc
3. Onsite rebuild assistance (depending on availability/skillsets needed)


6. Recovery:
1. Prioritization of recovery steps, down to department level (if not already established)
2. Assistance with hardening infrastructure by applying CIS Level One Controls
3. Expertise in firewalls, networking, and other infrastructure components (onsite or remote assistance depending on availability)
4. Scripting services for imaging, etc
5. Expertise with governmental systems and their critical interdependences
6. General troubleshooting of infrastructure and application issues

Download Strike Team Catalog

Contact Information:
Email: itstriketeam@nclgisa.org
Telephone: (919) 726-6508 (monitored 24/7)