Incident Response (IR) and cleanup methodology to identify the scope of compromises, identify malicious scripts and programs to eradicate network systems.

1. SD Cyber Security
Incident Response Methodology
__________________________________________________________________________________________
1 Easter Court, Suite E, Owings Mills, MD 21117
PHONE 410·902·0356 · FAX 410·902·9609
www.signalsdefense.com
©2014. ASTIC Signals Defenses, LLC. All rights reserved.
Signals Defense has a robust Incident Response (IR) and cleanup methodology that has been utilized to help
multiple Federal and Civilian agencies to identify the scope of compromises, identify malicious scripts and
programs, and eradicate those systems. The Signals Defense IR staff is all fully certified, and cleared
personnel dealing with both classified incidents as well as unclassified but highly confidential issues.
Signals Defense begins this process by working with your network and security staffs to get a complete
understanding of what is known about the compromise. At this time we will review any system and security
logs as well as any packet captures that have been taken of the malicious activity. We have had great success
identifying the initial point of entry of the attacker during this phase if it has not already been identified.
Signals Defense works with your network and security staff to determine what level of network access should
be provided to identify any currently compromised systems on the network while still maintaining the
appropriate level of business confidentiality for your
organization. Once this has been determined we develop
custom scripts and programs to identify compromised systems
and anomalous behavior. All data captured and reviewed in
this phase will be stored on a removable encrypted drive. All
data investigations will follow industry best practices for chain
of custody. This will assure that all data and findings
admissible in court if the case gets to that level. During this
phase we are constantly working with your internal teams to
ensure that any capabilities currently in place are maximized.
Signals Defense uses the information gathered during this
phase to establish the scope of the compromise and determine
what steps should be taken next.
After the compromised systems have been identified and the scope of the compromise has been determined,
we will provide a comprehensive plan to return the compromised systems to an acceptable state. This plan
includes multiple options, some of which can be used to successfully eliminate the attacker from the network;
others can be used to mitigate the effectiveness of the attack while systems are returned to production state in
stages.
Our experience resides in the following environments and industries:
• Department of Defense
• International Law Firms
• Financial Firms
• Civilian and Government Health Care
• High net worth individual clients
• The US Republican Party
• Drug Development and Research Facilities
• US Critical Infrastructure
• US Federal Agencies
• Casino and Gaming industry partners

2. __________________________________________________________________________________________
1 Easter Court, Suite E, Owings Mills, MD 21117
PHONE 410·902·0356 · FAX 410·902·9609
www.signalsdefense.com
©2014. ASTIC Signals Defenses, LLC. All rights reserved.
Rick Mellendick holds Top Secret (TS) clearance and is the Chief Security Officer for Signals
Defense in Owings Mills, MD with 18 years of information technology security experience.
Mr. Mellendick performs the duties of technical director and chief strategist to multiple DoD, federal,
intelligence, and private organizations. He provides direct support to the U.S. Critical Infrastructure. His
background is in designing secure networks in multi-platform/multi-classification environments. His knowledge
was gained from researching the advanced threats to critical infrastructure, as well as civilian, and federal
agencies which is the basis for the Signals Defense Computer Network Defense Team and Red Teams tactics
to protect our clients’ systems.
Rick has extensive experience in computer network operations including developing proof of concept attacks
and performing demonstrations for many federal and corporate clients. The teams that Mr. Mellendick leads
regularly perform Red Team analysis specializing in wireless and RF attack and defense as well as technical
surveillance counter-measure (TSCM) sweeps. He is a subject matter expert for computer network operations,
wireless offensive tactics, and designing information systems to comply with federal and local regulations. Mr.
Mellendick has personally completed over 200 wireless and wired penetration tests.
Rick was the chief security architect for a congressionally recognized center of excellence for a multi-billion
dollar hosted service data center built using non-traditional defense in depth strategies. His teams utilize
offensive network techniques to better defend the network and critical infrastructures. Mr. Mellendick
specializes in designing and testing wireless networks with non-traditional strategies using offensive
techniques. He is a builder and breaker of RF signals, inventor of the Wireless Capture the Flag
(http://wctf.us), and breaking and entering through RF is his specialty.
His certifications include CISSP, ISSEP, OPSA, CEH, IEM, IAM, MCP, Certified DoD System Administrator,
and Linux Security certifications.
About Us
Signals Defense, LLC headquartered in Owings Mills, Maryland, specializes in providing Full Spectrum
Security Solutions for Commercial and Governmental organizations. Signals Defense’s approach includes
the belief that full spectrum security is derived from addressing all three disciplines of security: IT/Cyber,
Technical/EMSEC, and Physical/OPSEC. Our organization has significant experience in providing products
and services across all three disciplines and can develop custom security mitigation solutions based on our
unique SDTVA™ (Signals Defense Threat and Vulnerability Assessment.)
SD Technology is deployed in over 1000 locations including Government Intelligence agencies, DoD and
Fortune 100 companies. Our technology has become the de facto standard for the US Government and
anyone desiring to properly secure locations handling sensitive and/or classified information.