About the lab
Devon Norton, CISSP, GCFA, and an independent triage lab in Reston
Norton Creek Incident Triage Lab is the trading name of Norton Creek Endpoint & Network Security LLC. Devon Norton founded it in 2017 to give small and mid-sized organizations around Northern Virginia the kind of incident response and hardening work that usually only large companies buy.
Who we are not
We are not Norton antivirus. We are not affiliated with, endorsed by or connected to Gen Digital Inc. or NortonLifeLock, and we cannot help with Norton product subscriptions, refunds or renewals. “Norton” is Devon Norton’s family name. Norton is a trademark of Gen Digital Inc.
Because our name resembles a brand that scammers impersonate, we are strict about how we work. We never contact anyone unprompted about a “virus on your computer.” We never take remote control of a machine without a signed engagement letter. We never ask for payment by gift card, wire to a personal account, or cryptocurrency. If anyone using our name does, please forward the details to cert@norton-tech-support.com.
Devon Norton, Principal Incident Responder
Devon holds the CISSP and the GIAC Certified Forensic Analyst (GCFA) credentials and has spent their career on the response side of security: memory and disk forensics, ransomware containment, and the slower work of rebuilding networks so the same thing does not happen twice. They write every runbook we ship and take the first call on every active incident.
Devon’s view of the job is simple. Small organizations do not need a security program designed for a bank. They need a short list of controls that actually get turned on, backups that are proven to restore, and somebody who will tell them plainly which of their worries matter.
How an engagement works
- Active incident
- Call-back within the hour during business days. Containment first, forensics second, root cause in writing.
- Baseline sprint
- Ten working days: firewall review, endpoint baseline, Sysmon rollout, and a written runbook your team keeps.
- Backup runbook
- We design or audit your 3-2-1-1-0 setup and run a timed restore drill with you.
- Clinic assessment
- IoMT and imaging inventory, VLAN plan, FIDO2 rollout and HIPAA Security Rule mapping.
- Fleet and IoT review
- Telematics inventory, dongle and backend isolation, admin-console hardening.
Every engagement starts with a written scope and a signed authorization that names the systems we may touch. Everything we produce belongs to you: configurations, rule sets, scripts and reports.
Where we work
Our office is at 11951 Freedom Dr, Suite 420, Reston, VA 20190. Most clients are in Fairfax, Loudoun, Arlington and Prince William counties, Washington, DC and Montgomery County, Maryland. We work on site when it helps and remotely when it does not.
Contact
General enquiries and hardening work: triage@norton-tech-support.com. Active incidents and vulnerability reports: cert@norton-tech-support.com. Please do not send passwords, malware samples or patient data by email; we will set up a secure channel.