What We Do
How we do it
Oct 18, 2021
Grief Ransomware Gang Claims 41 New Victims, Targeting Manufacturers; Municipalities; & Service Companies in U.K. & Europe
Grief Operators Earned an Estimated 8.5 Million British Pounds in Four Months Key Findings: The Grief Ransomware Gang (a rebrand of the DoppelPaymer Ransomware Group) claims to have infected 41 new victims between May 27, 2021—Oct. 1, 2021 with their ransomware.Over half the companies listed on Grief’s underground leak site are based in the U.K. and Europe. The Grief Ransomware Gang appears to…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Oct 12, 2021
eSentire Launches MDR with Microsoft Azure Sentinel Extending Response Capabilities Across Entire Microsoft Security Ecosystem
Waterloo, ON – Oct. 12, 2021 -- eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announced the expansion of its award-winning MDR services with Microsoft Azure Sentinel, as part of its integration with the complete Microsoft 365 Defender and Azure Defender product suites supporting Microsoft SIEM, endpoint, identity, email and cloud security services.…
Read More
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Aug 11, 2020

Blinking In The Dark: A Day In The Life Of A CISO

Originally posted in Information Security Buzz July 23, 2020

It’s said that the devil never sleeps. Perhaps no other industry demonstrates this so pointedly as cybersecurity, where the enemy could be anywhere in the world — and in any time zone. Finding time to relax is tough enough in today’s digital 24/7 world. But having a job where the bad guy could sit down to begin his “work” day with a hot cup of coffee at the same moment I’m rolling over to turn off the light, is a surefire recipe for insomnia. And that doesn’t take into account the challenge of keeping on top of an ever-evolving slew of technological advances all geared to keeping an organization secure.

Sunrise, Sunset

Knowledge is power. For any CISO worth their salt, staying on top of emails and daily threat briefs from the moment they get up means the difference between having a solid understanding of the threat landscape and what the day might have in store, and some very nasty surprises. Spoiler alert: CISOs don’t like surprises. In our line of work, they are rarely good — so you better have your finger on the pulse on what’s going on long before you sit down at your desk.

Being effective means always thinking to make sure you didn’t miss anything over the course of the day. Being a CISO, you get accustomed to the feeling you get when you’re on the way to the airport — no matter how much you planned, how well you organized, and how thorough you were in preparing, there’s the feeling that you’ve forgotten something.

For the most part, I sleep soundly, confident in my company’s cyber security approach of focusing on Response with a capital “R.” I know my team is ready to react at a moment’s notice and that they are armed with the tools they need to not only identify a threat, but contain and remediate it in less than 20 minutes. Knowing we have the ability to respond efficiently at any time of day provides me assurance that a threat’s impact will be minimized thanks to our quick reaction time.

Same Wolf, Different Sheep

It’s been interesting to see how attackers have adapted their lures in the wake of the pandemic. Unsurprisingly, they tend to be COVID-themed, but otherwise, the wolves are the same just in different sheep’s clothing. Even so, it pays to be ready.

Preparation is never time wasted, so when the pandemic broke – to ensure we were fully prepared for any eventuality – we executed a COVID-related phishing simulation to demonstrate what types of threats might arise in the current climate. A CISO’s objective is to prevent security breaches, and to do that you need to be focused on response. Spending the majority of your time on prevention is not the way to do that.

Knowing we have a strong response plan in place helps me sleep at night. But even knowing this, I can’t afford to become complacent. From where I sit, it’s critical to conduct test drills across the entire organization two to four times a year. By involving the company as a whole, I ensure there is representation across all teams and everyone has an understanding of how their roles can be impacted and how to respond accordingly.

Trust No One

CISOs need to be cognizant of the fact that their workforce will in all likelihood continue to be spread out, and that with the shift to remote work, there’s less talk around the office water cooler and more emphasis on collaborative tools that need to be protected. Accordingly, organizations need to think differently. They need, for the foreseeable future, to be even more vigilant about third-party tools and the security surrounding collaborative tools.

Basically, if a CISO isn’t already thinking about (or better still, implementing) a Zero Trust approach, they need to be. With Zero Trust, it’s not about the physical location – being inside your network’s perimeters is just as suspect as being outside it. Authentication is required from everyone, no matter where they are. It’s that ability to go beyond the physical confines of a network that will be a critical component of successful managed detection and response in the future.

It’s impossible to say with certainty what the future holds, but even without a crystal ball, it’s clear that CISOs need to be taking proactive steps to plan for a post-COVID world. To stay one step ahead of the bad guys, CISOs need to be able to pivot to whatever is going on in the threat landscape. Being able to cope with a constantly shifting environment is part of the job but it’s certainly not the only part. To be successful, you need to have just as much business acumen as you do an understanding of technology, and you have to be able to articulate to your Board how risk is managed and why it’s important.

I know that together with my team, I have taken every opportunity to secure our own operations as well as that of our clients. It’s because of this that it’s a rare night you’d find me counting sheep, cloaked wolves or otherwise.

Peter Romano
Peter Romano Chief Information Security Officer

As Chief Information Security Officer, Peter Romano is responsible for the enterprise security and compliance vision, strategy, and roadmap to ensure eSentire information assets are protected and compliant with various privacy and statutory requirements.