What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Jan 19, 2023
Increased Activity in Google Ads Distributing Information Stealers
THE THREAT On January 18th, 2023, eSentire Threat Intelligence identified multiple reports, both externally and internally, containing information on an ongoing increase in Google advertisements…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Dec 13, 2022
eSentire Named First Managed Detection and Response Partner by Global Insurance Provider Coalition
Waterloo, ON – December 13, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has been named the first global MDR partner by Coalition, the world’s first Active Insurance provider designed to prevent digital risk before it strikes. Like Coalition, eSentire is committed to putting their customers’ businesses ahead of disruption by improving their…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Dec 22, 2022

Creating Resilience Against Future Supply Chain Attacks

3 minutes read
Speak With A Security Expert Now

The very nature of the third-party relationships required in supply chain management presents the greatest weakness. Security leaders are tasked with being proactive, maintaining the highest level of visibility and control in their environments in order to balance security and functionality, as well as align with business objectives.

Security leaders and their teams must also continue to manage risk, which from an internal perspective means identifying and minimizing the impact of organizational risk. When a third party is introduced, organizations are placed in more of a reactive position, relying on attestations and details from the supplier regarding security posture, policies, etc. Visibility and control become drastically reduced.

In particular, ransomware has become a topic of discussion globally as cybersecurity leaders grapple with the magnitude and impact of cyber risk and the threat of downtime revenue disruption to their business. Successful attacks unfold in mere hours from Initial Access to data exfiltration and ransomware deployment, making the time to detect and time to contain critical factors in building an effective cybersecurity program.

Unless you’re prepared to defend against ransomware, these attacks result in your organization being locked out of critical systems and applications for days and weeks. In many cases, the resulting downtime can cost organizations upwards of $225,000 per day, which drives many CEOs to pay the ransom.

And these attacks are, unfortunately, not uncommon. Between the end of February and mid-July 2022, two affiliates of the Conti Ransomware Group - one of the longest-running and most lethal ransomware groups today – claimed that they had compromised 81 victim organizations. Fifty-nine percent of those victims are U.S.-based.

Mail-borne threats Emotet and Qakbot currently dominate the threat landscape for Manufacturing. These threats, which can lead to network-wide ransomware intrusions, arrive in email inboxes disguised as typical business communications with subjects like Invoice and Shipping. Qakbot has also been known to hijack and replay older email threads, sometimes from business partners, giving recipients the sense that the email is familiar and trustworthy.

Web-borne threats such as RedLine Stealer, SocGholish, and SolarMarker, are encountered when employees are browsing the web. These malwares depend on the user downloading and executing them. Their purpose is to steal data directly from the computer they are executed on, scraping browser history, passwords, cookies, and fingerprint telemetry from the user’s endpoint. This information can then be sold on the dark web and leveraged for further operations against the organization, often by utilizing the credentials to gain access.

At this point you may be asking “Is it realistic to think that we can develop a nationally secure and resilient supply chain against these and other ever-evolving threats?” As cyber criminals evolve and supply chain attacks continue to grow exponentially, these attacks offer threat actors increasingly stealthy, scalable, and privileged access to any organization’s on-premises, cloud, or hybrid environment. But while we may n​​ever be free of supply chain attacks, we can become more resilient, which will limit and eventually minimize the damage.

To make the case for new security investments, you need a clear understanding of the ROI you can deliver versus how operational downtime will impact your business revenue. ​​

The solution: a multi-layered defense strategy along with a strong Incident Response (IR) plan in place is crucial to secure your organization against future attacks. Again, there is a need to focus on resilience, which by definition (according to NIST) is, “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.”

Let’s break down what that means in practice:

  1. Anticipate - be proactive, control the controllables, address the ‘known knowns’ along with the ‘known unknowns.’
  2. Withstand - continuously improve detection and response capabilities, and outsource where it makes sense. Have a ‘ready for anything’ mentality, account for the unknown, and minimize the impact to the business. Not all risk can be avoided.
  3. Recover - continuously develop, test, and improve the IR plan.
  4. Adapt - conduct post-mortem analyses to identify lessons learned and make appropriate people, process, and technology changes, updates and implementations.
  5. Evolve - security programs cannot remain static; they must continue to evolve, just as the threat landscape does. The reality is, today’s solutions may not solve tomorrow’s problems, so constantly challenging our way of thinking and evaluating whether we’re solving or prioritizing the right problems the right way can drastically improve an organization’s security posture.

Outsourcing security operations, although a bit of control is relinquished, can enhance an organization’s security posture and cyber resiliency. Financial resources used to ensure security operations, leveraging the talent of external experts rather than applied to the purchase of individual controls that need to be internally managed, has proven to show a strong return on investment.

Originally posted on www.ien.com
View Most Recent Blogs
Larry Gagnon
Larry Gagnon SVP Incident Response

As SVP Incident Response, Larry is responsible for shaping the eSentire Global Incident Response Program. He is a veteran of the digital forensics and incident response world, having accumulated over 21 years of experience leading the investigation of technology-based crimes.

Larry has completed many forensics training programs with the RCMP, OPP e-Crimes, FBI, National White-Collar Crime Committee and the International Association of Computer Investigative Specialists as well as with several technology vendors. Larry is a Certified Forensic Computer Examiner (IACIS 2001), and GIAC Certified Incident Handler. He has extensive experience testifying as a qualified expert in both criminal and civil matters.