What We Do
How We Do
Get Started

CyFIR Incident Response: An Information Technology Department Use Case

BY eSentire

June 17, 2021 | 4 MINS READ

Want to learn more on how to achieve Cyber Resilience?

This blog was originally published on CyFIR.com and has been reposted as-is here following eSentire’s acquisition of CyFIR Inc. in June 2021. As of the date of the acquisition, no changes have been made to the content below.

Safeguarding digital infrastructure from cyber attacks is a challenge all enterprises face, and while defensive measures can reduce the risk of a data breach, that risk can’t be eliminated entirely. When a breach happens, the speed of a company’s Incident Response is critical to minimize its impact and cost. The following use case illustrates how CyFIR Incident Response Services can assist Information Technology Departments in the aftermath of a data breach.

Friday 7:27 p.m.

It was Friday night and Cesar was on his way to the parking lot when he received a call every Chief Information Security Officer fears: their network had been breached. A team of his security analysts was already on its way back to the office, but nobody knew the extent of the breach, when it occurred, how much data had been removed, or whether other systems had been compromised. Cesar hurried back to his office, shot off a few emails to notify the executive team, and settled back into his chair for what he knew was going to be a long night. Then, knowing his team needed help, he picked up the phone and began contacting cybersecurity consultants.

Friday 7:49 p.m.

Cesar’s first call was to a company that indicated it could have consultants arrive first thing Monday morning. He couldn’t wait that long. Cesar’s second call was to CyFIR where the CTO explained how CyFIR Incident Response Services could be initiated remotely. At 8:00 p.m. Cesar sent over a signed engagement letter, and by 8:30 p.m. CyFIR had remotely deployed its agents onto his network endpoints and begun analysis on all running processes to determine if any malware was still active. Incident Response had begun.

Friday 9:15 p.m.

After CyFIR analysts ran a snapshot of the running processes across all endpoints, they discovered 9 pieces of malicious malware that matched CyFIR’s database of over 1 billion known malware signatures. In addition, CyFIR identified several unknown processes running on the endpoints. Secondary analysis of these unknown processes determined there was a malicious piece of zero-day, or custom, malware in the network. CyFIR pulled the zero-day malware off the system for a more complete analysis.

Friday 9:45 p.m.

After 30 minutes, CyFIR finished analyzing the zero-day malware and identified its country of origin. Next, they ran a search on all endpoints and established that the malware was isolated to just one server. By midnight – four hours after the Incident Response began – CyFIR had deployed its agents, discovered malware running on the endpoints, determined its country origin, and eliminated it from the system. Now it was time to determine how much data had been lost.

Saturday 11:00 a.m.

Throughout the weekend, CyFIR analysts worked with Cesar’s security team to answer critical questions that would reveal the severity of the breach: How long had the intruder been in the system? How did the intruder gain access? What was the intruder’s origin? How much information was lost?

Saturday 3:45 p.m.

With CyFIR Incident Response Services, answers to these questions were quickly determined: Cesar now knew the intruder had been inside their system for about 45 days, he knew which systems had been accessed and how, and he could confidently report that no data had been removed from the network. Using this information and guidance from CyFIR analysts, Cesar’s team began implementing new security mechanisms that would prevent future compromises.

Monday 8:30 a.m.

By Monday morning Cesar had barely slept and he suspected he was in serious need of a shower, but first, he had to brief the Board on what happened and what management had learned from their investigation. Earlier that morning, he had emailed around CyFIR’s preliminary report detailing its findings, and now, he was preparing for what he feared would be a tense exchange.

Fortunately, after an extensive Q&A, the Board was satisfied with the steps he had taken and the findings that were presented. The Board was confident that management had the situation under control. Based on the report, their legal counsel concluded that the company had no responsibility to notify their customers of the breach. It was time for that shower.

When a breach happens, speed matters.

All too often, responding to a security breach is a slow, expensive, and challenging exercise even for large enterprises. Cesar’s experience illustrates the power of the CyFIR Incident Response Services to dramatically improve an organization’s Incident Response capabilities.

Some of the key takeaways from this use case include:


eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.

Read the Latest from eSentire