Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Join us for a live security brefing with (ISC)2 members.
Join Tim Segato, Director, Product Management and Ryan Westman, Manager,…
Ask questions and hear from Cybersecurity experts from eSentire,…
This blog was originally published on CyFIR.com and has been reposted as-is here following eSentire’s acquisition of CyFIR Inc. in June 2021. As of the date of the acquisition, no changes have been made to the content below.
Safeguarding digital infrastructure from cyber attacks is a challenge all enterprises face, and while defensive measures can reduce the risk of a data breach, that risk can’t be eliminated entirely. When a breach happens, the speed of a company’s Incident Response is critical to minimize its impact and cost. The following use case illustrates how CyFIR Incident Response Services can assist Information Technology Departments in the aftermath of a data breach.
Friday 7:27 p.m.
It was Friday night and Cesar was on his way to the parking lot when he received a call every Chief Information Security Officer fears: their network had been breached. A team of his security analysts was already on its way back to the office, but nobody knew the extent of the breach, when it occurred, how much data had been removed, or whether other systems had been compromised. Cesar hurried back to his office, shot off a few emails to notify the executive team, and settled back into his chair for what he knew was going to be a long night. Then, knowing his team needed help, he picked up the phone and began contacting cybersecurity consultants.
Friday 7:49 p.m.
Cesar’s first call was to a company that indicated it could have consultants arrive first thing Monday morning. He couldn’t wait that long. Cesar’s second call was to CyFIR where the CTO explained how CyFIR Incident Response Services could be initiated remotely. At 8:00 p.m. Cesar sent over a signed engagement letter, and by 8:30 p.m. CyFIR had remotely deployed its agents onto his network endpoints and begun analysis on all running processes to determine if any malware was still active. Incident Response had begun.
Friday 9:15 p.m.
After CyFIR analysts ran a snapshot of the running processes across all endpoints, they discovered 9 pieces of malicious malware that matched CyFIR’s database of over 1 billion known malware signatures. In addition, CyFIR identified several unknown processes running on the endpoints. Secondary analysis of these unknown processes determined there was a malicious piece of zero-day, or custom, malware in the network. CyFIR pulled the zero-day malware off the system for a more complete analysis.
Friday 9:45 p.m.
After 30 minutes, CyFIR finished analyzing the zero-day malware and identified its country of origin. Next, they ran a search on all endpoints and established that the malware was isolated to just one server. By midnight – four hours after the Incident Response began – CyFIR had deployed its agents, discovered malware running on the endpoints, determined its country origin, and eliminated it from the system. Now it was time to determine how much data had been lost.
Saturday 11:00 a.m.
Throughout the weekend, CyFIR analysts worked with Cesar’s security team to answer critical questions that would reveal the severity of the breach: How long had the intruder been in the system? How did the intruder gain access? What was the intruder’s origin? How much information was lost?
Saturday 3:45 p.m.
With CyFIR Incident Response Services, answers to these questions were quickly determined: Cesar now knew the intruder had been inside their system for about 45 days, he knew which systems had been accessed and how, and he could confidently report that no data had been removed from the network. Using this information and guidance from CyFIR analysts, Cesar’s team began implementing new security mechanisms that would prevent future compromises.
Monday 8:30 a.m.
By Monday morning Cesar had barely slept and he suspected he was in serious need of a shower, but first, he had to brief the Board on what happened and what management had learned from their investigation. Earlier that morning, he had emailed around CyFIR’s preliminary report detailing its findings, and now, he was preparing for what he feared would be a tense exchange.
Fortunately, after an extensive Q&A, the Board was satisfied with the steps he had taken and the findings that were presented. The Board was confident that management had the situation under control. Based on the report, their legal counsel concluded that the company had no responsibility to notify their customers of the breach. It was time for that shower.
All too often, responding to a security breach is a slow, expensive, and challenging exercise even for large enterprises. Cesar’s experience illustrates the power of the CyFIR Incident Response Services to dramatically improve an organization’s Incident Response capabilities.
eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.