CyFIR Incident Response: An Information Technology Department Use Case

This blog was originally published on CyFIR.com and has been reposted as-is here following eSentire’s acquisition of CyFIR Inc. in June 2021. As of the date of the acquisition, no changes have been made to the content below.

Safeguarding digital infrastructure from cyber attacks is a challenge all enterprises face, and while defensive measures can reduce the risk of a data breach, that risk can’t be eliminated entirely. When a breach happens, the speed of a company’s Incident Response is critical to minimize its impact and cost. The following use case illustrates how CyFIR Incident Response Services can assist Information Technology Departments in the aftermath of a data breach.

Friday 7:27 p.m.

It was Friday night and Cesar was on his way to the parking lot when he received a call every Chief Information Security Officer fears: their network had been breached. A team of his security analysts was already on its way back to the office, but nobody knew the extent of the breach, when it occurred, how much data had been removed, or whether other systems had been compromised. Cesar hurried back to his office, shot off a few emails to notify the executive team, and settled back into his chair for what he knew was going to be a long night. Then, knowing his team needed help, he picked up the phone and began contacting cybersecurity consultants.

Friday 7:49 p.m.

Cesar’s first call was to a company that indicated it could have consultants arrive first thing Monday morning. He couldn’t wait that long. Cesar’s second call was to CyFIR where the CTO explained how CyFIR Incident Response Services could be initiated remotely. At 8:00 p.m. Cesar sent over a signed engagement letter, and by 8:30 p.m. CyFIR had remotely deployed its agents onto his network endpoints and begun analysis on all running processes to determine if any malware was still active. Incident Response had begun.

Friday 9:15 p.m.

After CyFIR analysts ran a snapshot of the running processes across all endpoints, they discovered 9 pieces of malicious malware that matched CyFIR’s database of over 1 billion known malware signatures. In addition, CyFIR identified several unknown processes running on the endpoints. Secondary analysis of these unknown processes determined there was a malicious piece of zero-day, or custom, malware in the network. CyFIR pulled the zero-day malware off the system for a more complete analysis.

Friday 9:45 p.m.

After 30 minutes, CyFIR finished analyzing the zero-day malware and identified its country of origin. Next, they ran a search on all endpoints and established that the malware was isolated to just one server. By midnight – four hours after the Incident Response began – CyFIR had deployed its agents, discovered malware running on the endpoints, determined its country origin, and eliminated it from the system. Now it was time to determine how much data had been lost.

Saturday 11:00 a.m.

Throughout the weekend, CyFIR analysts worked with Cesar’s security team to answer critical questions that would reveal the severity of the breach: How long had the intruder been in the system? How did the intruder gain access? What was the intruder’s origin? How much information was lost?

Saturday 3:45 p.m.

With CyFIR Incident Response Services, answers to these questions were quickly determined: Cesar now knew the intruder had been inside their system for about 45 days, he knew which systems had been accessed and how, and he could confidently report that no data had been removed from the network. Using this information and guidance from CyFIR analysts, Cesar’s team began implementing new security mechanisms that would prevent future compromises.

Monday 8:30 a.m.

By Monday morning Cesar had barely slept and he suspected he was in serious need of a shower, but first, he had to brief the Board on what happened and what management had learned from their investigation. Earlier that morning, he had emailed around CyFIR’s preliminary report detailing its findings, and now, he was preparing for what he feared would be a tense exchange.

Fortunately, after an extensive Q&A, the Board was satisfied with the steps he had taken and the findings that were presented. The Board was confident that management had the situation under control. Based on the report, their legal counsel concluded that the company had no responsibility to notify their customers of the breach. It was time for that shower.

When a breach happens, speed matters.

All too often, responding to a security breach is a slow, expensive, and challenging exercise even for large enterprises. Cesar’s experience illustrates the power of the CyFIR Incident Response Services to dramatically improve an organization’s Incident Response capabilities.

Some of the key takeaways from this use case include:

• CyFIR can be deployed remotely, allowing Incident Response to begin immediately and eliminating the need to fly in Incident Response teams.
• Due to its searching speed and scalability, CyFIR can evaluate large numbers of endpoints concurrently, identifying malicious code (e.g. malware) running inside a network in a fraction of the time needed by traditional Incident Response tools.
• Within minutes of installation, CyFIR is uniquely capable of identifying known malware, zero-day malware, and advanced persistent threats (APT).
• The overall Incident Response, including identifying the malware in the system, determining which endpoints were infected, analyzing the malware, and eliminating it from the network was all performed in four hours. The subsequent analysis of what happened, what data was lost, report preparation, and reporting to the Board and Legal Counsel was accomplished in less than three days.
• CyFIR Incident Response Services were deployed with minimal disruption and network downtime.
• Other cybersecurity consultants contacted by the company proposed to have their consultants come on-site by Monday morning. They wouldn’t even have boarded the plane by the time CyFIR’s investigation was complete.