What We Do
How we do it
Resources
SECURITY ADVISORIES
Jan 13, 2022
GootLoader Hackers Are Compromising Employees of Law and Accounting Firms, Warns eSentire
GootLoader Gang Launches Wide-Spread Cyberattacks Enticing Legal and Accounting Employees to Download Malware eSentire, the industry’s leading Managed Detection and Response (MDR) cybersecurity provider, is warning law and accounting firms of a wide-spread GootLoader hacker campaign. In the past three weeks and as recently as January 6, eSentire’s threat hunters have intercepted and shut down…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Oct 28, 2021
Telarus and eSentire Expand Partnership to Safeguard Enterprises Globally Against Business Disrupting Ransomware and Zero-Day Attacks
London, UK and Sydney, Australia– Oct. 28, 2021 - eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announces the expansion of its partnership with Telarus, the largest privately-held distributor of business cloud infrastructure and contact centre services. Building on their mutual success across North America, Telarus will bring eSentire’s Managed…
Read More
Partners
PARTNER PROGRAM
Partners
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
PARTNER RESOURCES
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Jun 17, 2021

CyFIR Incident Response: An Information Technology Department Use Case

Speak With A Security Expert Now
This blog was originally published on CyFIR.com and has been reposted as-is here following eSentire’s acquisition of CyFIR Inc. in June 2021. As of the date of the acquisition, no changes have been made to the content below.

Safeguarding digital infrastructure from cyber attacks is a challenge all enterprises face, and while defensive measures can reduce the risk of a data breach, that risk can’t be eliminated entirely. When a breach happens, the speed of a company’s Incident Response is critical to minimize its impact and cost. The following use case illustrates how CyFIR Incident Response Services can assist Information Technology Departments in the aftermath of a data breach.

Friday 7:27 p.m.

It was Friday night and Cesar was on his way to the parking lot when he received a call every Chief Information Security Officer fears: their network had been breached. A team of his security analysts was already on its way back to the office, but nobody knew the extent of the breach, when it occurred, how much data had been removed, or whether other systems had been compromised. Cesar hurried back to his office, shot off a few emails to notify the executive team, and settled back into his chair for what he knew was going to be a long night. Then, knowing his team needed help, he picked up the phone and began contacting cybersecurity consultants.

Friday 7:49 p.m.

Cesar’s first call was to a company that indicated it could have consultants arrive first thing Monday morning. He couldn’t wait that long. Cesar’s second call was to CyFIR where the CTO explained how CyFIR Incident Response Services could be initiated remotely. At 8:00 p.m. Cesar sent over a signed engagement letter, and by 8:30 p.m. CyFIR had remotely deployed its agents onto his network endpoints and begun analysis on all running processes to determine if any malware was still active. Incident Response had begun.

Friday 9:15 p.m.

After CyFIR analysts ran a snapshot of the running processes across all endpoints, they discovered 9 pieces of malicious malware that matched CyFIR’s database of over 1 billion known malware signatures. In addition, CyFIR identified several unknown processes running on the endpoints. Secondary analysis of these unknown processes determined there was a malicious piece of zero-day, or custom, malware in the network. CyFIR pulled the zero-day malware off the system for a more complete analysis.

Friday 9:45 p.m.

After 30 minutes, CyFIR finished analyzing the zero-day malware and identified its country of origin. Next, they ran a search on all endpoints and established that the malware was isolated to just one server. By midnight – four hours after the Incident Response began – CyFIR had deployed its agents, discovered malware running on the endpoints, determined its country origin, and eliminated it from the system. Now it was time to determine how much data had been lost.

Saturday 11:00 a.m.

Throughout the weekend, CyFIR analysts worked with Cesar’s security team to answer critical questions that would reveal the severity of the breach: How long had the intruder been in the system? How did the intruder gain access? What was the intruder’s origin? How much information was lost?

Saturday 3:45 p.m.

With CyFIR Incident Response Services, answers to these questions were quickly determined: Cesar now knew the intruder had been inside their system for about 45 days, he knew which systems had been accessed and how, and he could confidently report that no data had been removed from the network. Using this information and guidance from CyFIR analysts, Cesar’s team began implementing new security mechanisms that would prevent future compromises.

Monday 8:30 a.m.

By Monday morning Cesar had barely slept and he suspected he was in serious need of a shower, but first, he had to brief the Board on what happened and what management had learned from their investigation. Earlier that morning, he had emailed around CyFIR’s preliminary report detailing its findings, and now, he was preparing for what he feared would be a tense exchange.

Fortunately, after an extensive Q&A, the Board was satisfied with the steps he had taken and the findings that were presented. The Board was confident that management had the situation under control. Based on the report, their legal counsel concluded that the company had no responsibility to notify their customers of the breach. It was time for that shower.

When a breach happens, speed matters.

All too often, responding to a security breach is a slow, expensive, and challenging exercise even for large enterprises. Cesar’s experience illustrates the power of the CyFIR Incident Response Services to dramatically improve an organization’s Incident Response capabilities.

Some of the key takeaways from this use case include:

View Most Recent Blogs
eSentire
eSentire

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.