Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
eSentire will be participating in the Avant Partner Summit.
Join eSentire and Telarus for a day of golfing.
The annual Black Hat USA conference is where many of the world’s top…
If there’s anything organizations should have learnt within the past year, it’s that cyber defenses can, and likely will, fail. Despite having all the necessary safeguards in place, ransomware attacks are bound to occur. Between January - April 2021 alone, eSentire’s Threat Response Unit (TRU) team, composed of expert threat hunters organized to protect you against advanced and emerging threats, along with Dark Web researcher, Mike Mayes, found that ransomware groups have compromised 292 new victims.
While ransomware gangs and their tactical playbooks have certainly evolved to become much more sophisticated, the driving force behind the occurrence of the attacks have also changed. Gone are the days of threat actors targeting organizations to chase a payout - the cyber attacks of today are ideologically motivated, designed and orchestrated to instill chaos within society.
The repercussions of an attack are significantly higher than they were five, ten years ago. While there will always be a financial element tied to these attacks, organizations are undergoing increased scrutiny over maintaining compliance standards for data security & privacy. Should an attack occur, if they are unable to demonstrate they were compliant with these regulations, not only would organizations face significant fines but they also open themselves up to a lawsuit (or two!).
As a result, CISOs don’t have the luxury of assuming they can thwart cyber attacks. While you should be well-equipped to prevent a ransomware attack, we recommend adopting the “assume breach” mentality, wherein you assume that your organization will eventually get breached.
Therefore, it’s critical that security leaders understand how to reduce the impact of a ransomware attack. Here are some of our recommendations:
Maintain regularly updated “gold images” of critical systems in the event they need to be rebuilt.
Backup copies are not limited to just data. Your team must retain backup hardware to rebuild systems in the event rebuilding the primary system is not preferred.
Implement a company-wide policy that corporate data should not be stored locally on any device. If a device is infected, you can lose all locally-stored data, compared to if the data is stored on the cloud.
Isolate the infected device immediately to limit the spread of ransomware across the rest of the network.
Identify the type of ransomware and/or the threat actors behind the attack, if possible, to determine if there is a possible decryption key already available. If you don’t have the expertise to conduct this investigation in-house, engage an external Incident Response provider that also has Digital Forensics capabilities to lead the charge.
In addition to system images, your team should have the applicable source code or executables backed up (or escrowed, have a license agreement to obtain, etc.) so that if the ransomware infection impacts the application code, you don’t lose it entirely.
Most importantly, create, maintain, and exercise a strong cyber incident response plan and associated communications plan that includes response and notification procedures for a ransomware incident.
Ransomware is one of the biggest threats to any organization today - period. As such, organizations must do everything in their power to reduce the impact of an attack. As long as there is a clear directive and plan in how your team will act in the event of an attack, you may be able to limit the operational disruption or the financial and legal repercussions that could ensue.
eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.