Combine cutting-edge XDR technology, multi-signal threat intelligence and 24/7 Elite Threat Hunters to help you build a world-class security operation.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Cyber risk and advisory programs that identify security gaps and build security strategies to address them.
XDR with machine learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
Proactive threat intelligence, original threat research and a world-class team of seasoned industry veterans.
Extend your team capabilities and prevent business disruption with expertise from eSentire.
Stop ransomware before it spreads.
Meet regulatory compliance mandates.
Detect and respond to zero-day exploits.
End misconfigurations and policy violations.
Defend third-party and supply chain risk.
Prevent disruption by outsourcing MDR.
Adopt a risk-based security approach.
Meet insurability requirements with MDR.
Protect your most sensitive data.
Defend brute force attacks, active intrusions and unauthorized scans.
Guard endpoints by isolating and remediating threats to prevent lateral spread.
Investigation and threat detection across multi-cloud or hybrid environments.
Remediate misconfigurations, vulnerabilities and policy violations.
Defend brute force attacks, active intrusions and unauthorized scans.
THE THREAT On February 20th, ConnectWise confirmed that two recently disclosed ScreenConnect vulnerabilities are now under active exploitation. The vulnerabilities are currently tracked as…Feb 09, 2024
THE THREAT On February 7th, CISA, NSA, FBI, along with Five Eyes intelligence partners, published a joint advisory related to state-sponsored threat actors from the People’s Republic of…
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Waterloo, ON–February 7, 2024 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced that three of Australia’s top Value-Added Resellers (VARs): Advance Vision Technology, Exigo Tech, and Rubicon 8 have joined eSentire’s CRN 5-Star e3 partner…
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
I was saddened to learn that two people who attended RSA 2020 in San Francisco had subsequently tested positive for COVID-19. This virulent disease has impacted our lives with restricted travel and cancelled public events. eSentire included.
On the surface, COVID-19 reminds us that what we don’t know can hurt us. Until a vaccination is developed and distributed, we can do little more than wash our hands, avoid those infected and stay away from major public gatherings…effectively hoping that preventative actions like this will keep us safe.
In the world of cybersecurity, we’ve seen that prevention is a broken model. When a network virus spreads without symptoms or other known indicators of compromise, it evades oblivious AV systems and firewall rules and the digital corollary is only detected once it’s too late and criminal symptoms manifest. By then, the infection has metastasized into business-disrupting or financially punishing events.
Even worse, criminal elements take advantage when we are disabled, distressed or otherwise distracted, kick you when you are down and strike when you can least afford it. Reports of multiple campaigns using fears of COVID-19 to lure victims into clicking. In one, safety guidelines are offered in a CoronavirusSafetyMeasures.PDF which deploys a remote access tool (RAT) and malware, and an erroneous Microsoft Office document purportedly from the Ukrainian Ministry of Health deploys keylogging and other malware. Checkpoint reported that over 4,000 coronavirus-related domains have been registered in 2020, of which 8 percent were malicious or at least suspicious.
Learning from Hurricane Sandy
Hurricane Sandy was the most deadly storm of the 2012 Atlantic hurricane season. The storm killed 233 people in eight countries, affected 24 US states, caused major flooding in Manhattan streets and subway tunnels and was responsible for $64 billion in damage.
These facts are easily traceable through the concentric rings of headlines and insurance records. What’s harder to spot is the cyber rot that accompanies events such as this.
Our security operations team studied traffic analytics for a three-month period around Hurricane Sandy. Data showed a 30 to 40 percent drop in network traffic across our client base located in New York City for the two weeks during and after the hurricane. However, the level of threats remained constant throughout. In fact, the week following the hurricane, attacks spiked by 30 percent!
Criminals knew the disaster and chaos caused by the storm. Employees couldn’t get to work, blocked by flooded subway lines. And massive power outages ensured office buildings in Lower Manhattan were vacant. All that data just sitting there without the usual contingent of IT security supervisors … the world’s bank vault was open and the guards were stuck at home.
Hurricane Sandy became the instant bar by which business continuity (BCP) and disaster recovery (DR) plans were measured. As the American Bar Association’s Cybersecurity Handbook puts it: “If a client’s disaster recovery plans cannot pass the ‘Hurricane Sandy test,’ such plans might also fail if cyber incidents caused prolonged disruptions.”
And most plans failed. Most of the client data for major financial institutions resided in data centers located in New Jersey, a quick ferry ride across the Hudson river. Turns out, category 2 hurricanes don’t follow state lines, and operations were crippled, and data was exposed during the clean up. In hindsight, it’s an obvious flaw in any BCP/DR plan. But that just goes to highlight a filter we bring to the table: hindsight bias. Given the outcome, we exaggerate our ability to predict and avoid the same fate. Where was the “I told you so” gang, months before the storm season when business continuity plans were being drafted?
With the uncertainty of COVID-19, most companies have deployed employee travel restrictions. It’s a smart response to reduce the risk of exposure. Now consider the risk of your data being exposed. As the Hurricane Sandy SOC data shows us, attacks go up when the storm is at its worst.
Consider the knock-on implications of your employees working remotely. How will you meet your obligations to protect client information in the face of diminished staff capacity? What mechanisms and protocols do you have in place to maintain consistent security practices during this shortage? Can you still monitor your environment 24/7? And if you find an anomaly or threat, can you take action with a diminished security team?
Run a COVID-19 incident simulation: One CSO I work closely with is using this event to run a tabletop simulation based on COVID-19. He’s putting his executives and IT teams through a lunch-time drill that simulates the decision making required when an employee tests positive for infection. It’s a smart approach.
Review your BCP/DR plans: It’s time to review your plans and determine if they cover an infection contingency. If they don’t, update them ASAP. Like the way the ABA characterized BCP plans nearly ten years ago, insurers will ask whether your BCP/DR plans now pass the “Coronavirus 2019 test”.
Review remote access protocols: Criminals know your employees are working from home. That’s go-time for phishing lures designed to harvest VPN credentials! This could be a good time to reset passwords, require multi-factor authentication, and restrict access to critical information, not required for everyday duties.
Protect your endpoints: As more employees work remotely, it’s critical to expand your umbrella of protection to include those distributed laptops, tablets and phones. And this goes well beyond basic antivirus services. Consider endpoint protection platforms (EPPs) and endpoint detection and response (EDR) solutions. We have a few flavors to offer.
Inform your employees: Remind employees that criminals will attempt to take advantage of the chaos created by COVID-19 through fraudulent invoicing, fake donation sites on social media, and likely attempt to collect VPN credentials. Forewarned is forearmed. Remind your employees to remain vigilant and follow security protocols.
Don’t forget your supply chain: Have you spoken to critical vendors to identify risks in your supply chain? Perhaps you have strong protocols for COVID-19, but your vendors haven’t quite got there. As I reported last year when we surveyed 650 executives, we found nearly half had suffered a material business disrupting breach as a result of vendor actions (or inactions). Read the report.
Be hyper vigilant and expect attacks: Adversaries are looking for a weakness and ready to strike when you are down. It’s even more critical to monitor your environment 24/7 and be able to respond to a threat. In these situations, it’s often best to ensure your detection and response eggs are not in one basket. Outsourcing Managed Detection and Response (MDR) reduces your coverage risks and improves your odds of catching attacks during contingency plan activation.
As I explain in my upcoming book, No Safe Harbor, ignorance isn’t bliss, it’s negligence. Data breaches, lawsuits, insurance claims and so on converge to create a line in the sand when it comes to expectation and accountability. Once we identify a risk, there is no plausible denial. We are obligated to manage this risk and be consistent in our approach. Even when the risk comes as a result of a global viral epidemic.
Ship’s captains aren’t responsible for the ocean’s weather, but they are accountable for keeping their ship, crew and cargo safe from harm. Similarly, you won’t get a pass because the coronavirus ate your BCP homework.
As corporate leaders, you are the ship’s captain. Can you navigate this storm? Can you keep your employees safe and manage the associated cyber risks with travel restrictions and a workforce working from home on-mass? If a data breach occurs during COVID-19, you won’t get a pass.
Missing employees or inability to provide 24/7 protection won’t provide an escape and influence insurance companies to cover an otherwise denied claim. And the inevitable finger pointing will begin. Cue the CSO: the Chief Scapegoat Officer. While we haven’t hit this inevitable stage, we will.
eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.