Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and remediating threats to prevent lateral spread.
Investigation and enhanced threat detection across multi-cloud or hybrid environments.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Customer testimonials and case studies.
Stories on cyberattacks, customers, employees, and more.
Cyber incident, analyst, and thought leadership reports & papers.
Demonstrations, seminars and presentations on cybersecurity topics.
Information and solution briefs for our services.
Episodes on cybersecurity strategy and threat intel.
eSentire will be hosting a bootcamp with AVANT.
eSentire will be exhibiting at the UK's largest insurance broking event.
Join eSentire’s half-day Cybersecurity Insights Summit to hear from a…
As an update from our Wednesday, December 9th, 2020 advisory, eSentire is continuing to closely monitor the situation. eSentire has not observed any indicators of compromise associated with the disclosure of FireEye’s Red Team assessment tools being used maliciously. We have detected numerous routine penetration testing instances using these tools and have alerted appropriately. MVS has been updated to include coverage for all CVE targets identified by FireEye (see below) and we recommend that you continue to review your reports and remediate associated vulnerabilities. We will continue to keep you updated if there are any additional updates. We encourage you to watch the recorded webinar that discusses this topic.
THE THREAT:
On December 14th, FireEye disclosed a global supply chain intrusion campaign based on compromised SolarWinds Orion releases. The compromised releases subsequently masqueraded its traffic as the Orion Improvement Protocol, thereby blending in with legitimate SolarWinds activity to obfuscate the threat actors' activities.
FireEye has developed and publicly released approximately 300 countermeasures, aimed at arming the security community at large to defend against the attacks they authored. eSentire has implemented new detection content based on information shared by FireEye. We will continue to monitor the situation and deploy new detection content as necessary.
What we're doing about it:
What you should do about it:
Additional Information:
Prioritized CVEs by FireEye:
CVE-2019-11510 - Pulse Secure SSL VPNs
CVE-2020-1472 - Microsoft Active Directory
CVE-2018-13379 - Fortinet Fortigate SSL VPN
CVE-2018-15961 - Adobe ColdFusion
CVE-2019-0604 - Microsoft SharePoint
CVE-2019-0708 - Windows Remote Desktop Services
CVE-2019-11580 - Atlassian Crowd
CVE-2019-19781 - Citrix Application Delivery Controller and Citrix Gateway
CVE-2020-10189 - ZoHo ManageEngine Desktop Central
CVE-2014-1812 - Windows
CVE-2019-3398 - Confluence
CVE-2020-0688 - Microsoft Exchange
CVE-2016-0167 - Microsoft Windows
CVE-2017-11774 - Microsoft Outlook
CVE-2018-8581 - Microsoft Exchange Server
CVE-2019-8394 - ZoHo ManageEngine ServiceDesk Plus