Chuck Leaver – 6 Damage Control Questions You Should Ask Before A Breach

Written By Michael Bunyard And Presented By Ziften CEO Chuck Leaver


The real truth of modern-day life is that if cyber attackers want to breach your network, then it is simply a matter of time before they will do it. The endpoint is the most typical vector of cyber attacks, and individuals are the biggest point of susceptibility in any organization. The endpoint device is where they interact with whatever info that a hacker is after: intellectual property, information, cyber ransom, etc. There are brand-new Next Generation Endpoint Security (NGES) services, where Ziften is a leader, that supply the needed visibility and insight to help reduce or avoid the opportunities or period of an attack. Approaches of prevention consist of minimizing the attack surface area through getting rid of recognized susceptible applications, reducing version expansion, killing destructive procedures, and ensuring compliance with security policies.

But avoidance can just go so far. No system is 100% effective, so it is necessary to take a proactive, real-time methodology to your environment, watching endpoint habits, finding when breaches have occurred, and reacting immediately with remediation. Ziften also supplies these capabilities, typically known as Endpoint Detection and Response, and organizations should change their mindset from “How can we avoid attacks?” to “We will be breached, so exactly what do we do then?”

To understand the true ramifications of an attack, companies need to be able to take a look back and reconstruct the conditions surrounding a breach. Security analysts require answers to the following 6 questions, and they require them quick, given that Incident Response personnel are surpassed and handling limited time windows to alleviate damage.

Where was the attack activity first seen?

This is where the ability to look back to the point in time of preliminary infection is vital. In order to do this effectively, companies have to have the ability to go as far back in history as necessary to determine patient zero. The regrettable state of affairs in accordance with Gartner is that when a cyber breach happens, the average dwell time prior to a breach is discovered is a shocking 205 days. According to the 2015 Verizon Data Investigations Breach Report (DBIR), in 60% of cases, cyber attackers were able to permeate organizations within minutes. That’s why NGES services that don’t continuously monitor and record activity however rather periodically poll or scan the endpoint can miss out on the initial vital penetration. Likewise, DBIR found that 95% of malware types showed up for less than a month, and four out of five didn’t last a week. You need the ability to continually monitor endpoint activity and recall in time (however long ago the attack happened) and reconstruct the preliminary infection.

How did it act?

Exactly what happened piece by piece after the initial infection? Did malware execute for a second every 5 minutes? Was it able to acquire intensified privileges? A constant image of exactly what happened at the endpoint behaviorally is vital to get an examination started.

How and where did the cyber attack spread after preliminary compromise?

Typically the enemy isn’t really after the info readily available at the point of infection, however rather wish to utilize it as a preliminary beachhead to pivot through the network to get to the valuable data. Endpoints include the servers that the endpoints are linked to, so it is necessary to be able to see a total image of any lateral movement that took place after the infiltration to understand exactly what assets were jeopardized and possibly also infected.

How did the contaminated endpoint(s) behavior(s) alter?

Exactly what was going on prior to and after the infection? What network connections were being made? How much network traffic was flowing? What procedures were active before and after the attack? Immediate answers to these concerns are vital to rapid triage.

What user activity occurred, and was there any prospective insider participation?

What actions did the user take previously and after the contamination occurred? Was the user present on the machine? Was a USB drive used? Was the time period outside their typical use pattern? These and much more artifacts should be offered to paint a full picture.

What mitigation is required to deal with the attack and prevent the next?

Reimaging the contaminated machine(s) is a time-consuming and costly solution but many times this is the only way to understand for sure that all of the hazardous artifacts have been removed (although state-sponsored attacks may embed into system or drive firmware to remain immune even to reimaging). However with a clear picture of all activity that happened, lesser actions such as removing malicious files from all systems affected might be adequate. Re-examining security policies will most likely be in order, and NGES systems can assist automate actions in the future should similar situations arise. Automatable actions consist of sandboxing, cutting off network access from infected devices, killing processes, and a lot more.

Don’t wait until after a breach takes place and you have to employ an army of professionals and spend time and finances piecing the facts together. Ensure you are prepared to answer these 6 crucial questions and have all the answers within your reach in minutes.


No Responses Yet to “Chuck Leaver – 6 Damage Control Questions You Should Ask Before A Breach”

Leave a Reply