CyCraft Joins International Forum of Incident Response & Security Teams

MalBot · June 17, 2020, 8:00am

Threat actor capabilities are continually evolving; new and stealthier tools continuously emerge. Maintaining up-to-date threat intelligence is paramount. Through joining FIRST, we aim to share our knowledge and services to aid the global community in the fight against sophisticated threat actors and to continue to accumulate threat intelligence and experience to better serve our customer community with increased accuracy and efficiency against cyber threats.

As of February 25 of 2020, CyCraft’s Taiwan subsidiary, CyCarrier, has been a proud member of FIRST (the Forum of Incident Response and Security Teams).

Who is FIRST?

The Forum of Incident Response and Security Teams (FIRST) is an international confederation of trusted incident response (IR) teams, also referred to as Computer Security Incident Response Teams (or CSIRTs). They cooperatively handle cybersecurity incidents by providing access to the best practices, tools, threat intelligence, and trusted communication with fellow FIRST members. Since its formation in 1990, FIRST has become a recognized global leader in incident response and currently has 531 IR teams in 96 different countries.

CyCraft’s CSIRT is Ready to Get to Work

CyCraft’s CSIRT team, CyCarrier Computer Security Incident Response Team (CCCSIRT), is proud to join FIRST in its mission to promote a safer and more secure global cyber environment. Our CSIRT specializes in AI-driven forensics to detect threats, identify threats, analyze threats, and coordinate incident response.

Our AI-driven solution will not only conduct cross-endpoint root cause analysis but will also analyze the root cause of the overall incident and auto-correlate disparate attack data into one incident attack storyline to help SOCs understand the narrative of the attack in its entirety. We work with you to provide a fast, accurate, and thorough incident resolution.

Increased Threat Intelligence

FIRST is the premier international incident response organization. The collective shared threat intelligence of over 531 CSIRTs from 96 countries allows each of us to conduct incident response investigations more efficiently, accurately, and thoroughly.

We also contribute to global threat intelligence as Taiwan’s official departments suffer from hundreds of successful internet attacks each year, more than half of which come from assaults by China’s cyber army, Reuters reports. Taiwan governmental departments face frequent cyberattacks and scanning of their vulnerabilities, with the attack volume reaching 10 million a month.

Having Taiwan join the global cybersecurity conversation allows us to share firsthand threat intelligence, including observed adversarial TTP (tactics, techniques, procedures), hacker tools, and threat actor behavior.

While we continue to improve our capabilities and better our solutions, the real winner is our growing customer community.

Security Incidents

CCCSIRT provides AI-driven digital forensics for security incidents, which can include APT-level attacks, malware infections, data breaches, identity theft, and web-based attacks. We offer five levels of support across the entire FIRST CSIRT Services Framework.

CCCSIRT Offers Five Levels of Support

CCCSIRT Services Framework

FIRST defines their CSIRT Services Framework as “a high-level document describing in a structured way the collection of cybersecurity services and associated functions that CSIRTs and other teams providing incident management related services may provide. The framework is developed by recognized experts from the FIRST community with strong support from the Task Force CSIRT (TF-CSIRT) Community, and the International Telecommunications Union (ITU).”

Powered by our AI-driven solution and team of expert analysts, our CSIRT provides five levels of support throughout all five areas of the CSIRT Services Framework. While our CCCSIRT does specialize in certain areas of the framework, such as Information Security Event Management, we understand that each organization’s cyber situation is unique and requires thorough and transparent communication with our team and yours.

CyCraft CSIRT Prioritized Services as Defined by the FIRST CSIRT Services Framework

Service Area: Information Security Event Management

This service area aims to identify incidents based on the correlation and analysis of security events from a wide variety of contextual data sources. In larger organizations, this service area is typically assigned to a Security Operations Center (SOC); however, not all organizations have SOCs capable of running an IR investigation to the degree they prefer.
Our CSIRT specializes in this service.