The Challenge:
A global organisation approached CCL to assist with a suspected data breach. Given the international status of the client, CCL were engaged to respond to an incident response, remotely. The client’s security team had identified an irregularity on their network and were suspicious that they had experienced a cyber attack. Although they were able to identify the irregularity and the servers involved almost immediately, they did not know how severely their systems had been compromised. Additionally, they had no knowledge on how long the threat had been present, which files they had accessed, nor how they accessed the server in the first place.
Although CCL have an international collections team, in this instance, the client team removed the compromised machines, took an image of the virtual machines and sent them securely to the Cyber Security experts at CCL.
Overcoming the Challenge:
The extraction of data for a digital forensic examination can be a slow process and this case required a quick reaction. Instead, our experts were able to implement a modern approach, incorporating forensic data acquisition and threat hunting determined by their hypotheses, to understand not only the result of the attack via Indicators of Compromise (IOC) but also the how and why.
Our experts achieved this through the use of multiple advanced tools and were able to communicate this to the client via methodologies (including Cyber Kill Chain and MITRE ATT&CK Framework, a knowledge base for hacker’s tactics, techniques and procedures (TTP)). This assisted the team in determining that the hacker gained access via a zero ) on an unpatched plugin and proceeded to download archived files, rather than personal data – suggesting their motivations were opportunistic rather than malicious. Luckily.
Our experts examined the artefacts, tracked the adversary’s lateral movements across the network, analysed and documented the TTP and produced a final report for the client.
The Result:
Once our experts had produced the report, they then flew overseas to deliver the final report and discuss the lessons learned across all teams that contributed to resolving the breach. The ability to put in place a proactive Response Capability plan is often as important as the analysis and can be used to contribute to overall resiliency in the future.
Here at CCL Group, our remote compliance health checks including our complete range of managed cyber security services keep your business protected 24/7.
With years of experience, best in class processes and a team of security experts, we can devise a solution that’s tailored to your exact requirements and potential cyber threats.
Contact us today for a low, fixed cost gap analysis assessment.
</div>
<div>
<div>
<div>
</div><div>
<div>
<h2>Sign up</h2> </div><p>Sign up to receive the latest news and insight from CCL Group.</p><p>
Notice: JavaScript is required for this content.</p><div>
<div></div>
<p></p></div><div>
</div></div>
</div>
Article Link: https://cclgroupltd.com/2020/05/22/remote-response-case-study/