Cyberscope
CyberscopeIT Security Services / Incident Response Team
Cyber Security Incident Response Team (CS-IRT)
24/7 cyber security incident response (DFIR) services, delivered to your IT team during a cyber attack.
24/7 incident response
Technical and managerial expertise
Support in English and Spanish
CyberScope’s cyber security perception
It is an unfair battle, and only a matter of time before a persistent hacker penetrates a typical organisation, even a highly protected one. Hackers need only one successful attempt, while organisations need 100% success in their continuous defence.
At CyberScope, we assume that all of our customers, including those who have implemented all of our security recommendations, will eventually be breached.
That is why our proactive CS-IRT services start from day one, before a real attack occurs. We can then respond faster and more effectively during an attack, and the potential damage is significantly reduced.
The Challenge
Given today’s threat landscape, most organisations will at some point face a cyber attack they need to respond to and manage. The speed, efficiency and expertise of that response are critical to avoiding catastrophic technical, business and financial losses.
Slow and tedious
Too many alerts from too many sources make it hard to prioritise and classify them.
Inefficient
Processes and customer communication are difficult.
Unaware
A typical IT engineer may face a cyber attack fewer than twice a year, so cannot gain the experience needed to face the next one efficiently.
The Solution
A specialised Cyber Security Incident Response Team (CS-IRT), qualified to respond to sophisticated attacks and to support management through hard strategic decisions that minimise business damage.
Speed
A 24/7 team ready to act immediately, communicating in English and Spanish.
Efficiency
Prepared in advance through an understanding of your network, your strategic, sensitive and vulnerable assets, and a tailored playbook.
Expertise
Proven technical and managerial experience from sophisticated attacks in Israel and worldwide.
Key differentiators
Proven expertise
Our CS-IRT experts have proven experience mitigating sophisticated attacks worldwide and in Israel.
Efficient response
Prepared playbooks tailored to known and unknown complex attack scenarios for each customer’s unique risks.
Security performance
Integrated security solutions that minimise blind spots and maximise telemetry for optimum security.
Immediate response
24/7 availability of multinational experts from Israel and Spain, communicating with clients in English and Spanish.
Optimum readiness
Periodic readiness maturity reviews and attack simulation drills.
Crisis management
Advising top management on hard decisions and sensitive internal and external communications, while controlling reputational damage and legal liabilities.
Why choose a SOC with CS-IRT capabilities
When choosing a SOC provider, it is important to pick one that offers specialised, comprehensive services beyond daily monitoring and limited incident response, including support for the whole organisation, top management included, during a sophisticated attack.
Customers are often confused by similar names such as SOC, MDR, MSP, MSSP and CS-IRT. A SOC (or any of the others) typically focuses on daily monitoring and limited incident response. A CS-IRT is a specialised task force trained to respond to sophisticated attacks from both a technical and a business-management perspective.
CyberScope’s CS-IRT at work
Investigate
We deploy cloud-based security technologies to investigate attack indicators, analyse Active Directory and firewall logs, validate account usage, and look for data exfiltration, exploited vulnerabilities and phishing that may have enabled the initial foothold.
Manage the crisis
We meet top management to update them on status and alternative plans, managing the crisis so all stakeholders understand the situation, and coordinating responsible, controlled internal and external communication.
Trace, contain and remediate
We track the attacker’s initial vector and propagation, use threat intelligence to understand their profile and motivation, and collect forensic evidence where needed to build the best containment, eradication and remediation strategy.
CyberScope’s CS-IRT at work
CERT Israel identified suspicious activity related to XXX.XXX.XXX.XXX between Wednesday 27th, 23:11, and Thursday 28th, 12:02 (Israel time). This is how the response unfolded.
Step 01
An Israeli company asks CyberScope for support during a cyber attack.
Step 02
CyberScope team meeting to prepare the EDR installation.
Step 03
Installation of EDR sensors begins.
Step 04
Forensic investigation begins using a malware scanner.
Step 05
Installation of an agent for vulnerability analysis.
Step 06
Logs are extracted for further investigation using a Windows artifact collector (Security, System, Windows PowerShell, PowerShell Operational).
Step 07
High PowerShell CPU usage is detected. Process Explorer and a traffic analyser are installed to investigate.
Step 08
Endpoint investigation: no critical or high vulnerabilities found, but critical software was unpatched.
Step 09
An EDR remote terminal session reveals Windows Update manipulation.
Step 10
Failed login attempts and abnormal commands found: a new user, DefaultAccount, was created using a file named user.bat.
Step 11
The client is asked to check where DefaultAccount has logged in, using PowerShell.
Step 12
Malicious IPs linked to the .exe and .dll files that launch the .bat file are found and blocked at the firewall.
Step 13
The Security event log was found to have been cleared before CyberScope was called in.
Step 14
The malware scan completes: no malware found.
SOC vs. Standard CS-IRT vs. Comprehensive CS-IRT
| Service | SOC (MDR) | SOC (MDR) + Standard CS-IRT | SOC (MDR) + Comprehensive CS-IRT |
|---|---|---|---|
| Managed detection (active monitoring)Constant support to improve readiness for a cyber attack • 24/7 alert monitoring and notifications • Triage: qualification and validation of alerts | ✓ | ✓ | ✓ |
| ResponseBlock suspicious activity on specific compromised hosts • Respond via remote access and investigate via scripts • Quarantine suspicious messages and contain specific hosts on the network | ✓ | ✓ | ✓ |
| Threat managementThreat hunting (manual and semi-automatic) • Threat intelligence | ✓ | ✓ | ✓ |
| Standard incident response (IR)Network-wide attack vector investigation, including searching for suspicious events, artefacts and IOAs, and removing planted persistence, malware artefacts and malware-less activity from all endpoints, servers and networking equipment, including AD and firewalls | ✕ | ✓ | ✓ |
| Comprehensive incident response (IR)Advisory to top management on critical dilemmas during and after the attack, such as information sharing with employees, customers, suppliers, media and law enforcement; whether to shut down part or all of the operation; and ransomware negotiation | ✕ | ✕ | ✓ |
More IT Security Services
MDR via SIEM / SOC-as-a-Service
24/7 active monitoring and response, delivered as a managed service.
Incident Crisis Management (CS-ICM)
Advisory for top management before, during and after an attack.
Pro-Active Readiness Program (PRP)
A readiness assessment with actionable recommendations.
Recovery & Restoration (R&R)
Rebuild and harden the network elements needed for normal operation.
