July - 2019ENTERPRISE SECURITY| | 9bulletins that share examples of deceptive emails can also prove enlightening to employees. To gauge the effectiveness of their training programs, many enterprises are proactively making social engineering exercises part oftheir technical penetration testing programs. Annual training should be in addition table top exercises that involve the IT Security teams, the corporate staff, internal and external legal counsel and a third party incident response firm like Kroll Cyber Risk.Be prepared with threat intelligence, endpoint monitoring and expert response For many organizations, endpoint threat monitoring is part of their network protection arsenal, but next generation end point solutions are still evolving. Kroll regularly works with clients who have traditional AV solutions that have historically proved ineffective against polymorphic, bit-shifting, and process hollowing techniques.While each banking Trojan is unique in the mechanisms it employs to inflict harm and further spread malware, the following simplified overview of the way we typically handle common banking trojans such as Emotet or Trickbotprovides a glimpse into the steps of an effective response:· Kroll leverages our Endpoint Detection and Response ("EDR") solution to combine forensic and incident response tools, threat intelligence feeds, human analysts, and client feedback about their own networks to identify and ban identified malware hashes (i.e., unique fingerprints of malicious processes or binaries) which terminates running processes and prevents subsequent execution. When deployed at an enterprise level, this gives us the ability to block the execution of malware network wide· When necessary, Kroll can isolate infected systems to prevent data acquisition or exfiltration from client networks due to unauthorized access and network intrusions.· Work with the client to identify and blockactor command and control ("C2") IPs at the network perimeter· Pull selected events to generate a timeline of infections and determine user accounts being utilized by malware for installation and/or spreading.· Work with Client to reset domain and local user account credentials for all accounts known to have been used by the malware to spread (or at the appropriate time, performs an enterprise-wide password reset); also ensures all local administratoruser account passwords are unique.· Ultimately, we create and deploy a custom remediation script to purge remaining malware artifacts.Ubiquitous and persistent threat The evolving nature of banking Trojans--and frankly, all types of malware--means that enterprises of all sizes can never let down their guard. In fact, there is no better time than now to ask yourself three questions: 1. Are we continually educating employees and leaders on realistic threat scenarios? 2. How are we testing our defenses and how regularly are we testing? 3. Do we have advanced resources to detect and eradicate threats? With every day that goes by, cybercriminals are counting on you not to know. Get answers and take action today. ES
< Page 8 | Page 10 >