Let me tell you a story about a recent DFIR investigation I was fortunate enough to be involved with.
The target was a relatively large restaurant chain with multiple locations throughout the United States and some internationally. It considered itself to be rather mature in its security posture, meaning it had a CISO and some cybersecurity staff on board and was outfitted with the traditional security components like firewalls, IDSes/IPSes, VPNs and anti-virus.
Trustwave had recently published a threat brief providing indicators of compromise (IOCs) found from a recent criminal campaign in the wild: Carbanak. This company's CISO had read the threat brief and quickly realized he had seen some similar activity in his network. Luckily this company had an IR retainer on file and called it in.
In less than 24 hours he had a team of experts on site hunting the threat. It turns out the company was also in the process of rolling out a new managed endpoint detection solution (MDRe). This was critical, as this allowed the IR team to discover that there was in fact cybercrime activity present in the network, and it was actively stealing data.
These advanced and persistent criminals were on to the investigators, so they were also moving laterally to avoid detection. As the crooks played cat and mouse, the company quickly finished its endpoint protection rollout, which helped enable the IR team to contain the activity and stop it from further damage. What came next was particularly blood chilling.
Post cleanup, the IR team was huddled in the CISO's office for follow up, when a phone call came in. The CISO answered, then put the call on speaker. The voice was a strong eastern European accent: "Just wanted you to know, good job, but we will be seeing you again," the caller said.
The attackers called the CISO. That's just incredible right there. And the criminals did return, through another wave of phishing attacks. The IR team returned and had it contained within a few days, again.
The positive aspect of the story is that, through a series of incident response planning and consulting engagements prior to the Carbanak activity, the company had followed advice to isolate different processing systems, which made it harder for the criminals to ever get to the really valuable data. Without having invested in incident readiness and response this company may have lost everything.
In the cybersecurity world, it's all about cutting your losses, because you will get hacked. If you are prepared, you won't lose as much. That's why, at a minimum, you need to have a digital forensics and incident response (DFIR) team on call 24/7/365, also known as the IR retainer.
There are two types of organizations out there - ones that are prepared for a security breach and ones that aren't. If you are prepared, you're smart because you are protecting your company and your job. Cybercriminals are getting away with billions, and few get caught. Even if they do, the losses aren't recoverable.
If you are sitting on the fence about getting an IR retainer, here is why you should reconsider:
Incidents are Common
According to the 2018 Trustwave Global Security Report, retail and hospitality make up two of three most compromised industries (the other is finance). These two, public-facing verticals are particularly prone to financially motivated, targeted attacks because they handle so much sensitive information, conduct business through often-vulnerable network pathways like e-commerce platforms and point-of-sale terminals and often lack adequately trained security staff. And, make no mistake, organized crime groups behind certain attacks, such as Carbanak, are very good at what they do as well.
Talent is Short
A certain amount of DFIR can be automated, but even that can only be done with highly skilled, experienced and confident IR staff, something many industries, especially retail and hospitality, are lacking. You need to look at the bigger picture because there are things that cannot be automated such as determining the intent behind new indicators of compromise, industry and target specific threat patterns, complex use-case correlation, knowledge about where critical data resides, attack vectors and the ability to devise response and containment strategies on the fly.
Time is Money
Negotiating an IR retainer is a purchasing process like anything else. First there's the meeting of the minds and then the quote (and hopefully you don't have to do an RFP because that could take months.) In addition, there's legal involvement, red lining and purchasing. If you are under attack and only then purchasing IR services, then you are behind the eight ball. When you finally get the IR team on site, it has to rush through a cram session to understand your environment, which means it will take longer to remediate an incident than it should have to begin with.
Craig Ellrod is a systems engineer at Trustwave.
