sb-nz logo
Story image

CrowdStrike compiles 'casebook' of cybersecurity's important lessons

11 Dec 2017

CrowdStrike has compiled a ‘casebook’ of some of cybersecurity’s important lessons on the subjects of state-sponsored attacks, fileless malware, mean-time-to detect - and the ultimate finding that organisations are getting better at self-detection.

The company’s annual Cyber Intrusion Services Casebook looks at attack tactics, techniques, procedures and the state of breach readiness across various industries.

According to CrowdStrike Services CSO and president Shawn Henry, organisations need to be aware of emerging attack trends and techniques so they can implement best incident response strategies.

With cybersecurity becoming a core business issue, CEOs and business leaders need to improve their ability to anticipate threats, mitigate risks, and prevent damage in the wake of a security-related event,” he explains.

The casebook found that the average time between the first evidence of a compromise and its initial detection was 86 days. The company says that the longer an attacker can ‘dwell’ in an environment, the more opportunity that attacker has to find, exfiltrate and destroy data or operations.

However, organisations are getting better at detecting attacks internally. In 68% of the reviewed cases, the affected organisations were able to internally identify the breach – up from 11% over previous years.

The casebook also suggests that nation-state sponsored attacks and other cybercriminals are starting to merge.

“Both threat groups increasingly leverage similar tactics such as fileless malware and “living off the land” techniques involving processes native to the Windows operating system, including PowerShell and WMI (Windows Management Instrumentation),” the company says.

The casebook found that attack trends towards fileless malware, such as those that execute code from memory, made up 66% of all attacks. This category also includes credential theft for remote logins.

 “Based on the CrowdStrike Services team’s extensive experience, this Casebook informs not only security professionals, but also executives, boards of directors and shareholders on how to prepare for and respond to intrusions in a more effective manner,” Henry continues.

CrowdStrike states that organisations must improve their resiliency if they are to protect against sophisticated threat actors.

“Relying on traditional security measures, tools and approaches is no longer effective in the face of modern cyber threats. As attacks continue to become more sophisticated and prolific, organizations must evolve their security strategies to proactively prevent, detect and respond to all attack types, including fileless malware and malware-free attacks," the company states.

In August 2017 CrowdStrike announced expansion into the Asia Pacific market.

“The CrowdStrike Falcon platform delivers to customers maximum protection against modern-day threats, along with best-in-class performance, efficacy, and efficiency,” commented CrowdStrike APAC vice president Andrew Littleproud.

“This powerful combination has allowed us to set a new standard in endpoint security, which is driving incredible momentum in our sales across APAC. We are excited to expand our presence in APAC countries and will continue to invest within the region throughout the rest of 2017.”

The company opened its APAC headquarters in 2017. Since then, the company has made strategic hires to continue its investment in the region.  

Story image
IBM Security completes industry first with updates to Cloud Pak for Security solution
"With these updates, we will be the first in the industry to bring together external threat intelligence and threat management alongside data security and identity."More
Story image
Palo Alto Networks extends cloud native security platform with new modules
Palo Alto Networks has announced the availability of Prisma Cloud 2.0, including four new cloud security modules, thus extending its Cloud Native Security Platform (CNSP). More
Story image
Video: 10 Minute IT Jams – A glimpse inside a ransomware cell
This is our second IT Jam with SonicWall senior manager of product marketing Brook Chelmo, and in this video Brook walks us through his one-on-one experience with a member of a ransomware cell. More
Story image
Palo Alto Networks launches new SD-WAN solutions and enhancements
Palo Alto Networks has introduced two new SD-WAN appliances and enhancements to its next-generation SD-WAN solution, expanding the company’s CloudGenix SD-WAN solutions reach.More
Story image
Cybersecurity market continues meteoric ascent
With the increase in cyberattacks, organisations are continuing to spend more money on security. However, without a focused cybersecurity strategy, they often spend it in the wrong areas.More
Story image
Creating private data regulations for employees
Whether employees are hired on a part-time or full-time basis, everyone must know about data privacy regulations. Everyone needs to be responsible for keeping the organisation’s data secure. More