Information Security Blog

Stopping Malware from Compromised Insiders: Many of the most devastating data breaches are caused by attackers using stolen credentials to gain access to organizations’ network assets.

Exabeam Threat Intelligence Services (TIS) with SIEM: While SIEMs are central for SOC cybersecurity, SIEMs are often not enough. With the growing sophistication of organized, modern cyber attackers and their highly-targeted techniques, organizations can be left with serious vulnerabilities using SIEM alone.

Every cybersecurity leader senses the urgent need to prepare for a cyberattack. If you haven’t already, most likely you’ll want to deploy an effective incident response policy soon, before an attack results in a breach or other serious consequences. Creating an effective incident response policy helps ensure a timely, effective, and orderly response to a security event.

Writing a Mock Breach Notification Letter Before a Security Disaster: Working backward from a breach that hasn’t occurred yet will illuminate the weaknesses in your disaster plan, so you can take action now—rather than when you’re in a breach recovery.

Russian meddling in the 2016 US elections and the Hillary Clinton campaign email breach came as a surprise to many (with investigations underway as to who knew what and who was involved). Two years later, alarms are again sounding about new threats from Russian bad actors targeting US elections. How can this be stopped?

Unlike a SOC, the comprehensive response provided by a CSIRT reaches beyond the technical actions taken to remediate an incident. It includes recommending changes to systems or organizational practices to protect against future incidents. Plus, it includes important nontechnical responsibilities as well.

Frequently cyber threats and incidents go undetected and unreported—sometimes for years. What is known is that it’s likely your organization faces possible exposure to insider threats—and it’s probably larger than what you’ve anticipated.

Until recently, most security operations centers (SOC) were dependent on their analysts’ skill level and relied on manual steps to detect the cyber threats to their organization.

Ransomware attacks often target victims with high-value, unstructured data. In this case it was the PGA Championship and Ryder Cup files consisting of marketing materials such as PGA banners, logos, and signage, which are the type of files that organizations frequently don’t back up properly.

Quickly get up to speed on the emerging field of User and Entity Behavior Analytics (UEBA) and how information security organizations are utilizing it: Security teams are increasingly shifting towards tying technologies like UEBA to their conventional SIEMs and other legacy prevention systems.

Modern SIEMs provide out of the box correlation rules and sophisticated models to surface a broad range of abnormal behavior and events. Understand how to customize these resources, while adding your own rules and models for your organization’s unique cybersecurity requirements.