If short on time directly jump to the playbooks section. Here we talk about how a Supply chain attack can be mitigated in general. A specific use case will be the SolarWinds supply chain attack – Link and the log4j vulnerabilities – Link It is important for an organization to have a list of all the software the company uses, their licenses and versions Know […]

If short on time directly jump to the playbooks section. It is key to follow new reports continuously as newer discoveries and developments are happening. Ensure to see article time stamps. https://us-cert.cisa.gov/ncas/alerts/aa20-352a https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://github.com/fireeye/sunburst_countermeasures Volexity blog – Link The SolarWinds supply chain attacks are sophisticated in execution, broad in scope, and incredibly potent in their effectiveness. “SUNBURST is the malware that was distributed through SolarWinds […]

First – We compliment a SOAR solution. Our approach is to first design all your playbooks on Kanban boards, know the tasks well, profile them and run them manually. Then selectively move to automation using your selected SOAR solution. Advantages Playbook development workflow Below is a proposed workflow of a Playbook as we have observed working with enterprises and critical infrastructure companies

The use cases are critical to identifying any of the early, middle, and end-stage operations of the adversary. A small abnormal event can be a clue to a larger attack. There also needs to be a Playbook on how to respond. What are Use Cases Best Practises Why it is important to have a large set of Use Cases and have playbooks for them? FlexibleIR […]