Brochure

WithSecure
Incident Readinessand Response
TM

Peace of mind

Incident Readiness and Response

Why incident response matters
27% of companies worldwide have suffered a data breach costing morethan US $1M since Oct 20191.
Succeeding as a business means putting yourself in the firing line ofcyber threats every single day. You can’t eliminate these outside threats
any more than you can control the rain. But you can be prepared.
The stakes are high: a well-handled security incident can be resolvedin hours, rather than days or months, and at a fraction of the cost of apoorly handled incident.

1 https://www.pwc.com/gx/en/news-room/press-releases/2022/global-digital-trust-insights-survey.html

2Incident Readiness and Response

Doing the numbers
The insurance company Hiscox estimates the average costof a cyber-attack is €180,000, with 60% of smaller companies
going out of business within six months of an attack.
Many organizations don’t have their own IR teams, and theones that do simply don’t encounter the volume and variety
of incidents necessary to maintain battle fitness. If they could
only outsource one security service, it would be IR.

3Incident Readiness and Response

How we help
Good security requires partnership. No one can solve every
cyber security problem alone.
We take a ‘co-security’ approach, helping you to build a confident cyber security incident response team that is trained andequipped to respond to different conditions. We will help you
to minimize the business impact of any cyber security crisis,
understand why the incident happened and improve yoursecurity posture to reduce the likelihood of future breaches.
We offer 3 incident response services:
Incident Response Readiness – exercise and improveyour incident response capability without interruption to
your business.
Incident Response Retainer - guaranteed expert
support in the event of a cyber-attack.
Emergency Incident Response Support - fororganizations that may call at any time, who we help
with available resources.

4

Incident Readiness and Response

The outcomes we deliver
In a crisis, we provide the support that you need. Our
co-security approach and experience enables your incident
response teams to:

Increase resilience
Maintain operations while under attack, minimize disruption.

Reduce risk
Enable and support your IR team, minimize response cost.

Maintain customer trust
Comply with regulations, demonstrate a duty of care toyour customers.

5

Incident Readiness and Response

6

The way we work
Our methodology is based on NIST’s industry standards2 forincident response, business continuity management and otherstandards relevant to operational technology.

Peace time

In addition to the services illustrated in the figure, we offer
standardized incident response packages that deliver specificoutcomes. They include:• Root cause analysis to help mitigate or prevent recurrence ofthe incident• Data exfiltration assessment to determine what data may
have been exfiltrated.

2 National Institute of Standards and Technology (NIST): https://www.nist.gov/

Under attack

Containment

Peace time

Readiness
Post incident
review

Readiness
Detection& analysis

Eradication& recovery

Postincident
review

Incident Readiness and Response

Our record
We co-secure companies, and governments, worldwide. Asa major Managed Detection and Response (MDR) service
provider, we are regularly exposed to incidents. Every day, ourincident response teams battle with organized, well-resourced
criminal and state-sponsored groups that attack our clients’
on-premises and cloud IT.
We have over 30 years of incident response experience. Our
capability is assured by government agencies in Germany3
and the UK4.
It is by working in partnership that we are proud to say thatmany of our partnerships have lasted a decade or longer.

Case study 1

Case study 2

IT estate – 15k~ Endpoints , ~700 web servers

IT estate – 200 servers, one 30 TB database

Visibility – AV (No-EDR), SIEM with inconsistent log

Visibility – AV (No-EDR), SIEM with inconsistent log

coveragecoverage

Timeline

Timeline• Day 0 – collect data, preserve evidence, validate attack,• Day 0 – investigated suspicious activity, identified several

plan response• Day 1 – find and analyze entry vector and payload• Day 2-7 – Hunt threat actor: identify infected hosts andcommand and control mechanism; investigate attacker
identity

encrypted hosts, cut internet access, supported getting DR
environment running• Day 1 – Identified malware as BlackCat ransomware soldas a service on Russian dark web forums• Day 4 – attack surface mapping performed to minimise• Day 8 – plan containment, muster resources, execute planvulnerabilities that could be exploited in a DOS attack. 4• Day 9-15 – battle the attacker's attempts to persist

found plus a DOS protection workaround• Day 16-45 – deep forensic analysis to identify (and find)dormant attacker assets.

• Day 1-6 – verified that backups were not compromised
before uploading them to DR environment• Day 10 – Countercept XDR deployed as IT environment

Statistics – 223 hosts compromised, 17 command andbrought back up.

control IPs, 20 experts involved in 45-day engagement.
Outcome – accelerated security transformation, greater

Statistics – 250 hours of IR consultancy, forensic support

team cohesion.

and threat hunting.
Outcome – Ransom not paid. IT domain hardened, improved

3 https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/
Themen/Dienstleister_APT-Response-Liste.pdf?__blob=publicationFile&v=11
4 https://www.ncsc.gov.uk/section/products-services/
verify-suppliers?scheme=Cyber+Incident+Response+%28CIR%29

capability.Investigations indicated that no data exfiltration hadtaken place.

7

Who We Are
WithSecureTM, formerly F-Secure Business, is cyber security's reliable
partner. IT service providers, MSSPs and businesses – along with thelargest financial institutions, manufacturers, and thousands of theworld's most advanced communications and technology providers –trust us for outcome-based cyber security that protects and enables
their operations. Our AI-driven protection secures endpoints andcloud collaboration, and our intelligent detection and response arepowered by experts who identify business risks by proactively hunting
for threats and confronting live attacks. Our consultants partner withenterprises and tech challengers to build resilience through evidencebased security advice. With more than 30 years of experience in building
technology that meets business objectives, we've built our portfolio togrow with our partners through flexible commercial models.
WithSecureTM Corporation was founded in 1988, and is listed on NASDAQOMX Helsinki Ltd