Cyber Risk

Elite security leaders uniquely
positioned to deliver end-to-end
cyber risk solutions worldwide

Cyber Risk

Manage Cyber Risks Seamlessly
with Kroll
How do you manage cyber security when virtually every
area of your organization is digitally interconnected?
Today, beyond the risks associated with malicious insiders
and outsiders, cyber security must also be viewed throughthe lens of “unintended consequences.” From system
upgrades or a move to the cloud to applications meant toimprove the customer experience to integral third-party
relationships, one misstep can cascade into multiple threats,
like wire fraud, ransomware, data breaches, and more.
Kroll’s elite cyber security experts can help you withevery facet of cyber security. With years of public andprivate sector experience and law enforcement service,
our experts provide invaluable guidance at any point in
the cyber security continuum.
Kroll’s expertise managing thousands of cyber security
engagements worldwide, backed by the diverse backgroundsof our experts, helped build the framework for a defensible
cyber security strategy in five pillars. Strengthening thesepillars helps your company develop an effective narrative inthe event of an incident, including considerations such as:• “We have performed a threat-based assessment
focused on the type of data we store and transact.”• “We’ve taken reasonable measures to protect ourdata from the threats that are most prevalent to
our type of business.”• “If an attacker does infiltrate our network, theywould have to take extraordinary measures to
bypass our security.”
Kroll’s cyber experts can help you build processes,
training and contingencies, to develop, implement andenforce your strategy, and respond with speed andaccuracy when needed.

Kroll

FIVE PILLARS OF A DEFENSIBLE CYBERSECURITY STRATEGY
An attacker with enough time, commitment andresources will eventually get into any network.
The measure of a strong information security strategy,
then, is the ability of a company to rapidly detect
when an incident happens and effectively respondto it. Kroll’s unique ability to deliver end-to-end
cyber risk solutions helps develop and strengthena narrative for when (not if) an incident occurs andto prepare well in advance.
The five pillars consist of:Governance

Policies and Procedures

Infrastructure and Standards

People and Training

Relationships

2Cyber Risk

PROTECT. DETECT. RESPOND

Third-Party Cyber Risk
Incident Response Planning
Privacy / DPO Consultancy

Kroll Responder

VCISO &ADVISORY

Dark Web Monitoring
Cyber Threat Intelligence

MANAGED
DETECTION &RESPONSE
INCIDENTRESPONSEPENETRATIONTESTING
Digital Forensics
Crisis Communications

Risk and Privacy Assessments

Cyber Risk Retainer

Cloud Security Services
Ransomware Preparedness

Cyber Litigation Support

BREACHNOTIFICATION

Call Center ServicesCredit and ID Monitoring
ID Restoration and Consultation

Kroll3

Cyber Risk

KROLL AT WORK – SELECT CASE STUDIESIP Theft: Smart Car Startup
SCOPEISSUESWHAT KROLL DID• A smart car startup was being sued
for theft of intellectual property (IP)by the executive team’s previousemployers.

• Investigators needed to determine
which machines and custodians (ifany) had access to the IP in question.

• Forensically imaged 230 hard drives
beginning on a Friday night andending Sunday morning.

• Devices needed to be collected andanalyzed with minimal businessinterruption.

• Extracted from all devices andprocessed 10 TB of data into a
Relativity workspace that deduplicateddown to approximately 2 TB.

• Kroll investigators were engaged toforensically examine every device inthe organization.

• Structured analytics operations,such as email threading, andconceptual analytics indexes wereutilized to document clustering andconcept searching.

Unauthorized Access: Regional Healthcare U.S. Provider
SCOPE

ISSUES

WHAT KROLL DID• Provider noticed suspicious databasequeries made over four-six weeks andcontacted Kroll per insurancecompany’s guidance.

• Incident response team wasconcerned about not alerting theactor to avoid punitive action,such as ransomware.

• We deployed EDR within two hours
of engagement, to kickstart forensics.

• Cyber investigators were needed
to validate whether queries wereunauthorized, eject bad actors andeliminate any persistence.

• Needed to determine whether andhow much PII/PHI was exposed byexamining several mailboxes.

• Identified initial impacted populationof over four million (mn) records andreduced it to 2.4 mn thanks to addressvalidation procedures.

• Outside counsel needed a detailed
evaluation of the extent of thecompromise to assess HIPAA
and/or PIPEDA impact.

• Flagged corrupt activity and contained
the incident.

• Notified everyone affected within
three days, including state-specificletters in the U.S., Canada andbi-lingual call centers, delivering
ID and credit monitoring.
• Hardened configuration for Microsoft
Office 365 and additional cloud services.
• Client hired Kroll for ongoing virtual
CISO services.

Kroll4

Cyber Risk

Cyber Incident Leadership: Southeast Asia Regional BankSCOPEISSUESWHAT KROLL DID• The information security team of aSoutheast Asia Regional Bank noticed
large-scale unauthorized accessacross several sensitive systems,
which needed immediate response.

• The bank’s COO quickly recognizedthat the lack of leadership andexperience was responsible forthe poor performance.

• Provided oversight of the tworemaining vendors on the engagement
and led the investigation.

• Due to the scope of the issue, thebank hired four regional firms tohandle incident response, but little
was accomplished.

• They reached out to Kroll toamend the situation and manage
the investigation.

• Guided internal team on evidence
preservation and communicatedwith counsel.
• Delivered post-incident guidance andlocal support to harden bank’s systems• Provided SOC monitoring and training.

SWIFT Fraud: Middle Eastern BankSCOPEISSUES

WHAT KROLL DID• Over $10 million identified assuspicious SWIFT transactions.

• Kroll needed to review thousands ofSWIFT transaction logs and accessdetails in a limited timeframe.

• Took over monitoring of EDR
software across ~3K endpoints tohunt malicious behavior.

• Malicious scripts had been buried deep
within systems and could give attacker
means to deploy ransomware.

• Identified several command-andcontrol IPs and URLs, downloading
malicious tools across many servers
for over a year.

• With several critical servers andworkstations sabotaged despite EDR
software deployed, the bank needed
an incident response partner in thesame time zone that could identify
the root cause and remediate any
potential compromise.

• Removed automated rules on popped
exchange servers that blocked emails
containing “swift” and “case” keywords.
• Provided full remediation andrestoration of the bank’s systems.
• Client requested we continue toprovide managed detection andresponse support, yearly penetration
testing,red team exercises andphysical security assessments.

MAKE CONFIDENT SECURITY DECISIONS
We know what is at stake and provide critical security insight to help organizations strengthen their privacy and information
security programs. From incident response to risk assessments, and complex forensics to breach notification and litigation
support, Kroll’s cyber experts can help at every step on the way toward cyber resilience.

Kroll5

Many of our cyber• Federal Bureau of Investigation (FBI)professionals bring years• Interpolof unique experience fromtheir former service with

• U.S. Department of Justice (DOJ)

large enterprises as well

• Securities & Exchange Commission (SEC)

as law enforcement and• U.K. Intelligence and Policing

regulatory agencies:• U.S. Department of Homeland Security

CREST has accredited Kroll
as a global Penetration
Testing provider(DHS)• U.S. Secret Service (USSS)• U.S. Attorney’s Office
Kroll is certified as a Global
PCI Forensic Investigator(PFI) company

Kroll works on …

3200+

Kroll works with over…

68%

Cyber events per year for clients
ranging from Fortune 100 tomedium-sized businesses.

93%of theof theFortune 100

AM Law 100

Kroll recognized as a
Representative Vendor for
Digital Forensics and Incident
Response (DFIR) and Managed
Detection and Response (MDR)

Kroll has a dedicated insurance team for insurance and legal channels,
with extensive relationships with 60+ cyber insurance carriers and exclusive
benefits to insureds.

Kroll named a Global Leader inIncident Response Readiness

About Kroll
Kroll provides proprietary data, technology and insights to help our clients stay ahead of complex demands related to risk, governance and growth. Our solutions deliver
a powerful competitive advantage, enabling faster, smarter and more sustainable decisions. With 5,000 experts around the world, we create value and impact for ourclients and communities. To learn more, visit www.kroll.com.
M& A advisory, capital raising and secondary market advisory services in the United States are provided by Kroll Securities, LLC (member FINRA /SIPC). M& A advisory,
capital raising and secondary market advisory services in the United Kingdom are provided by Kroll Securities Ltd., which is authorized and regulated by the Financial
Conduct Authority (FCA). Valuation Advisory Services in India are provided by Kroll Advisory Private Limited (formerly, Duff & Phelps India Private Limited), under acategory 1 merchant banker license issued by the Securities and Exchange Board of India.
© 2022 Kroll, LLC. All rights reserved. KR202591_Y0522