Casebook provides insights into attack methodologies and techniques from various adversary groups; offers compelling incident response situational analysis and best practices

Sunnyvale, CA — December 11, 2018 — CrowdStrike® Inc., the leader in cloud-delivered endpoint protection, today announced the release of the 2018 CrowdStrike Services Cyber Intrusion Casebook, which provides valuable takeaways and insights into the frontlines of incident response (IR) cases spanning 2018. It offers recommendations for organizations looking to safeguard critical data and improve overall breach preparedness, detection and response capabilities.

The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 notable cyber intrusion cases, spanning a multitude of industries, that CrowdStrike Services engaged on during the past year.

The Casebook provides a detailed look at distinct IR use cases to offer trends in adversary behavior, motivation, and tactics, as well as response scenarios. It provides an all-encompassing investigative analysis of specific cases, dives into forensic artifacts uncovered in multiple instances referencing the MITRE ATT&CK™ framework, and offers best practices for organizations looking to improve cyber defenses.

Some key findings include:

• Organizations are not making substantive progress to detect intruders and stop breaches overall. This year, 75 percent of the organizations CrowdStrike engaged with were able to internally detect a breach. This represents merely a 7 percent increase over the prior year’s findings, indicating that organizations have only slightly improved their ability to detect breaches. Dwell time also remained relatively the same at an average of 85 days compared to 86 in 2017. This statistic reflects the number of days between the first evidence of a compromise and its initial detection.
• Commodity malware was often observed as a precursor to larger, more disruptive attacks. An organization’s susceptibility to commodity malware is also an indicator of the effectiveness of their entire security strategy: If their systems can be compromised with commodity malware, then what could a more sophisticated attacker do?
• There was a dramatic rise in the number of attacks that leveraged social engineering and phishing. Across the IR cases observed, the CrowdStrike team observed a dramatic increase in the number of attacks leveraging social engineering, phishing and spear-phishing, jumping from 11 percent in 2017 to 33 percent in 2018. This accounted for one-third of all attacks investigated by CrowdStrike Services. Web server attacks comprised the biggest single attack vector, but showed a decline from the 37 percent noted last year to 7 percent.

“Cyber-related attacks continue to proliferate as eCrime actors and nation-states ramp up their sophistication. It’s absolutely critical that today’s businesses are aware of emerging attack trends and adversary motivations in order to implement a more proactive stance to cybersecurity,” said Shawn Henry, chief security officer and president of CrowdStrike Services. “It is not a question of if you will be targeted, because it will happen to everyone. This is a business risk, and Boards of Directors and the C-Suite need to have a sense of urgency to protect their organizations’ viability. The CrowdStrike Services Casebook contains indispensable content that provides valuable insights into proactively preparing for security incidents and responding efficiently in the wake of an attack.”

The 2018 Casebook offers guidance on remaining protected against today’s ever-evolving threat landscape, including integrating next-generation endpoint security and proactive strategies to increase cyber resiliency. Tools such as machine learning and behavioral analytics help prevent exploits and never-before-seen threats, while proactive threat hunting can help uncover even the most stealthy adversary. Additionally, solutions that provide for efficient remediation capabilities can aid in mitigating the threat before a small infection or compromise turns into something larger and more costly to the organization.

About CrowdStrike®

CrowdStrike is the leader in cloud-delivered endpoint protection. Leveraging artificial intelligence (AI), the CrowdStrike Falcon® platform offers instant visibility and protection across the enterprise and prevents attacks on endpoints on or off the network. CrowdStrike Falcon® deploys in minutes to deliver actionable intelligence and real-time protection from Day One. It seamlessly unifies next-generation AV with best-in-class endpoint detection and response, backed by 24/7 managed hunting. Its cloud infrastructure and single-agent architecture take away complexity and add scalability, manageability, and speed.

CrowdStrike Falcon® protects customers against all cyber attack types, using sophisticated signatureless AI and Indicator-of-Attack (IOA) based threat prevention to stop known and unknown threats in real time. Powered by the CrowdStrike Threat Graph™, Falcon instantly correlates 1 trillion security events a week from across the globe to immediately prevent and detect threats.

There’s much more to the story of how Falcon has redefined endpoint protection but there’s only one thing to remember about CrowdStrike: We stop breaches.

You can gain full access to Falcon Prevent™ by starting your free trial.

Learn more: https://www.crowdstrike.com/

Follow us: Blog | Twitter

© 2018 CrowdStrike, Inc. All rights reserved. CrowdStrike®, CrowdStrike Falcon®, CrowdStrike Threat Graph™, CrowdStrike Falcon® Prevent™, Falcon Prevent™, CrowdStrike Falcon® Insight™, Falcon Insight™, CrowdStrike Falcon® Discover™, Falcon Discover™, CrowdStrike Falcon® Intelligence™, Falcon Intelligence™, CrowdStrike Falcon® DNS™, Falcon DNS™, CrowdStrike Falcon® OverWatch™, Falcon OverWatch™, CrowdStrike Falcon® Spotlight™ and Falcon Spotlight™ are among the trademarks of CrowdStrike, Inc. Other brands may be third-party trademarks.

Contacts

CrowdStrike, Inc.
Ilina Cashiola, 202-340-0517
Ilina.cashiola@crowdstrike.com

Required Disclaimer:

Gartner Peer Insights Customers’ Choice distinctions are determined by the subjective opinions of individual end-user customers based on their own experiences, the number of published reviews on Gartner Peer Insights, and overall ratings for a given vendor in the market, as further described here, and are not intended in any way to represent the views of Gartner or its affiliates.