April 13, 2015 By Michael Sanders 2 min read

In the security industry, we tend to emphasize prescriptions. We invest a lot of time talking about technologies, methodologies and practices that build a strong security posture and threat response capability.

What we don’t talk about much is people, as if the skills, motivation and commitment of those who plan, manage and — perhaps most important in my view — monitor, detect and respond to security events don’t much matter.

You might suppose the human factor in threat response and mitigation is just another commodity, such as office supplies or real estate. However, if you talk to chief information security officers, they will tell you at length about the challenges that come with trying to fill security jobs, developing people once they’re hired and retaining them. It goes beyond technical learning or industry certification. Instead, they’re looking for a proactive approach, a desire to collaborate with other teammates and a commitment to solving problems. These things can’t necessarily be taught.

My experience tells me that teams matter. When led correctly, they develop a collective personality characterized by confidence, mutual support and continuous learning.

For example, consider the way IBM’s Managed Security Services threat response team approaches its work by looking at how it handled the Waski virus last fall. Managers on the team became aware of an email directed at employees of an IBM client in the banking industry. The message, a typical spear-phishing email crafted to seem as though it came from a human resources executive, invited a reader to open a damaging attachment, a variant of W32/Waski malware. This was a Trojan horse software that silently downloads and installs other programs capable of damaging systems and harvesting a client’s critical data.

But rather than tell you more about this, let me show you a video we developed that’s a little different than our usual presentation. It’s a story that focuses on our team and its incredible response to the attempted breach of our clients. We’ve even supplemented it with a graphic novel about the event.

Our response to the Waski malware not only demonstrated the value of a major-league threat response team, but it showed how our recently introduced advanced cyberthreat intelligence service can get the right intelligence, alerts and response to clients. Our team’s wipeout of Waski served as a further proof point of IBM’s cybersecurity expertise and client value.

More from Malware

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed ITG05…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today