In the security industry, we tend to emphasize prescriptions. We invest a lot of time talking about technologies, methodologies and practices that build a strong security posture and threat response capability.

What we don’t talk about much is people, as if the skills, motivation and commitment of those who plan, manage and — perhaps most important in my view — monitor, detect and respond to security events don’t much matter.

You might suppose the human factor in threat response and mitigation is just another commodity, such as office supplies or real estate. However, if you talk to chief information security officers, they will tell you at length about the challenges that come with trying to fill security jobs, developing people once they’re hired and retaining them. It goes beyond technical learning or industry certification. Instead, they’re looking for a proactive approach, a desire to collaborate with other teammates and a commitment to solving problems. These things can’t necessarily be taught.

My experience tells me that teams matter. When led correctly, they develop a collective personality characterized by confidence, mutual support and continuous learning.

For example, consider the way IBM’s Managed Security Services threat response team approaches its work by looking at how it handled the Waski virus last fall. Managers on the team became aware of an email directed at employees of an IBM client in the banking industry. The message, a typical spear-phishing email crafted to seem as though it came from a human resources executive, invited a reader to open a damaging attachment, a variant of W32/Waski malware. This was a Trojan horse software that silently downloads and installs other programs capable of damaging systems and harvesting a client’s critical data.

But rather than tell you more about this, let me show you a video we developed that’s a little different than our usual presentation. It’s a story that focuses on our team and its incredible response to the attempted breach of our clients. We’ve even supplemented it with a graphic novel about the event.

Our response to the Waski malware not only demonstrated the value of a major-league threat response team, but it showed how our recently introduced advanced cyberthreat intelligence service can get the right intelligence, alerts and response to clients. Our team’s wipeout of Waski served as a further proof point of IBM’s cybersecurity expertise and client value.

more from Malware

Raspberry Robin and Dridex: Two Birds of a Feather

IBM Security Managed Detection and Response (MDR) observations coupled with IBM Security X-Force malware research sheds additional light on the mysterious objectives of the operators behind the Raspberry Robin worm. Based on a comparative analysis between a downloaded Raspberry Robin DLL and a Dridex malware loader, the results show that they are similar in structure and functionality. Thus, IBM Security…

From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers

A comparative analysis performed by IBM Security X-Force uncovered evidence that suggests Bumblebee malware, which first appeared in the wild last year, was likely developed directly from source code associated with the Ramnit banking trojan. This newly discovered connection is particularly interesting as campaign activity has so far linked Bumblebee to affiliates of the threat group ITG23 (aka the Trickbot/Conti…