Cynet Takes Cyber Threat Protection Automation to the Next Level with Incident Engine

I see this gap manifesting in two ways. First, companies that
want to hire cybersecurity talent simply cannot find candidates
with sufficient skills. Second, companies that cannot afford
specialized cybersecurity talent and therefore lack the necessary
skills to adequately protect their organizations from the growing
and increasingly sophisticated cyber threats.

Both of these are real problems, and both can lead to
devastating consequences. It’s also fair to say that most
cybersecurity teams today are overworked and understaffed.

One of the primary reasons we need such high-level cybersecurity
skills lies in the shortcomings of cybersecurity technologies. Due
to the changing and increasingly sophisticated stream of attack
techniques, the breadth and depth of cybersecurity defensive
technologies used to combat these threats and protect organizations
against breaches have exploded. Today, there seems to be a
specialized tool to cover every part of the attack surface and
response process.

Unfortunately, all but the largest organizations with the
deepest pockets can afford to acquire and then adequately integrate
and maintain the expansive set of technologies required to protect
modern-day organizations from breaches. Most smaller companies
suffer from a lack of technologies to protect their
organizations.

We are in dire need of approaches that simplify and consolidate
the cybersecurity toolset so that companies can afford the coverage
required and to make effective breach protection accessible to
those other than world-class experts.

Enter Cynet

One company that seems to get the need for simplification, without
sacrificing the effectiveness, is Cynet. Cynet was formed specifically to
consolidate multiple threat prevention and detection controls into
a single offering for two primary reasons. First, keeping all the
controls on a single platform allows for far better results than
integrating and managing technologies from multiple providers.

Second, it dramatically simplifies the technology stack (not to
mention affordability improvements). Then, Cynet goes beyond these
benefits by automating many of the common workflows required to
respond to cyber threats that would otherwise require high-level
skills, time, and effort.

Product Review: Cynet 360, 2020 Fall Platform Update

The Cynet 360 platform is built on three pillars; Extended
Detection and Response (XDR), Response Automation, and Managed
Detection and Response (MDR). These three components together
provide what Cynet calls Autonomous Breach Protection – essentially
breach protection on auto-pilot. Let’s look at each of these
components.

XDR

While XDR is considered a new technology – it’s something Cynet has
been doing since its inception. XDR technology essentially combines
signals from multiple control points as part of a single platform
to provide better results than when deploying multiple siloed
controls and then trying to figure out the stream of alerts and
data from each. Many analyst firms are touting XDR as “the next big
thing in cybersecurity.”

The Cynet XDR (learn more about it here^[2]) combines prevention,
detection, and data from:

• Endpoint Protection – Next-Generation Antivirus (NGAV) for
  basic endpoint malware prevention and detection and Endpoint
  Detection and Response (EDR) for more advanced endpoint protection,
  detection, and response,
• Network Traffic Analysis (NTA) for identifying malicious
  activity on your network,
• Entity and User Behavior Monitoring (EUBA) to detect anomalous
  user behaviors,
• Deception technology to trick successful intruders into
  exposing their presence before damage can be done.

Response Automation

Cynet automates many tasks associated with threat detection
response and cross-environment remediation, including infected
hosts, compromised user accounts, malicious processes, and
attacker-controlled network traffic.

The New Cynet Incident Engine

Cynet’s new Incident Engine can immediately improve cybersecurity
operations for any company and help full the cybersecurity skills
gap.

Many solutions can detect threats and then automatically prevent
them from executing and causing damage. This is wonderful and
helpful, but only represents the first step in addressing a threat.
We must assume that the threat discovered is likely only the tip of
the iceberg and is likely only a piece of a larger, coordinated
attack. This is where the cybersecurity skill gap becomes
dangerous.

The Cynet Incident Engine triggers an automated investigation
following certain high-risk alerts, fully disclosing its root cause
and scope, and applying all the required remediation activities.
This is offered on a single platform, out of the box, ready to
bring your cybersecurity to the next level on day one. This, my
friends, is the most amazing and useful cybersecurity breakthrough
I’ve seen in some time.

How it Works

On certain high-risk alerts, customers can click the Incident View
button:

As shown in the screenshot below, a simple workflow diagram
shows the series of investigation queries and results (blue) that
lead to findings (red) that are addressed with remediation (green).
The Timeline on the right shows a more detailed description of
every step, while the Incident Artifacts display the attack flow.
The full incident is summarized in the upper text boxes.

In the following example, we see an Unauthorized Memory Access
Attempt alert that was triggered by an attempt to dump credentials
– a common attack scenario. The initial alert indicates that Cynet
neutralized the attempt and that the credentials were not accessed.
The Incident Engine then does its thing – it isolates the
compromised host against from which the attack was launched and
revealed a lateral movement. It turns out that the attack was
actually launched remotely from another host in the environment,
which is the true root cause. This finding is concluded by
isolating the root cause host as well.

This off-the-shelf automated root cause analysis, impact
investigation, and remediation actions took Cynet’s platform just
under seven minutes to fully perform, all in the background, saving
literally hours of analyst effort. Or, it performed a series of
tasks to find and remediate threats that some organizations would
not have known were necessary or how to do them.

MDR – CyOps

Cynet calls their MDR team of cybersecurity experts CyOps. I find
it amazing that Cynet includes 24×7 monitoring for all clients to
ensure any real attacks are not overlooked. They also provide
ad-hoc threat investigations and forensic analysis and guide their
clients through any necessary remediation steps. CyOps is
automatically included in the Cynet platform – at no additional
cost.

This type of service is typically quite expensive and oftentimes
only available from third-party providers. With CyOps intimate
understanding of the Cynet platform, they can provide far superior
service than MDR teams that some vendors contract with to support
their platform. Learn more about CyOps here^[3].

Summary

The fully automated Incident Engine, coupled with Cynet’s full
Extended Detection and Response (XDR) platform and included Managed
Detection and Response (MDR) service, provides quite a cyber
protection package for any organization.

Many companies continue to rely solely on EDR or a combination
of EDR and NGAV to protect the organization from cyberattacks and
breaches. Alternatively, Cynet’s solution provides a complete
prevention and detection capability along with fully automated
response actions and a full 24×7 MDR service to boot. If I were
suffering from a lack of cybersecurity resources, as most companies
are, my first call to improve my situation would be to Cynet.

Sign up for a Free Trial of Cynet 360^[4]
here.

^[1]