2 ms·
I was the one who made the call to bring in CrowdStrike. It had zero to do with PCI/DSS or any other compliance obligation. It was to 1) bring in a team with de
by eastdakota 3y ago
I was the one who made the call to bring in CrowdStrike. It had zero to do with PCI/DSS or any other compliance obligation. It was to 1) bring in a team with deep experience with a broad set of breaches; and 2) to make sure our team didn’t miss anything. The CrowdStrike team were first class and it was good to confirm they didn’t find anything significant our team hadn’t already. And, for the sake of clarity, no system breached touched customer credit card or traffic information.
- deleted 3y ago[deleted]
- elitistphoenix 3y agoWas the self hosted environment running a AV like the Crowdstrike agent? Or was it running different AV and that's why you chose to use Crowdstrike as someone different? I guess no need to specific names. I'm just using that as examples.
- tptacek 3y agoWhat's an AV going to do about the fact that Okta got popped?
- de-moray 3y agoPerhaps the parent commenter was referring to the section in the report which stating the IOCs indicated that the attackers used the known third-party command and control system named Sliver. There are multiple public yara signatures for Sliver.
- tptacek 3y agoAhh, that makes sense. Thanks!