MTS RED: Service for detecting traces of hacking companies

Main article: [IT outsourcing IT outsourcing|https://www.tadviser.ru/index.php/Статья: IT outsourcing IT outsourcing]

2023: Launch of a service to detect signs of successful hacker attacks

The company's Future Crew Innovation Center MTS RED on September 6, 2023 announced the launch of a service to detect signs of success hacker attacks at the company - both past and ongoing. As a result, customers will get a complete picture of the points of presence cybercriminals in the infrastructure and will be able to completely eliminate them.

Complex targeted attacks imply the longest and most inconspicuous presence of attackers in the company's IT infrastructure. It often takes several months from getting a point of presence to starting active hackers and detecting an attack, in some cases industrial espionage can go unnoticed for several years.

To detect the actions of intruders, a set of information security solutions is needed, as well as built-up incident monitoring processes, which have only a small proportion of Russian organizations. If the hack occurred before the start of monitoring information security events, it will be possible to identify the attack at best during the active phase of cybercriminals. At the same time, even after blocking the attack, the company may not know which systems have been compromised and whether they have software bookmarks or backdoors that will allow cybercriminals to repeat the attack.

The service for identifying traces of compromise helps to determine whether the company was hacked in the past, whether attackers left opportunities for re-entry into the infrastructure, as well as at an early stage to detect complex attacks that are currently underway. This will help reduce the risks that an attacker will achieve his goal - long-term espionage, theft of intellectual property and other confidential data of the company.

In addition, as part of the service, Future Crew specialists identify unsafe configurations of information systems that can help an attacker develop an attack, and other obvious inconsistencies in terms of cybersecurity policies. Based on the results of a comprehensive infrastructure audit, Future Crew specialists form a report containing a list of detected signs of compromise, suspicious events, their assessment by specialists, as well as recommendations for improving the level of cybersecurity.

In the course of projects to identify traces of compromise of companies, there are both previously unknown and unexplored cybersecurity incidents. Sometimes from past successful attacks there are only traces that cannot be detected by traditional means of protection. Therefore, we focus all experience in the fields of digital forensics and incident response in order to identify in the client's infrastructure what has so far gone unnoticed, - said Maxim Sukhanov, leading expert in the area of ​ ​ security analysis of the Future Crew innovation center of MTS RED.