Improving Business Visibility within Financial Services
Customer Challenge
A key component of a strong cyber security posture is strong visibility of a systems and tooling. Our customer, a Canadian Financial Services company approached us due its struggles to achieve this. The organisation had been using McAfee ePO for over 15 years, combined with a number of other disparate systems. The customer needed to consolidate its vendors, simplify operations, and extend application visibility and monitoring.
Due to its large client base and prominent public profile, the company required a lift-and shift approach with new asset inventory tools and processes.
Quorum Cyber Services
Quorum Cyber brought industry-leading expertise to the table, crafting a solution tailored to the unique demands of financial services:
- Deployment of Microsoft Defender for Endpoint: Addressing operational visibility and endpoint protection as part of a zero-trust security framework.
- Seamless Transition to Microsoft E5 Licensing: Reviewing and migrating over 300 use cases, ensuring uninterrupted functionality and compliance.
- Full-Service Support: Our team managed every step of the transition, including design, testing, and extensive documentation.
- Confidence Through Expertise: Our certifications and experience in the financial services sector provided the reassurance needed for executive buy-in.
Leveraging automation and robust security measures, we ensured rapid onboarding and operational continuity within just 90 days
Achieved Outcomes
The collaboration with Quorum Cyber empowered the customer to achieve key strategic outcomes:
- Enhanced Cybersecurity Visibility: Achieved through a fully integrated Microsoft security ecosystem.
- Operational Continuity: A seamless transition with no disruption to ongoing services.
- Streamlined Security Management: Consolidation of vendors and simplified operations.
- Accelerated Onboarding: Transition completed within an aggressive 90-day timeline.
- Proactive Resilience: Strengthened defense against risks like supply chain vulnerabilities and operational disruptions.
Conclusion
Quorum Cyber helped the company reduce operational overhead and costs while dealing with a tight project timeline. With our expertise, Quorum Cyber was able to design and deploy Microsoft Defender for Endpoint successfully with no business impact or loss of capability from existing solutions. The customer now has visibility into its entire environment, simplifying its security management.
To find out more about how we help our customers win, view more case studies here.
Need ongoing Microsoft Defender XDR support? Our Clarity managed services provide 24/7 alert detection, response, and platform management to maximize your Microsoft Security technologies.
Global Technology Firm Transforms Security with Quorum Cyber
Customer Challenge
Our customer is a global technology company that specialises in providing innovative solutions for the financial services sector. With a geographically diverse workforce and varied user personas, securing endpoints was a growing concern. Despite having Microsoft E5 licensing, the organisation struggled to fully leverage its capabilities, resulting in operational inefficiencies and increased exposure to cyber threats.
The fragmented security environment led to alert fatigue, overwhelming their security team with a high volume of alerts that obscured actionable threats. Additionally, limited visibility into their endpoint security posture created a gap in their ability to respond proactively, putting sensitive data and business operations at risk.
Quorum Cyber Services
Quorum Cyber collaborated closely with the customer to address these critical challenges by delivering a tailored security strategy that aligned with their operational goals:
- Comprehensive Analysis: Our experts evaluated the company’s technical and business requirements to design a strategy that maximised the value of its Microsoft E5 licensing.
- Custom Implementation: Leveraging Microsoft Defender for Endpoint, we provided a seamless installation, configuration, and integration process to ensure enterprise-wide protection. Rigorous quality assurance testing validated the solution's effectiveness within their environment.
- Knowledge Transfer and Enablement: Virtual workshops equipped the customer’s team with the skills to manage potential risks, optimise operations, and respond to threats effectively.
"Quorum Cyber’s hands-on guidance transformed our existing security measures. From the initial analysis to the seamless deployment of Defender for Endpoint, their expertise was evident every step of the way. The training and knowledge transfer workshops were pivotal for our team. Our analysts have been better able to effectively manage potential risks and respond to alerts since working with Quorum Cyber."
CISO, Global Technology Firm
Achieved Outcomes
The partnership resulted in measurable and transformative results:
- Enhanced Visibility: Centralised monitoring across all endpoints reduced blind spots, empowering proactive risk management.
- Reduced Alert Fatigue: Intelligent filtering and prioritisation of alerts improved efficiency and focus for the security team.
- Optimised Resource Utilisation: By unlocking the full potential of Microsoft E5, the organisation streamlined its security processes.
- Audit Compliance: Robust reporting and improved visibility ensured alignment with regulatory requirements.
Why This Matters
For global organisations handling sensitive financial data, fragmented systems and inefficiencies can escalate risk. Quorum Cyber's expertise in integrating Microsoft technologies enabled this customer to bridge the gap between investment and implementation, creating a resilient security posture.
Conclusion
By implementing Quorum Cyber's Defender for Endpoint Professional Security Services and fully leveraging its existing Microsoft E5 investment, the customer achieved a remarkable transformation of its cyber security strategy.
The comprehensive solution provided the necessary visibility to efficiently identify risks and respond across all user personas. The approach bridged the gap between investment and implementation, ensuring a proactive, holistic endpoint security strategy. Integrating Quorum Cyber’s expertise with the untapped E5 potential, the customer established a robust cyber security foundation aligned with its goals. This amalgamation empowered the organisation to mitigate risks, proactively respond to emerging threats, and maximise its Microsoft Security ROI.
To find out more about how we help our customers win, view more case studies here.
Strengthening Operational Technology Security in the Healthcare Sector
Customer Challenge
In the healthcare sector, operational technology (OT) environments are critical for ensuring seamless production and service delivery. A leading pharmaceutical organization in North America, undergoing rapid expansion, faced growing cybersecurity challenges. The organization’s reliance on bespoke security tools, coupled with limited visibility into its OT infrastructure, left it vulnerable to escalating cyber threats.
With a lean in-house security team, the organization struggled to efficiently monitor and respond to threats, compounding the complexities of managing a growing attack surface. Although it had invested in Microsoft Security E5 licenses, the organization lacked the expertise to maximize their potential, necessitating a trusted partner to enhance its security posture.
Quorum Cyber Services
Quorum Cyber partnered with the pharmaceutical organization to implement a robust, layered security strategy tailored to its unique needs. Our approach combined technical expertise with a deep understanding of operational requirements to deliver tangible results:
- Deployment of Microsoft Defender for IoT: Enhancing OT/ICS asset visibility at a key facility, ensuring comprehensive monitoring and classification.
- Maximizing Microsoft Security Investments: Leveraging Microsoft Defender for Endpoint to establish a foundational security layer, streamlining operations and bolstering defenses.
- Asset Classification and Risk Assessment: Conducting a High Consequence Event Assessment to prioritize critical assets and improve risk management strategies.
- Seamless Integration: Ensuring minimal disruption to OT processes through careful planning and execution.
Achieved Outcomes
The collaboration with Quorum Cyber resulted in key strategic wins for the customer:
- Improved Visibility: Gained enterprise-wide insight into OT assets and operations.
- Streamlined Security Operations: Simplified processes, reducing reliance on fragmented tools.
- Enhanced Security Posture: Strengthened OT defenses with a focus on proactive threat management.
- Optimized Resource Utilization: Enabled the in-house security team to focus on high-priority tasks, improving efficiency and response times.
Why This Matters
As the healthcare sector becomes an increasingly attractive target for cyberattacks, achieving operational visibility and efficiency is vital for resilience. The pharmaceutical organization’s journey exemplifies how strategic use of Microsoft Security tools, guided by Quorum Cyber’s expertise, can transform security operations without disrupting critical processes.
Transforming Security, Together
Quorum Cyber’s approach not only addressed immediate challenges but also laid the groundwork for sustained security maturity. By leveraging existing investments and delivering tailored solutions, we empowered the customer to navigate a complex threat landscape with confidence.
“Our work with Quorum Cyber is part of an ongoing effort to maintain operational safety and resilience, including the reduction of cybersecurity risks. The team helped us understand the security of our OT environments without disrupting our daily operations."
Principal IT Security Engineer
Discover how Quorum Cyber can enhance your organisation’s cybersecurity posture while ensuring operational continuity, contact us today.
US University Navigates Data Recovery Challenges
Data encryption at exam finals time
A leading university faced a critical situation when its ESXi servers and virtual machines were encrypted by a cyber-attack. This incident coincided with a particularly challenging period, as it occurred during exam finals and the holiday season. Many students were using loaned devices and were off-campus, complicating communication and coordination efforts. The university decided against purchasing a ransomware decryptor, necessitating an alternative recovery strategy. Additional challenges included the university staff's unfamiliarity with their IT environment and a lack of trust between domain controllers, further complicating recovery efforts.
Planning and implementing recovery strategy
To address these challenges, the university implemented a comprehensive recovery strategy which involved the support of Quorum Cyber. The university’s strategy comprised:
- Infrastructure Rebuild: The university rebuilt its ESX hosts using backups stored on Amazon Web Service (AWS), ensuring that critical infrastructure components were restored
- Expert Recovery Teams: Quorum Cyber’s team restored the university's environment to enhance recovery efforts and ensure a thorough and efficient process
- Security Software Deployment: Enhanced endpoint security and monitoring capabilities were deployed across the university's network.
An outstanding recovery
Through these targeted efforts, the university was able to achieve significant recovery milestones:
- Infrastructure Restoration: The rebuilding of ESX hosts from AWS backups allowed the university to regain control over its IT infrastructure, restoring essential services and systems.
- Collaborative Recovery Effort: The involvement of expert recovery teams facilitated a coordinated and effective response, demonstrating the importance of collaboration in crisis situations.
- Enhanced Security Posture: Improved the university's security posture, providing greater protection against future threats.
The university's swift and strategic response to the cyber-attack enabled the institution to overcome significant challenges during a critical time. By leveraging expert resources and prioritising infrastructure restoration, the university successfully navigated the recovery process, underscoring its commitment to resilience and the protection of its academic community.
Contact us if you would like to strengthen your organisation's cyber security or cyber resilience.
Enhancing Security for a US Utilities Company
The looming threat of a ransomware attack
A utilities company in the US faced a significant cyber security threat and the looming risk of a LockBit ransomware attack. With over 350 hosts potentially at risk and compromised domain controllers, the company needed an urgent and effective response to secure its network and protect its operations.
Activating a defence strategy
To address these challenges, the company brought in Quorum Cyber and implemented a multi-faceted security strategy:
- Device Isolation: Impacted devices were immediately isolated to prevent further spread and minimise the impact on critical systems
- Proactive Threat Hunting: The company conducted proactive threat hunting to identify potential vulnerabilities and threats before they could escalate
- Falcon Platform Utilisation: Endpoint detection and response (EDR) was deployed to identify and prioritise vulnerable hosts, enabling targeted remediation and strengthening overall security posture.
Positive outcomes and a long-term manged services contract
The comprehensive security measures led to several positive outcomes:
- Network Security Enhancement: The company successfully secured its entire network, mitigating the immediate threat and bolstering defenses against future attacks.
- Collaborative Remediation: Quorum Cyber’s close collaboration with the business ensured that compromised systems were remediated efficiently and returned to full operational status.
- Long-Term Partnership: Impressed by the effective response and improved security, the utility firm signed up for a long-term engagement with Kivu, demonstrating confidence in the company's ability to provide ongoing protection and support.
Through strategic action and collaboration, the utility company overcame the immediate cyber security threat and also established a robust security framework that supports its long-term operational integrity.
Contact us if you need help to strengthen your company's cyber security.
Managing Multiple Stakeholders During Ransomware Response
Introduction
The network of a small, privately held provider of heating, ventilation and air conditioning (HVAC) services was infected with Ryuk ransomware, leaving the company unable to run backend sales processes such as quoting and billing. Quorum Cyber was called in to clear the malware from all affected devices and restore their systems.
The challenge
The customer’s entire IT environment was managed by a regional managed service provider (MSP), which was found to be running legacy systems on the customer’s servers, including Windows 2003. In addition, the only risk management measures in place were a firewall and basic anti-virus software. Ten months prior to the incident, two banking trojans, Emotet and Trickbot, had been installed on the system via a phishing email. These enabled the attackers to subsequently install the Ryuk ransomware variant in late January 2020.
The MSP detected the ransomware attack and notified the company, which then contacted their insurer. By the time Quorum Cyber became involved, 12 servers were encrypted and 58 workstations were infected with either banking trojans or ransomware. This represented about 75% of the customer’s total endpoints, and left them unable to perform crucial financial transactions. No customer data was accessed or stolen.
Quorum Cyber’s response and solution
The majority of Quorum Cyber’s work was conducted remotely, linking to the customer’s onsite data centre via secure online connections. Quorum Cyber coordinated communication between the customer and the MSP, which struggled to provide system information and backups due to insufficient technical expertise. During the engagement:
- Quorum Cyber sent two incident response (IR) analysts for the initial IR phase, followed by five PBR responders for the remediation phase
- The IR team ran forensic imaging, collected evidence, and deployed KECT and endpoint detection and response (EDR) software
- The PBR team reimaged and decrypted the servers and workstations, ultimately deploying the backups to restore the company’s systems.
Outcome
Despite the incurred costs, the overall business interruption was significantly reduced by Quorum Cyber’s quick IR and remediation work paired with EDR deployment. In summary:
- No ransom had to be paid, as Quorum Cyber restored systems from backups
- EDR was installed and ran for a month to prevent secondary attacks
- Fifty-eight workstations were restored within four days over the weekend and were back online and fully operational by close of business on Monday
- The period of loss caused by business interruption was reduced by three weeks.
Preparing a US Utility Company for Ransomware Attacks
Introduction
The rampant increase in ransomware attacks has put critical-infrastructure providers on notice. A $10 billion electric utility, which provides electric power production, transmission and retail distribution operations to the south-eastern US, decided it wouldn’t wait until it was victimised. It invested in a prescriptive programme to strengthen its cyber readiness and resilience.
The challenge
With the well-publicised attack against Colonial Pipeline in May 2021 fresh in their minds, the utility’s Board of Directors was becoming increasingly concerned about how prepared their company was to identify and effectively respond to such an attack, and mitigate its potential impact. Incident response (IR) plans were in place at both a technical and executive level, and the company had an IR retainer with a well-known digital forensics and incident response (DFIR) firm.
However, the Board wasn’t confident that those plans or the DFIR partner were adequately prepared to address the unique nature of a ransomware attack. The Security Incident Response Committee turned to Quorum Cyber to understand how to best analyse the nuances of ransomware attacks, evaluate how well their IR plans were positioned for identifying and responding to an event, and determine if there were additional areas of improvement that could help limit the impact of an attack when it happened.
Quorum Cyber’s response and solution
To fully evaluate the effectiveness of the utility’s IR plans and ability to respond to a ransomware event, Quorum Cyber proposed a two-phased approach comprising:
- An IR Plan Assessment
- A technical and executive-level Ransomware Tabletop sessions.
In the first phase, Quorum Cyber evaluated the customer’s technical and executive IR plans against NIST 800-61, with a specific view toward use of incident-handling best practices related to ransomware.
In the second phase, Quorum Cyber collaborated with multiple individuals from across the organisation to develop a customised and environment-plausible ransomware attack scenario for field-testing during the two tabletop exercises. By leveraging this two-phased approach, Quorum Cyber was able to evaluate the efficacy of the company’s procedures as well as IR personnel’s knowledge and ability to respond to a realistic ransomware attack.
Outcome
By gaining insight into how well-positioned its people and procedures were to effectively respond to a ransomware event, the utility:
- Increased Board of Directors’ confidence in limiting the operational and financial impact of a ransomware event
- Prepared the executive team for evaluating the pay/ no-pay decision in a ransomware event, to limit financial exposure
- Enabled re-prioritisation of cyber investments to yield greater return on investment (ROI) in ransomware protection.
Outmanoeuvring Persistent Threat Actors in the Chemical Industry
Introduction
A small US-based chemical manufacturer with a supply chain comprising 50+ household names in chemicals was hit with a creative new twist on the HAFNIUM threat targeting Microsoft Exchange Servers. This new threat, coined ProxyShell, opened companies’ on-premise email to a new present danger. Acquired by Quorum Cyber in 2024, Kivu’s 24x7 cyber security monitoring service flagged ProxyShell and dispatched it. Within 48 hours, Kivu and the chemical company worked to remediate and evolve the stance against this attack surface and future attacks.
The challenge
HAFNIUM is a Chinese state-sponsored threat intent on information theft and espionage. Following HAFNIUM techniques that utilised mutability and suitability ProxyShell, was discovered by security researcher Orange Tsai, who showed it in detail at a security conference in August 2021. The researcher found that by chaining together three different vulnerabilities, threat actors could establish a web-shell-based backdoor access into a company’s email server. The actor could then perform unauthenticated, remote-code execution – or potentially gain the “keys to the castle” – to release emails, exfiltrate data and then move on to owning the whole company network from the inside out.
Kivu’s response and solution
Alerted to the true nature of the threat (vs. known bad actors) by the monitoring service, Kivu’s team acted immediately. By conducting analysis of log and server files, the team identified the new indicators of compromise (IOCs) associated with ProxyShell activity. Kivu isolated the problem in a safe form separate from the company’s operational systems (but still connected to Kivu), preventing further spread.
Kivu then worked with the company’s two-person IT department, following Microsoft plus industry guidance to rebuild the mail server into a hardened, refined form. Kivu consultants consolidated techniques used in this ProxyShell attempt, as well as input from Microsoft and future recommendations, into a shared threat intel and reporting platform, ensuring the knowledge was shared quickly internally and then to other Kivu clients that may have been affected or about to be attacked. Much of this work was undertaken in 48 hours over the weekend.
Kivu used this threat profiling against all of its customers, identifying those with “on-premise” Exchange mail servers, alerting nine others at risk, stopping ProxyShell attempts from further exploit, and assisting Kivu’s digital forensics and incident response efforts at large.
Outcome
Because it had Kivu’s Cyber-as-a-Service 24x7 threat monitoring in place, the company:
- Rapidly identified a brand new risk (under two days old) and remedied the situation
- Prevented hijacking and man-in-the-middle attacks risks, which could have led to fraud
- Avoided business downtime and maintained its 99% service level agreement (SLA).
Strengthening Security for a Managed Cloud Service Provider
Hit by a ransomware attack
A Canadian managed cloud service provider faced a severe security breach when a ransomware attack infiltrated their systems. The attack was initiated through a vulnerability in a business partner’s customer system, leading to the encryption of all data managed by the provider. Having recently acquired new infrastructure, the provider was operating with limited tooling and lacked a log retention strategy, complicating its ability to respond effectively to the breach.
Identifying and mitigating the threats
To counter the ransomware attack, the provider worked with Kivu, a part of Quorum Cyber, to rapidly deploy endpoint detection and response (EDR) solutions to identify and mitigate the threat. Additionally, Kivu was engaged in negotiations and facilitated payment, enabling the successful decryption of the compromised data. Subsequently, Kivu, a Quorum Cyber company, conducted a thorough forensic analysis to identify the initial point of compromise, known as "patient zero."
Recovering with stronger security
The interventions led to several significant outcomes:
- Enhanced Security Monitoring: The provider established 24/7 Managed Detection & Response (MDR) coverage, ensuring continuous monitoring and rapid threat detection.
- Operational Restoration: All operations were successfully restored, allowing the provider to resume normal business activities without further disruptions.
- Legal Support: A critical forensic timeline was developed to aid the provider in its legal proceedings, offering detailed insights into the breach.
- Infrastructure Security Reinforcement: The Canadian company reconstructed its infrastructure with a strong emphasis on security defence principles, reducing vulnerabilities and strengthening its overall security posture.
By swiftly addressing the ransomware attack and implementing robust security measures, the managed cloud service provider restored its operations and also fortified its defences against future threats, ensuring the integrity and reliability of its cloud services.
Get in touch if you would like to talk through any of your cyber security needs.
Market-leading company invests in long-term cyber security partnership
Cyber security is a huge challenge for all organisations, with a greater number of threats and more sophisticated cyber-attacks happening now, more than ever before. As such, organisations need to be on guard to protect their IT systems, data, business and reputation from harm at all times. To meet this increased demand, managed cyber security services have evolved in the last few years.
Prior to becoming a Quorum Cyber customer, and before the digital world became more inhospitable and unpredictable, a well-known organisation in the UK used an external provider’s third-party legacy system information and event management (SIEM) service that only ran from 9am to 5pm, Monday to Friday. It was designed, very optimistically, around the assumption that cybercriminals only worked during these hours and didn’t attempt to breach systems in the evenings or at weekends.
Unsurprisingly, the organisation decided to upgrade its defences. They wanted to transform to a modern SIEM, monitor the latest signals and adopt an identity-centric approach. After reviewing their options, they chose a Microsoft strategy because it was holistically integrated and connected, which could provide efficiencies for their small team. This strategy was centred around bringing in technologies that were commonly understood by IT professionals, making it easier to recruit talented people, instead of searching for people with niche and rare skills.
The best cultural fit
Choosing Quorum Cyber, a Microsoft Solutions Partner for Security, and its Managed Detection and Response (MDR) service in a multi-year contract, was straightforward for this customer. They liked the cyber security company’s modern principles and culture, which is set top-down from CEO Federico Charosky, and especially liked its mantra and vision: “We fight bullies”.
Many other benefits stood out too. Quorum Cyber monitors the whole IT estate 24x7, 365 days a year, with a UK-based team. Its investment in the future workforce, by hiring graduate talent to help fill the enormous skills gap in the sector, resonated with the customer as they had realised that experienced professionals were in hot demand. It was becoming increasingly expensive, and more difficult, to recruit, train and retain them.
“This has become a proven model over the last two years – seeing internal recruitment and promotion within Quorum Cyber has led us to maintaining relationships and continuity throughout our journey,” the customer commented.
Stronger in a cyber security community
A broader appeal in favour of working with Quorum Cyber was the community thinking proposition. “I never feel like we’re a customer, it’s a true partnership approach. Furthermore, they have top-notch people in incident response and ex-Microsoft employees to add to the value we get from them. It’s more than ‘just’ a Managed Detection and Response service, or only a consultancy – we never feel alone.”
The partnership between the customer and Quorum Cyber has deepened over time. “We have taken a risk-based approach and have worked together to increase our cyber security maturity – detection is now our highest maturity on the NIST framework. People in our organisation can sleep better at night.”
The organisation trusts Quorum Cyber to act on its behalf if they experience a cyber-attack in the dead of night. Automation and Delegated Authority is in place to take containment action quickly. This is very important now that cybercriminal dwell times have reduced so significantly in recent years.
This partnership also gives the organisation’s security team opportunities to meet more like-minded people and customers who face similar challenges while trying to protect themselves. In an age where security professionals can often feel alone and isolated, Quorum Cyber believes that it’s really important to create a cyber security community so that people can share lessons, ideas and successes with each other as the industry evolves over time.
