What should we look for on our network after a partner or peer company is breached?
Look at every link with them, and at anything new. Start with the connections between you: shared VPN tunnels, remote-access accounts they use on your systems, file transfers, e-mail threads and shared cloud folders. Suspend or rotate those credentials until they confirm what was affected, and treat their e-mails asking for payment changes with care, because attackers reuse stolen mail threads. If their advisory or statement lists indicators of compromise, such as IP addresses, domains or file hashes, search your firewall, proxy and DNS logs for them going back several weeks. Then watch behaviour: hosts that suddenly reach new outside servers at regular intervals, scanning, unusual uploads. NetSenX flags those on every plan, and its network map shows who talks to whom on the segments it monitors.
Read next
Related questions
- We had an incident last year. How do we make sure we would detect it if it happened again?
- Why do companies so often learn about a breach from outsiders?
- How do we tell a network attack from a heavy update or backup?
- How do we know what normal looks like on our network?
- What is an indicator of compromise (IOC)?