A year in the wild: fighting malware at the corporate level

Yelp as any large company has a problem with viruses, malware and organized phishing campaigns targeting our corporate network and our employees. We have assembled a set of tools and processes to stop the pests from infecting our network.From the mom...

Yelp as any large company has a problem with viruses, malware and organized phishing campaigns targeting our corporate network and our employees. We have assembled a set of tools and processes to stop the pests from infecting our network.From the moment of the threat detection, first response throughout the analysis, and the final resolution, we make sure that we can catch as many incidents as possible and properly sanitize the environment so that the potential problems are cut short. All this in an automated and orchestrated fashion, eliminating the manual repetition as much as possible thanks to the in-house built tools like AIR (Automated Incident Response), OSXCollector (Mac OS X forensics collection) and ElastAlert (alerting out of Elasticsearch). We also compliment the pipeline with some available open source tools, like osquery and other proprietary threat detection technologies. This adds up to a balanced ecosystem that helps us leverage the current assets, learn about the potential problems quickly and respond to them in a timely fashion.