Evernote, a popular app for note taking and archiving, reported that they had a security incident.  As a part of their incident response and operational security monitoring, their staff noted that the compromise had occured and that the attackers were actively attempting to access secured areas of their system.  While they did not have evidence of sensitive data being compromised, user profile data (passwords, email addresses and similar) has likely been.  In response, they are forcing all user credentials to be changed.

From an incident response point of view, I will have to commend Evernote for how they are handling the situation. 

It appears that their security operations was able to detect the incident in a reasonable period of time (within a day).  In addition, their communications/PR arm responded with good initial recommendations in the news article.  And while there is not much technical information yet, they were able to limit some of the questions about how they stored passwords (one way hash with salting).  It is my guess that Evernote has been preparing for the eventuality that a security breach would occur, and prepared all of the appropriate parties to respond.

Protect, Detect, Respond, Recover.  Remember to not just focus on one or two of these within the continuum.

And if you use Evernote, change your credentials soon to limit your personal exposure.

--

Scott Fendley ISC Handler