ThreatConnect expands its threat intelligence analysis workbench

To continue to help organizations streamline threat intelligence, operations, and incident response, ThreatConnect announces improved functionality and features to ease security operations process automation and integration.

Improved features and functionality include:

• Updated Search: With the new Search feature, users are able to find information and intelligence faster. Results now provide clearer and more relevant information, including Observations and False Positive reports. Files and documents are also parsed and the results sorted using ThreatConnect’s proprietary ThreatAssess algorithm, which allows analysts to uncover the malicious indicators.
• NEW Graph View: From the graph view, users can pivot to find additional relationships and view in-depth information without losing context on their investigation. The Graph View is available in ThreatConnect for every Indicator, Group, and Tag in the Platform. With Graph View, users now have a range of options to understand relationships in-depth and build out their investigations for faster understanding of threats.
• NEW Notifications Center: The Notifications Center helps analysts stay on top of critical updates to their intelligence. Users have control over what they’re notified about and how often, and have multiple notifications options: an in-app alert, an immediate email, or a digest email. Users can also create custom notifications using ThreatConnect’s API or Playbooks. By expanding the notifications capability, analysts can accomplish monitoring tasks.
• Indicator Status: Users now have the ability to manage the status of Indicators in the Platform automatically with ThreatConnect’s CAL (Collective Analytics Layer) or set Indicator status manually. With this, analysts can keep a record of benign and/or formerly malicious indicators even if they don’t want the indicators considered for action.

“Our goal is to help Security Operations Centers and threat intel teams run with high efficiency and effectiveness. These new features will help analysts be able to investigate threats faster and more effectively and share the impact of their efforts with their security team and other staff. We will continue to improve the Platform’s capabilities to provide organizations the confidence that they are basing actions and decisions on relevant threat intelligence.”, said Andy Pendergast, ThreatConnect’s Vice President of Product.

from Help Net Security https://ift.tt/2mYhmz4

FireEye brings machine learning to endpoint security with MalwareGuard

FireEye announced the addition of MalwareGuard to its Endpoint Security solution. MalwareGuard is designed to help detect and block cyber-threats including threats to provide customers a level of protection to stop attacks and protect customer information, sensitive data, and intellectual property.

MalwareGuard is integrated into the FireEye Endpoint Security agent and is available now for current customers at no additional cost, and via a free trial for other organizations interested in upgrading their endpoint defenses.

Data for machine learning

FireEye MalwareGuard is the result of a two-year research project from FireEye data scientists and testing in real-world incident responses. The MalwareGuard model is trained using machine learning techniques to enable MalwareGuard to make intelligent malware classifications on its own and without human involvement.

The machine learning model is trained with both public and private data sources, including data gathered from over 15 million endpoint agents, attack analyses based on more than one million hours spent responding to attacks to date, over 200,000 consulting hours every year and adversarial intelligence collected from a global network of analysts that speak 32 languages.

FireEye analyzes hundreds of millions of malware samples resulting in knowledge of the threat landscape that’s not available to any other organization.

The FireEye data science team has real-world experience analyzing cyber-threats and they use FireEye’s data to train MalwareGuard to detect new threats that bypass competitors’ machine learning and signature-based solutions.

Endpoint security in one agent

With the addition of MalwareGuard, FireEye Endpoint Security agent now includes four integrated engines: machine learning (MalwareGuard), behavior-based (ExploitGuard), signature-based (Malware Protection) and intelligence-based (IOC), to provide a layered defense designed to protect customers from known and unknown threats. These engines are continuously updated with threat intelligence and designed to keep pace with evolving threats.

In addition to prevention engines, FireEye Endpoint Security includes investigation, detection and response (EDR) capabilities that are designed to enable organizations to investigate and respond to attacks on the endpoint. This is all included in one agent and managed through the cloud, on-premises or a hybrid deployment.

“Attackers are constantly innovating and outmaneuvering legacy, signature-based technology,” said John Laliberte, senior vice president of engineering, FireEye.

“Reducing the window of time from discovery, to analysis, and deployment of protection is critical to reducing risk in your enterprise. By combining our unique frontline knowledge of the adversaries with our in-house machine learning expertise, we can now better protect our customers against cyber-threats including never-before seen threats by automating the discovery, analysis, and deployment of protection through our endpoint solution.”

New management features simplify moving from alert to fix

In addition to the new machine learning capabilities, FireEye Endpoint Security now includes features designed to deliver management as well as simplify the process of moving from alert to fix. These include:

• Policy Manager: enterprise management makes it easy to enable varying levels of access, allowing administrators to balance the needs of security and performance,
• Alert Workflow Update: provides the context for organizations to respond to the alerts that matter,
• Cloud Identity and Access Management: enables higher level of authentication for cloud-based deployments.

Simplified security operations and seamlessly add new hunting capabilities

FireEye Endpoint Security includes the FireEye Helix security operations platform, which integrates security tools and applies threat intelligence, automation and case management to help organizations take control of incidents from alert to fix.

FireEye Endpoint Security also works with FireEye Managed Defense, a managed detection and response (MDR) solution, and offers the ability to add new services like threat hunting without increasing personnel or taxing existing security teams.

Availability

These new FireEye Endpoint Security features are now available in the latest version of FireEye Endpoint Security (4.5). A free trial of FireEye Endpoint Security is available from authorized FireEye partners worldwide.

from Help Net Security https://ift.tt/2M7FMRG

SentinelOne partners with Lookout to extend endpoint protection to mobile devices

SentinelOne has partnered with Lookout to integrate mobile threat data into the SentinelOne console to protect mobile endpoints from attacks.

Attackers are redirecting ransomware and malware attacks from desktops to target mobile endpoints, and organizations now require autonomous protection that detects and blocks threats from gaining a footprint on employee mobile devices.

Through this integration, Lookout will feed Android and iOS threat information directly into the SentinelOne console, providing a pre-execution, on-execution, and post-execution view of threats.

By displaying mobile threat data in conjunction with desktop, server, and cloud threat data, security teams can now protect all endpoints in the enterprise through a single console.

“Business is increasingly done on mobile devices. Adversaries know this and are adjusting their attacks and malware payloads accordingly. Secure organizations are starting to protect mobile endpoints as diligently as they do servers or desktops,” said Tomer Weingarten, CEO and Co-Founder, SentinelOne.

“The integration with Lookout provides our customers with needed visibility across all attack surfaces – a single view of critical assets and their protection status.”

The integration will add Lookout links for detailed descriptions of mobile threats and allow users to access the Lookout Mobile Endpoint Security console to configure changes as needed, all from within the SentinelOne console.

“Over the last 10 years, Lookout has built the world’s largest mobile security dataset, giving us the intelligence needed to stay ahead of threat actors and accurately predict their next attack — whether it’s malware, an exploited vulnerability, a man-in-the-middle attack, or a phishing attempt,” said Jim Dolce, Lookout CEO.

“It’s this understanding of the mobile threat landscape that allows us to provide superior protection across the mobile spectrum of risk. As the number of endpoints enterprises must protect increases, and the complexity of cyber-attacks continue to as well, Lookout’s partnership with SentinelOne provides customers with comprehensive next-generation endpoint protection.”

from Help Net Security https://ift.tt/2KhbLNB

The 24×7 Fidelis MDR service team now bolsters internal security teams

Rates of cybercrime and nation-state espionage are increasing while the cybersecurity skills gap continues to grow. To better support security teams and operations in this environment, Fidelis Cybersecurity announced the release of a new managed detection and response (MDR) service.

The 24×7 Fidelis MDR service provides a team of security experts who leverage patented Fidelis technology to analyze rich network and endpoint metadata, content, behavioral and asset characteristics, as well as enterprise IoT devices to aid in hunting and investigations.

Earlier this year, Fidelis commissioned The State of the SOC study that affirmed just how overwhelmed security teams are today. Over 60% of respondents said they were unable to triage even a quarter of the alerts they receive daily.

Even with security technology in place, Security Operations Centers (SOCs) often don’t have the staff or skills in-house to monitor and respond to threats, execute threat hunting to better understand and protect against future attacks. These needs were found to be acute at smaller enterprises that did not have a Security Operations Center.

“With the risk enterprises face each day, organizations need more than just an MSSP partner,” said Nick Lantuh, President and CEO at Fidelis Cybersecurity.

“Our team of experts are true threat hunters, not just alert watchers. Most come from US Government Department of Defense Cyber Security Units and Intelligence Community backgrounds with deep hunting and incident response experience. They are empowered by our advanced analysis engine which provides rich metadata and content to expose and understand the context behind an alert, to gain full life-cycle visibility during an attack and to rapidly and accurately find, contain and eradicate threats.”

The Fidelis Cyber Threat Analysis Center is staffed 24×7 with security operations professionals, forensic analysts, incident responders and threat hunters, who have a pedigree of identifying, triaging and responding to threats targeting enterprises of all sizes.

The MDR team uses the Fidelis Elevate platform, which provides Endpoint Detection and Response, Network Traffic Analysis, Enterprise IoT visibility, Asset Discovery and Deception, to identify, classify and protect an organization’s digital assets.

By going beyond NetFlow data and instead analyzing the metadata and content derived from Fidelis’ patented Deep Session Inspection of network traffic, the MDR team can understand whether a document or executable has been seen before, what the file type is, who authored it, who received a copy and who logged into the machine that sent the document.

These data-driven insights, combined with Machine Learning and automation, aid the Fidelis MDR team with an incident response workflow, ensuring detection and response that removes false positives and produces only actionable intelligence.

“Our MDR team is equally versed in supporting large enterprises with fully developed SOC and Incident Response teams, as it is supporting organizations with less developed cyber-security capabilities”, says Lantuh.

“For large enterprises with built out SOCs, Fidelis’ MDR can provide a SOC Augmentation Service delivering only actionable intelligence based on findings within the Fidelis Infrastructure.”

The Fidelis MDR service is one of the offerings in the market to incorporate deception technology which enables the classification of assets and the deployments of breadcrumbs as lures to decoys, fake file systems, enterprise IoT support, plus Man-in-the-Middle detection and Active Directory fake accounts with activity on decoys.

Fidelis MDR is part of a wider portfolio of service offerings including Incident Response and Security Assessments which include Incident Response Readiness, Security Operations and Security Program reviews.

from Help Net Security https://ift.tt/2LFCDwq

Digital trust: Security pros, business execs and consumers see it differently

An extensive global survey of consumers, cybersecurity professionals and business executives about their views on digital trust conducted by analyst firm Frost & Sullivan, highlights how consumers perceive and trust organizations to protect their digital data. It also includes data about how business leaders and cybersecurity professionals at organizations view their responsibilities of data stewardship, the licensing of consumer data to third parties and the technologies they are implementing to protect data and customer privacy.

This report comes at a critical time, as consumers are increasingly transacting online – whether for work, leisure or play – providing organizations with access to vast amounts of data, from consumer profiles and personal information to user behavior and habits. With that increasing store of data also comes greater responsibility to protect it against abuse from external and internal sources.

Data breaches worldwide

Amidst a continuous stream of headlines about major data breaches in enterprise and government agencies, the degree to which consumers have placed their trust in organizations to protect their personally identifiable information (PII) online has never been more relevant. In 2017 alone, the number of confirmed data breaches globally was staggering. Against this backdrop, it is crucial for business leaders to understand worldwide public sentiment concerning the sharing of information online, and the impact of data and privacy breaches on the company’s bottom line.

“We are at a crossroads in the information age as more companies are being pulled into the spotlight for failing to protect the data they hold, so with this research, we sought to understand how consumers feel about putting data in organizations’ hands and how those organizations view their duty of care to protect that data,” said Jarad Carleton, industry principal, Cybersecurity at Frost & Sullivan. “What the survey found is that there is certainly a price to pay – whether you’re a consumer or you run a business that handles consumer data – when it comes to maintaining data privacy. Respect for consumer privacy must become an ethical pillar for any business that collects user data.”

Responses to the survey showed that the Digital Trust Index for 2018 is 61 points out of 100, a score that indicates flagging faith from consumers surveyed in the ability or desire of organizations to fully protect user data. The index was calculated based on a number of different metrics that measure key factors around the concept of digital trust, including how willing consumers are to share personal data with organizations and how well they think organizations protect that data.

Key findings from the report

• Nearly half (48 percent) of consumers report that they currently use, or have used in the past, services of organizations that were involved in a publicly disclosed data breach and, of those, 48 percent have stopped using the services of an organization because of a breach.
• There is a 14-point gap between the Digital Trust Index of consumers (61 percent) and the perceptions by business decision makers and cybersecurity professionals (75 percent), signifying mismatched perceptions among these audiences in a measurement of perceived consumer trust versus actual consumer trust.
• Only half of consumers surveyed (49 percent) are willing to provide their personal data in exchange for digital services.
• 90 percent of organizations claim that they are very good at protecting consumer data, showing a high level of self-confidence, despite the fact that nearly half (48 percent) of business executives admitted that their organization has been involved in a publicly disclosed consumer data breach in the last year.
• 43 percent of business executives admit to selling consumer data that includes personally identifiable information, while only 15 percent of cybersecurity professionals surveyed knew that their company was selling data containing PII.

Disconnect

These results point to a significant gap between how organizations view their responsibilities on data stewardship and consumer expectations around how organizations protect consumer data. In the application economy where data is king, organizations must prioritize data privacy and security or risk serious ramifications.

Organizations can mitigate these risks by taking a proactive stance on security, such as narrowing their policies for sharing user data, reducing privileged user access, implementing continuous user authentication technologies, and adopting better cybersecurity and privacy controls to stop hackers.

“In today’s digital world, consumers expect security and privacy to go hand-in-hand with a great user experience. The study clearly shows that trust is fleeting if organizations don’t do their due diligence to protect consumer data from getting into the wrong hands,” said Mordecai Rosen, general manager, Security at CA Technologies. “Now, more than ever, organizations need to understand that success in the digital economy requires that they embrace a security-first mindset – a key tenet in our Modern Software Factory model. A loss of digital trust has implications on all aspects of a business and brand perception, so organizations owe it to their customers and shareholders to get it right.”

from Help Net Security https://ift.tt/2LFYGmP

Insights into consumer attitudes to biometric payments

Biometric payments are poised for significant growth, but substantial consumer security concerns could put its future at risk according to a new report from Transaction Network Services (TNS).

18 to 24 year olds willing to make a biometric payment in the future using the different biometric identifiers given

The report reveals that 15% of adults have made a biometric payment in the last year, including a quarter of 18 to 24 year olds.

Mark Collins, Managing Director of TNS’ FinTech Solutions business in the EMEA region, said: “We are delighted to see that biometric payments are being tested by consumers, however, a staggering 61% felt that providing companies with their fingerprint and iris information put their personal identity information at risk. The industry needs to take measures to both ensure the security of this sensitive information and to convey to consumers what protections are in place.

“It’s exciting to hear that more than half are willing to use the widening range of biometric identifiers available, which now includes iris and vein scanning, as well as facial recognition and fingerprints. Reassurance will be the key to ensuring that biometric payments achieve the successful future that our survey data suggests.”

Number of adults that feel biometric payments will help to increase financial security by reducing fraud

Report highlights

• Fingerprints were chosen as the most popular identifier overall; however, the second choice varied by region
• 68% believe biometric payments will become more commonplace in the next 2-5 years
• Trust in biometric payments among US adults has increased slightly since TNS’ last survey two years ago
• Usage in the last year has been greatest among UK adults
• In the US and UK more men reported security concerns, but in Australia women were most concerned.

from Help Net Security https://ift.tt/2AuPQmv

Porn-warning security scam hooks you up to “Apple Care”

Adequate Man Who Has The Worst Logo In Sports?

Adequate Man Who Has The Worst Logo In Sports? | Jezebel 21-Year-Old Adult Chloe Grace Moretz Deftly Handles Stupid Feud With 37-Year-Old Child Kim Kardashian | The Root Cue the World’s Smallest Violin: White Driver Who Followed Black Man, Called Him Slurs, Now Whines About Life Being Ruined | Splinter Amazon Is Reportedly Pushing Injured Workers Into Homelessness | The A.V. Club Guy Fieri once again demonstrates that he’s a good guy (Fieri) |

from Lifehacker https://ift.tt/2LQcXws

The Best Baby and Toddler Books I’ve Bought (So Far)

What Would You Like to Hear on The Upgrade?

To Get Your Kids to Take Your Advice, Have Someone Else Give it to Them

Track Your Online Spending at the Sites Where You Shop

Don't Use DNA Tests to Make Decisions About Your Dog’s Health

Which Store-Bought Foods Do You Prefer Over Homemade?

Save Big On a 65" TV With Dolby Vision and Local Dimming, Plus More TV Deals

Ask The Salty Waitress: What can I do about these jerks at the table next to me?

Read Reddit's Favorite Life Hacks

That 'Certified Pre-Owned' Car Might Not Be What You Think

How to Earn Yearly Point Bonuses on Your Credit Cards

This Ginger Dressing Tastes Exactly Like it Came From a Japanese Restaurant

Actually Appear In Your Own Vacation Photos With This Flexible Tripod Deal

Tuesday's Best Deals: Apple AirPods, Portable Projector, Gaming Laptop, and More

Staircases in Space: Why Are Places in Science Fiction Not Wheelchair-Accessible?

The Easiest Way to Load a Broken Webpage

CompTIA PenTest+ certification now available worldwide

CompTIA launched CompTIA PenTest+, its newest credential for cybersecurity professionals around the world.

CompTIA PenTest+ provides an assessment of the knowledge and skills needed to run a penetration testing program.

“As organizations become more proactive when it comes to cybersecurity, penetration testing is one of the tactics that they are employing,” said James Stanger, chief technology evangelist at CompTIA.

“But for penetration testing to be effective, the tester must have a range of skills, from pre-test preparation through post-test assessment and reporting. CompTIA PenTest+ covers the entire process and skillset of penetration testing.”

The CompTIA PenTest+ certification exam tests individuals in five technical areas: planning and scoping; information gathering and vulnerability identification; attacks and exploits; penetration testing tools; and reporting and communication.

“CompTIA PenTest+ is a performance certification, so in addition to answering multiple choice questions, the exam includes hand-on simulations,” Stanger explained.

“Test takers must perform simulated penetration testing and vulnerability assessment job tasks during the exam. Another differentiator of CompTIA PenTest+ is that it tests on knowledge and skills that go beyond the boundaries of a traditional firewall, and extend into post-perimeter networking environments, emphasizing end point device diversity, cloud platform use, and targeting end users.”

Exam content was created with input from cybersecurity professionals around the world. These experts have years of hands-on work experience and knowledge of the full range of cybersecurity threats, responses and pro-active measures.

CompTIA Cybersecurity career pathway

The new exam joins CompTIA Cybersecurity Analyst (CySA+) at the intermediate-level of the CompTIA Cybersecurity Career Pathway. They follow CompTIA Security+, which validates baseline security skills; and precede CompTIA Advanced Security Practitioner, which covers advanced topics in enterprise security operations and architecture.

“CompTIA PenTest+ also fits into the ‘red team vs. blue team’ security exercises that many large organizations engage in,” explained Patrick Lane, director, product management, CompTIA.

“This activity combines a red team penetration testing approach with a blue team defensive security analyst’s perspective. The result is a stronger, proactive security team.”

Becoming CompTIA PenTest+ certified can help IT professionals advance in their careers by adding skills that many employers are looking for.

CyberSeek, a cybersecurity career and workforce resource, reveals that there were nearly 11,000 job openings for penetration and vulnerability testers across the U.S. as of March 2018. The average salary for these jobs was $97,000.

CompTIA PenTest+ is targeted at cybersecurity professionals with three to four years of experience who are responsible for hands-on penetration testing and vulnerability assessments.

Some of the job roles that would benefit from this credential include penetration tester, vulnerability assessment and management, vulnerability assessment analyst, vulnerability assessor, cybersecurity engineer, network security manager, cybersecurity analyst, and cybersecurity specialist.

from Help Net Security https://ift.tt/2vprIvN

Deadspin Bryce Harper Is Available | Jezebel Alaska Airlines Made a Same-Sex Couple Move so a Straig

Deadspin Bryce Harper Is Available | Jezebel Alaska Airlines Made a Same-Sex Couple Move so a Straight Couple Could Sit Together | Splinter Jesse Watters Says We Don’t Want ‘Some Guy’s Uncle From Zimbabwe’ in America | The Root Betsy DeVos Doesn’t Give a Damn About Students, Education or the Cost Thereof | The A.V. Club Stephen Colbert swallows hard and addresses boss Les Moonves’ #MeToo mess |

from Lifehacker https://ift.tt/2M9sLqI

Control Your External Display's Settings From Your MacBook

Gemalto and Entrust Datacard extend partnership to accelerate IoT security adoption

Gemalto and Entrust Datacard announced the expansion of their partnership to include a secure framework for Internet-connected devices. This expanded collaboration and integration will allow customers to leverage Entrust Datacard ioTrust Security Solutions with Gemalto’s SafeNet Data Protection On Demand to establish and secure trusted identities across their Internet of Things (IoT) infrastructures and further enable their digital business initiatives.

A recent Gemalto IoT security study found that 90 percent of consumers lack confidence in the security of IoT devices and only half of companies have adopted a “security by design” approach when building IoT devices.

In addition, more than half of consumers are concerned with a hacker controlling their IoT device or having their data stolen due to the connected object, according to the study.

Based on the security risks and need for “security by design,” companies like Gemalto and Entrust Datacard are working together to make securing the IoT as easy and efficient as possible.

The partnership addresses the industry need to simplify the process of building and maintaining security in IoT products and services with an integrated cloud-based solution for identity management and data protection.

Customers adopting Entrust Datacard’s ioTrust Security Solution are able to identify IOT devices from the earliest stages of manufacturing throughout the operational lifecycle and secure data within IoT infrastructures.

Gemalto’s SafeNet Data Protection On Demand enables enterprises to protect IoT device identities and data with cloud-based Hardware Security Modules and range of cloud-based encryption, key brokering and key vaulting services.

Organizations can also choose to deploy on-premise versions of both the SafeNet Hardware Security Modules, Key Management and Data Encryption products and Entrust Datacard’s ioTrust Security Solution.

“Organizations are still struggling to incorporate security into IOT initiatives and keep pace with the broader IOT objectives of delivering innovative services and more efficient operations. While we continue to work with the industry to mature best practices and standards, we’ve also incorporated these learnings into our solutions,” said Josh Jabs, vice president, office of the CTO and GM of IoT solutions for Entrust Datacard.

“Extending our long-standing relationship with Gemalto to IOT made sense as together we make critical elements of IoT security easier to adopt.”

“We are pleased that many security providers are now coming together to integrate solutions and employ security across the entire IoT ecosystem,” said Todd Moore, senior vice president of Encryption Products at Gemalto.

“We’re moving our strong partnership with Entrust Datacard into a new era – securing the IoT, where encryption, cryptography, identity issuance and access management are a full-stack solution and not individual components. This way, security is built-in and no longer an after-thought or a challenge. It becomes invisible and just happens.”

from Help Net Security https://ift.tt/2v1aZzK

Entrust Datacard makes investment in CensorNet and acquires its MFA technology solution

Entrust Datacard announced that it has made a strategic investment in CensorNet to propel Entrust Datacard toward achieving real-time threat awareness with enhanced pattern analysis for continuous authentication capabilities.

Entrust Datacard has also acquired SMS Passcode, CensorNet’s adaptive multi-factor authentication technology solution. The acquisition of the SMS Passcode technology and the investment in CensorNet’s USS platform further establishes Entrust Datacard as an authentication solution provider and allows the company to expand its global footprint throughout DACH/Benelux and The Nordics.

CensorNet’s USS platform, which includes a cloud access security broker (CASB), multi-factor authentication, and web and email security, will bolster new offerings for Entrust Datacard across authentication, PKI and SSL.

Additionally, the collaboration will enhance the Entrust Datacard intelligent Authentication Insight Engine by accelerating its behavior and pattern capabilities for real-time, intelligent decision-making, improving security and the user experience for the threats and compliance needs.

“Identity-centric data analysis is in CensorNet’s DNA, and identity assurance capabilities in ours,” said Todd Wilkinson, president and CEO for Entrust Datacard.

“This new relationship and investment in CensorNet presents opportunities for collaboration to enhance both companies’ offerings and re-shape the market together.”

For greater collaboration between the companies, Entrust Datacard CEO Todd Wilkinson will join CensorNet’s board of directors and the SMS Passcode team will integrate with the larger Entrust Datacard authentication team.

In the IT and threat landscape, the need for a seamless, frictionless and secure customer experience has never been greater.

The acquisition of SMS Passcode will allow Entrust Datacard to serve customers by integrating the solution’s technology with its IntelliTrust SaaS authentication solution, expanding USS capabilities to Entrust Datacard customers while adding mobile and cloud capabilities to SMS Passcode customers.

“CensorNet and Entrust Datacard have a shared vision for real-time identity centric security that can be achieved faster and with greater impact together rather than separately,” said Ed Macnair, CEO for CensorNet.

“The acquisition of SMS Passcode will benefit the broader IAM market as well as SMS Passcode customers, and this new relationship will continue serving customers as Entrust Datacard builds upon existing partnerships and enhances our USS offering.”

Entrust Datacard has a history of innovating and expanding both geographically and technologically to provide solutions that reflect changing market conditions.

Continuing this approach, the SMS Passcode acquisition and investment in CensorNet’s USS platform represents a step toward both a holistic security approach and global presence for the organization.

At a time when other security players are going through mergers or acquiring and shelving innovators, Entrust Datacard is building partnerships through targeted investments and acquisitions.

“SMS Passcode is an established multi-factor authentication (MFA) leader in DACH/Benelux and The Nordics, making it a natural fit for our acquisition strategy,” said Wilkinson.

“The MFA technology, as well as the USS platform, will be strong complements to the Entrust Datacard portfolio of solutions.”

The acquisition was signed and finalized on June 30, 2018. Terms of the acquisition are undisclosed.

from Help Net Security https://ift.tt/2Ke6Ddn

Mimecast announces acquisition of Solebit

Mimecast announced it has acquired security software developer Solebit for approximately $88M net of cash acquired.

Solebit’s technology is engineered to provide an approach for the identification and isolation of zero-day malware and unknown threats in data files as well as links to external resources.

Further enhancing Mimecast’s cyber resilience platform architecture, Solebit provides threat protection to help customers face today’s threat landscape with evasion-aware, signature-less technology.

According to research Mimecast conducted with Vanson Bourne, more than 80 percent of organizations have seen both targeted and untargeted phishing attacks increase or stay the same over the last year.

Additionally, cybercriminals are constantly adapting their attack methods, looking for new ways to bypass security solutions that look for specific behaviors or signature matches.

Solebit has developed a differentiated approach that is engineered to preclude the need for signatures and sandboxes. It is designed to help customers find threats by recognizing when there is malicious code embedded within active content and data files.

Solebit is built to scan content as it enters an organization’s systems to determine whether it is infected with malware in a transient way, avoiding the need for extra hardware and processing time required to isolate and detonate content presumed ‘risky.’

Solebit currently provides Mimecast and its customers insight into what was detected and why it was categorized as a threat.

“Security methods like signature-based antivirus and sandbox detonation are too limited when it comes to today’s most advanced threats. It’s time for a more capable, efficient and durable approach,” said Peter Bauer, CEO at Mimecast.

“We’re excited to welcome Solebit into the Mimecast family, as it helps us to offer customers a new approach that fundamentally improves their cybersecurity and resilience efficacy in the most efficient way on the market.”

Solebit’s threat detection capabilities are already integrated into Mimecast Targeted Threat Protection products.

Combined with the recent acquisition of Ataata in the security awareness and training space, and the recently previewed early adopter web security program, Solebit brings another set of microservices to the Mime|OS platform that all of Mimecast’s unified services are built upon.

from Help Net Security https://ift.tt/2v3D2yi

Threat Intelligence launches Evolve, a new cloud-based security automation platform

Threat Intelligence announced the launch of Evolve, a new cloud-based security automation platform. Evolve is the platform to deliver three pillars of security automation across a unified platform – automated penetration testing, automated security infrastructure orchestration and automated incident response.

With Evolve, businesses and individuals can enhance current security skills and capabilities; streamline security operations and maximise existing security budgets, ensuring a better ROI.

The security automation platform is also revolutionising the consumption of security services with the choice of a subscription or on-demand usage-based business model.

“Evolve is an innovative security automation platform for businesses and individuals based anywhere in the world,” said Ty Miller, managing director of Threat Intelligence.

“It is designed to address the current gap in automated security offerings. By integrating an automated approach to penetration testing, security infrastructure orchestration and incident response we are able to deliver the broadest automated security platform offering in the market today.”

He continued: “Evolve also has a unique capability to orchestrate whole environments on the fly, making it easier to respond to rapidly evolving security needs. Our goal is to make automating security requirements easy.”

The Evolve security automation platform has been launched to meet a demand for a rapid response to increasing security visibility and capabilities in an efficient operational and cost-effective manner. It meets these needs via its transparent platform capable of dissolving threats across one interface.

Evolve Platform

On-demand coverage – Execute on-demand automated penetration testing to identify attack vectors and security flaws faster than before. Location-Agnostic Penetration Testing now allows penetration testing environments to be orchestrated in the cloud or across security zones. Evolve delivers quality penetration testing and repeatable real-time verification of risks. Organisations can minimise the time it takes to detect risks and security weaknesses. This is achieved through Automated Reconnaissance, Automated Infrastructure Penetration Testing and Automated DevOps Application Security Testing.

Immediate proactive protection – Evolve Security Automation makes it easy for organisations and security teams to orchestrate a range of security infrastructure components and automate the integration of Cyber Threat Intelligence feeds in for immediate proactive protection. Using the Evolve “Location-Agnostic Orchestration” capabilities, these security infrastructure components can be orchestrated within the Evolve Cloud or across any security zone in your organisation or third-party cloud provider.

Transformational incident response – Evolve enables automatic evidence collection, analysis and response to security incidents to ensure that threats are dissolved, and breaches are contained. Responses are customized for each organizations’ needs.

“Evolve was developed to directly respond to evolving global threats and the challenges of limited security budgets, skills and resources. We acknowledge many organizations would love to be able to better proactively respond to security challenges, rather than constantly managing security issues. Evolve lets them do this and can scale up or down to meet their needs at different times,” concluded Miller.

Evolve is commercially available now.

from Help Net Security https://ift.tt/2KdA6E2

Kx selected by BroadBridge Networks to power its cybersecurity platform

Kx announces that its Kx technology has been selected by BroadBridge Networks to power its cybersecurity platform. The partnership provides access to the Kx technology stack, enabling BroadBridge Networks to provide streaming analytics on network telemetry.

BroadBridge Networks, based in Silicon Valley, provides a security platform which analyzes network telemetry, leveraging artificial intelligence and machine learning to provide human-centric data visualizations and security policy automation, allowing enterprises to secure their networks at scale.

BroadBridge Networks’ solution uses an intent-based networking approach that enables organizations to secure their entire network and have full visibility of communication between all of their assets.

Kx technology is optimized to analyze time-series data in real time, and is built upon kdb+, the time series database. This enables BroadBridge Networks Marathon and Centry products to store and analyze network telemetry (i.e., flows, packets, and logs) at network speed, allowing security and IT personnel to have full visibility, analyze all traffic and leverage security policy automation, in a scalable platform.

The combination of Kx’s technology and BroadBridge Networks’ cybersecurity expertise provides an advantage by increasing the speed and performance of data analysis and the ability to provide real time actionable recommendations and automation.

“At BroadBridge, we saw the significant need for a more mature, easily accessible, and streamlined analytics platform in the cybersecurity market, which is precisely why we have chosen to partner with Kx. Because Kx technology is scalable, simple and fast, it is the perfect fit for our forward-thinking solution.”, said Kelvin R Franklin, CEO, BroadBridge Networks.

“We are delighted that BroadBridge Networks has chosen Kx to power its disruptive network security platform. This agreement further demonstrates how Kx technology continues to be a key enabler of disruption across many industries.”, said Brian Conlon, CEO, Kx.

from Help Net Security https://ift.tt/2v1AxNc

Ariel Dan appointed as new CEO of Cloudify

Cloudify announced the appointment of Ariel Dan as the company’s new CEO. Dan will begin his new role effective August 1st.

Cloudify’s Board issued the following statement: “Ariel Dan brings deep experience in the cloud and SaaS industry, and comes with excellent skills and experience to take Cloudify to its next phase of growth. With his track record of roles across company functions, we trust Ariel to deliver compelling insights as Cloudify evolves its product offerings to support new technology and cloud-focused consumption models”

Ariel is an entrepreneur with over 16 years of sales, business development and marketing management expertise. Prior to Cloudify, Ariel led two companies to M&A, and has experience in building sustainable cloud & SaaS operations. With product & industry knowledge, Ariel brings a business track record in international markets.

“I am pleased to join Cloudify as CEO,” says Dan. “I look forward to working with the board and management team to deliver digital transformation through deeply intelligent cloud automation. Cloudify is uniquely positioned across industries to deliver on the promise of next-generation technologies – from cloud to containers, networking and much more, and I am excited to be taking leadership of the company at this pivotal time.”

Dan succeeds Zeev Bikowsky, who has been serving as CEO for nearly a decade, and was behind establishing GigaSpaces as a company.

In parallel, Zeev also led and built the Cloudify team and product from the ground up, as well as its customer base of Fortune 500 companies, and some of the financial services organizations and telecoms selecting Cloudify, including: Proximus, Partner Communications, ATOS, Telstra, F5, Sprint, as well as strategic partnerships with technology vendors Intel, VMware, and Microsoft.

Zeev is wrapping up his tenure following the completion of the spinoff of Cloudify from GigaSpaces by appointing Ariel to take the reins of Cloudify.

“I have had the privilege of leading GigaSpaces and Cloudify from visions to well-established companies,” said Bikowsky. “I am excited to now go on to pursue new endeavors, and expect Ariel to continue driving the cross-industry momentum Cloudify has achieved to date.”

from Help Net Security https://ift.tt/2KdofG0

Believe It Or Not, AirPods Are Actually On Sale Right Now

Does Your Corporate Credit Card Affect Your Credit?

Get Free Guac at Chipotle Today

Save $10 On Our Favorite Electric Lighter, Which Includes a Built-In Flashlight

SamSam: The (almost) $6 million ransomware

NSA hasn’t closed security windows Snowden climbed through

Football team in trouble over unauthorized access to rivals’ videos

Achieving compliance: GDPR, CCPA and beyond

AB 375, or the California Consumer Privacy Act (CCPA) of 2018, was signed into law by California Governor, Jerry Brownon, on June 28, 2018 and is recognized as one of the toughest privacy laws in the U.S. The statute requires companies to disclose to California residents what information is being collected on them and how it will be used. Companies have 18-months to prepare for this new law to go into effect; it’s set to begin in January 2020.

To fulfill the regulation’s stipulations, any business in the U.S. that has the personal data of a California resident will have to identify all categories of the data which they possess. Further, these organizations must be able to provide a full report — within 45 days of user request — of what exactly they do with this data. This includes not only the specific categories of data, but also why they possess it and who they sell it to or share it with. For many organizations already complying with the General Data Protection Regulation (GDPR), which went into effect on May 25, 2018, this new CCPA law is nothing to be concerned about. The requirements of GDPR are very similar to those of the CCPA, so there is no action to take beyond what your organization is already doing from a compliance standpoint.

However, if your U.S.-based organization has not taken GDPR seriously or does not believe it will impact your business, then this new California law might as well be coming to you surrounded by flashing lights. As we’ve seen with GDPR, and other similar legislation like The Australian Data Privacy Regulations, data privacy laws and requirements are spreading globally. If any of the current laws haven’t already impacted you, similar statutes certainly will in the future as concern for data privacy continues to spread across the U.S. and abroad.

So, what should you do if your business is not prepared for data protection regulations already? Here are a few tips to get started:

Map data workflows by charting what data is incoming and outgoing. Through doing this, you will be able to granularly account for specific data types. This will help to provide a holistic view of your organization’s data, so that you will be able to monitor sensitive information where any legislation might apply.

Work closely with your vendors to ensure coordination compliance. If you work with third parties that process data on your behalf, it’s crucial you ensure that the appropriate terms are in place to comply with GDPR, CCPA and other legislative statutes to safeguard your data.

Take time to learn about your customer’s compliance requirements. It’s not only important to remain compliant to any legislative requirements, but it’s equally essential to identify your customer’s concerns. Consider using surveys and focus groups to learn their compliance needs. Afterwards, if you find that it’s required, refresh any necessary contractual obligations to align with regulations.

Understand the extent of your data protection responsibilities. Compartmentalize data based on whether you are processing it, transferring it and where you would be considered a controller of data. From there, you can segregate the requirements put forth in legislation to determine the extent of your responsibility.

Fine-tune your internal policies and processes. Develop an internal process and solution to meet your customers’ needs that also complies with the intent of the framework of the regulation. Also devise a public compliance message such that your customers will be able to find a definitive compliance statement.

As these laws are still new, remember to stay on your toes to best ensure you remain compliant. The regulations themselves continue to evolve and proliferate, so make sure your organization is flexible, appropriates funds and can make adjustments as necessary. Additionally, it is crucial that you closely monitor how the language of these legislative statutes are interpreted in the context of the data protection services that your organization provides. This way, you will be able to ensure continued compliance in the wake of these new regulations no matter what.

The bottom line is this: take action immediately. Most current and up-and-coming regulations are very similar, so utilize these common frameworks and enact the tenants of legislation such as GDPR, The Australian Data Privacy Regulations and CCPA so that you will be ahead of the game once these requirements spread to include your business.

from Help Net Security https://ift.tt/2n0m1AQ

Leaky radio devices broadcast chipset data, discover researchers

Spectre chip weakness can be used to steal data remotely

Hacking a Robot Vacuum

Enterprise IT modernization: Replace prerelational DBMS systems

Prerelational database management systems (DBMSs) are aging technology, and the number of applications using these systems is declining.

The market share for prerelational DBMS products continues to decrease, and Gartner predicts that by 2020, prerelational DBMS revenue will account for less than 1 percent of the overall DBMS market.

“We believe that this trend will continue, and more and more organizations will move on to more modern solutions,” said Donald Feinberg, vice president and distinguished analyst at Gartner. “Migrating to a modern DBMS offers several benefits, including lower maintenance costs, greater system flexibility and agility, and a bigger skill base. The time is now, and it is urgent to begin modernizing systems and databases.”

Aging applications are slow, expensive and not compatible

There are many factors and motivations for replacing prerelational DBMS technology, the most obvious being that it’s simply outdated. Prerelational DBMSs were originally designed for database sizes measured in megabytes and gigabytes.

“Managing today’s big data systems is too much to ask from software that is decades old,” said Mr. Feinberg. “In addition, the tools for managing and accessing these large systems don’t support prerelational databases. To be used, the data must be moved to a modern DBMS platform, adding additional latency.”

In contrast, today’s relational database management systems (RDBMSs) support operations such as multiterabyte online transaction processing applications with thousands of concurrent users. The modern engines can do everything the prerelational DBMS can but with added scalability, flexibility and functionality.

“Another factor to consider is the cloud,” Mr. Feinberg added. “In the era of prerelational DBMSs, the cloud did not yet exist. Today, many systems and applications such as software as a service (SaaS) make use of cloud resources. Services to extract data from or connect cloud data to prerelational databases are rare, so it’s almost impossible to bring cloud and prerelational technology together in an effective and economic way. Database platform as a service (dbPaaS) offerings are a valid and up-to-date alternative.”

Organizations that do not wish to part with their prerelational DBMS must assign more budget for maintenance and consulting. As the installed base drops, vendors must increase maintenance and support costs to make up for the smaller base.

“The diminishing technical skills base for this technology will also result in higher costs,” added Mr. Feinberg. “Universities ceased teaching this technology, and the current staff is moving from inside IT departments to outside consultancies to sell their services at a higher price.”

There are many options for replacing prerelational applications and DBMS platforms. Data and analytics leaders should carefully examine those options and choose the best one for each system to be migrated or replaced.

Data and analytics leaders should also prepare a migration plan based on platform choices and realistic cost estimates. Gartner believes that the migration costs are offset by reduction of maintenance costs, mitigation of a reducing skill base, and an overall higher scalability and functionality of the new platforms. If the necessary workforce is not available in-house, there are many consultancies that can support these projects but will charge for their services.

from Help Net Security https://ift.tt/2LVOXIo

Cryptojacking for beginners – what you need to know

Analysis: Reported data breaches in Australia

The Office of the Australian Information Commissioner (OAIC) has published the first report on data breaches that fall under Notifiable Data Breaches scheme and, thus, had to be reported to the OAIC.

“The NDB scheme applies to agencies and organisations that the Privacy Act requires to take reasonable steps to secure personal information. This includes most Australian Government agencies, businesses and not-for-profit organisations with an annual turnover of $3 million or more, credit reporting bodies, private health service providers, and TFN [tax file number] recipients, among others,” the OAIC explained.

The report encompasses 242 data breaches reported between 1 April and 30 June 2018.

Data breach statistics

The analysis of the reports reveals that 59 percent of those breaches were caused by malicious or criminals attacks, 36 percent by human error, and 5 percent by system faults.

“Many cyber incidents in this quarter appear to have exploited vulnerabilities involving a human factor (such as clicking on a phishing email or disclosing passwords),” the OAIC shared.

It’s interesting to see how many of the breaches are pulled off by compromising credentials.

Most of the breaches involved the compromise of contact information (e.g., individual’s home address, phone number or email address), and 42 percent of them the compromise of financial details (e.g., bank account or credit card numbers).

Health service providers in the private sector reported the greatest number of data breaches (49), followed by organizations in the finance sector (36), legal, accounting and management services (20), education (19), and business and professional associations (15).

And that’s not counting the notifications made under the My Health Records Act 2012, which have not been included in the report as they are subject to specific notification requirements. Also, public hospitals aren’t covered by the Notifiable Data Breaches scheme, so these numbers don’t include data breaches at those organizations.

Other interesting revelations

Ransomware attacks that lead to data breaches are unexpectedly rare: only two were reported in this batch.

The compromise of credentials through phishing, brute-force attacks, or by unknown methods is a particularly popular attack approach in the finance sector:

Human error – sending personal information to the wrong recipient, loss of paperwork or storage devices, etc. – is the largest source of data breaches from the health sector.

from Help Net Security https://ift.tt/2Atgook

CEO guidance: Handling dynamic change in the cybersecurity industry

In a little over 18 months since SonicWall split from Dell, the company has become operationally and financially independent. “In fact, while achieving independence, we are thriving, surpassing financial objectives for six straight quarters as of Q1 2018,” the company’s CEO Bill Conner proudly states.

“Looking back, I’ve been fortunate to have seen the ‘ins’ and ‘outs’ of various departments within service providers, software and security companies. These experiences and opportunities have enabled me to build a strong company foundation with realistic and industry-specific company growth goals, and it’s because of that we are seeing such an explosive growth.”

Before helming SonicWall, Conner was president and CEO of Silent Circle. Before that, and for over twelve years, he was the president and CEO of Entrust. And for a decade before that, he held various executive positions at Nortel Networks.

So when he offers advice on “how to CEO well” in the infosec industry, it’s worth it to take the time and listen.

No clear vision = chaos in the workforce

For those aspiring to become a CEO one day, he advises fostering a “lifelong learner” mentality for the industry they work in – whether that’s physical security, data, storage, cloud, mobile communications or cybersecurity. Additionally, staying up-to-date on news and trends within that industry is a must.

“Then learn to extend your knowledge base beyond your specific specialization. Working across industries will make you a more versatile and sought-after professional,” he says.

A CEO in the cybersecurity industry, where so much is at stake, has to have both strong leadership skills and cybersecurity knowledge.

“In order to build a strong cybersecurity team, you must have the leadership skills to recruit and inspire the right kind of employee as well as the industry-knowledge to train and mold these individuals into experts that will eventually take on more leadership roles,” he points out.

“Decisions are sometimes made quickly and you can’t second-guess yourself. This is when you rely on your cybersecurity knowledge and decades of experience to complement your leadership skills.”

The “lifelong learning” mentality also has to encompass learning from past experiences – both good and bad, he adds.

Next, a CEO has to have good communication skills and a clear vision, and has to make sure that vision is shared and consistently communicated throughout all levels of an organization.

“Finding the appropriate message and best method for delivering that message is vital, as it differs from individual to individual, group to group and company to company,” he advises.

Finally, a CEO in the cybersecurity industry must be persistent and determined in the midst of dynamic change: “With the ever-changing technology and security landscape, it’s important for executives to maintain a level of confidence and fortitude in order to achieve success.”

Infosec lessons learned

Conner’s 30+ years in the IT and cybersecurity industry have taught him a number of lessons.

“I’d say that no matter the business, a leader will tell you to tap into the mind of the customer first, and the rest will come later,” he shares. “I find that people are doubtful of advancing technology and often put an end to innovation before we’re able to see the full results or reap the true benefits of the idea.”

He has also learned that when discussing the implementation of a new technology or app, security, policy and privacy need to be taken into consideration before launch. But, one has to keep in mind that these three factors differ across each industry and should be handled differently on a case to case basis.

In IT/cybersecurity, companies, employers and employees need to be focused and vigilant at all times as there’s a lot at stake and cyber attackers are constantly innovating.

“The time commitment and 24/7 response expectation is often an overlooked challenge in running a global cybersecurity company,” he adds.

“Cyber threats come from around the world with different intentions. The clock never stops on incoming threats. Security experts need to be willing to work long, hard hours and security executives need to find ways to better proportion the time commitment imposed on their employees.”

The future of cybersecurity

“The cybersecurity market is currently very fractured due to the changing technologies and networks that are being developed but, within the next 10 years, the value proposition of security will rely on how each organization manages and protects their own assets, not one vendor solving it all,” he says and predicts that once companies begin to prioritize security as their number one concern, we’ll see a large cultural shift in the market.

He also believed that cloud technology will play a significant role in how business and security will evolve over time.

“While cloud technology benefits seem overall positive, from a security perspective, it introduces an entirely new set of risks. Therefore, traditional security technologies will need to adapt to the cloud or be left behind,” he notes.

Finally, as AI and IoT technologies continue to grow and evolve, organizations should consider investing in advanced detection technology.

“Consider purchasing technology that includes a layered and dynamic approach, with integrated and automated breach detection capabilities. These capabilities should have the power, intelligence and flexibility to deploy what they want, when they want and where they want to eliminate potential network vulnerabilities,” he concludes.

from Help Net Security https://ift.tt/2Oufc75

Six best practices to follow in access control

Finding the right access control for your organization is best done in stages. In this way, you’ll be able to foresee costs and activities that you must tackle both on short-term and long-term basis, and keep your staff and business assets consistently safe.

Access control best practices include activities where you need to pay attention to how much you will spend upfront for which product, who will be your preferred vendor, how will you set up the access control within your organization, and how will you maintain the access control system as the company grows.

By learning from users who have tested the waters previously and borrowing their best practices, you can implement a pain-free access control solution. To make things simple, take the process step-by-step, and organize the access control in three stages:

• Planning for access control
• Setting up an access control solution
• Operating an access control system.

Let’s look into some of the best practices for each of the above stages.

Planning for access control

This is the most important stage of organizing access control since what you do here will affect the next two stages. Start by paying attention to the following:

Create role-based access – Your company will probably incorporate several departments with various responsibility levels. Not everyone needs to get access to all areas. Therefore, it’s best to create a scheme in which your employees will be clearly identified by roles and given appropriate authorizations based on the type of job that they do. Examples of role-based access are the network administrator who gets access to the server room or the accountant who can unlock the company safe. When you create roles, make sure to check regulatory compliance practices for each of these roles.

Implement security layers – When planning for access control, consider several access options. Various technologies enable making your company more or less secure. Implement each of these technologies at the appropriate level so that you encircle specific areas with strict access requirements while leaving others more open to a wider audience. Establish two-factor or multi-factor authentication to prevent fraudulent use of stolen passwords or PINs. Think of what tools you will install to support the access control infrastructure – for example – cameras, sensors, door locks, readers, and wireless technology, and make sure that each security layer is appropriately supported by the right authorization level and access control tools.

Setting up an access control solution

Despite the careful planning things can get awry if you don’t set up the system as planned. Here is what’s critical to take care of when you get to the second stage:

Apply the least privilege access control – Most security experts will advise you that applying the least privilege rule is one of the best practices when setting up access control. In general terms, least privilege means that access should be granted only to persons who explicitly need to get it. Access control privileges shouldn’t be given out of convenience. In addition, any IT staff or security personnel that have specialized roles in terms of deciding about the access control privileges should be closely monitored since they can cause the greatest damage to your organization.

Install software to automate processes – User provisioning is best done with an automated solution. Once you establish the roles and the responsibilities, it’s difficult to keep track of all assigned authorizations, especially if you employ hundreds or thousands of people in a large enterprise. Therefore, instead of relying on manual tracking, deploy a user provisioning software that will automate activities and keep records of all changes as they happen in real time. Automate IT integrations, workflows, role hierarchies, password management, and auditing to avoid costly mistakes.

Operating an access control system

Once that all is set and done with the best practices from the first two stages, you need to make sure that the established system will stay functional for a long time. Here are a few of the best practices you need to implement to maintain an effective access control system and a long-term safe workplace.

Secure data – Using an integrated access control system can effectively solve many enterprise security problems, but it can also pose greater risk because the integration can create additional challenges, such as more points of vulnerabilities for hacker’s attacks. Having that many account information, stored passwords, PINs, personal user details in the same system is a risk unless it’s properly secured. Consequently, secure all data by applying logical and physical access protective measures.

Run system audits – One of the easiest ways to audit your access control system is to use the software reporting capabilities, naturally, if you have them. By inspecting the reports you will be able to monitor if the system is up and running as it should be and whether you need to implement fixes, changes or updates. Make the audit process a mandatory activity in your enterprise security policies so that you are not able to forget about it since it will become a regular part of how you manage your business.

from Help Net Security https://ift.tt/2M6Rtbk

Deadspin Why Your Team Sucks 2018: Cleveland Browns | Splinter Medicare for All Will Save Trillions,

Deadspin Why Your Team Sucks 2018: Cleveland Browns | Splinter Medicare for All Will Save Trillions, Conservative Wonks Forced to Admit | The A.V. Club “Hitler was liberal” is just one insight offered by Dinesh D’Souza’s fraudulent Death Of A Nation | Very Smart Brothas Things Black People Say When You Might Be About to Catch Those Hands But You’re Not Quite Sure | Jezebel PSA: Avoid This Man |

from Lifehacker https://ift.tt/2v0t1SA

Ask Dr. NerdLove: I Keep Chasing ‘Manic Pixie Dream Girls’

The 10 Best Deals of July 30, 2018

How to Get a Free Breast Pump Through Your Insurance

Is It Ok to Splurge on Something Frivolous When You Have Debt to Pay Off?

Add CarPlay and Android Auto To Your Older Vehicle For $348

Freeze Bitters Into Ice Cubes for a Drink That Evolves

Did Twitter Shadow Ban You?

How to Take Back Control of Your Smart Home Devices From Someone Else

We've Got the First Discount Ever On ElevationLab's Ingenious CordDock [Exclusive]

The correct way to eat xiao long bao, the world's most magnificent soup dumplings

Jezebel ‘I Don’t Have to Explain Shit to You’: Restaurant Manager Fired After Ordering a Black Woman

Jezebel ‘I Don’t Have to Explain Shit to You’: Restaurant Manager Fired After Ordering a Black Woman to Leave [Update] | The Root White Fox News Guest: ‘There’s Nothing Worse Than Being Called A Racist’ | Splinter Why Income Inequality in the US Is Way Worse Than in Europe | Deadspin Braves Announcers Throw Exquisitely Awkward Tantrum Over Dodgers Batting Practice Attire | The Takeout The correct way to eat xiao long bao, the world’s most magnificent soup dumplings |

from Lifehacker https://ift.tt/2Ar4NGg

The Poor Cybersecurity of US Space Assets

How to Rate Your Pain on a Scale of 1 to 10

Can You Get Sick From Air Conditioning?

Tripwire Data Collector uncovers blind spots in industrial cybersecurity

Tripwire announced the debut of Tripwire Data Collector, a new cybersecurity solution to provide visibility into vulnerabilities and changes within operational technology (OT) environments.

Tripwire Data Collector provides visibility of cyber risk through its ability to harvest asset data using native industrial protocols, standard IT protocols, and integrations with intermediary software applications.

The solution gathers and assesses data from devices that have been inaccessible to security teams before, while still maintaining a no-touch approach to avoid disrupting operations.

“Industrial organizations understand the need to manage cyber risk in their increasingly connected OT environments, but they often struggle to gain the visibility needed to manage that risk,” said Gabe Authier, senior product manager at Tripwire.

“We built Tripwire Data Collector with expanded industrial protocols and integrations so operators can more easily get a proper view of their OT networks and uncover risks that may have been lurking in blind spots.”

To enhance the understanding of cyber risk, Tripwire Data Collector assesses OT networks and devices for vulnerabilities and secure configurations, and compliance with policies and industry standards. It then monitors environments for change, alerting users to cyber risks that could cause a disruption to operations.

Tripwire Data Collector is ideal for industrial organizations, such as energy, utilities, manufacturing, chemicals and transportation. It natively supports Ethernet/IP CIP, Modbus TCP, SNMP and Web Retriever industrial protocols, and integrates with Rockwell FactoryTalk AssetCentre, MDT AutoSave, and Kepware KEPServerEX.

Tripwire Data Collector is the latest offering within Tripwire’s Industrial Control System (ICS) Security Suite.

from Help Net Security https://ift.tt/2K6Xwem

Monday's Best Deals: Wireless Earbuds, Nike Sale, Battery Packs, and More

Financial institutions fight cybercrime with intelligent platform from Fiserv and BlueVoyant

Fiserv and BlueVoyant announced a strategic alliance to deliver a managed security platform that addresses the needs of financial institutions – from threat detection, response and remediation to regulatory compliance and reporting.

Using resources and data that go beyond what is available to banks and credit unions, Fiserv and BlueVoyant provide detection, real-time response and automated remediation of suspicious activity targeting internal systems using an integrated combination of network and endpoint monitoring, threat intelligence and behavioral analytics.

These are among a range of intelligent security capabilities offered by Fiserv to enable financial institutions to understand emerging threats and establish multilayered defenses to minimize risk, prevent fraud, help ensure compliance, and enable consumers and businesses to transact with confidence.

These capabilities embody an approach that emphasizes fact-based security decisions and measurable outcomes, facilitating intelligent financial experiences.

This new solution complements other cybersecurity solutions offered by Fiserv, including Sentry Cyber Security and SecureNow, which are designed to mitigate risks within the financial institution as well as risks associated with customer-facing services such as digital banking platforms.

“Fiserv and BlueVoyant are delivering a leading-edge cybersecurity solution that is both broader and deeper in its protection than any other solution we evaluated,” said Elizabeth Macias, Chief Information Officer, Ponce Bank.

“Cyberattacks are a very real threat to financial institutions today, and we are pleased to have implemented this robust tool to protect our customers’ money and their data.”

Disparate cybersecurity components, an inability to customize solutions to their needs, and a shortage of qualified cybersecurity talent can make it difficult for financial institutions to defend internal systems against attacks.

Fiserv and BlueVoyant help overcome these challenges with a cybersecurity platform that orchestrates an organization’s internal cybersecurity modules and provides a portal with actionable, plain-English alerts, along with cybersecurity experts who work to remediate threats to the institution.

Financial institutions receive consolidated reports to simplify regulatory compliance, and professional threat remediation that allows IT staff to focus attention on building business value.

The long-term strategic alliance between Fiserv and BlueVoyant is fortified by an investment from Fiserv in BlueVoyant, a company led by cybersecurity experts formerly with the National Security Agency, FBI, and British and Israeli intelligence services.

“Adversaries are targeting banks and credit unions of all sizes with sophisticated attacks,” said Byron Vielehr, Chief Administrative Officer, Fiserv.

“By working with partners like Fiserv and BlueVoyant, financial institutions can access capabilities and insights to make their cybersecurity strategies exponentially more effective than if they went it alone.”

“It’s time to end the hacker advantage,” said Jim Rosenthal, CEO, BlueVoyant. “The solution we’ve developed jointly with Fiserv closes the information and organization gap and offers financial institutions the advanced defenses previously only available to the largest banks and government agencies. These defenses are essential to protect financial institutions, our industry and our economy.”

from Help Net Security https://ift.tt/2OslNyR

LogMeIn unveils secure federated login to LastPass with Active Directory

LastPass by LogMeIn announced a new integration with Microsoft’s Active Directory Federation Services (“ADFS”), providing organizations utilizing Microsoft ADFS with the ability to allow employees to access LastPass with their Active Directory (“AD”) credentials.

Maintaining the LastPass zero-knowledge security model, this patent-pending security architecture ensures the user’s AD credentials are never exposed to LastPass while providing employees a single sign-on experience. As a result, with federated login, the user’s AD identity becomes securely linked with their LastPass identity.

In addition, organizations can continue to leverage the benefits that LastPass Enterprise already offers, including:

• Granular control and visibility: LastPass Enterprise offers a centralized admin dashboard for IT managers, with controls like customizable policies and audit reporting.
• Automation for IT teams: Through scalable, automated integrations with directories, cloud apps, and other services, LastPass simplifies deployment and management for IT teams.
• Safe password sharing: From IT departments managing and sharing privileged accounts to marketing teams sharing access to vendors and social media, LastPass provides the password sharing that employees need while maintaining the accountability and proper security controls that IT wants.
• Reliable autofill across the web: LastPass captures and autofills all credentials in use across the organization. LastPass relieves the password burden from employees while giving IT insight into the password hygiene across the business.
• Proven security model: From security features to endorsements from industry experts, LastPass is based on a security model that’s tested and proven time after time.

“We’re dedicated to providing our LastPass Enterprise customers with a frictionless experience employees love and the strong security and control IT admins need,” said Sandor Palfy, CTO of Identity and Access Management at LogMeIn.

“By tying LastPass to Microsoft Active Directory Federation Services, employees truly only have one password (their AD password) to remember, which translates to a higher adoption rate, helping organizations meet their password security goals faster.”

Today, the LastPass integration with ADFS is available for new customers only. Admins can start provisioning newly-added users with AD federated login immediately. We expect the ADFS integration will be available for existing users and already-provisioned users later this year.

from Help Net Security https://ift.tt/2NT3t0Q

Action1, new cybersecurity startup founded by Netwrix veterans

The two co-founders of Netwrix, Alex Vovk and Mike Fimin, established Action1 with the vision of extending into the growing cloud-based cybersecurity market.

After building Netwrix for almost 12 years from the ground up to a very successful technology business and ensuring the successful transition of strategy to the new CEO, the visionary entrepreneurs went on to create Action1 to further extend into the hyper growing cybersecurity ecosystem to endpoints and the cloud.

Action1 is a cloud-based endpoint security platform that discovers all of your endpoints and allows you to receive real-time alerts and retrieve live security information from the entire network using plain English queries, right in your web browser.

Alex Vovk was named the CEO of Action1. He has a PhD in information security and will bring more than 20 years of business and technology experience.

Mike Fimin joined the company as President to run product strategy. Previously Co-CEOs of Netwrix, Mike and Alex built a cybersecurity business and plan to replicate and scale Netwrix’s success in this new company.

from Help Net Security https://ift.tt/2LMdgIG

I'm Writer Laura June, and This Is How I Parent

Play the Free Fan-Made Sequel to the Adventure Game 'Day of the Tentacle'

Should You Drop Your Traditional Bank for Amazon?

Tell Us Your Portland, OR Travel Tips

Prisoners exploit tablet vulnerability to steal nearly $225K

Social media rumors lead to PepsiCo lawsuit

Google bans Android miners from Play Store

Cut the Cord With Anker's Newest True Wireless Headphones For Only $65

What's Coming and Going From Netflix the Week of July 30, 2018

Identifying People by Metadata

Idaho inmates hacked prison system to add money to their accounts

364 inmates at five correctional facilities in Idaho have managed to add nearly a quarter million dollars worth of credit to their JPay accounts by exploiting a vulnerability in the system, the Associated Press reported.

What is JPay?

JPay is a US-based service provider that contracts with state Departments of Correction (DOC), county jails, and private federal prisons.

It provides tablets designed specifically for the corrections industry through which inmates can send emails or messages to their loved ones, buy music, play games, receive money to their commissary or trust account, and more (all for a fee, of course).

The inmates get the tablet and are allowed to use it, but they can’t access the Internet from it.

Hacked prison system

The inmates found a way to credit their accounts without paying for it.

Fifty inmates credited their accounts in amounts exceeding $1,000, and the largest amount credited by a single inmate was just under $10,000. In total, nearly $225,000 were added to the various accounts.

“This conduct was intentional, not accidental. It required a knowledge of the JPay system and multiple actions by every inmate who exploited the system’s vulnerability to improperly credit their account,” Idaho Department of Correction spokesman Jeff Ray told the AP.

Security expert Jake Williams posited that the inmates’ credit balance is most likely stored on the tablet, in a SQLite database, and inmates figured out how to access it and change the numbers in their account.

The Idaho Department of Corrections has issued disciplinary reports to the inmates involved in the scheme and as a result of this they can lose some privileges and be reclassified to a higher security risk level.

JPay managed to recover over $65,000 worth of credits but is determined to get the rest of the money back from the hacking inmates. They can continue to send emails and messages to family and friends, but can’t buy music or access games until they pay the company back.

from Help Net Security https://ift.tt/2NUGYZb

Monday review – the hot 27 stories of the week

From why your website is officially no longer secure and Whatsapp limiting messaging forward after lynchings to your guide to what sysadmins really mean, and more!
from Naked Security https://ift.tt/2OoLuQK

Building a sound security strategy for an energy sector company

As more and more attacks against companies working in the energy sector become public, it is becoming increasingly clear that those systems are far from impermeable. And it’s not just state-sponsored attackers that are looking for a way in: opportunistic cyber crooks wielding crypto-miners and ransomware don’t care where the target computer is located or what systems they will disrupt.

It’s no wonder, then, that 70 percent of energy security professionals are concerned that a successful cyberattack could cause a catastrophic failure.

“Energy and industrial automation companies have to deal with a distinct array of cyber threats—including not only traditional IT concerns but also a range of operational technology (OT) related endpoints, e.g. programmable logic controllers (PLCs) and industrial I/O modules that do not appear in a typical IT environment. These include well-known OT protocols such as Modbus or DNP3, but also a variety of lesser-known, often proprietary protocols,” says Gary Williams, Senior Director of Cybersecurity Services Offer Management at Schneider Electric, the European energy management and automation solutions giant.

“While the OT energy space is full of many connected devices unique to industry, the attack vectors and hacking approaches are surprisingly similar to any cyberattack in other industries. For example, ransomware arrives most often via phishing emails, and Trojans embedded into OT devices still require credentialed access to the network, so proper defense should start with the human interacting with the system and include the implementation of appropriate behaviors and site security practices.”

Minimizing risk

CISOs working in energy and industrial organizations have to understand the cybersecurity risks they are facing and pinpoint the things that need to be protected.

“Experts who have the best knowledge of the plant and its systems can provide a ‘cold eyes’ review to help new CISOs develop a picture of what vulnerabilities they have and how serious they are,” Williams advises.

To quantify risk in an energy organization, CISOs should focus on the likelihood and severity of an attack. The Common Vulnerability Scoring System (CVSS) can help with that, as it provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity.

“Security leaders should use CVSS to establish how seriously at risk different elements of the plant are, then match that up to the potential of the loss of that element in the plant. To do this, they will need subject-matter experts on plant operations to contribute to the overall plant risk management strategy and cybersecurity assessment,” he notes.

The most severe risks must, naturally, be addressed first, and resources need to be focused where they will have the most significant effect.

Should the company invest in cybersecurity insurance?

In the energy sector, delivering energy profitably to customers is the primary mission. This makes it crucial to keep the business in operation even through a cyberattack.

“While cybersecurity insurance is a crucial part of the overall risk management plan, it alone will not bring business continuity,” Williams points out. “Also, insurance may cover a monetary loss, but it does not include the loss of reputation or other damage that would result from a loss of service.”

What CISOs should do is make sure they are working with employees to reduce threat exposure.

Security is part of the operations lifecycle, incorporating stronger employee training to plug every hole. This includes everything from heightened personnel screening requirements to regularly reviewing and assessing site and system security protocols to ensure antivirus software is always up to date.

“As an extension of this, CISOs must make themselves and their teams aware of cybersecurity standards for the manufacturing industry, then implement and always adhere to those standards. For example, they should learn about ISA99/IEC 62443, the rigorous standard for industrial automation technology,” he adds.

The goal is to make engaged vigilance a regular activity and bringing accountability to each employee for their part in the security story.

The overarching objective is to make sure that attackers, whether they are nation-state perpetrators with political agendas or low-level cyber criminals motivated by financial gain, look elsewere because they can’t identify security gaps.

“It’s essential to build a sound strategy and execute that strategy with due diligence, and the risk of cyberattack will be significantly reduced,” he concludes.

from Help Net Security https://ift.tt/2LwRdGl

How rouge data puts organisations at risk of GDPR noncompliance

The GDPR compliance deadline came in by force on 25th May 2018 and applies to all organisations processing and holding the personal information of data subjects. This includes contacts such as customers, partners and patients. Much has been written about the immense efforts of organisations to improve their data privacy procedures in order to comply with GDPR, but there is a largely undiscussed oversight lurking just under the surface which, if left unaddressed, still leaves organisations exposed to potential risks and hidden costs.

While progress has been made in privacy and control procedures for managed data typically held in customer and/or patient databases and business applications, most organisations will (reluctantly) admit to a problem of “rogue” personal identifiable information (PII) that is not under some form of direct IT control and governance.

These electronic office documents, presentations, images, video recordings, etc. are quite often hiding in plain sight, so to speak, and within an organisation’s IT infrastructure. We are of course referring to the countless letters, spreadsheets, data extracts, x-ray images, voice recordings (the list goes on) containing PII and stored in places such as an employee’s desktops, personal folders, shared folders, cloud storage or mobile devices. Not having good visibility and control over these kinds of rogue PII does not diminish the accountability of organisations – in fact, it exposes them to the worst kind of risk: the unknown type.

Three main problems associated with rogue PII

1. Data subjects (the people whose information is being controlled) are entitled to request all PII data held on them. This is really hard to do when a business is not 100% certain if all PII is being managed in known, secure and managed information systems. Information blind spots will leave organisations exposed to risk.

2. Requests for either a copy and/or erasure of PII by data subjects need to be completed within certain time limits (typically one month). This can be a challenge if organisations do not maintain a certain level of process efficiency in order to comply. Organisations may also be caught on the back foot if swamped by a sudden spike in requests or where there is a heavy reliance on manual procedures to fulfil these requests.

3. The new regulation typically leaves data controllers with no recourse to charge for fulfilment of these data requests. Under most circumstances, these rights translate to both a potential cost and accountability risk burden on organisations. Not only do they need the capability of finding PII faster and cheaper than ever before, but they also need to be confident that they have provided (or erased, as the case might be) ALL managed and unmanaged instances of PII held on a data subject.

Dealing with rogue PII data?

How then should an organisation deal with rogue PII data? If we assume that managed sources of PII are well understood and practices adopted to ensure data processing is governed within data privacy policies, organisations face two options for dealing with their unmanaged PII:

• Migrate or move rouge sources of data to a managed environment.
• Develop a capability to monitor – on an ongoing basis – unmanaged PII (providing visibility) combined with the ability to then manage such PII (providing control).

Endpoint Detection & Remediation (EDR) solutions enable organisations to perform investigation and remediation across their entire IT estate, at speed and at scale. This means that EDR tools can firstly help find traces of PII in unmanaged locations as well as automate the remediation process of either removing or relocating such data.

A good EDR solution should perform such remediation in real-time, and make it easy to configure the remediation steps as easily repeatable instructions for ongoing maintenance purposes. Speed, scale and automation are key here. Together, these form the essential ingredients for a solution to address problems of “hidden PII” cost and risk.

from Help Net Security https://ift.tt/2vfcGsn

Risks grow, yet security is still an afterthought in many IoT strategies

Trend Micro released survey findings that show businesses are most concerned about losing customer trust in the event of an Internet of Things related cyber attack, however they remain unprepared. The survey, which was issued to 1,150 IT and security decision makers across the globe, indicates major discrepancy between the investment in IoT systems and security to protect them.

As the growing number of connected devices opens businesses up to additional cyber threats, close to half (43%) of IT decision makers and security decision makers say that security is an afterthought when implementing IoT projects (peaking at 46% in Germany). In addition, while nearly two-thirds (63%) agree that IoT-related cybersecurity threats have increased over the past 12 months (rising to 71% in the UK and the US), only about half (53%) think connected devices are a threat to their own organisation (75% in Japan).

Additionally, the results suggest there could be minimal testing taking place ahead of implementation to ensure new devices added to corporate environments are secured. The survey also showed businesses are experiencing an average of three attacks on connected devices in the last 12 months. Thirty-eight percent of those that have already implemented, or plan to implement, an IoT solution enlist security decision-makers in the implementation process.

This falls to one in three for smart factory implementation (32%), with a similar proportion enlisting the help of security teams for the roll out of smart utility (31%) and wearables (30%) projects. This suggests that a significant proportion of businesses globally could be unwittingly opening themselves up to a range of threats.

“IoT systems are the future for businesses and many new types of connected devices are being introduced to corporate networks,” said Kevin Simzer, chief operating officer, Trend Micro. “While this is beneficial for business operations, the embedded operating systems of IoT devices aren’t designed for easy patching, which creates a universal cyber risk problem. The investment in security measures should mirror the investment in system upgrades to best mitigate the risk of a breach that would have a major impact on both the bottom line and customer trust.”

Security, responsibility, reputation, and business impact

According to businesses, the top consequences as a result of a breach include loss of customer trust (52%) closely followed by monetary loss (49%). Despite the recent introduction of GDPR making it top of mind for many, the following consequences were ranked significantly lower. Some of the areas businesses think an IoT breach would impact are:

• Customer trust (52%)
• Monetary loss (49%)
• Loss of personally identifiable information (32%)
• Being fined by regulators (31%)
• Breaking data security regulations (28%).

With breaches having the potential for a significant impact on business operations – such as jeopardising GDPR compliance or taking critical networks offline – the research confirms that cybersecurity cannot be an afterthought and it must be key to the IoT implementation process from the offset.

Simzer at Trend Micro continued: “The significant investment in this technology across the globe is testament to the fact that IoT solutions can bring many advantages to businesses. But if security is not baked into the design of IoT solutions, and SDMs aren’t involved in the IoT implementation process, businesses could face damages far greater than the benefits this connected tech delivers.”

The findings show significant investment is going toward IoT systems, with businesses spending over $2.5 million on average each year. Given the substantial financial investment, and the significant impact to organizations that could come from a cyber attack against these systems, security must be equally prioritized to mitigate this risk.

from Help Net Security https://ift.tt/2LyFCqx