New infosec products of the week: March 1, 2019

SecBI launches new solution to help MSSPs maximize their productivity and scalability

SecBI announced an automated threat detection and response solution designed to help managed security service providers (MSSPs) maximize their productivity and scalability. The SecBI MSSP offering automates both threat hunting, based on comprehensive network traffic analysis, and breach response.

Egress releases new software to enhance protection against email data breaches

Egress Risk-based Protection and Egress Smart Authentication determine the actual risk of a data breach as information is sent and accessed via email, to ensure the right security is applied. Both solutions tackle a common problem with security tools: that one-size-fits-all approaches often leave users frustrated or don’t ensure adequate security is applied to sensitive data.

GreatHorn protects users from the large variety of Microsoft and Google credential theft attacks

GreatHorn announced the capability to analyze and assess the authenticity of Office 365 and G Suite login pages embedded in emails received by users. The new release further protects GreatHorn users from the large variety of Microsoft and Google credential theft attacks that have increased in volume and sophistication over the past year.

ThreadFix 3.0 provides an understanding of overall risk to business operations

The ThreadFix architecture has been substantially modernized, and now provides a microservices-based application that will help organizations handle significantly larger data sets and more frequent data upload volumes from DevOps CI/CD pipelines. The new architecture will assure smoother deployment and scales horizontally by deploying additional containers for services that are proving to be bottlenecks.

SentinelOne releases full remote shell capabilities for remote endpoint attack query and response

SentinelOne released full remote shell capabilities, providing security and IT operations teams unparalleled technology in identifying, assessing and remediating endpoint attacks across the enterprise, regardless of the comprised endpoint’s location.

from Help Net Security https://ift.tt/2tM1V0g

Enterprises are blind to over half of malware sent to their employees

As the use of SSL grows to the point where it’s the standard protocol, cybercriminals are increasingly using encryption to conceal and launch attacks. This has become possible because SSL certificates, which used to be difficult to obtain, are now readily available at no charge.

Zscaler released the 2019 Cloud Security Insights Threat Report – An Analysis of SSL/TLS-based threats, which examines encrypted traffic across the Zscaler cloud from July through December 2018. The report, compiled by the Zscaler ThreatLabZ research team, delves into a variety of attacks executed over SSL and blocked by Zscaler, including phishing attacks, botnets, browser exploitation, and malicious content.

“With the ever-increasing concerns over data privacy, there has been a massive trend toward Internet properties having encryption by default. This is a great thing for privacy, but it presents a challenge to IT security. Decrypting, inspecting, and re-encrypting traffic is nontrivial, causing significant performance degradation on traditional security appliances, and most organizations are not equipped to inspect encrypted traffic at scale,” said Amit Sinha, Executive Vice President of Engineering and Cloud Operations, Chief Technology Officer, Zscaler.

“With a high percentage of threats now delivered with SSL encryption, and over 80 percent of Internet traffic now encrypted, enterprises are blind to over half of malware sent to their employees. The Zscaler cloud platform enables “man-in-the-middle” SSL inspection at scale, so it can inspect SSL traffic without latency and capacity limitations and provide customers with protection against the growing number of threats attempting to hide behind encryption,” Sinha added.

During the study period, Zscaler blocked 1.7 billion threats hidden in SSL traffic, which translates to an average of 283 million advanced threats blocked per month.

Key research highlights

• Phishing: On average, the Zscaler cloud platform blocked 2.7 million phishing attacks over encrypted channels per month in 2018. This represents an increase of more than 400 percent when compared to SSL-based phishing attacks blocked in 2017.
• Malicious content: An average of 32 million botnet callback attempts were blocked by the Zscaler cloud platform every month in 2018.
• Browser exploitation: The Zscaler cloud platform blocked an average of 240,000 browser exploitation attempts per month in 2018.
• Newly registered domains: Nearly 32 percent of newly registered domains that were blocked by the Zscaler cloud platform were using SSL encryption.

“One of the most notable SSL threat trends that we saw in 2018 was the increase in JavaScript skimmer-based attacks. These attacks start with the e-commerce sites being compromised and injected with malicious, obfuscated JavaScript, which, in turn, tries to tap into purchase transactions,” said Deepen Desai, Vice President of Security Research, Zscaler. “With the increase in JavaScript skimmer-based attacks, criminals can conduct their nefarious activity within the confines of the SSL environment, leaving most e-commerce sites unaware of the activity.”

from Help Net Security https://ift.tt/2EFTv0U

Businesses need to rethink security priorities due to shifting trends

One shift in attacks that businesses should be aware of is the rapid growth of cryptocurrency mining, which increased 237 percent, according to the 2018 Security Roundup Report by Trend Micro.

BEC attempts increased

Overall, attacks that capitalize on the human desire to respond to urgent requests from authority are on the rise, such as Business Email Compromise (BEC) and phishing, with phishing URL detections having increased an incredible 269 percent compared to 2017.

“The changes across the threat landscape in 2018 reflect a change in cybercriminal’s mindset,” said Jon Clay, director of global threat communications for Trend Micro. “Today’s most prevalent attacks are targeted and well planned, as opposed to one-size-fits-all attacks of the past. Knowing this pattern, we’re developing products that can outsmart these attack methods and allow us to be one step ahead of the bad guys.”

The number of BEC attacks in 2018 increased by 28 percent. While these attacks are less frequent than phishing attacks, they are more sophisticated and take more careful planning for cybercriminals and they yield an average of $132,000 per attack.

As these attacks contain no malware and go undetected by traditional security measures, companies need to increase their protection against these attacks with smart solutions that analyze the email writing style of key executives in order to identify whether the email may be fraudulent.

Another area of change across the threat landscape in 2018 was seen in zero-day vulnerabilities. Trend Micro’s Zero Day Initiative (ZDI) bought and disclosed more vulnerabilities in 2018 than ever before, including 224 percent more Industrial Control System bugs.

This is particularly significant for organizations that struggle to implement patches across their systems. While zero-day exploits are less and less common, known vulnerabilities were used to execute the largest attacks in 2018. These tactics rely on vulnerabilities that have had patches available for months, even years, yet remain exposed in corporate networks.

Another strong indicator of how the threat landscape is shifting can be seen in the types of threats that decline. Ransomware detections decreased by 91 percent compared to 2017, along with a 32 percent decrease in new ransomware families. This reinforces the shift in attack tactics, as ransomware does not require extensive planning, technical skills or ingenuity due to the large number of resources available for malicious hackers in the cybercriminal underground.

Trend Micro’s ongoing research and most advanced threat intelligence influences future product enhancements to ensure customers remain a step ahead of malicious actors.

from Help Net Security https://ift.tt/2Xwb3UH

Half of business leaders say a breach could end their business, others remain unaware

A majority (58 percent) of executives at SMBs are more concerned about suffering a major data breach than a flood, a fire, a transit strike or even a physical break-in of their office.

The figure jumps to 66 percent when measuring large SMBs (150-250 employees) that now fear a data breach would be more detrimental than traditional disasters for businesses, according to the inaugural AppRiver Cyberthreat Index for Business Survey.

“In today’s digital age, businesses rely on their intellectual property and use automated business processes more than ever before – bringing cybersecurity to the forefront,” said Dave Wagner, CEO of Zix Corporation, parent company of AppRiver. “The AppRiver Cyberthreat Index for Business Survey findings punctuate this evolution and highlight how businesses need to better prepare for cyberthreats.”

Nearly half of SMBs (48 percent) said a major data breach would likely shut down their business permanently. The percentage increased significantly with 71 percent of financial services and insurance SMBs reporting that a major breach would be fatal to their business. Healthcare and business consulting SMBs followed at 62 percent and 60 percent, respectively.

The survey further revealed that SMBs are more concerned about attacks from disgruntled ex-employees than highly publicized threats from nation-states, or even cyberattacks from competitors, rogue hacktivist groups or lone-wolf hackers.

While SMBs are concerned about cybercriminals, not all of them are on high enough alert. The hospitality industry is a prime example. Despite the 2018 Marriott breach of 500 million customer records, only 28 percent of hospitality-sector respondents believe their business is vulnerable to imminent threats of cybersecurity attacks, compared to 62 percent of respondents who work in technology and 47 percent in the financial sector.

Similarly, only 50 percent of hospitality respondents believe a successful cyberattack would cast short- and long-term business losses, compared to 72 percent each in the financial and healthcare sectors and 71 percent in the technology sector.

“Today, 6 in 10 U.S. SMBs go out of business within six months of a successful cyberattack,” said Troy Gill, a senior security analyst at AppRiver. “However, I often see a sizable gap between perceptions and reality among many SMB leaders, which is again evident in the inaugural index. They don’t know what they don’t know; the lack of preparedness becomes a dangerous weapon for cybercriminals.”

University of West Florida Center for Cybersecurity Director Dr. Eman El-Sheikh said this research sheds new light on serious issues confronting SMBs.

“The establishment of the AppRiver Cyberthreat Index for Business addresses a critical need to understand organizations’ cyber vulnerability and readiness,” she said. “The Index provides a benchmark for small- and medium-sized businesses and leaders to measure our collective cyber resiliency and emphasizes the importance of cybersecurity workforce development.”

The AppRiver Cyberthreat Index for Business surveyed 1,059 cybersecurity decision-makers in SMBs (less than 250 employees) in early 2019, covering diverse industry sectors and company sizes. The national study had a strong SMB leadership involvement with 80 percent of those surveyed holding titles of CEO, president, owner, CTO or head of IT.

from Help Net Security https://ift.tt/2Tkb2UG

40% of malicious URLs were found on good domains

While tried-and-true attack methods are still going strong, new threats emerge daily, and new vectors are being tested by cybercriminals, according to the 2019 Webroot Threat Report.

40 percent of malicious URLs were found on good domains. Legitimate websites are frequently compromised to host malicious content. To protect users, cybersecurity solutions need URL-level visibility or, when unavailable, domain-level metrics, that accurately represent the dangers.

Home user devices are more than twice as likely to get infected as business devices. Sixty-eight percent of infections are seen on consumer endpoints, versus 32 percent on business endpoints.

Phishing attacks increased 36 percent, with the number of phishing sites growing 220 percent over the course of 2018. Phishing sites now use SSL certificates and HTTPS to trick internet users into believing they are secure, legitimate pages. Seventy-seven percent of phishing attacks impersonated financial institutions, and were much more likely to use HTTPS than other types of targets. In fact, for some of the targeted financial institutions, over 80 percent of the phishing pages used HTTPS. Google was found to be the most impersonated brand in phishing overall.

After 12 months of security awareness training, end users are 70 percent less likely to fall for a phishing attempt. Webroot found that organizations that combine phishing simulation campaigns with regular training saw a 70 percent drop in phishing link click-through.

Nearly a third of malware tries to install itself in %appdata% folders. Although malware can hide almost anywhere, Webroot found several common locations, including %appdata% (29.4 percent), %temp% (24.5 percent), and %cache% (17.5 percent), among others. These locations are prime for hiding malware because these paths are in every user directory with full user permissions to install there. These folders also are hidden by default on Windows Vista and up.

Devices that use Windows 10 are at least twice as secure as those running Windows 7. Webroot has seen a relatively steady decline in malware on Windows 10 machines for both consumer and business.

“We wax poetic about innovation in the cybersecurity field, but you only have to take one look at the stats in this year’s report to know that the true innovators are the cybercriminals. They continue to find new ways to combine attack methods or compromise new and existing vectors for maximum results. My call to businesses today is to be aware, assess your risk, create a layered approach that protects multiple threat vectors and, above all, train your users to be an asset—not a weak link—in your cybersecurity program,” said Hal Lonas, CTO, Webroot.

Despite the decrease in cryptocurrency prices, cryptomining and cryptojacking are on the rise. The number of cryptojacking URLs Webroot saw each month in the first half of the year more than doubled in the period from September through December 2018. These techniques can be more lucrative than ransomware attacks, since they don’t require waiting for the user to pay the ransom, and they have a smaller footprint. As far as web-based cryptojacking, Coinhive still dominates with more than 80 percent market share, though some new copycat cryptojacking scripts are gaining in popularity.

While ransomware was less of a problem in 2018, it became more targeted. We expect major commodity ransomware to decline further in 2019; however, new ransomware families will emerge as malware authors turn to more targeted attacks, and companies will still fall victim to ransomware. Many ransomware attacks in 2018 used the Remote Desktop Protocol (RDP) as an attack vector, leveraging tools such as Shodan to scan for systems with inadequate RDP settings. These unsecured RDP connections may be used to gain access to a given system and browse all its data as well as shared drives, providing criminals enough intel to decide whether to deploy ransomware or some other type of malware.

from Help Net Security https://ift.tt/2XEnQ7E

By 2025 workforce most likely to consist of humans and bots

The workforce, workplace, and the technologies that support them will be so different by 2025 that enterprises need to provide global access and ensure continuous uptime now. That’s only one of several conclusions arising from OneLogin’s survey of 100 CIOs of companies with at least 5,000 employees.

The majority of the surveyed CIOs, based across the U.S., EMEA, and Asia-Pacific regions agreed that the volume, complexity, and pace of business are accelerating far faster than in this decade. Because of that, they urge a strong focus on developing solutions to alleviate the growing access bottleneck created by the convergence of trends including ubiquitous connectivity, automation at massive scale, infinite scalability, and artificial intelligence.

A near-unanimous 97 percent of the respondents said they believe technology will grow in sophistication and complexity in the next six years and that the workforce will be dispersed across all geographies and time zones. Additionally:

• 94 percent agreed the 2025 workforce will consist of both human resources and bots.
• 93 percent said the pace of business will continue to accelerate through 2025.
• 89 percent agree that high-performing businesses of the future will be required to leverage machine learning and AI to predict and rapidly meet the needs of their customers.
• 59 percent anticipated the pace of business will evolve to at least twice today’s rate

The CIOs recognized that work now occurs anywhere at any time, with 58 percent agreeing that remote work will increase significantly over the next six years. In fact, 43 percent of employees say they work remotely at least part-time, and 69 percent of professionals say workplace flexibility is a critical issue when evaluating potential employers.

Unified Access Management, the study showed, lies at the heart of the dynamic marketplace. It provides a platform which enables the centralized management of all users, devices, and apps to provide simple and secure access in a system that is intuitive to use for everyone from the end-user to the system admin.

“Imagine the billions of handshakes and interactions with a workforce spread around the world, requiring access to hundreds of SaaS and on-premise apps. This is where the bottlenecks are going to occur. Finding a solution will be the greatest challenge,” OneLogin Chief Product Officer Venkat Sathyamurthy said. “And this challenge is not just because of new cloud technologies. Industry research continues to confirm that organizations will operate in hybrid environments that include on-premise technologies as well. Managing both sides are key to business success.”

CIOs largely agreed, as 85 percent of those polled said that poor access management could exacerbate that bottleneck. “In the evolving digital economy, the pace of business is critical,” Sathyamurthy said. “The challenge that we’ll face in the coming years belongs to the emerging commercial ecosystem we call the ‘Dynamic Marketplace.’ This is where the developments across workforce, workplace, and technology interact. There must be a way to manage access in the dynamic marketplace, or we’ll fail to realize the benefits it offers.”

“Until recently, most access scenarios involved internal employees working primarily from dedicated desktop computers on the corporate network,” said Garrett Bekker, Principal Security Analyst, 451 Research. “However, modern firms will face considerable changes in the coming years and the approaches to access control will need to evolve accordingly. For example, the user community has expanded, consisting of employees, partners, contractors, consultants, customers, and, increasingly, ‘non-humans’ like bots. Further, ‘human’ users are no longer confined to their desks, but increasingly work from a variety of locations, including home offices or coffee shops, and are accessing resources that can be located virtually anywhere. Access control solutions that fail take this diversity into account will be found lacking.”

from Help Net Security https://ift.tt/2Tm7PUn

ENISA provides recommendations to improve the cybersecurity of EU electoral processes

In the context of the upcoming elections for the European Parliament, the EU Agency for Cybersecurity ENISA published an opinion paper on the cybersecurity of elections and provides concrete and forward-looking recommendations to improve the cybersecurity of electoral processes in the EU.

ENISA explores cyber-enabled threats, which have the potential to undermine the EU democratic process. Of particular significance is the possibility of interference in elections by cyber means, due to the widespread use of digital technology to support electoral processes in activities such as confidential communications of politicians and political parties, political campaigns, the electoral register, the counting of votes, and the dissemination of the results.

Udo Helmbrecht, Executive Director of ENISA: “As some EU Member States have either postponed or discontinued the use of electronic voting, the risk associated with the voting process can be considered to be somewhat reduced. Nonetheless, the public political campaigning process is susceptible to cyber interference. We have witnessed in the past election campaigning processes being compromised due to data leaks. ENISA encourages the EU Member States and key stakeholders such as political parties to partake in more cyber exercises aimed at testing election cybersecurity in order to improve preparedness, understanding, and responding to possible election-related cyber threats and attack scenarios. These stakeholders should have incident response plans in place, in the event that they become a victim of data leaks.“

An evolving threat is the motivation behind the actors interfering with the due process of elections by cyber means. The motivation for the actors can be manifold, for example for financial gain, fame and reputation, or to provoke chaos and anarchy, undermine trust in democracy, and subvert political opposition.

Through this paper, ENISA puts forward a set of recommendations aimed at improving the cybersecurity of elections across the EU and supporting the Member States in their efforts.

The most important recommendations that ENISA makes are:

• Member States should consider introducing national legislation to tackle the challenges associated with online disinformation while protecting to the maximum extent possible the fundamental rights of EU citizens
• Member States should continue to actively work together with the aim to identify and take down botnets
• Consideration should be given to regulation of Digital Service Providers, social media, online platforms and messaging service providers at an EU level to ensure a harmonised approach across the EU to tackling online disinformation aimed at undermining the democratic process
• The above players are also advised to deploy technology that will identify unusual traffic patterns that could be associated with the spread of disinformation or cyberattacks on election processes
• A legal obligation should be considered to classify election systems, processes and infrastructures as critical infrastructure so that the necessary cybersecurity measures are put in place
• A legal obligation should be put in place requiring political organisations to deploy a high level of cybersecurity in their systems, processes and infrastructures
• Official channels/technologies for the dissemination of the results should be identified, as well as back-up channels/technologies that validate the results with the count centres. Where websites are being used, DDoS mitigation techniques should be in place.

from Help Net Security https://ift.tt/2C0UKWS

IBM X-Force Red will use Onapsis ERP technology to help organizations uncover critical vulnerabilities

Onapsis, the global leaders in ERP cybersecurity and compliance, announced IBM Security’s team of veteran hackers, X-Force Red, will use its ERP technology to help organizations identify exploitable vulnerabilities in their business-critical applications.

X-Force Red will use Onapsis’ ERP technology when performing vulnerability assessments and penetration testing against SAP and Oracle applications to help quickly uncover known and unknown vulnerabilities.

Customers can access X-Force Red’s services through the X-Force Red Portal, the team’s cloud-based communications and collaboration platform. Using the X-Force Red Portal, customers can sign up for tests and assessments, check their status, view findings as they are uncovered, view remediation recommendations, and communicate directly with X-Force Red testers, eliminating time-consuming back and forth and the manual sharing of spreadsheets.

“We are very excited to be a part of X-Force Red’s vulnerability assessment offering. In the face of explosive growth in attacks to ERP systems, as evidenced by the US Department of Homeland Security releasing two critical alerts in the past three years, organizations have realized they must incorporate ERP continuous vulnerability assessment and monitoring into their security programs. With Onapsis’ patented ERP cybersecurity technology, combined with X-Force Red’s security expertise and attacker mindset, organizations can now quickly understand their security posture, and receive actionable information on how to ensure the core of their business is secure,” said Mariano Nunez, CEO and Co-founder, Onapsis Inc.

“SAP and Oracle ERP are applications that many organizations use for sensitive business processes,” said Charles Henderson, Global Partner and Head of X-Force Red. “Because of their importance and the kind of data they hold, it is crucial these applications are scanned and tested continuously so that critical vulnerabilities can be remediated before attackers find them. Our collaboration with Onapsis will make that mission come to fruition.”

X-Force Red delivers vulnerability assessment and security testing programs that focus on uncovering vulnerabilities across applications, hardware, personnel, internet-connected devices, networks, cars, ATMs, blockchain and just about everything else.

The team is comprised of veteran hackers who apply the same tools, techniques, practices and mindset as attackers, uncovering exploitable vulnerabilities that may lead criminals to the crowned jewels.

This collaboration further highlights Onapsis’ increased effort on growing the global ERP security partner ecosystem. Onapsis also works closely with the IBM Security Services group for protecting, continuous monitoring, addressing compliance and enabling cloud migrations of some of the world’s largest organizations.

from Help Net Security https://ift.tt/2NxLzl2

More than 120 partners commit to Symantec’s integrated cyber defense platform

Symantec, the world’s leading cyber security company, announced that more than 120 companies have joined forces with Symantec to drive down the cost and complexity of cyber security, while improving response times to protect enterprises against sophisticated threats.

This includes major players like AWS, Box, IBM Security, Microsoft, Oracle, ServiceNow and Splunk, as well as dozens of other technology innovators, who are now building or delivering more than 250 products and services that integrate with Symantec’s Integrated Cyber Defense (ICD) Platform.

This unprecedented industry collaboration reflects a “platform shift” in the cyber security industry, as new research from Enterprise Strategy Group (ESG) shows enterprise customers are looking to consolidate vendors and adopt more integrated platforms backed by an open ecosystem.

Integrated defense improves security by increasing the speed and effectiveness, while greatly reducing the resources required. To make that shift even easier, Symantec also today announced important innovations – including a new universal data exchange, shared management capabilities, and upgraded data loss prevention software that help customers stop untrusted apps before they compromise confidential data.

All are built on Symantec’s ICD Platform, which provides a unified framework for information protection, threat protection, identity management and compliance across endpoints, networks, applications, and clouds.

“There’s a seismic shift happening in cyber security,” said Art Gilliland, EVP and GM Enterprise Products, Symantec. “The old way of fighting cyber-attacks using fragmented tools has become too complex and expensive to manage. Integrated platforms are the future. We’re proud to be leading this platform shift with a clear vision and winning portfolio – along with hundreds of partners and thousands of experts working every day on the front lines to protect our customers. We are completely convinced that our best defense going forward is an integrated defense.”

New research demonstrates the need for integrated platforms

ESG recently published new customer research showcasing how the lack of a cohesive security technology strategy creates real problems for enterprises, leading customers to seek more integrated platforms and fewer, more strategic vendors. Key findings based on the research include:

• More than 80 percent of C-level executives said threat detection and response effectiveness is impacted by too many independent point tools;
• 53 percent of organizations have a problematic shortage of cyber security staff and skills; and
• 91 percent of enterprises are actively consolidating or considering consolidating the cyber security vendors with whom they conduct business.

“Almost two-thirds of large enterprises surveyed use at least 25 different cyber security products. For security operations centers, managing disparate tools can be ineffective, costly, and time consuming, especially considering the shortage of cyber security skills,” said Jon Oltsik, senior principal analyst and fellow, ESG. “This explains why CISOs are looking to consolidate and integrate their security infrastructure with platforms and open architectures that provide advanced developer support and deliver a partner ecosystem with robust third-party integrations.”

Symantec integrates products, services and partners

Symantec started building ICD two and a half years ago with its acquisition of Blue Coat Systems, which added best-of-breed web and cloud security technologies to Symantec’s market-leading endpoint, email and data loss prevention (DLP) technologies.

At the time, Symantec saw and heard that customers were spending enormous time and resources to integrate point technologies in order to derive real value from their cyber security investments. So, the company invested in a strategy and roadmap to deliver an integrated platform that significantly reduces cost of operations while improving the speed and accuracy of prevention, detection and response in order to reduce risk.

Since then, Symantec has:

• Invested significant R&D effort to integrate its products around key customer pain points – protecting information in SaaS applications; integrating complementary technologies like cloud access security broker (CASB) and DLP; enhancing endpoint security with advanced endpoint detection and response (EDR) to protect against targeted attacks; and securing infrastructure from endpoint to cloud for “Zero Trust” security implementations.
• Acquired innovative security technologies like Fireglass, Skycure, Appthority, Javelin, and Luminate to address emerging challenges – and quickly integrated them into the Symantec portfolio.
• Deepened its services portfolio to provide security leaders with in-depth expertise in global threat intelligence, advanced threat monitoring, cyber readiness, and incident response.
• Opened its APIs and launched a Technology Integration Partner Program (TIPP) to do deeper integration work with key technology players.

ICD platform earns broad ecosystem support

Symantec now has more than 120 partners in TIPP, who are building or delivering more than 250 new applications and services that integrate with Symantec’s ICD Platform, so enterprise customers can reduce the cost and complexity of their security operations.

In addition, Symantec is now launching a new “Innovation Playground” program within TIPP to simplify integration with startups. The new program will enable startup teams to leverage Symantec APIs and gain access to products, engineering resources, and customer innovation days.

“In order to reduce security operations complexity and fight today’s increasingly sophisticated adversary, organizations need products that work as a platform instead of an army of point products working in silos,” said Oliver Friedrichs, VP of security automation and orchestration at Splunk. “Splunk’s support for the ICD Platform provides our joint customers with consolidated views across their security infrastructure, including incidents flowing from endpoint, web, network and email security solutions.”

“At Box, security is a top priority and we are dedicated to providing our customers with powerful controls to protect their sensitive content,” said Niall Wall, senior vice president of partners at Box. “Symantec is a founding member of the Box Trust Ecosystem. We are excited about Symantec’s Integrated Cyber Defense and how it will help our mutual customers reduce risk of data loss, detect advanced threats, and seamlessly bring together our security capabilities.”

“Security analysts today deal with increasingly complex threats, fragmented security tools, and siloed organizations,” said Rich Telljohann, director of business development at IBM Security. “To combat this we are seeing that the cyber security landscape is demanding a shift to integrated platforms in order to reduce complexity and cost. We have built an integration using Symantec ICD Exchange, so the IBM Resilient Incident Response Platform can provide intelligent orchestration, automation, and enrichment of incidents triggered by Symantec ICD, allowing analysts to respond intelligently to threats.”

ICD platform drives customer adoption and value

As evidenced by Symantec’s recent quarterly earnings, more and more customers are moving beyond individual products to adopt the ICD platform and portfolio. For example:

• In Europe, a household appliance manufacturer signed an eight-figure deal with Symantec, adopting a substantial footprint of the ICD platform;
• In Asia Pacific, a major securities and derivatives trading exchange expanded beyond Symantec endpoint security to adopt Symantec’s cloud security stack; and
• In the U.S., a global Fortune 500 power company – originally a single product customer – signed a seven-figure, multi-product, multi-service deal to build an internal security operations center.

“The threat landscape we all face is not static and is constantly on the move, as are our customers and employees, so strategies to deal with that kind of environment are very complex,” said Emily Heath, vice president and chief information security officer, United Airlines. “Visibility of your environment and integration of solutions are a key part of that strategy. For example, if one security control catches something, it is much more efficient for us if those controls are integrated and can communicate seamlessly with each other to help with real time detection. Additionally, if security providers take the time to integrate across the stack so we don’t have to, that results in an even better outcome.”

Symantec extends ICD platform with new features & functions

Symantec is introducing three new technology innovations today that extend ICD for shared intelligence and shared management across multiple technology components, as well as new “threat aware” data protection capabilities:

• ICD exchange: A universal data exchange that shares events, intelligence and actions across Symantec and third-party systems, improving visibility for security teams and security operations centers, so they can take faster action and increase automation.
• ICD manager: Shared management capabilities that will provide customers with unified visibility into threats, policies and incidents, helping them to reduce incident response times from days to minutes.
• Data loss prevention 15.5: New data loss prevention (DLP) software that integrates with Symantec’s market-leading endpoint protection suite to help customers stop untrusted apps before they compromise confidential data. This “threat aware” data protection is one of many breakthroughs made possible due to Symantec’s ICD platform investments.

from Help Net Security https://ift.tt/2SBgLAW

SecBI launches new solution to help MSSPs maximize their productivity and scalability

SecBI, a disruptive player in automated cyber threat detection and response, announced an automated threat detection and response solution designed to help managed security service providers (MSSPs) maximize their productivity and scalability.

“With cyberattacks becoming commonplace for every business size, the MSSP market is set to take off,” said Gilad Peleg, CEO of SecBI. “However, the most successful MSSPs will be those that possess advanced breach detection and remediation expertise, as well as the tools to scale and increase resource productivity. Providers will benefit greatly from the ability to automate threat detection and response tasks.”

The SecBI MSSP offering automates both threat hunting, based on comprehensive network traffic analysis, and breach response. SecBI provides full scope detection, creating a comprehensive view of each cyber incident by combining disparate alerts, events, and logs into a single narrative that shows all the affected entities and kill chain. Finally, the solution delivers gap analysis that identifies network security blind spots and implements fixes.

MSSPs using the SecBI solution will benefit from:

• Improved analyst productivity
• Automated and improved detection and remediation
• Seamless integration with existing infrastructure
• Ease of scalability, with cloud-based, multi-tenant deployment
• Fast and simple deployment with minimal ramp-up time

“Traditional security services are no longer capable of uncovering malicious communications within minutes,” added Peleg. “Having a team of analysts manually review logs from a SIEM is simply no defense against the types of sophisticated, stealthy and unknown threats we are now seeing.”

“Orange Polska is looking to lead the Polish market in cyber security,” said Donegan. “I know from speaking with the company directly that the SecBI solution has proven effective at identifying threats that other security controls couldn’t spot. Orange Polska has also received a lot of value from partnering with SecBI in terms of going up the curve on deploying machine learning/AI in its cyber security infrastructure.”

from Help Net Security https://ift.tt/2IIGN5C

Intel and partner ecosystem plan to accelerate the adoption of hardware-enabled security

Intel along with customers and industry partners announced several solutions designed to scale and accelerate the adoption of hardware-enabled security across data center, cloud, network and edge.

From OEMs to cloud service providers (CSPs) and independent software vendors (ISVs), Intel continues to help lead the industry and advance security tools and resources that help improve the security and privacy of application processing in the cloud, provide platform-level threat detection and shrink the attack surface.

“Hardware-based security technologies are a top priority for cloud providers aiming to address enterprise scaling challenges. Trusted execution technologies such as Intel SGX are now readily available in a wide range of platforms helping to fuel innovation in the digital security ecosystem and further assist in implementation roll-out.”
– Dimitrios Pavlakis, industry analyst, ABI Research.

Intel SGX for the data center

Helping protect customer data in the cloud is a top priority for cloud service providers. Intel Software Guard Extensions (Intel SGX) was designed to help create more secure environments without having to trust the integrity of all the layers of the system. The technology isolates specific application code and data to run in private regions of memory, or enclaves.

Intel SGX is currently used by top cloud providers, including Alibaba Cloud, Baidu, IBM Cloud Data Guard and Microsoft Azure for various projects to help protect customer data at runtime. Today, Intel announced new products and ecosystem solutions that enable Intel SGX to be used even more broadly in the data center.

Scaling Intel SGX for the cloud: Intel introduced the Intel SGX Card, a new way to help extend application memory protections using Intel SGX in existing data center infrastructure. Though Intel SGX technology will be available on future multi-socket Intel Xeon Scalable processors, there is pressing demand for its security benefits in this space today. Intel is accelerating deployment of Intel SGX technology for the vast majority of cloud servers deployed today with the Intel SGX Card. Additional benefits offer access to larger, non-enclave memory spaces, and some additional side-channel protections when compartmentalizing sensitive data to a separate processor and associated cache. Availability is targeted for later this year.

To enable cloud adoption of Intel SGX at scale, Intel and industry partners are also introducing new tools and capabilities that enhance operational control, simplify development and support emerging workloads.

Operational control: Intel is delivering a new capability called flexible launch control that enables a company’s data center operations to set and manage their own unique security policies for launching enclaves as well as providing controlled access to sensitive platform identification information. This capability is currently available on Intel SGX-enabled Intel Xeon E Processors and some Intel NUC’s.

New developer tools: Fortanix launched its Enclave Development Platform (EDP), the open-source software development kit (SDK) that uses the state-of-the-art security properties of the Rust programming language and Intel SGX to deliver a more secure application development platform. Developers can build enclaves with Rust to help improve protection from development vulnerabilities and outsider attacks. The Fortanix EDP is fully integrated with the Rust compiler allowing developers to immediately build, sell or distribute the secure applications they create.

Scale for emerging workloads: Baidu announced a preview of its Intel SGX-enabled MesaTEE that delivers artificial intelligence algorithm protection for cloud and edge computing devices.

Advancing threat detection

Intel is helping lead the industry with hardware-enhanced security technology by delivering new capabilities to Intel Threat Detection Technology (Intel TDT), a set of silicon-level capabilities that helps detect classes of threats. First introduced last year and deployed across 50 million enterprise clients, Intel TDT is experiencing broad adoption and expanding platform support to Linux and virtual machines.

Intel threat detection technology evolves: Intel is expanding Intel TDT capabilities in 2019 to include support for Linux on servers in virtualized data center and cloud environments. Intel TDT combines platform-level telemetry infrastructure and machine learning models to detect targeted attacks. Detection alerts based on the heuristics are sent to the security service provider (ISV) for remediation. Integration of the Intel TDT stack into the existing ISV solutions results in improved performance and lower incidences of false positives. At RSA Conference, Intel will demonstrate Intel TDT on Linux using Intel-developed heuristics to detect unauthorized execution of specific cryptomining workloads.

SentinelOne: SentinelOne (S1) is the first licensee to have adapted Intel TDT’s accelerated memory scanning (AMS) technology for detection of cryptomining. With Intel TDT, S1’s customers running Windows will enjoy up to 10-times faster pre-execution scanning and 4-times faster detection with immediate roll back of uncovered threats.

Shrinking the attack surface

Intel’s security open-source initiatives and community partners are equipping the ecosystem with tools to help reduce the attack surface in platforms and products before they are deployed at scale.

Device design: Intel is announcing Host-based Firmware Analyzer, a new tool for the TianoCore open-source firmware community. Intel is applying best practices used by software developers and helping lead the industry in delivering a framework that automates the testing of firmware components prior to system integration. The Host-based Firmware Analyzer allows developers to run open-source advanced tools, such as fuzz testing, symbolic execution and address sanitizers in an OS environment. This tool is targeted for availability in the first half of this year.

Secure device onboarding: For secure device provisioning and management of internet of things (IoT) devices before they are activated on corporate networks, Mocana announced full integration of Mocana TrustCenter with the Intel Secure Device Onboard service. This solution reduces the burden on OEMs to pre-load customer specific credentials in the supply chain and delivers a model where cloud selection and configuration happen dynamically when first powered on.

Defending firmware: Intel and Eclypsium announced a collaboration that helps organizations manage the entire hardware and firmware attack surface for threats. The Eclypsium Platform, now generally available, extends Intel’s secure foundation by analyzing the system configuration and ensuring the latest firmware is deployed.

Scaling enterprise endpoint protection: Qnext announced integration of Intel SGX in remote access of its sharing and collaboration platform FileFlex. Intel SGX helps improve FileFlex Enterprise security for Microsoft Office 365 users when accessing files and folders from source locations at the edge of the network.

from Help Net Security https://ift.tt/2UeZsHo

Eclypsium and Intel offer new silicon-enabled security solutions

Eclypsium announced a collaboration with Intel to help organizations manage the entire firmware attack surface. Together with Intel, Eclypsium helps enterprise IT and cloud service providers construct a more secure foundation for computing by pairing security capabilities built-in to Intel silicon with advanced defenses against firmware threats.

Intel Security Essentials provide a built-in foundation for improved security features and are available across Intel processor lines. They enable security professionals to help protect the platform and the data and to build applications with security features in a consistent way.

The Eclypsium Platform, now generally available, builds upon Intel’s foundation by analyzing the system configuration and ensuring the latest firmware is deployed. With Eclypsium, the end user can see the status of their firmware patch levels, gain visibility into firmware misconfigurations, and validate the integrity of Intel systems as part of the supply chain.

“With security features built into the hardware, Intel delivers a ‘chain of trust’ rooted in silicon that makes the device and extended network more trustworthy and secure,” said Yuriy Bulygin, CEO of Eclypsium. “We are pleased to be working with them to extend that chain of trust for the firmware layer, and therefore across the supply chain, while enabling leading hardware OEMs to deliver the right patches and more secure hardware configurations to the market.”

“Security sensitive organizations need to be able to inspect these low-level technologies to look for signs of malicious activity,” said Window Snyder, Chief Software Security Officer and General Manager, Platform Security Division at Intel.

Intel and Eclypsium at RSA Conference

Eclypsium VP of Engineering John Loucaides will be presenting at the Intel booth (Booth # 6173 North) during RSA Conference in San Francisco. Details are as follows:

• Dates: Tuesday, March 5th at 3pm PT and Thursday, March 7th at 12:30pm PT
• Topic: Extending Cybersecurity to the Firmware Layer – This session will cover how attackers are targeting the firmware layer for both persistence and disruption. It will show the most common attack vectors that attackers use today and how to detect them as part of a complete security operations strategy.

In addition, Intel and Eclypsium will be demonstrating the following use cases throughout the show at Intel’s booth.

• Firmware visibility and patch management – Visibility of firmware versions across hardware components and centralized patch updates.
• Protection from supply chain attacks – Find firmware that has been compromised in the hardware supply chain even before deployment.
• Protecting cloud infrastructure – Help protect cloud and bare-metal infrastructure from implants at the firmware level or software-level attacks that can spread to the firmware.
• Protecting laptops during travel – Help ensure that laptops haven’t been compromised during travel such as via USB-based “Evil Maid” attacks.
• Verifying device integrity after infection – Bring firmware security into your IR workflow to help ensure devices are clean at the firmware level before re-imaging.

from Help Net Security https://ift.tt/2BWGfU2

ZeroFOX releases new AI and computer vision tools enhancing risk detection

ZeroFOX, the social media and digital security category leader, announced the release of new artificial intelligence (AI) and computer vision capabilities, including optical character recognition (OCR), natural language processing (NLP), sentiment analysis and financial fraud detection.

As security teams look to automate and streamline risk detection associated with digital engagement platforms, these new features eliminate the manual, time-intensive process of analyzing millions of images that pose possible threats to brands and businesses.

“Enterprises are overwhelmed by rich media-based threats to their brand and business, and they are relying too heavily on manual human analysis and SOC teams,” said James C. Foster, CEO of ZeroFOX. “ZeroFOX dramatically reduces the burden on organizations by offering expert human analysis through the ZeroFOX Alpha Team coupled with powerful AI and computer vision capabilities. For our customers, this means they now have the ability to more efficiently and accurately identify and remediate critical risks based on varying use cases that many organizations face today across social media, surface, mobile, deep and dark web.”

Digital marketing relies heavily on image and video platforms to drive leads and generate clicks. While these platforms help organizations grow their business and attract new customers, in recent years attackers have been targeting these platforms as avenues to carry out attacks.

As a result, teams are faced with new challenges including phishing, information leakage, customer scams, financial fraud and more. With the introduction of these new AI and computer vision capabilities, ZeroFOX is equipping teams with the ability to quickly detect threats in images, saving teams time and resources spent analyzing images and posts manually.

“As organizations increase their use of digital marketing techniques, the number of posts, images, videos and sites security teams need to analyze is growing exponentially. It’s nearly impossible for them to get through everything, let alone spot a potential threat,” said Mike Price, CTO of ZeroFOX. “Leveraging tools that are powered by AI, which have the ability to sort through and analyze millions of data points in a matter of seconds, enables security teams to search, identify, and prioritize the greatest threats to their organization.”

ZeroFOX’s new features provide comprehensive AI capabilities for efficient and effective risk identification via a combination of computer vision and NLP tools. These new capabilities allow organizations to take advantage of the opportunities digital engagement offers, particularly in image and video marketing, while mitigating the risk that different digital platforms introduce. Benefits offered by the new capabilities include:

• Extracting meaning from visual mediums – With computer vision tools, security teams get clearer indications of threats. Often an image itself is the only sign of a threat or issue within a post, either in the case of the text within that image or the suspicious use of an image altogether. To address these challenges, ZeroFOX now offers OCR, face and logo detection as well as comparison technologies. OCR extracts text from images while image comparison detects the similarities between images even if they are modified from their originals, ensuring security teams don’t miss these hidden risks.
• Understanding and interpreting human language – NLP tools save security teams time and help eliminate false positives and provide deeper analysis than word matching alone. Key NLP capabilities now offered by ZeroFOX include sentiment analysis, which can detect the types and amount of negative sentiment present in text. NLP also enables scam and fraud detection which assesses the presence of a digital fraud and malicious web links.

from Help Net Security https://ift.tt/2EmLvjY

Synopsys launches new security options for ARC HS Processors

Synopsys announced the new Enhanced Security Package for Synopsys DesignWare ARC HS Processors, enabling designers to develop isolated, secure environments that help protect embedded systems and software from evolving threats in high-end automotive, storage, and gateway applications.

The Enhanced Security Package incorporates a range of features, including integrity protection, multiple privilege levels, and a watchdog timer that help protect system-on-chips (SoCs) against both logical and physical attacks, such as IP theft and remote attacks, without compromising performance.

ARC HS Processors with the Enhanced Security Package enable SoC developers to create devices less susceptible to security threats while eliminating the increased area and power consumption that an additional security core and associated memories would impose.

Synopsys DesignWare ARC HS Processors are based on the scalable, 32-bit ARCv2 instruction set architecture (ISA) and are optimized for performance efficiency, making them ideally-suited for a wide range of high-end embedded applications.

The Enhanced Security Package for ARC HS Processors offers integrity protection for registers and memory to detect fault injection attacks, which helps prevent the use of power or clock glitching to bypass secure boot checks or elevate the privilege level.

Access control of hardware resources and the system bus is protected by the HS Processors’ secure memory protection unit (MPU), helping to prevent an attacker from injecting executable code as data.

The availability of multiple privilege levels enables software applications to be isolated, making them less vulnerable to attack. Hardware stack bounds checking and compiler-inserted canaries prevent stack overflows that can be exploited to achieve arbitrary code execution or privilege escalation.

In addition, randomization of the base address for software prevents return-oriented programming (ROP) and jump-oriented programming (JOP) in larger systems running Linux.

“With the increasing amount of electronics in high-end applications like automotive safety systems, effective security measures are needed to limit external attacks,” said John Koeter, vice president of marketing for IP at Synopsys. “By extending our portfolio of security solutions with Synopsys’ new Enhanced Security Package for ARC HS Processors, we are enabling designers to implement the necessary functionality to safeguard their SoCs against malicious attacks while achieving the performance goals of their target application.”

from Help Net Security https://ift.tt/2BZRyKU

Zyxel launches a network security solution for SMBs

Zyxel Communications, a leading provider of secure broadband networking, Internet access and connected home products, announced the launch of ZyWALL ATP800 Security Gateway, an advanced network security solution for medium-sized businesses.

Designed to provide robust network and data protection for medium-sized businesses, ATP800 is the first Zyxel ATP (Advanced Threat Protection) firewall to incorporate the Cloud Query service to protect networks from zero-day attacks that can go undetected by conventional security solutions.

The rack-mountable ATP800 with Cloud Query provides advanced 24/7 protection against a rapidly evolving array of known and unknown cyberthreats using a multi-source cloud database that is consistently updated by trusted third-party sources and other Zyxel ATP firewalls nationwide.

ATP800 further safeguards the network with multiple layers of protection including content and botnet filers, app and email security, intrusion detection and prevention, geo-blocking, managed AP service, and cloud-based security monitoring and analysis software.

Features and Benefits of ZyWALL ATP 800:

• Self-evolving cloud intelligence: Unknown files or user patterns from Zyxel ATP firewalls are added to the cloud threat database and top-ranked threat intelligence is pushed to all ATP firewalls to provide a seamless defense shield against unknown threats. The continuously growing, self-evolving security defense ecosystem adapts to external attacks and keeps all ATP firewalls synchronized.
• Sandboxing: Unknown files are sent to an isolated cloud environment where they are emulated to identify whether they are malicious or not. Packet behavior is inspected in isolation to keep potential threats from entering the network and prevent against zero-day attacks.
• High-assurance multi-layered protection: Comprehensive security features including botnet filter, sandboxing, app patrol, content filtering, anti-malware, and IDP provide a multi-layered defense against advanced malware attacks.
• High-performance business-class solution: Supports up to 500 users with 8,000 Mbps of throughput; supports up to 2,000,000 concurrent TCP sessions; multi-WAN (Ethernet/SFP); up to 1,000 concurrent IPSec VPN tunnels; manage up to 130 access points (with Gold Security Pack subscription).
• Cloud-based analytics and threat reporting: Zyxel Cloud CNM SecuReporter provides a centralized view of user activities and threat statistics within the entire network. The suite of analysis and reporting tools includes network security threats identification and analysis, security services, security events, application usage, website and traffic usage, VPN status, and device health status.

The Zyxel ZyWALL family of ATP firewalls includes:

• ZyWALL ATP800 12-Port Gigabit Ethernet ATP Firewall with 2 SFP Ports ($1,999.99 street);
• ZyWALL ATP500 7-Port Gigabit Ethernet ATP Firewall with 1 SFP Port ($849.99 street);
• ZyWALL ATP200 4-Port Gigabit Ethernet ATP Firewall with 1 SFP Port ($599.99 street).

“The AV-TEST Institute reports that they are registering more than 350,000 new malicious programs and potentially unwanted applications every day,” said Tri Nguyen, Market Development Manager at Zyxel. “Our ATP firewalls are self-evolving security solutions that take network protection to the next level. The incorporation of cloud intelligence to the comprehensive suite of security capabilities is key to identifying and tackling unknown threats before they enter the network.”

from Help Net Security https://ift.tt/2TigI1p

Capsule8’s protection platform achieves PCI DSS certification

Capsule8, the only company providing comprehensive, high-performance attack protection for production Linux environments, announced that Capsule8 Protect has been certified as compliant with the Payment Card Industry Data Security Standard (PCI DSS 3.2.1), meeting requirements in such areas as intrusion detection and prevention systems (IDS/IPS), file integrity monitoring (FIM) and anti-virus (AV).

This certification establishes Capsule8 Protect as the leading PCI-compliant cloud-native security solution capable of being deployed in production Linux environments, including public cloud, containers, virtual machines, and data centers. This certification will allow enterprises to shift from multiple legacy controls to a single, simple solution that performs well even on the busiest workloads and networks.

Capsule8’s Protect platform works across all Linux production environments – whether containerized, virtualized or bare metal. Capsule8 Protect prevents attacks without relying on inherently reactive indicators of compromise, and also has a powerful policy-based protection capability that solves security exception management problems that have long plagued host-based policy solutions.

The Capsule8 platform performs even on busy servers and networks that previously were too mission-critical for agent-based security solutions that inevitably slow down systems. As a result, customers using the Capsule8 platform can now leverage a single platform that outperforms the functions of traditional IDS/IPS, FIM, and AV tools, without adding risk to production infrastructure.

The PCI DSS, developed by the founding payment brands of the PCI Security Standards Council, was created to provide an actionable framework for developing a robust payment card data security process – including prevention, detection and appropriate reaction to security incidents against a range of potential threats and attack profiles.

“The move to Cloud Native technologies is hard enough. Doing so while remaining PCI compliant has been a huge challenge for enterprises, and the quality of security has suffered as a result,” said John Viega, co-founder and CEO of Capsule8. “With just one product, Capsule8 now satisfies several key PCI requirements, and at the same time protects customers better, dramatically reduces false positives, and removes performance risk in a way that makes operations teams happy, all resulting in a smoother PCI audit process for our customers.”

Following a rigorous evaluation by DirectDefense, a leading provider of PCI and security assessment services for PCI DSS, Capsule8 was found to be a compliant solution for several controls regarding IDS/IPS, FIM and AV for architectures that rely on Linux for their host operating systems, and for enterprises that manage PCI compliance in house, including several of the key “control” statements in Requirements 5, 6, 10 and 11. This allows organizations to replace legacy IDS/IPS, FIM and AV solutions in their Linux production environment with a single solution.

Among the PCI DSS requirements the Capsule8 solution helps address are the following:

• Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs – Capsule8 provides comprehensive prevention and detection, not only for malicious and unwanted programs, but also zero-day attacks or those using previously unknown exploitation techniques.
• Requirement 6: Develop and maintain secure systems and applications – To stay ahead of the curve, Capsule8 Labs has a continuous process to identify and evaluate new and existing CVEs (Common Vulnerabilities and Exposures), testing its product continually against new exploits to ensure effectiveness — even by quickly writing custom exploits when no public exploit is available for a customer-impacting vulnerability.
• Requirement 11: Regularly test security systems and processes – Capsule8 Protect provides cloud-native detection and prevention capabilities that leverage workload-level data to provide vastly superior protection than traditional IDS/IPS. The solution also provides a policy capability, including File Integrity Management (FIM), that helps granularly define prevention strategies to automatically stop unwanted activity in even the most complex Linux production environments.

from Help Net Security https://ift.tt/2UkXHZa

Companies can save millions of dollars annually in preventable downtime and outages

Gremlin, the world’s first hosted Chaos Engineering service created by engineers formerly at Amazon and Netflix, announced ‘Gremlin Free’ which makes it easy for DevOps teams to get started with Chaos Engineering.

Gremlin Free includes the ability to randomly shut down servers, like the open source Chaos Monkey tool from 2011, but can also target specific hosts and simulate CPU spikes for more focused experiments. It also comes with a simple user-interface (UI), a halt button to safely rollback attacks, and industry-leading security not available with open source solutions.

Downtime is expensive: Gartner cites average per-company figures at $5,600 per minute (roughly $300,000 per hour), and for top eCommerce websites that figure can be millions per hour. The Gremlin team, made up of engineers and on-call leaders from Amazon, Netflix, Google and Dropbox, have developed tools that enable teams to better understand their systems and identify weaknesses before they cause outages and impact customers.

“Similar to a flu shot, the idea is to purposefully inject a controlled bit of harm in order to build up an immunity,” said Lorne Kligerman, Director of Product at Gremlin. “It’s still a new concept to most engineering teams, so we wanted to offer a free version of our software that helps them become more familiar with Chaos Engineering — both from a tooling and culture perspective.”

“I love Chaos Engineering and Gremlin’s service is the best there is,” said Charity Majors, CEO and Co-Founder of Honeycomb. “Injecting controlled failure into your systems to examine how they behave aligns perfectly with the goals of observability.”

Before launching Gremlin, CEO and Co-Founder Kolton Andrus worked at Netflix and built their second generation of fault-injection tooling (F.I.T.) to go beyond the limitations of Chaos Monkey. To date, Gremlin has raised $26.8Million in funding from Redpoint Ventures, Index Ventures, and Amplify Partners.

Existing customers include Expedia, Qualtrics, Twilio, Under Armour, and Walmart. Gremlin Pro offers a dozen different attack modes to better simulate real-life scenarios, as well as Application-Level-Fault-Injection (ALFI) for more granular attacks that work in serverless environments.

from Help Net Security https://ift.tt/2VtpeId

Egress releases new software to enhance protection against email data breaches

People-centric data security provider Egress has announced its latest releases, which use machine learning to improve sender and end user experience, and enhance protection against data breaches. The new software, Egress Risk-based Protection and Egress Smart Authentication, determine the actual risk of a data breach as information is sent and accessed via email, to ensure the right security is applied.

Both solutions tackle a common problem with security tools: that one-size-fits-all approaches often leave users frustrated or don’t ensure adequate security is applied to sensitive data. Typically, outbound email security tools (encryption) rely on static DLP rules or user actions (for example, encrypting emails at the desktop).

Risk occurs in these approaches when DLP rules aren’t updated frequently enough or if users make a mistake – for example, not choosing to encrypt sensitive information or sending it to the wrong recipient. Additionally, neither approach questions users’ intentions: for example, whether it’s normal for the individual to send emails at a certain time or to certain domains.

Risk-based Protection analyses these and other factors, including recipients’ security profile, in real-time to determine the actual risk of a data breach as information is shared via email, recommending the correct level of protection – including Egress Email Encryption, as well as TLS and other third-party solutions. As a result, organizations can have confidence that information is protected in line with data protection and data privacy regulations, such as GDPR, and that security tools are being utilized correctly.

Similarly, Smart Authentication will also change the way people interact with email security to improve user experience and data protection. Available as a feature of Egress Email Encryption, Smart Authentication has been designed to overcome one of the biggest challenges to email encryption solutions: recipient adoption. Current tools require recipients to authenticate to access encrypted emails, either through more secure but onerous password enrolment schemes or by using weak one-time passwords.

Usernames and passwords could see recipients struggling to access information and trying to find a work around, while one-time passwords are often delivered to the same mailbox as the encrypted email and therefore provide little assurance about who is accessing the information (particularly with the rise of business email compromise (BEC) attacks).

Smart Authentication uses AI and machine learning to analyse the level of risk when a recipient receives an Egress encrypted email, providing seamless access for trusted recipients (where the risk is low) and requiring more information or actions from the recipient when the risk is higher, for example if the recipient is accessing the email from an unknown or untrusted location.

The launch of this software comes after a successful year for Egress, culminating in $40m in a Series C financing round led by FTV Capital, with continued participation from existing backer AlbionVC.

Egress CTO Neil Larkins comments: “We’re very excited for the launch of this software, which feel will change the way email security solutions are consumed. User adoption is frequently a challenge for CIOs and security teams implementing email protection software. If internal employees using the solution or their recipients find it too challenging to use, they will often find a workaround. This leads to a growth of shadow IT and significantly increases the risk of a data breach and non-compliance with regulations like GDPR. We’ve developed and launched this software to tackle these problems head on and ultimately provide enhanced protection and compliance, as well as a way for organizations to realise ROI on their security investments through enhanced usage.”

from Help Net Security https://ift.tt/2EEr3wm

Red Hat launches new certification program to support the future of cloud-native telco infrastructure

Red Hat, the world’s leading provider of open source solutions, announced a new training and certification program emphasizing the next-generation of telecommunications innovation. The Red Hat Certified Architect Program in Telco Cloud focuses on the skills that telecommunications engineers need to build network functions virtualization (NFV) clouds, critical technologies that can help drive advanced services like 5G.

Used by Rakuten Mobile Network, as part of their collaboration with Red Hat in building a fully virtualized core-to-edge NFV cloud, the program is designed to help Red Hat Certified Engineers and Red Hat Certified Architects gain the knowledge needed to effectively use virtualized and cloud-native functions in building telecommunications infrastructure and services.

Red Hat Certified Architect Program in Telco Cloud

Red Hat Certified Architect in Infrastructure and Red Hat Certified Architect in Enterprise Applications are Red Hat’s highest certifications, representing both depth and breadth of skills and knowledge. The Telco Cloud Program consists of a certification path specifically recommended for professionals in the telecom industry that will lead to RHCA in Infrastructure.

Available now, engineers taking the program can gain the skills needed to build open, innovative next-generation infrastructure that covers core to edge processes and technologies, enabling them to more effectively create full-scale NFV clouds.

Participants must first become certified as Red Hat Certified Engineers, and then must earn the following additional certifications:

• Red Hat Certified System Administrator in Red Hat OpenStack
• Red Hat Certified Engineer in Red Hat OpenStack
• Red Hat Certified Specialist in Ceph Storage Administration
• Red Hat Certified Specialist in Ansible Automation
• Red Hat Certified Specialist in Configuration Management

Red Hat offers training aligned to all these certifications, available worldwide in a variety of self-paced and instructor-led options and languages. The Red Hat Learning Subscription provides the most flexible, cost-effective means of achieving RHCA.

“To deliver the future of telco innovation, engineers and architects need the proper skillsets to use emerging technologies like cloud-enabled NFV and Linux containers to their fullest. The Red Hat Certified Architect Program in Telco Cloud is designed to help these individuals gain a greater understanding of the technologies and processes underpinning next-generation telecommunications infrastructure and provide them with the knowledge to bring these advancements to their respective organizations. We’re pleased to have Rakuten Mobile Network as the first organization taking advantage of this program as they work to launch a fully virtualized, end-to-end cloud-native mobile network,” said Randy Russell director, Certification, Red Hat.

“The infrastructure of our new, innovative mobile network leverages complete virtualization of network functions across a telco cloud. This differs dramatically from traditional networks, and requires an entirely new set of skills and knowledge. Through the Red Hat Certified Architect Program in Telco Cloud, our engineers have been able to develop the skills to build and maintain the network, bringing us one step closer to making our vision of creating the world’s first fully-virtualized, end-to-end cloud-native network a reality,” said Tareq Amin, CTO, Rakuten Mobile Network.

from Help Net Security https://ift.tt/2Vsl17O

The “Momo challenge” – why it’s time to stop the hype [VIDEO]

Stellar Cyber raises $13.2M, rebrands from Aella Data and expands board and executive team

Validating its pioneering position in the rapidly-evolving cybersecurity industry, security analytics provider Stellar Cyber announced that it has closed $13.2 million in Series A funding.

This investment follows a period of rapid customer growth for the company as well as the crossing of major milestones including a corporate name change from Aella Data and an expansion of its board and executive team.

In an era where enterprises are grappling with a higher volume of cyberattacks, Stellar Cyber’s unified security analytics platform Starlight – a tool for security operations centers (SOC) and security professionals – is fast emerging as the timely and preferred solution.

This latest funding round is led by Valley Capital Partners, an early stage venture capital firm focused on security, enterprise infrastructure and AI, joined by existing investor Northern Light Venture Capital, as well as new strategic investor Digital Hearts and other investors. Stellar Cyber will use the funds to accelerate its go-to-market expansion and growth across all departments including sales, marketing, engineering, and product management.

Stellar Cyber rebrands from Aella Data

Additionally, Stellar Cyber rebrands from Aella Data. The company, which formally launched at the RSA Conference last year as Aella Data, has established itself as a pioneer in data-driven unified security analytics platforms. It introduced the market’s first data- and AI-driven platform security solution Starlight, that provides pervasive data collection, breach detection, investigation and response (CDIR).

The name change is significant for the company as its mission is to bring to light the darkness of network and computing environments by providing organizations better security visibility in an age of heightened cybersecurity threats and infrastructure complexities.

The company has deep roots in the security industry, with several founding and early team members and investors hailing from Netscreen Technologies, acquired by Juniper Networks for $4 billion. Team members have also worked at and helped pioneer Fortinet, Barracuda, Comodo, Aerohive and more.

New board member and executive

Helping Stellar Cyber in its next stage of growth are the additions of Steve O’Hara, founder and managing partner of Valley Capital Partners, as board member, and David Barton as Chief Security Officer.

• Steve O’Hara, a Silicon Valley veteran and entrepreneur, founded Valley Capital Partners in 2013. Steve was the original seed investor in Netscreen Technologies. He has also been the principal founder of three venture-backed companies – Nebula, OnFiber Communications, and CoreLogic – and a board member and investor in several others.
• David Barton is a security industry veteran with more than 20 years’ experience across a variety of sectors including telecommunications, healthcare, software development, finance, and government. Previously he was Chief Information Security Officer at Forcepoint and before that Head of Information Security at Hireright. Barton was also Director of Information Security at AT&T/Cingular for eight years.

“As the volume and pace of applications have skyrocketed, the number of vulnerabilities has exploded,” said Steve O’Hara, managing partner of Valley Capital Partners. “Stellar Cyber’s security analytics solution addresses a major pain point for the CISOs of modern enterprises: providing better security visibility in an age of heightened cybersecurity threats. It’s exciting to be an investor and board member in a company that is helping security teams in pioneering and meaningful ways.”

According to Changming Liu, Stellar Cyber’s CEO, “Our series A funding combined with our strong customer traction affirms the significance of our flagship product, Starlight. We have put into the hands of our customers and partners a powerful and comprehensive SOC solution that will protect them from the fates of Equifax and Marriott Hotels. It’s also an honor to work alongside industry veterans and to welcome on board new investors who believe in our vision for a safer world.”

from Help Net Security https://ift.tt/2SyATn9

API Fortress and Axway automate API testing across the agile product development lifecycle

API Fortress, a leader in continuous API testing, providing a complete suite of cloud or on-premises tools for agile development and CI/CD workflows, announces a beta release of an integration with Axway to automate API testing across the agile product development lifecycle.

With just the click of a “Build from Axway” button, developers and QA testers can work in parallel with instant feedback about API quality, thereby allowing teams to significantly shorten release cycles as well as standardize approved API tests for all internal and external API development on Axway. Anyone can log into an API Fortress account to see the integration.

Many enterprises including financial services and Insurance (FSI), banks, online retailers, and digital media services look to Axway and API Fortress to help tackle unique challenges on their paths to complete digital transformation.

While new regulations such as PSD2 (Open Banking) and evolving consumer preferences for more sophisticated digital experiences push enterprises to speed up innovation, many IT leaders fear the risks that acceleration may have with costly software defects that expose financial data.

Patrick Poulin, CEO at API Fortress, says, “‘Innovation speed’ and ‘data usability’ are the currency of a world in which digital experience decides winners. That means APIs have become the backbone for many companies. Our integration with Axway, a global leader in API management, signals a tipping point for IT leaders to rewrite the belief that increased speed means greater risk. With the Axway integration, we give our customers a purpose-built solution to maintain consistent API quality at any speed.”

Axel Grosse, VP of Innovation at Axway, remarks, “When combining Axway with API Fortress, business owners can deliver new APIs quicker, safer, and with more confidence. FSI organizations should standardize API testing on a single end-to-end platform to help maintain control over financial data exposure.”

from Help Net Security https://ift.tt/2GQ99ZP

A Clean Desk Starts With Cable Management, and Cable Management Starts With This Gear

A messy desk is not a sign of a genius—it’s a sign of a messy person—don’t get it twisted. The fact that “great” men had messy desks, e.g., Thomas Edison (racist), Steve Jobs (asshole), Donald Trump (racist asshole), etc., doesn’t permit you to live like a pig.

Read more...

from Lifehacker https://ift.tt/2GQm91G

To Defeat Perfectionism, Make Mistakes on Purpose

The urge to be perfect can prevent you from taking action. You don’t share creative projects that aren’t 100% ready, or you’re afraid to ask someone out if you’re not sure it’s exactly right—so you just ... don’t. If you’re feeling stymied by this need to never screw up, try making a mistake on purpose.

Read more...

from Lifehacker https://ift.tt/2NARp58

How to Keep Your Kid Safe on YouTube

You’ve probably seen it. That image—a creepy, what-the-hell-is-that lady-bird figure with bulging eyes and a chilling grin. Its name: “Momo.”

Read more...

from Lifehacker https://ift.tt/2TllI59

How to Schedule an Exact Delivery Day for Your Amazon Packages

What’s worse than waiting for an Amazon package? Finding out it will arrive sometime between tomorrow and a week from now, with no guarantee.

Read more...

from Lifehacker https://ift.tt/2T7wrBb

Don't Tickle Kids Without Their Permission

Tickling can be a fun way to bond with a kid—all that giggling and squealing is downright precious. If the kid likes it, that is. And surely they like it, right? After all, they’re laughing.

Read more...

from Lifehacker https://ift.tt/2VtcRvB

Your Breakfast Sandwich Needs Pickles

Breakfast sandwiches are a deeply personal affair. The classic combination of meat, cheese, egg, and bread is infinitely variable, with everything from one’s preferred egg doneness to regional processed meat delicacies contributing to each person’s ideal version. Personal preferences aside, most people would probably…

Read more...

from Lifehacker https://ift.tt/2EF0VBz

How to Get on ‘Jeopardy!’

Are you a trivia master? Or an Alex Trebek superfan? You could be on Jeopardy! The show’s application and testing process are open to anyone willing to put their knowledge to the test.

Read more...

from Lifehacker https://ift.tt/2T7cHgX

To Stop Worrying So Much, Deflate Your Own Ego

I know from neurosis. Seconds before writing this post, I heard “Hey Soul Sister” come up on our office’s playlist. I saw a visitor sitting someone from outside the company sitting in the lobby, and my bad broken brain thought, Oh no, what if she’s here for an interview and thinks our company is the kind of place…

Read more...

from Lifehacker https://ift.tt/2BYEo0H

How Severance Pay Is Taxed

You got laid off and are expecting a severance check from your former employer. You’re trying to work out a budget with that money in mind, picking up work to fill in the gaps. Then you finally receive the payment, but it’s for far less than you expected. What’s going on?

Read more...

from Lifehacker https://ift.tt/2T5nic9

What to Do When You've Found a Lost Dog or Cat

I love dog and cat transformation videos on YouTube.

Read more...

from Lifehacker https://ift.tt/2T70glh

The Pretty and Powerful Instant Pot Ultra Has Never Been Cheaper, In Two Different Sizes

The regular, 6 qt. Instant Pot is still on sale for $70, and honestly, it’s probably the one you should buy at that price. But if you need a larger model for a bigger family, or care about aesthetics and a few extra features, the Instant Pot Ultra just went on sale too, in two different sizes.

Read more...

from Lifehacker https://ift.tt/2EphlwK

How to Talk to Your Kids About Climate Change

Of all the tough conversations we should be having with our kids as they grow up, I’ll admit that educating my son about climate change has not exactly been a priority. We’ve had conversations about death, disability, mental illness, racism, sexism, poverty and gun violence. All of those felt like important, pressing…

Read more...

from Lifehacker https://ift.tt/2EDB8JY

Thursday's Best Deals: Switch Games, Akira, Philips Hue, Urban Decay Lipstick, and More

A Dutch oven, air fryer, Anker projector, and kitchen essentials lead off Thursday’s best deals.

Read more...

from Lifehacker https://ift.tt/2Vq5QvC

Deadspin Racist Fans Force Quebec Hockey Player To Leave Game Early With Family | The Muse Why Leavi

Deadspin Racist Fans Force Quebec Hockey Player To Leave Game Early With Family | The Muse Why Leaving Neverland’s Director Believes His Subjects’ Claims of Being Molested by Michael Jackson | Splinter Here’s Definitely Not Racist Mark Meadows Being Wildly Racist About Obama | The Root Buffet Brawl Over Crab Legs…

Read more...

from Lifehacker https://ift.tt/2ED6511