Passion, ingenuity and hard work: The cybersecurity startup story of Israel

According to Start-Up Nation Central (SNC), there are currently 400 cybersecurity start-ups operating in Israel. In 2018, they raised over $1.2 billion in 96 rounds of funding. That is more money raised than any other vertical market in the Israeli economy. However, as many as 80% of these companies fail to progress from the early stage to mature, high growth companies.

What does this typical growth trajectory indicate? Is it because of a highly competitive market where only a few companies can prosper? Israel is known for its start-up culture – does the country encourage entrepreneurship but not follow through on what is needed to support a business to grow for the long run?

Where creativity is nurtured and encouraged

There is one start-up company for every 1,400 people in Israel. This is the largest number of companies per capita in the world. Every Israeli knows what a start-up is and either knows someone who founded one or worked in one. This entrepreneurial spirit is so embedded within the Israeli economy, society and collective psyche that it has become a defining aspect of the country’s national identity.

Israel is known as “the start-up nation” for a few reasons. The first is the existence of a culture that supports entrepreneurship. The Israeli people, rather adapting to whatever change is on the horizon, are instead quite proactive in shaping their future. There is a cultural acceptance that there might be a failure in efforts to establish a business or new product. That acceptance makes the risk understood and the notion of it less fueled by fear.

Israeli businesspeople are aware that statistically a start-up has a greater chance of failing than succeeding. But, rather than being stopped by the possibility of failure, Israelis are instead motivated to work even harder to avoid it.

The entrepreneurial spirit is also nurtured from a young age. Parents and teachers in other cultures and countries might be more inclined to encourage children to pursue salaried careers at established businesses. In Israel, there is a great inclination to encourage and support innovative thinking and inventiveness.

Israel’s Defence Forces (IDF) continue the encouragement of entrepreneurship. IDF has access to all of Israel’s youth and are able to select the most skilled individuals for their elite technological units. It’s a competitive culture that produces a dedicated student that is constantly in pursuit of excellence and a work ethic that they carry with them throughout the rest of their working lives.

The IDF’s diverse recruits are taught to use the most up-to-date technologies and encouraged to seek new approaches in solving real-world problems, preparing them to spearhead revolutionary solutions in their chosen field and in the rest of the world.

Many of the IDF recruits become commanders before the age of 20. This high level of responsibility at such an early age breeds confidence and the required skillset for founding a business. IDF’s elite intelligence units are a springboard for many of Israel’s most successful IT companies.

Israel’s “do-it-yourself” approach supports it entrepreneurial spirit and success. The constraints that Israeli people have to work against give rise to innovation and flexibility. Israel does not have any natural resources to mine or from which to manufacture tangible goods, and its geographically sequestered location means that even if it did have natural resources to exploit, they would not likely be easily exported.

Software development – conceiving, designing and coding creating systems and applications -provides an export that is in worldwide demand. Israel’s necessity for innovation married with other entrepreneurial qualities of ambition, problem-solving and intellectual diversity, has given rise to a booming tech sector, and cybersecurity in particular.

Growth and change

As the cyberthreat landscape constantly grows and evolves, it follows that the world constantly needs new solutions. Israel’s economic and cultural conditions have enabled cybersecurity to flourish in meeting some of this demand.

Israel is filled with intellectual diversity, dynamism and benefits from the foresight of its entrepreneurs. Their expertise enables them to identify unsolved problems and challenge and begin developing approaches to solve them. This is the path to creating new solutions, new markets and sustain growth.

2018 was a boom year for this innovation-led growth. Israel’s start-ups began to move away from traditional cyber sectors, such as endpoint protection and email security, and looked to evolving fields like cloud security, IoT security, and security for blockchain and cryptocurrency. The network security market, which secured $546 million in funding in 2018, has grown, scaled-up and been monopolized, while IoT and the cloud present new opportunities for the up and coming generation of IDF recruits.

This ability to identify and tap into new market demands can be seen in Israel’s IoT market. In 2018, its 406 companies received $237 million; the fourth highest investment across all verticals. As of June 2019, IoT has received well over half of that figure, taking the number one spot for the highest amount of investment for a single industry in the Israeli economy.

This is good news. However, the abundance of companies within certain sectors can also lead to competition for limited resources. With so many aspiring companies competing for the same highly-skilled engineers and developers, it can be difficult to hire the best and the brightest talent.

In response, Israel’s budding cybersecurity start-ups have begun to collaborate to become more powerful, cost effective and survive the tumult of intense market competition in the beginning years. Israel’s tight-knit start-up economy also allows entrepreneurs to work together, share knowledge and use platforms like accelerators and meet-ups to continue to gain skills, knowledge and expand.

What’s next?

Revisiting the statistic that 80% of new businesses fail in Israel, the number of cybersecurity start-ups in Israel grows year-on-year. The desire to succeed and make an impact on the industry is engrained within Israel’s young professionals. Many of these aspiring entrepreneurs will be hired by large corporations and will, at some point, embark on creating new solutions and forming new businesses.

As long as the security demands of the world’s companies continues to grow and change, the trend for pioneering new solutions will continue as well, and Israel’s status as a global cybersecurity powerhouse will continue to flourish.

from Help Net Security https://ift.tt/314LlYn

Microsoft is right, mandatory password changes are obsolete

Microsoft has recently come out and said that mandatory password changing is ancient and obsolete. This goes directly against everything we were trained to think for the last couple of decades, and against most compliance directives including some of the most dominant security standards. And it is correct.

If anything, Microsoft hasn’t gone far enough: password changing is the visible tip of the iceberg – there are many other major inconveniences for our users that make bad security policy and should be done with.

One of the most destructive notions against good and practical IT security is the supposed axiom that security is the opposite of simplicity. This manifests in the popular “Dilbert” comics that depicts the typical office IT environment and has a recurring character called “Mordac the Preventer of Information Services”, which comes to capture the common belief that the IT security team is there to circumvent and ideally block all usable functions.

Like many things in life, the relationship between security and usability isn’t straightforward. In the very extremes that axiom seems to hold: if I can block all access to a machine (for example: bury a computer under 30 feet of concrete) that would probably make it as secure as it can ever be, and completely useless at the same time.

The other extreme is mostly correct too: if I give free and unfiltered access to a certain computer, it will be as insecure as can be: any wannabe hacker will be able to access any information on that machine (not to mention anyone passing by the server will be able to physically pick it up and take it) while anyone who wanted to use it for anything proper will have open and unfiltered access to it. Perfect usability with zero security, achieved.

As tempting as it may be to now draw a straight line between the “full security, no usability” and “no security, full usability” data points, the reality is that this is grossly incorrect in the middle. In most cases reducing inconvenience does not make something more secure and vice versa. No security feature shows it better than passwords.

Passwords were necessary to control access from the time humans started using non-human devices. Door keys are passwords that control who can access a house. Speakeasies used passwords to allow patrons to visit an illegal bar while blocking uninvited people from nosing around.

While with other humans we have a range of options, machines are not as flexible; it’s unlikely that a liquor store owner will card my grandfather, for example, but it’s near certain that the self-checkout machine will ask him for his ID every single time he buys a six-pack of beer. As we interact more and more with machines, passwords become a way we identify ourselves. In classic security theory we call this granting access based on “something I know”. That something is the secret password.

Playing the password game was reasonably ok while we were humans trying to prevent other humans from breaking into our systems; I choose a secret password and not tell you. The only way you can break into my system is try to guess what password I used. Not knowing what I know means you’ll have a very hard time guessing. There are more than 170,000 words in the English language. Good luck trying to guess the words I used as a password (assuming they’re even in the dictionary in the first place).

The problem with passwords surfaced once computers got involved in attacking other computers. Passwords are asymmetrical: humans are not good at remembering while machines have perfect memory. Humans take time to recall and type things while computers do it in milliseconds. So, as soon as those human attackers started getting assistance from computers, the game was skewed against us – like teenagers playing casual neighborhood basketball when suddenly one team asks their NBA player uncle to join their team. A computer that tries 1000 passwords per second will go through the entire oxford dictionary in just 3 minutes. It isn’t fun to play this game against computers.

This is where things took a bad turn. Applying the false maxim that “security is the opposite of usability”, security experts decided that making it harder for users to use systems via passwords will enhance its security. They therefore opted for more complex passwords; if dictionary words produce hundreds of thousands of combinations, adding digits (and then uppercase characters, and then symbols) adds order of magnitude of complexities. Suddenly computers need days, or weeks, or months to go through all combinations. Aha! Thinks Mordac the preventer, I may be making it somewhat difficult for my users, but I’m also blocking would-be attackers. What other choice do I have; after all, security is the opposite of usability!

What an unfortunate turn of events. Not only has this proven to not be true, but it also derailed the security world from finding a good solution to the problem (there are several). Let’s first see why it didn’t work.

The human brain likes simple patterns; the password ‘12345’ is easy to remember. So is the word ‘password’ (both were the world’s single most used password at some time or another). Team preventers decided to force users to use complex passwords, but humans adapt well. If ‘12345’ is not allowed, and ‘abcde’ is not allowed, I can use ‘abc123’ instead. Anyone who ever worked at a large IT company knows of dozens of clever ways to construct an amazingly simple password while bypassing the restrictions set by the password policy makers. In other words, an arms race started between users and their IT security people. The loser: both. The IT security staff was busy implementing advance password policies, the users were busy finding ways to circumvent these policies (not to mention posting secret passwords on post-it notes around the office) and attackers using computers were still able to crack these simple passwords in a variety of ways. In short – low security coupled with low usability.

Next came the single complex password era: as a user, I can come up with a single very complex password and remember it. The problem – I use dozens, maybe hundreds of services online and they all want me to use a security password. And so, this single (but very secure) password is used across hundreds of sites, and everything seems good for a while.

Until attackers compromise one of those online services. It doesn’t seem alarming at first: who cares if a cat meme generator site gets compromised by some hacking group? The problem is, of course, that my password is now exposed – the same complex password I use for my bank account and my main server at work. Computers have the ability to try my password against thousands of online services almost immediately, so before I hear about my password being compromised, dozens of my online services are already hacked. But what could I, as a user, do? I can remember a few simple passwords, or I can remember one complex password. But how can I remember many complex passwords? There is an obvious asymmetry between the attacker (using a computer) and the user (using a human brain). It’s not a fair match.

It took us more than 30 years to realize that passwords are the wrong direction. It could have been an instant conclusion if we just had gotten rid of the ‘security is the opposite of usability” false narrative. What if we come up with something that is easy for users to do but difficult for computers? Eureka.

As soon as we change the definition, solutions pop up everywhere. The Bank of America allows me to choose any 4-digit PIN that I want and then use it to withdraw real cash. They do that in a way that I can remember it and will not need to write it down; why is a simple 4-digit PIN (only 10,000 combinations) secure? Because it requires “something I have” (a debit card) in addition to “something I know” (the PIN code). Gmail and Facebook use the same method when they send you an SMS to confirm that it’s really you who is logging into the account – a mobile phone is “something you have”.

We also know how to block computers while minimizing disturbance for humans. The ‘CAPTCHA’ tests use abilities humans have naturally (like finding all the stop signs in a set of pictures) and computers struggle with. Another behind-the-scene protection is a temporary account lock-out after a few attempts. If you can’t enter your password within 3 tries you probably need a long time-out to quietly figure out what the password is before you can continue. Why allow a computer try millions of combinations an hour where we can limit it to 3 per hour, blocking these brute-force attacks while giving a very minor inconvenience to legitimate users?

We are just starting to move away from passwords, and unfortunately their inconvenience will be with us for a while. But realizing you have a problem is a necessary step towards a solution. The security world is just now realizing that inconveniencing users is not the right way to enhance security.

Our job as security professionals is to find those security solutions that provide maximum security with minimal inconvenience to humans; in a few decades it will be common knowledge that user convenience provides the best security. Let getting rid of passwords be the first step in that seemingly utopian direction.

from Help Net Security https://ift.tt/2YtUmws

The probability that an EV SSL certificate is associated with a bad domain is 0.013%

In 2018, phishing attacks were attempted 482.5 million times, more than doubling the number of incidents in 2017.

New research conducted by the Georgia Institute of Technology Cyber Forensics Innovation (CyFI) Laboratory confirms that a website with a company-branded address bar greatly decreases the chance of internet users falling victim to a malware attack or phishing (fraud) scam.

CyFI Lab’s research concluded that the presence of an Extended Validation (EV) SSL certificate represents a 99.987% likelihood that the site it represents is not associated with common forms of online crime.

The conclusion means that EV certificates play a critical role in assuring consumers that the website they are visiting is legitimate and safe to interact with – playing a much-needed role in online trust.

“Across the millions of domains with EV certificates that we studied, we found overwhelming evidence that EV certificates are highly indicative of a legitimate domain registered by a legitimate business,” explained Dr. Brendan Saltaformaggio, Professor & Director of the CyFI Lab, and co-author of the study, Understanding the Role of Extended Validation Certificates in Internet Abuse.

“The probability that an EV SSL certificate is associated with a bad domain is less than 0.013%. Our findings reinforce the notion that consumers should view EV certificates as a browser security indicator for trusted domains.”

To conduct the study, researchers cross-correlated a global repository of web domains with EV certificates against an aggregation of web domains associated with malware, suspicious activity blacklists, and underground marketplace communications.

EV SSL enables consumers to protect themselves from online fraud

SSL certificates create a secure communication tunnel by encrypting the data sent between a client and server, or between two servers, to prevent cybercriminals from modifying data.

When an active SSL certificate is present, users see a padlock (and never a “Not Secure” warning). There are three types of SSL certificates organizations use on their web pages:

• Good – Domain Validation (DV): The Certificate Authority confirms only that the registered domain is under the control of the certificate requestor. No other identifying information is validated or provided.
• Better – Organization Validation (OV): The Certificate Authority authenticates not only domain control, but also the identity of the legal entity or individual that requested the certificate. OV certificates provide a higher level of identity validation than DV certificates.
• Best – Extended Validation (EV): The Certificate Authority follows a uniformly high set of authentication procedures specified by the governing industry standards body to ensure that the true identity of the certificate holder is represented. Popular browsers display the authenticated company name in the address bar, often in the color green. EV represents the highest level of identity authentication an online business can receive.

“The presence of EV influences consumers’ perception of a brand or company,” said Tim Callan, Senior Fellow, Sectigo.

“EV certificates are reliably authenticated using techniques that have proven effective through a decade of industry-wide use. EV is a powerful tool to protect consumers from phishing and communicates that an online business has elected to use premium security practices.”

Tips for staying secure and safe online

According to PhishLabs, more than half of all phishing sites now use SSL certificates (June 2019). To avoiding phishing scams when browsing a website online or opening a link in an email message, Sectigo recommends that consumers look for the full company name at the left of the address bar to ensure the site is really part of the intended online business.

In addition, a user should never input credit card numbers, personal information, logins, or other sensitive data on any web page that is not secured with a certificate (as indicated by a padlock in the URL).

from Help Net Security https://ift.tt/2GGYgYy

Companies struggle with the slow, unpredictable nature of AI projects

Despite significant investment in AI, many companies are still struggling to stabilize and scale their AI initiatives, according to Dotscience.

While 63.2% of businesses reported they are spending between $500,000 and $10 million on their AI efforts, 60.6% of respondents continue to experience a variety of operational challenges.

This is evidenced by the fact that 64.4% of organizations deploying AI said that it is taking between seven to 18 months to get their AI workloads from idea into production, illustrating the slow, unpredictable nature of AI projects today.

The State of Development and Operations of AI Applications 2019 report findings are based on a survey of 500 industry professionals.

The research examines the AI maturity of businesses based on the practical business applications of machine learning, the tools and processes being used to develop, deploy and monitor machine learning models and the scalability and stability of their AI initiatives.

What is driving the use of AI today?

AI has moved beyond the experimentation stage and is now seen as a critical and impactful function for many businesses. Dotscience’s research revealed that:

• Efficiency gains (47%), growth initiatives (45.6%) and digital transformation (43.8%) are the top three drivers for AI adoption.
• Over 88% of respondents at organizations where AI is in production indicated that AI has either been impactful or highly impactful to their company’s competitive advantage.
• Nearly a third of respondents (30.2%) are budgeting between one and ten million dollars for AI tools, platforms and services.

The study also found that despite this level of financial commitment, data science and ML teams continue to experience issues, including duplicating their work (33%), rewriting models after team members leave (27.6%), justifying the value of their projects to the wider business (27%), and slow and unpredictable AI projects (24.6%).

“With the amount of resources and money that organizations are spending on their AI initiatives, they cannot afford to make sacrifices when it comes to the productivity and efficiency of the teams responsible for realizing their AI ambitions,” said Luke Marsden founder and CEO at Dotscience.

“It is difficult to be productive when different team members cannot reproduce each other’s work. Reproducibility is key to enabling efficient collaboration and auditability. Many companies still rely on manual processes which discourage collaboration and make it difficult to scale and accelerate ML teams.”

Call to action: Data science and ML teams – do away with manual tracking!

Before the DevOps movement, practices such as version control and continuous integration were not commonplace––it was typical for software to take months to ship.

Today, companies can ship software changes in minutes. History is now repeating itself in the AI and ML sphere, with teams experiencing productivity and collaboration challenges analogous to those of the pre-DevOps software development era.

AI deployments today are slow and inefficient. Moreover, the manual tools and processes predominantly in use to operationalize ML and AI do not support the scaling and governance demanded of many AI initiatives. Results from the study indicate that:

• The top two ways that ML engineers or data scientists collaborate with each other are using a manually updated shared spreadsheet for metrics (44.4%) and sitting in the same office and working closely together (38%).
• Nearly 90% of respondents either manually track model provenance––a complete record of all the steps taken to create an AI model––or do not track provenance at all.
• Of those that manually track model provenance, more than half (52.4%) do their tracking in a spreadsheet or wiki.

“Manual processes are cumbersome, discourage collaboration and create knowledge silos within teams,” explained Marsden. “When model provenance is tracked manually, AI and ML teams often use spreadsheets without an effective way to record how their models were created. This is inflexible, risky, slow and complicated. To simplify, accelerate and control every stage of the AI model lifecycle, the same DevOps-like principles of collaboration, fast feedback and continuous delivery should be applied to AI.”

According to Gartner’s 2019 CIO Survey, the number of enterprises implementing AI grew 270% in the past four years and tripled in the past year.

While AI is increasingly in use throughout the modern enterprise, many organizations will be unable to realize the full potential of their deployments until they find faster and more efficient means of tracking data, code, models and metrics across the entire AI lifecycle.

from Help Net Security https://ift.tt/2GFmPFh

Gurucul Network Behavior Analytics solution provides identification of advanced and unknown cyber threats

Gurucul, a leader in behavior based security and fraud analytics technology for on-premises and the cloud, announced the Gurucul Network Behavior Analytics (NBA) solution, the industry’s most advanced Network Traffic Analysis product.

It leverages Gurucul’s advanced machine learning analytics to provide identification of advanced and unknown cyber threats.

The Gurucul Network Behavior Analytics solution delivers flexible entity modeling to monitor and identify unusual, risky behavior from any entity.

This includes traditional devices like workstations, servers and firewalls, as well as extended network devices such as Robotic Process Automation (RPA) processes, IoT devices (CCTV, vending machines), OT infrastructure (automation sensors used in manufacturing and utility industries) and point of sale (POS) devices.

Most organizations tend to rely on network monitoring tools for checking the health of the network. These tools detect and report failures of devices or connections. However, they cannot repair problems, nor can they find unknown threats.

By applying behavioral analysis to network traffic, a network traffic analysis solution can help organizations identify suspicious activities that conventional cybersecurity tools would overlook.

“The adoption of cloud, mobile and IoT technologies is creating a much larger attack surface, while exposing organizations to entirely new categories of security threats including malicious bots and scripts,” said Nilesh Dherange, Chief Technology Officer for Gurucul.

“As a result, addressing entity-based security threats in the network has become imperative. With very few inherent means to monitor devices and their behaviors, Gurucul’s network traffic analysis technology provides valuable detection, risk-scoring and alerting capabilities to preempt malicious activity.”

Gurucul Network Behavior Analytics

Gurucul Network Behavior Analytics identifies unknown threats using advanced machine learning algorithms on network flows and packet data.

The solution uses entity models to create behavior baselines for every device and machine on the network based on network flow data such as source and destination IPs/machines, protocol and bytes in/out. It also leverages DHCP logs to correlate IP specific data to machines and users.

Gurucul Network Behavior Analytics comes with pre-packaged machine learning models pre-configured and tuned to run on high frequency network data streams to detect real-time anomalies and to risk rank threats.

Tied into the Gurucul User and Entity Behavior Analytics (UEBA) platform, the solution provides 360-degree visibility across network, identity, access and activity on enterprise applications or systems.

This contextual linked data and extensive library of out-of-the-box behavior and threat models help identify advanced and unknown threats like zero-day exploits, fileless malware, and ransomware.

It does so by detecting unusual behavior on a given entity (e.g. server, IP, device), related lateral movement within the network, command and control (C2) communication, suspicious account activity from a compromised account and access misuse.

The product’s data processing and analytics framework quickly detects threats in real-time, as well as uncovers APT / Stealth attacks which lay dormant between various stages of a cyberattack.

from Help Net Security https://ift.tt/2GFahxH

RiskIQ JavaScript Threats Module protects orgs’ high-traffic payment pages from JavaScript attacks

RiskIQ, the global leader in attack surface management, announced the launch of RiskIQ JavaScript Threats Module to ensure customer trust in e-commerce by protecting organizations’ high-traffic payment pages from JavaScript attacks.

The module is part of a comprehensive platform for reducing threats to organizations’ internet attack surfaces. JavaScript Threats is the only enterprise-scale product trusted by the largest financial and e-commerce companies and powered by the threat intelligence of industry-leading experts on Magecart JavaScript attacks.

JavaScript Threats leverages RiskIQ’s proprietary global discovery infrastructure to build complete, dynamic inventories of organizations’ websites, including critical e-commerce assets with their own and third-party JavaScript.

It then monitors the web assets and JS resources, creating alerts for malicious and suspicious changes so organizations can quickly detect JavaScript attacks.

Magecart cybercriminals inject malicious JavaScript code into web pages once every five minutes, according to RiskIQ threat research group’s detection data. These attacks can be direct compromises or supply-chain compromises.

Supply chain attacks target third-party JavaScript resources, such as analytics trackers, website optimization tools, and chat plugins, and give threat actors massive reach by multiplying their attack across potentially thousands of websites.

Businesses incur reputational and financial damages such as loss of customer trust and market share, lawsuits, and punitive regulatory fines.

The damages caused by JavaScript attacks came into sharp focus earlier this month when the UK Information Commissioner’s Office proposed a £183 million ($224 million) fine on British Airways.

The JavaScript attack on its website resulted in the theft of credit card data for almost 500,000 customers. This proposed fine represents 1.5% of British Airways 2017 revenues and could have been as high as 4% of revenues, or £489 million ($598 million).

The breach, analyzed by RiskIQ threat research group in September 2018, was carried out by one of the most sophisticated Magecart cybercriminal groups.

“Many organizations have almost no visibility into their web assets, third-party web resources, and the way their customers and employees interact with them,” said Elias Manousos, RiskIQ CEO and co-founder.

“Because of this, JavaScript attacks have become the go-to method for threat actors to target digital businesses, their customers, and their employees in a stealthy manner.”

The 2019 Verizon Data Breach Investigations Report: Executive Summary substantiates the prevalence of JavaScript attacks. The report highlights that malicious code designed to capture data entered into web forms is the primary attack pattern for breaches in the Retail, Professional Services, Finance, and Manufacturing industries.

The Verizon report also states: “Payment card web application compromises are well on their way to exceeding physical terminal compromises in payment card-related breaches. Data from one of our contributors, the National Cyber-Forensics and Training Alliance (NCFTA), substantiates this shift appears to have already occurred, and our larger data set is also trending that way.”

Magecart JavaScript attacks are likely to increase, as they have been highly successful. RiskIQ threat research group has pointed out previously that Magecart is an active threat that operates at a scale and breadth that rivals, or may even surpass, the compromises of retail giants such as Home Depot and Target.

The Magecart actors have been active since 2015 and have never retreated from their chosen criminal activity. Instead, they have continually refined their tactics and targets to maximize the return on their efforts.

Cybercriminal syndicates have created entire economies around JavaScript attacks with vibrant, lucrative markets emerging for stolen data, web skimmers, and compromised websites.

“Actors like Magecart are responsible for some of the most high-profile breaches in recent history, and thousands of businesses have been targeted with stealthy attacks on their e-commerce web assets,” Manousos said.

“With JavaScript attacks poised to carve out a significant portion of the threat landscape for years to come, businesses will be forced to evaluate their security strategy and investments to address them.”

from Help Net Security https://ift.tt/2GFeBx1

Masergy unveils integrated and bundled options for SD-WAN security

Masergy, a leading provider of managed SD-WAN, cloud communications and managed security solutions, announced industry-unique bundles that combine its Managed SD-WAN solutions with advanced security services.

Masergy Managed SD-WAN delivers simple, secure, and scalable connectivity that improves application performance, reduces cost and increases agility. A recent IDG survey indicated that for 81% of buyers, security was the top criteria in selecting SD-WAN services.

With deep expertise in both software-defined networking and sophisticated threat detection and response, Masergy is now providing customers with integrated and bundled options for SD-WAN security.

Masergy’s three new SD-WAN bundles include options for:

• Unified threat management (UTM): This built-in capability integrates a range of security features including web filtering, antivirus, data loss prevention, and intrusion detection and prevention into a single platform.
• Threat monitoring and response: Advanced protection includes 24/7 threat monitoring and real-time incident response for the entire SD-WAN deployment by certified security experts in global Security Operation Centers (SOCs).
• Managed security services: Comprehensive managed detection and response services for cloud, on-premises and hybrid environments, including an advanced security tool suite with machine-learning behavioural analytics, embedded threat intelligence, and 24/7 security monitoring and incident response.

“We’re witnessing a sustained increase in SD-WAN adoption across many verticals and industries,” said Mike Sapien, Chief Analyst of Enterprise Services at Ovum.

“From survey work, Ovum sees security as the top concern for SD-WAN deployments. Customers want the application performance benefits provided by SD-WAN, but lack the internal resources necessary to ensure their network remains secure against all attack vectors.

“Masergy is in a unique position to offer differentiated Managed SD-WAN with advanced security services for customers with its tightly bundled offerings.”

“As leading enterprises are embracing the strategic advantages of a robust SD-WAN solution, they are also realizing the critical importance of securing their networks,” said Terry Traina, Chief Digital Officer at Masergy.

“Our new SD-WAN bundles are currently the only solution on the market for companies that want the performance of SD-WAN coupled with the peace of mind that comes with 24/7 security monitoring and response.”

from Help Net Security https://ift.tt/2OwOkHG

eGlobalTech launches Auxilium, an AI solution for federal and commercial organizations

eGlobalTech, A Tetra Tech Company, is pleased to announce the launch of Auxilium, eGlobalTech’s premier Artificial Intelligence (AI) solution.

Auxilium is an open source chatbot solution which answers internal and external stakeholder questions efficiently and effectively, empowering teams to focus on higher-level tasks and complex business problems.

An innovative and impactful tool for both federal and commercial organizations, Auxilium:

• Understands intent
• Answers questions in milliseconds
• Monitors impact through a customizable dashboard of detailed analytics
• Supports your brand through tailored answers and the interface’s aesthetic
• Integrates seamlessly with existing tools, including Salesforce and Slack
• Replies to voice commands, increasing accessibility
• Assists stakeholders’ securely with data protection and access control
• Avoids significant changes to your system, negating the need for an Authority to Operate (ATO)

Jesus Jackson, eGlobalTech’s Head of eGT Labs, said, “Our chatbot is designed with the latest in machine learning and AI technology to troubleshoot questions while reducing your team’s workload. With Auxilium’s support, your employees can focus on the bigger picture.”

eGlobalTech’s AI chatbot has endless possibilities for organizations, from relieving a help desk to assisting with internal training to supporting web portal service functions.

from Help Net Security https://ift.tt/31bFIaX

Aqua Security releases runtime protection for Pivotal Cloud Foundry

Aqua Security, the leading platform provider for securing container-based and cloud native applications, announced the public release of Aqua Security’s runtime protection for Pivotal Cloud Foundry (PCF).

Users of Pivotal’s platform can download and install the Aqua Security for PCF service from Pivotal Services Marketplace, and deploy an end-to-end solution for scanning, application assurance and runtime protection for their application workloads.

PCF includes a widely deployed distribution of Cloud Foundry Application Runtime (CFAR) and allows customers to implement the same application platform on any major vendor’s cloud, on premises or in a hybrid model.

“No matter where they began their journey with Pivotal, enterprises routinely begin pushing code into production faster and more frequently with our platform. Therefore, application security checks must be accessible within the deployment pipeline in order to scale safety and compliance,” said Angus MacDonald, GM Technology Ecosystem at Pivotal.

“Solutions such as Aqua provide the automation and controls necessary. Together, we hope to make the task of implementing end-to-end security simpler for our customers.”

Aqua Security for PCF is offered in two tiers – standard and advanced protection. The standard tier allows users to:

• Scan their applications for vulnerabilities during the Continuous Integration process
• Provision policies to block unauthorized applications during the staging phase
• Scan and monitor application or container artifacts for vulnerabilities, malware, and user activity
• Apply host assurance policies for application or container artifacts

Aqua’s advanced protection tier includes all of the standard features with an added layer of security, allowing users to:

• Detect and block unapproved changes to running application workloads
• Monitor and control application activity based on customized policies
• View application network connections and apply firewall rules that whitelist authorized connections
• Leverage granular audit trails of access activity, scan events and coverage, application activity and system events

Aqua Security for PCF installs natively as a Buildpack (containing the languages, runtimes, libraries, and services used by the app), and the advanced runtime protection component is implemented as a Bosh add-on, protecting all Pivotal Application Service apps without requiring any manual changes or individual re-deployments of Aqua per application.

Since introducing scanning for Pivotal Cloud Foundry last year, we have seen tremendous interest in the PCF platform at some of our largest customers”, said Upesh Patel, VP of Business Development for Aqua.

“As they progressed in their application rollouts, they are now looking to protect their production-grade applications as well, and we are pleased to deliver the complete Aqua solution for Pivotal Cloud Foundry today.”

from Help Net Security https://ift.tt/2LRKgj9

Confluera launches its Early Access Program for Real-time Attack Interception and Defense platform

Confluera, the real-time cybersecurity company, announced that it has raised $9 million in Series A funding led by Lightspeed’s Ravi Mhatre with significant participation by John W. Thompson, former CEO of Symantec; Frank Slootman, former CEO of ServiceNow; and Lane Bess, former CEO of Palo Alto Networks.

The company also launched its Early Access Program for Real-time Attack Interception and Defense platform.

In spite of aggregate security spending exceeding $124 billion, businesses around the world are struggling to detect and stop ever-increasing cybersecurity attacks.

These attacks typically blend in the environment, dwell over potentially long periods and use stealthy techniques to move around the infrastructure leading to devastating data breaches and reputational damages.

However, the cybersecurity industry continues to focus on largely ineffective point solutions with narrow visibility, inconclusive correlations, and post-facto breach analysis.

Confluera offers complete real-time visibility and automated response to security breaches by fusing machine comprehended threat rankings with accurately tracked activity trails.

This marks the beginning of an era in cybersecurity space where manual threat hunting and correlations are replaced by deterministic and autonomous tracking of the attacker’s intent and progress. Enterprises can now automatically manage security risks across their critical infrastructure.

The Confluera platform is underpinned by patent-pending Distributed Execution Trail Ranking technology. The technology leverages distributed ledger principles to deterministically track infrastructure wide activity trails while continuously aggregating machine-comprehended behavioral signals on these trails.

These trails are scored and ranked to conclusively intercept ongoing attacks out of a haystack of disconnected signals and automatically deliver surgical responses.

“Confluera addresses today’s cyber threats with a game-changing platform that eliminates costly and ineffective solutions that rely on manual triages and probabilistic correlations. Our platform delivers deterministic and autonomous protection against cybersecurity threats,” says Confluera Co-Founder and CEO Abhijit Ghosh.

“We are fundamentally changing how businesses manage security risks.”

Early Access Program

Demonstrating the pent-up demand for a new approach to cybersecurity, Confluera is already working with several customers and partners. Starting today, the Real-time Attack Interception and Defense platform is now available through Confluera’s Early Access Program.

“As a global company, we are always concerned about protecting our core applications and data against ever-increasing cyberattacks. None of the solutions in the market could detect breaches in real time, and more importantly, remove them surgically.

“With Confluera, we are able to accurately detect and respond to breaches in real time without impacting our business.” – Sean Henry, Sr. MIS Manager, American Showa

“With the number of data breaches in the headlines on a daily basis, and customer-sensitive data appearing on the dark web, we at CohnReznick are focused on state-of-the-art technologies that can help us detect and thwart ongoing attacks.

“Confluera allows us to very easily deploy a unique solution that operationalizes our critical infrastructure security.” – Richard Cannici, Head of Infrastructure and Security, CohnReznick

from Help Net Security https://ift.tt/2ZjqVu6

Sixgill unveils HyperLabel, a new desktop data labeling application for ML

HyperLabel, a new desktop data labeling application for Machine Learning (ML) just announced by Sixgill, offers the fastest path to creating high-quality labeled datasets for better ML models.

With HyperLabel, there’s no need to upload files to an external service. Users retain complete ownership, privacy and control of their data, while accelerating project onboarding and completion with quick and easy usability anchored on the desktop. It’s all cloud-free, highly scalable and locally installed.

HyperLabel is designed to be fast, easy and accurate, from setup to label export. Customizations are straightforward and explanations are clear. HyperLabel will even use ML itself to give labeling projects a speed and accuracy boost with pre-trained models for common objects that will automatically create labels for you.

An easy QA interface will enable quick and efficient batch reviews of labeled data, to further streamline and simplify the labeling process. This will allow developers, engineers and data scientists to spend less time labeling and more time training their ML models.

Because HyperLabel is so easy to use with the power of ML, labeling projects will be more error free. HyperLabel enables accurate labeling that is critical to the success of ML models and the applications they inform. Labeling errors or inconsistencies damage the quality of training datasets, inhibit model performance and are causing many ML projects to fail.

With disruptive new tools that save time, cut costs and increase user control with a cloud-free, locally installed implementation, HyperLabel upends the assumption that accurate labeling is inevitably tedious and slow.

HyperLabel is available now for download via the Mac App Store or Microsoft Store. Valuable new features will be included in early August. Additional versions of HyperLabel will launch in the coming months, accommodating the full spectrum of data labeling needs, from individual developers to large teams:

• Developer, available now, is free to get started and includes the first 3,000 labels created.
• Developer Unlimited, beginning on August 12, will give users unlimited labels for only $9.99 per month after they surpass the first 3,000 labels. Optionally, users can select a pre-paid annual subscription for only $99.
• Pro, when released later this year, will offer powerful enhancements and advanced capabilities such as ML-assisted object tracking and pre-trained architectures, cloud collaboration, import/export support and labeling of 3D data types including DICOM, LiDAR.
• Enterprise, available now, will meet the needs of organizations with large and distributed data science teams; licenses will be custom-quoted based on scope.

“For our own customer projects, we need fast, high-quality data labeling to build ML solutions, including vision models for object identification in video data,” says Logan Spears, Innovation Chief at Sixgill.

“None of the available labeling tools gave us what we needed, so we built HyperLabel, and it worked so well that we had to share it. Developers shouldn’t have to trade speed for quality and ease of use.”

HyperLabel will deliver these powerful features and benefits:

Data privacy & control: With HyperLabel, you’ll always retain complete ownership, privacy and control of your data. Keep it private and label it where it lives. You are not forced onto the cloud.

Simple user experience: Get from project setup to label export in a few easy steps. Label objects without unnecessary clicks. See how much is left to do, and if the file you’re viewing has already been labeled.

Scalable: HyperLabel can handle even the most complex data labeling projects and can be used by solo developers, up to large teams. Or, request HyperLabel Managed Labeling Services and let HyperLabel experts do it for you.

Easy access: HyperLabel puts everything you need right at your fingertips. No need to upload files to an external service. Simply import your files from a hard drive or connect to your cloud storage and label away!

Easy export: Export labels to JSON, COCO, Pascal VOC, YOLO and other common formats, and include them in your training process.

Flexible user-defined schemas: Configure label schemas by selecting from rectangles, polygons, point, feature points, free text, select and multi-select, for almost any use case.

ML-automated labeling: HyperLabel uses the power of ML itself with pre-trained classifiers for predictive labeling of common objects. Advanced ML integration is coming soon.

Confident QA: The Quality Assurance (QA) interface will let you perform quick and efficient batch reviews of labeled data to ensure quality and accuracy.

Saves money: Labeling projects can sometimes take weeks or months and cost tens of thousands of dollars. HyperLabel optimizes and accelerates the process, so labeling gets done faster.

from Help Net Security https://ift.tt/2GBbupF

Western Digital boosts performance and cost-effectiveness of its ActiveScale storage system

Western Digital announced enhancements to its ActiveScale storage system portfolio, making it one of the highest performing and most cost-effective object storage platforms for storing, managing and extracting value from the ever-expanding universe of unstructured data.

With the introduction of OS 5.5, ActiveScale becomes an even more integral part of an IT infrastructure by expanding its comprehensive set of data management capabilities for streamlining workflows and reducing latency barriers for multi-site data distribution.

More than ever, enterprises are realizing that to extract timely insights from a multitude of unstructured data sources requires the right infrastructure that delivers both sustained performance and predictable costs at scale.

Yet research continues to show that most data goes unstored or unanalyzed, data siloes persist, governance remains inadequate, and a disproportionate amount of time is spent simply discovering and preparing data.

To solve these challenges, IT leaders are increasingly turning to ActiveScale, a cloud-scale object storage solution that provides extreme data durability, scalability and operational simplicity with unmatched storage economics.

Industry-leading scale-out performance

As the leader in its class for HDD-based object storage, ActiveScale leverages its scale-out architecture to provide near-linear performance growth for data-intensive applications such as AI, machine learning and HPC workloads.

With its industry-leading performance, the ActiveScale X100, coupled with OS 5.5, is projected to deliver data throughput of up to 75GB/second in scale out configurations, making it the ideal solution for large-scale data workflows.

Data Pipeline Service

The ActiveScale Data Pipeline Service offers a versatile way to stitch together distributed web-scale applications to streamline data processing. With real-time object notifications from ActiveScale, business applications can optimize task initiation for improved productivity and faster time to value.

This new notification feature simplifies workflow processing for a variety of use cases, including real-time analytics, IoT, mobile applications, media and entertainment, and business processes.

Asynchronous Geo-Spread

ActiveScale Geo-Spreading is an advanced data protection scheme that delivers outstanding system availability by spreading data across geographically dispersed availability zones.

The new OS 5.5 adds asynchronous mode support, which enables low-latency data ingest for IoT applications without compromising system availability. Customers can now choose between synchronous or asynchronous geo resiliency with Geo-Spread to meet their unique needs.

Improved storage density and economics

Well known for its unmatched TCO at exabyte-scale, ActiveScale enables customers to further reduce CAPEX and overall hardware footprint with improved storage economics.

With the integration of new 14TB Ultrastar data center-class drives, customers can take advantage of the 16 percent increase in storage density and improved cost/capacity, without increasing power and cooling costs.

“ActiveScale 5.5 further extends the unique value that only Western Digital can deliver in terms of performance, efficiency, scalability and superior economics for those putting data at the center of their business,” said Phil Bullinger, senior vice president and general manager of Western Digital’s Data Center Systems business unit.

“We’re extremely proud of the innovation that has gone into developing solutions that enable our customers to make data infrastructure synonymous with a successful data business strategy.

“The world of big data may be complex, but by listening to customers, we’re more confident than ever that our ActiveScale system meets the needs of even the most demanding data-centric environments.”

In addition to the ActiveScale cloud object storage system, Western Digital’s full data center portfolio includes the IntelliFlash family of NVMe-based all flash and hybrid flash arrays; OpenFlex NVMe over Fabrics (NVMe-oF) open composable infrastructure; Ultrastar server and storage platforms; Ultrastar memory extension drive; and its family of Ultrastar data center-class HDDs and SSDs.

from Help Net Security https://ift.tt/2yqWN42

Attivo Networks’ portfolio enhancements lock down endpoints so attackers cannot advance

Attivo Networks, the award-winning leader in deception for cyber security threat detection, announced significant portfolio enhancements that effectively lock down the endpoint so that attackers cannot advance their attacks. These innovations include securing Active Directory and the ability to turn every endpoint into a network decoy.

The company’s ThreatDefend Detection Platform provides a comprehensive deception fabric that interweaves decoys, lures, and breadcrumbs throughout the network. By blending in seamlessly with the production environment, the deception fabric sets landmines and bait to derail attackers and alert on their presence.

These new ThreatDefend offerings go one material step further by creating a deception blanket over the endpoint so that regardless of the attack method a cybercriminal chooses, they cannot bypass or avoid detection.

“Deception has been highly successful in casting a net over the network to snare adversaries,” said Srikant Vissamsetti, senior vice president of engineering at Attivo Networks.

“We have now tightened the net so that there is no way for an attacker to be able to get through. With the traditional perimeter’s disintegration and the increased need to secure endpoints, the ThreatDefend Platform will be a critical resource for every defender’s security suite.”

The company’s new Active Directory solution, which can be purchased standalone or as part of the ThreatDefend Endpoint Suite, intercepts advanced attacks (APTs) and contains them automatically at the endpoint.

When Active Directory queries are made, the response gets altered and deceptive content is added, creating an altered reality for the attacker. Valuable enterprise resource information can now be hidden, and attack surfaces reduced.

With the redirection of activities into the deception environment, the attack can also be safely studied and Tactics, Techniques and Procedures (TTPs), along with company specific threat intelligence, gathered.

The company also announced new platform capabilities that monitor available services on production endpoints and redirect attempted access into a deception environment.

Every endpoint on the network becomes a decoy and when paired with the company’s deception lures, locks down an attacker’s ability to break out from the endpoint without getting caught.

In addition to early attempted lateral movement detection, defenders gain visibility into the attacker’s tools, the use of malicious software, and the ability to quickly quarantine infected systems.

Attivo doubles down on detecting lateral attack methods

The time it takes for an attacker to move off of an initially compromised system – breakout time – has been recorded at an average of 4.5 hours, making it critical to stop lateral movement and prevent an adversary from establishing a foothold.

The new ThreatDefend Platform offerings now not only interweave deception throughout the network but also make every endpoint a decoy designed to disrupt an attack’s ability to breakout. It also does this without requiring agents on the endpoint or disruption to network operations.

The attack methods include, but are not limited to:

• Steal local credentials
• Look for file shares and connected systems
• Network reconnaissance as they look for hosts (production assets) and available services on these hosts
• Active Directory Reconnaissance to query AD to find privileged domain accounts, system accounts and high value systems
• Man-in-the-Middle attacks where credentials are stolen in transit

“The attacker’s ability to rapidly gain a foothold, complete reconnaissance, and quickly move through an enterprise will be severely impacted through the deployment of a well-orchestrated deception solution that includes these new capabilities,” said Chris Roberts, chief security strategist at Attivo Networks.

With the latest expansion of the ThreatDefend Platform, the company has further enhanced the portfolio’s overall capabilities to not only detection and response but also in the identification and prevention of insider and external threats. The portfolio enhancements include:

• Identification and prevention: Insight into attack path vulnerabilities as well as the ability to detect and redirect active attackers. At risk credentials and paths can be automatically remediated for attack surface reductions.
• Endpoint detection: In addition to an extensive offering of credential, file share, and cloud access management, the company has added the ability to redirect attacks into a deception environment as they attempt to target unused services.
• Network detection: A full suite of high interaction decoys creates a full deception fabric for the early detection of reconnaissance, AD reconnaissance, and Man-in-the-Middle attacks.
• Analysis: The deception management server automates the gathering and analysis of threat intelligence and forensics and displays it in its new Informer dashboard.
• Response: Automated incident response is achieved through over 30 native integrations with firewalls. SIEMs, NACs, Endpoint Detection, Response (EDR), and orchestration solutions.

from Help Net Security https://ift.tt/32VFlmm

GTT expands its SD WAN offer with additional features on uCPE

GTT Communications, the leading global cloud networking provider to multinational clients, announced it has expanded its SD-WAN service by adding the capability to run multiple network applications on a single universal customer premises equipment (uCPE) device.

uCPE enables more cost-effective and efficient delivery of network services, including centralized management of software updates and more flexible service customization.

GTT leverages virtualized network function (VNF) technology to deliver multiple services, such as SD-WAN, firewall and WAN optimization, on the same uCPE device, eliminating the requirement to deploy multiple hardware devices at a single client site.

“GTT is advancing its portfolio of cloud networking services with new functionality. We will continue to expand our SD-WAN offer with additional features on uCPE to connect our enterprise clients to any location in the world and every application in the cloud,” stated Rick Calder, GTT president and CEO.

GTT SD-WAN provides direct connectivity to leading cloud service providers across its Tier 1 global IP network with 600 points of presence on six continents and established relationships with thousands of network suppliers that enable GTT to deliver redundant last-mile connectivity options around the globe.

“Consolidating network functions such as routing, firewall and WAN optimization on a single device lowers hardware costs and improves agility by making it easier to manage remote offices and roll out new networking services,” commented Cliff Grossner, executive director of research and analysis at IHS Markit.

“Our research findings indicate that interest in uCPE is growing strongly from enterprises that want to automate management of their edge connectivity and is an increasingly important element used by service providers to deliver SD-WAN.”

from Help Net Security https://ift.tt/2SUi4g9

Zyxel’s new Pro Outdoor Router provides high-speed broadband services over existing LTE networks

Zyxel Communications, a leading provider of secure broadband networking, Internet access and connected home products, announced it has begun shipping the LTE7480 LTE-A Pro Outdoor Router, enabling network operators to cost-effectively provide high-speed Fixed Wireless Access (FWA) to customers in remote areas where other technologies would be cost-prohibitive.

Designed for use in suburban areas, public locations, homes and offices, the LTE7480 utilizes the 3.5 GHz Citizens Broadband Radio Service (CBRS) band to deliver high-speed broadband services using 4G LTE-Advanced technology.

CBRS offers capacity expansion functions without the complexity of sharing the band with WiFi allowing the LTE-based solution to provide better network quality than that of WiFi.

Features and Benefits of the LTE7480 LTE-A Pro Outdoor Router:

• Lightning-fast internet connectivity: LTE7480 employs 3GPP UE category 16 with downlink data rates of up to 573 Mbps through eight spatial streams on two carrier components.
• High-gain antennas: LTE7480 features a 4×4 MIMO, high-gain 10 dbi antenna; outdoor design enables the LTE7480 to work under near non-line-of-sight conditions to increase coverage and bandwidth.
• Easy to deploy and manage: The LTE7480 supports bridge and router functions for flexible deployment; 802.3af/at PoE eliminates need for separate power source; IP67 hardened industrial grade enclosures for mounting in harsh environments; TR-069 and remote GUI management; remote throughput testing capability.
• Non-stop connectivity: Wireless LTE can be used for the multi-WAN fail-over application without a cabling plan. As long as the gateway supports multi-WAN fail-over, simply connect the LTE7480 to the existing gateway and set the LTE as the fail-over WAN.

Zyxel’s line of LTE outdoor routers for service providers also includes the LTE7461 4G LTE-A Outdoor Router. The multi-band LTE7461, which also functions in bridge or router modes, employs 3GPP UE category 6 – the best-practice LTE technology – to provide downlink data rates of up to 300 Mbps through four spatial streams using 2×2 MIMO, high-gain 8 dbi antennas.

Designed for deployment in harsh outdoor environments, the LTE7461 is housed in an IP67 hardened industrial-grade enclosure. 802.3af/at PoE support ensures ease and flexibility of deployment. The LTE7461 is easily managed using TR-069 and remote GUI.

“The Zyxel family of LTE products gives network operators cost-effective solutions to deliver high-speed broadband services over existing LTE mobile networks,” explained Brian Feng, Senior Vice President at Zyxel.

“Our fixed wireless access offerings provide the flexibility and performance to deploy 4G LTE as a main connection or backup solution giving operators options to rapidly increase revenue in untapped markets.”

from Help Net Security https://ift.tt/313aWAI

New Light Technologies partners with Fugue to keep cloud environments secure and compliant

New Light Technologies (NLT) announces a strategic partnership with Fugue to deliver public cloud configuration, drift detection, active drift enforcement (e.g., self-healing infrastructure), and security control gap analysis for NLT’s Amazon Web Services (AWS) and Microsoft Azure clientele.

The partnership extends Fugue’s capabilities to all of NLT’s Azure and AWS clients, strengthening NLT’s Cloud Service Provider (CSP) and Managed Service Offerings (MSO).

Fugue rounds out a set of best-of-industry tools and practices chosen by NLT to protect and provide the greatest value to each customer. In addition to the capabilities that Fugue offers, each NLT cloud customer partner is ensured:

• 100% infrastructure-as-code buildout of their environment
• 3rd-party uptime monitoring and SLA enforcement
• A core security model built from NIST, HIPAA, and GDPR controls

“By using Fugue, we can multiply the impact of each of our engineers. Instead of having to write custom scripts, alarms, and notifications, we simply turn on Fugue and get alerted if any of our environments deviate in any way from our last build baseline,” said Dave Williams, Cloud Architect with NLT.

“Plus, for certain production accounts, we enable active self-healing infrastructure so that when an anomaly is found, the environment is automatically rolled back to the desired configuration.”

We’re excited to partner with New Light Technologies to use Fugue’s cloud infrastructure baselining technologies to keep NLT’s cloud environments secure and compliant with policy,” said Phillip Merrick, CEO of Fugue.

“NLT is delivering cutting edge cloud-based geospatial applications and managed services, and with Fugue, NLT can keep customer data and applications secure in a highly efficient and scalable manner.”

from Help Net Security https://ift.tt/2K5yTSp

Alibaba Cloud and Fortinet provide streamlined security for orgs with hybrid cloud infrastructures

Alibaba Cloud, the data intelligence backbone of Alibaba Group, and Fortinet, a global leader in broad, integrated and automated cybersecurity solutions, announced the expansion of the Fortinet Security Fabric offerings and new automation capabilities for Alibaba Cloud to provide streamlined and consistent security for organizations with hybrid cloud infrastructures.

The combination of Alibaba Cloud and the Fortinet Security Fabric provide organizations with the ability to extend security visibility and control from the data center to the cloud and the ability to ensure that organizations employ consistent security policies no matter where their applications are deployed.

By implementing the Fortinet Security Fabric on Alibaba Cloud, customers can apply consistent security policies throughout their hybrid infrastructures and can realize multi-layer security protection and operational benefits for running applications on Alibaba Cloud.

Sodexo and Fung Group are among the global customers leveraging Fortinet’s cloud native integration with Alibaba Cloud to secure its hybrid cloud environment.

Sodexo is using Fortinet’s FortiGate-VM to deploy secure VPC on Alibaba Cloud, effectively aggregating and securing its globally distributed infrastructure. Fung Group is also taking advantage of the integration with the deployment of the FortiGate-VM on Alibaba Cloud, which enables consistent visibility and security management across its cloud environments.

As organizations move workloads and applications to the cloud, the digital attack surface is expanding and making it harder to ensure robust, consistent security across clouds and data centers.

Organizations are looking to take advantage of the agility and scalability that cloud environments offer without compromising security. Alibaba Cloud’s extended collaboration with Fortinet addresses this concern as it leverages Fortinet’s breadth of cloud security offerings that are part of the Fortinet Security Fabric.

Additional benefits of this expanded partnership include:

• Native integration: Fortinet’s security solution will natively integrate with Alibaba Cloud for seamless integration with workloads running in Alibaba Cloud. As a Fortinet Fabric-Ready Partner, Alibaba Cloud will integrate its APIs with the Fortinet Security Fabric to provide more consistent and effective end-to-end security to end users.
• Broad protection: The Fortinet Security Fabric for Alibaba Cloud includes a broad range of Fortinet security offerings including: FortiGateVM, FortiWeb, FortiManager, FortiAnalyzer and Fabric connectors. These solutions address a broad set of use cases including protecting cloud workloads, securing hybrid cloud and cloud-based security management.
• Management and automation: With the expanded integration, Alibaba Cloud’s security functionalities can be managed through the Fortinet Security Management tools across both Alibaba Cloud and on-premises deployments to streamline security operations. Customers can leverage automation capabilities provided by The Fortinet Security Fabric, leveraging APIs and stitches for example, to further streamline and automate operations.

Fortinet’s cloud security solutions are available on Alibaba Cloud Marketplace or can be purchased from a Fortinet channel partner providing customers with the flexability of purchasing only on demand or owning a license that is transferrable across platforms.

from Help Net Security https://ift.tt/331QzG6

Paul D. Fabara joins Visa as Chief Risk Officer

Visa announced that Paul D. Fabara will join Visa as Chief Risk Officer, effective Sept. 3. Mr. Fabara takes over from Ellen Richey, Visa’s former Vice Chairman and Chief Risk Officer who recently retired after more than 11 years with the company. Mr. Fabara will report to Al Kelly, Visa’s Chairman and Chief Executive Officer.

Mr. Fabara’s responsibilities will include a broad portfolio of functions designed to maintain the integrity of the Visa payment system and protect the company and its assets from unexpected loss. He will serve as principal liaison with regulatory agencies that exercise supervisory authority over Visa in the 200+ countries in which the company operates.

In addition, Mr. Fabara will continue Visa’s leadership in payment security, working across the entire ecosystem to promote strategies that secure the future of payments and deliver industry-leading services to prevent, detect, and minimize the impact of attacks on Visa’s clients and other payment system stakeholders.

“We’re thrilled to have Paul joining Visa as our Chief Risk Officer,” said Al Kelly, Visa CEO. “Trust and security is foundational to Visa’s long-term success, and I’m confident of the positive impact Paul will have on Visa’s risk strategy.”

Prior to joining Visa, Mr. Fabara spent eight years at American Express in a variety of roles, most recently as President of American Express’s Global Services Group where he was responsible for managing all support groups including New Accounts, Customer Service, Credit, Collections, Asset Recoveries, Fraud Operations, Procurement, Manufacturing, Automation, Facilities, Sales and Business Enablement, Enterprise Strategy and Execution.

Prior to American Express, Mr. Fabara was at Barclay’s Bank as Global Chief Operating Officer, Barclaycard. Prior to Barclay’s, Mr. Fabara was Chief Operating Officer, Card Services, for Alliance Data Systems.

from Help Net Security https://ift.tt/32Zku1v

‘Urgent/11’ flaws affect 200 million devices – from routers to elevators

iMessage bug could have allowed attackers to read data from any iPhone

Georgia hit with malware yet again

Another Attack Against Driverless Cars

In this piece of research, attackers successfully attack a driverless car system -- Renault Captur's "Level 0" autopilot (Level 0 systems advise human drivers but do not directly operate cars) -- by following them with drones that project images of fake road signs in 100ms bursts. The time is too short for human perception, but long enough to fool the autopilot's sensors.

Boing Boing post.

from Schneier on Security https://ift.tt/2Mu8jnN

Cyberattacks on connected cars could gridlock entire cities

AWDL flaws open Apple users to tracking, MitM, malware planting

Vulnerabilities in Apple Wireless Direct Link (AWDL), the wireless protocol that underpins Apple’s AirPlay and AirDrop services, could allow attackers to track users in spite of MAC randomization, to intercept and modify transmitted files, and to prevent transmission or crash devices altogether.

Apple has already fixed one of the DoS vulnerabilities, but the other holes are not that easy to plug.

What is AWDL?

“With deployments on over one billion devices, spanning several Apple operating systems (iOS, macOS, tvOS, and watchOS) and an increasing variety of devices (Mac, iPhone, iPad, Apple Watch, Apple TV, and HomePod), Apple Wireless Direct Link (AWDL) is ubiquitous and plays a key role in enabling device-to-device communications in the Apple ecosystem,” researchers from TU Darmstadt and Northeastern University explained.

AWDL is a extension of the IEEE 802.11 (Wi-Fi) standard and integrates with Bluetooth Low Energy (BLE), and its proprietary nature apparently prevented security and privacy analysis – until now, that is.

To performe the analysis, TU Darmstadt and Northeastern University researchers have analyzed patents and reverse-engineered Airdrop, which runs on top of AWDL.

They have also implemented open versions of AWDL and AirDrop and made them available as open source software to stimulate future research in this area.

Possible attacks

The unearthed vulnerabilities affect AirDrop’s BLE discovery mechanism, AWDL synchronization, UI design, and Wi-Fi driver implementation.

The attackers demonstrated several attacks:

• A long-term device tracking attack that isn’t stymied by MAC address randomization and may, in most cases, reveal personal information such as the name of the device owner
• A MitM attack that allows for interception and modification of files transmitted via AirDrop, effectively allowing for planting malicious files.
• A DoS attack that works by desynchronizing the targets’ channel sequences
• Two DoS attacks on Apple’s AWDL implementations in the Wi-Fi driver, which can crash Apple devices (one or more) by injecting specially crafted frames.

In this video, they demonstrated the MitM attack on Apple AirDrop by successfully modifying a photo in transit:

The attacks can be stealthy and can be launched by devices not connected to the target Wi-Fi network, the researchers pointed out.

They can also be extremely cheap to pull off: all one needs is a low-cost ($20) micro:bit device and an off-the-shelf Wi-Fi card.

What else? What now?

Apple has been notified of these vulnerabilities and has fixed one DoS bug, but to address the rest they have to redesign some of their services.

The researchers also noted that their findings have implications for the non-Apple world: since the Wi-Fi Alliance adopted AWDL as the basis for Neighbor Awareness Networking (NAN, aka Wi-Fi Aware), that protocol might be also susceptible to similar attacks.

The researchers have put forward practical mitigations for all four attacks they demonstrated, but the only thing that end users can do to protect themselves is to disable AirDrop – and that only prevents tracking via AWDL.

Unfortunately, there generally seems to be no shortage of flaws that can be used for tracking users: a few weeks ago, a group of researchers from Boston University detailed several BLE-based vulnerabilities that could expose users of iDevices, MacBooks, Microsoft tablets and laptops to the risk of being tracked and identified by unwanted adversaries, despite privacy protecting measures already in place.

from Help Net Security https://ift.tt/2GDLAl8

Solving security problems: Security advice for those with limited resources

In this interview, Mark Sangster, VP & Industry Security Strategist at eSentire, gives SMBs advice on how to minimize the risk of a data breach through better security practices, sets out priorities for a successful data security plan, and opines on the key challenges for the information security industry over the next five years.

Massive data breaches have unquestionably demonstrated that no organization, regardless of size, is immune to risky security practices. While large organizations have the financial resources to deal with the fallout of a data breach, SMBs are in a perilous position. What can they do?

Unlike larger large firms with comparable resources with which to protect client non-public information, small firms can find themselves trapped between cyberattacks like ransomware that don’t discriminate based on the size of the firm, and regulators who are indifferent to your size when investigating a potential violation.

A 90-day snapshot of security operations statistics comparing large to small firms indicates relative volume of security incidents, but closer to par breaches and security events requiring immediate response. In this case, a large firm represents 500-750 employees working throughout 20 locations; whereas, a small firm is comprised of 25-50 employees at one location. The small firm generates 65,000 security traffic elements, that filter down to 20 incidents which led to one urgent incident that required immediate response. The large firm generated over 40 times more traffic, 325 security incidents (16 times more), and one escalation.

While the larger firm generates significantly more security traffic elements, as the security events were investigated, the ratio of escalated incident and incidents baring emergency response, moves closer to one to one. Diving deeper, the data indicates that the emergency incidents were born of the same, industry-targeted attack. In other words, both the large and small firm were impacted and breached by the same targeted attack. Neither the criminals, nor their tools discriminate by the number of employees.

It’s important that as firms expand their business in a growing environment of cyber threats, remember Sheriff Brody’s advice: size does matter when you’re going after big fish. As Sheriff Brody quips in Spielberg’s 1975 blockbuster, Jaws, “You’re going to need a bigger boat.” Weigh then benefits and the risks. And recognize that there is chum in the water, put there by the criminals and the regulators alike. And be prepared for the behemoth that might bite your line.

Recommendations:

Inventory hardware, applications: Keep a register of all laptops, servers and applications. This should include cloud services such as Amazon EC2, Microsoft Office 365 or other document management services.

Identify and audit data and related obligations: By extension, you have the obligation to understand the legal and regulatory boundaries in which your clients operate, and to meet those requirements. Ensure you understand your obligations.

Engage and IT consultant: Managed Services firms can provide device management (updates and patching), along with basic system on-boarding and off-boarding processes. They can also help you encrypt devices and set up private networks to encrypt email and file transfers.

Establish cybersecurity and acceptable use policies: Leverage a consultant to build fundamental policies about the management, transfer and storage of client confidential information.

Protect sensitive data and avoid portable media: Avoid using media such as USB keys to store and transfer non-public information. USB keys are a main source of infection and are difficult to control if the data is not removed once the authorized use is complete.

Require encryption: Unfortunately, password credentials are routinely acquired by unauthorized users. For this reason, you should encrypt hard drives or devices.

Use VPN security: The best way to protect data in motion from such attacks is to use a Virtual Private Network (VPN) service. A VPN creates a secure and encrypted connection through which your data travels from you to the intended recipient. No information (including passwords) are transmitted in the clear. There are many low-cost and easily deployed VPN services.

Establish a records management policy (control and destruction): Determine how documents are stored, who has access and establish ‘least privilege’ with a ‘need to know’ attitude and consider how you securely destroy old documentation.

Establish a back-up system: Leverage an outsourced IT service to routinely back-up and then test backups to reduce the business disruption impact in the event of a cyber breach. Back-up are the best defense against ransomware attacks and avoid having to pay ransoms.

Consider cyber insurance: Engage an agent to weigh the cost and benefits of insuring your business against cyberattacks, and whether your business disruption, lost revenue or other non-cyber specific policies cover cyber incidents.

There are innumerable ways an attacker could gain access to sensitive data, which makes the process of building and running a strong security architecture a considerable challenge. How can organizations better understand an attacker’s mindset, motivations, and tactics to help them with their defense efforts?

Thinking like law enforcement, mean, motives and opportunities hold relevant when preparing to protect a business from cyber criminals. Criminals use lures and messaging tailored to your business, and often use your own tools against you to defeat defenses.

Opportunistic attacks like transactional ransomware is waning as criminals shift to more lucrative targets. Through broader attacks, they have identified businesses more likely to pay instead of suffering the consequences of a breach, public operation disruption or repetitional damage. Now we see phishing lures designed to peak the interest of the recipient. And they are designed to infiltrate the business and abscond with higher value assets, rather than smaller quick financial returns.

Moreover, and perhaps most concerning, criminals like to ‘live off the land’, exploiting your own vendor services and operating systems tools. Our research indicates that of more than 650 respondents, over 44% had suffered a material breach as a result of their supplier. And more disturbingly, only 15% of these breaches were reported by the vendor.

In many cases, they use a compromised user account to use remote administration tools (RAT) or the remote desktop protocols (RDP) built into all operating systems. Their activity looks like normal administrative tasks such as creating new users or changing user privileges, but at the microscopic level, the differences are evident and show a trend toward creating unauthorized users who can disable security systems, delete logs, and move through your network with impunity.

Much of this information is recorded and published by law enforcement agencies, and task forces called ISACs (Information Sharing and Analytics Centers) that focus on cyber events for core economic pillars such as banking, healthcare, law, transportation, and so on. These organizations offer public resources.

An expanding cybersecurity skills gap is creating issues for organizations of all sizes, and many of them don’t have an adequate ability to detect and respond to threats in a timely fashion. How can overworked security teams overcome this challenge?

It’s not finding the needle in the haystack. That’s easier than dealing with the needle. The headline around the cybersecurity skills gap hides the real story. It’s not simply the general shortage of experts, but it’s a shortage of specific experts within the cyber community. Of top priority is the need for experts who can hunt for threats using a myriad of cyber sensors and logs, and also experts who know how to respond when they discover unauthorized activity.

There is no shortcut to truly automate cybersecurity. Artificial intelligence can greatly reduce false-positives (data that needs to be chased down to eliminate threats, but turn out to be innocuous or a false alarm), and orchestration tools can help streamline investigations and response, but the trick is combining technology, with experts and well tested processes. Time is money. The faster an event is stopped, the less it will cost the business in the long run.

Most mid-sized firms prefer focus on their business and partner with a vendor who can deliver services that are either too expensive to develop in-house or too difficult to staff. Managed detection and response services provide threat hunting and response services that can complement in-house expertise in network and logging management.

What advice would you give to a newly appointed CISO that needs to strike a balance between data use and the associated risks? What are the priorities for a successful data security plan?

IT and security are stressed by the opposing forces of the demand for competitive advantages through adoption of technology, and while mitigating, lowering or avoiding risks that could materially impact the business. The reality is that most if not all data is digitized and shared across an ever more distributed IT environment and scattered workforce.

Cybersecurity is a risk issue and not a IT practice. And CISOs need to speak the language of the Board and executives. It’s critical to consider risk, align with the general counsel and provide technical information in a way that resonates with business leaders. The role of the CISO is to impact the quantifiable risk, with mitigation strategies so that business leaders can make an informed decision about spend and risk tolerance.

CISO top priorities:

• Regular cadence of annual planning, quarterly reporting to the board.
• Dashboard and flash communications that focus on regulatory changes, security performance, risk registry, and incident testing and results.
• Run 2-4 annual incident simulations based on most likely scenarios. Engage the board in their role and review findings.

CISOs and board alike can leverage public documents such as the National Association of Corporate Directors (NACD) Cyber Risk Handbook and the National Cyber Security Centre (NCSC) Board Toolkit for programs, dashboards and best practices.

What do you see as the key challenges for the information security industry over the next five years?

Budgets for security continue to grow, and in smaller firms, now garners the attention of senior management, the board, and even strategic investors. This is a blessing and a curse. The blessing is direct access to decision makers, resources and funds to run a security program. Perhaps an exaggeration, the curse is direct access and ever watching spotlight. It’s important to proactively address security concerns, focus on risk not security tools, and engage the board in decision making rather than coming with hands out for more funds and headcount.

Attacks that leverage your own tools (living off the land) will increase and the subtlety of these attacks will provide almost perfect camouflage with which to hide in plain sight within your environment. This means controls must tighten, relying on multiple stages, and systems that look for a collection of anomalies instead of well know signatures and patterns. AI, behavioural analytics and user access controls will become paramount.

The consequences of breaches will continue to tighten the reins of accountability. Insurance firms will hones their actuarial data and demand heightened security. More claims will be rejected when the insurer thinks the claimant failed to meet basic security standards, and courts will treat cyber claims under tort law which means well understood damages, and the ability for plaintiffs to collect without proving damages. As in, the risk of damage associated with exposed data will be rough for courts to award settlements.

The adoption of emerging technology will accelerate shortening the window in which security professionals can access risk and deploy mitigation strategies. Interconnected and always connected (5G) devices will be pervasive and accelerate the drive for distributed workforces and perimeter less organizations.

from Help Net Security https://ift.tt/316iqTC

Orchestrating security policies across your hybrid cloud with intelligent data virtualization

The proliferation of data is causing a security and governance challenge across the hybrid cloud. Estimates project the global datasphere will grow from 33 zettabytes in 2018 to 175 by 2025. As new, data-intensive systems are spun up to keep pace with business needs, maintaining security and data governance is becoming a top concern. The complexity is such that a report on cloud security asserts that through 2022, 95% of security failures will be the customer’s fault.

Fortunately, intelligent data virtualization, a suite of technologies used to provide cloud data transformation of siloed data, is also an ideal solution for orchestrating security policies across the hybrid cloud.

Central and unified orchestration of policies

Virtualization is known for its ability to bring data together from the various silos of the enterprise data warehouse (EDW) so that analysts can work with more comprehensive sets of data. The process of joining disparate sets of data is aided by the application of a standard business logic across the EDW that automatically and transparently adjusts for similar data in different formats. Data with the same purpose but different units or scales are dynamically transformed to enable data analysts to focus on business questions and not formatting issues.

Intelligent data virtualization acts as an intermediary, where disparate data sets are pulled in from different databases, transformed according to the standardized business logic defined by the company, and then joined and presented to analysts. This function and virtualization’s central positioning in data transactions also applies to security.

When assembling data from disparate sources, how does the virtualization system know which data the user has permissions to view? Should a sales manager be able to see sales data from other regions? Should a data analyst be able to see credit card numbers? And when combining data from different databases, those databases may have intricate security policies that are particular to their data and the business unit that created them. The enterprise must acknowledge and respect the security of all data and data sources.

There are four components to virtualized security access rights: Preserve, Merge, Overlay and Track.

1. Preserving the security policies of the original database: As each new database is spun up in an organization, that database will have specific security policies appropriate for its purpose and the community it serves. The virtualization system must be aware of these policies in order to respect and preserve them in query results to prevent data from being presented to unauthorized users. Some solutions attempt to create a centralized security registry, but this exposes the enterprise to security failures due to synchronization lag between the source databases and central registry. A better solution is for the virtualization system to poll the security policies of each database as queries are being made to get the most up-to-date policies to apply to the data.

2. Merging the security policies of disparate data sources seamlessly: As data is joined from various sources, the data will reflect the security policies of multiple databases. Intelligent data virtualization automatically applies the correct policies and presents the data without intervention from the user.

3. Overlaying global security policies: In addition to the security policies of constituent databases, the enterprise has global security policies as well. These policies are defined in the virtualization system so they are applied to all query results and aggregates.

4. Tracking user identities: User access policies are only as good as the user information against which they are compared. Shared connection pools for database queries can obfuscate identity and render access controls ineffective. Intelligent data virtualization manages user access to all the data, even through shared resources such as connection pools. When a query is made, the user identity is checked against global security policies and the security policies of each database in the query to ensure only data that the user is entitled to see is presented.

Security through infrastructure

In addition to the way intelligent data virtualization manages access to data, virtualization aids security by virtue of its infrastructure. When queries and aggregates are managed in the virtual space provided by the virtualization system, extracts are minimized. Data can remain within the security envelope of the enterprise data warehouse where it can be encrypted at rest and in flight.

Intelligent data virtualization as a secure space

The central position that intelligent data virtualization takes in order to bring together all of the enterprise’s data makes it the best solution for orchestrating and managing security policies for the enterprise’s data. Intelligent data virtualization creates an interface through which all data interactions with the enterprise data warehouse can be managed and protected by merging the local security policies of source data with the global security policies of the enterprise.

from Help Net Security https://ift.tt/2LRRCTI

53% of enterprises have no idea if their security tools are working

The majority of organizations don’t know if the security tools they deploy are working, and are not confident they can avoid data breaches, according to AttackIQ.

AttackIQ released the report based on Ponemon Institute research evaluating the efficacy of enterprise security strategies. Ponemon surveyed 577 IT and IT security practitioners in the United States who are knowledgeable about their organization’s IT security strategy, tactics and technology investments.

“The significant number of security experts who have observed a security control falsely reporting it blocked a cybersecurity attack is alarming,” said Larry Ponemon, founder and chairman of Ponemon Institute.

“When processes and solutions like this fail, many companies respond by throwing more money at the problem. Further security spending needs to be put on hold until enterprise IT and security leaders understand why their current investments are not able to detect and block all known adversary techniques, tactics and procedures.”

According to the findings, organizations are investing heavily in cybersecurity technologies, but their IT teams are unsure if these tools are working as expected in terms of truly protecting the network. Key data points include:

• Companies surveyed are spending an average of $18.4 million annually on cybersecurity
• 58 percent of companies will be increasing their IT security budget by an average of 14 percent in the next year
• 53 percent of IT experts admit they don’t know how well the cybersecurity tools they’ve deployed are working
• 63 percent of respondents said they have observed a security control reporting it blocked an attack when it actually failed to do so
• Only 39 percent of respondents say they are getting full value from their security investments

Despite deploying many different cybersecurity solutions, companies are not confident their technology investments, staff and processes can reduce the chances of a data breach.

This lack of confidence stems largely from uncertainty in the efficacy of cybersecurity tools and the ability of staff to identify gaps in security and to respond to security incidents in a timely manner. Key data points include:

• Companies deploy on average 47 different cybersecurity solutions and technologies
• Less than half of IT experts are confident that data breaches can be stopped with their organization’s current investments in technology and staff
• 56 percent of respondents say a reason data breaches still occur is because of a lack of visibility into the operations of their security program
• Only 41 percent of respondents say their IT security team is effective in determining gaps in IT security infrastructure and closing those gaps
• 75 percent of respondents say their IT security team is unable to respond to security incidents within one day

IT experts believe penetration testing is effective in uncovering cybersecurity gaps, but many are not conducting penetration testing on a continuous basis. Key data points include:

• 57 percent of respondents say their IT security teams conduct penetration testing
• 65 percent of respondents say their penetration testing is very effective or effective in uncovering security gaps, but almost one-third have no set schedule for penetration testing and only 13 percent conduct penetration testing daily
• Only 48 percent of respondents say their organization leverages a continuous security validation (CSV) platform that allows them to determine how well security solutions are performing, but 68 percent of these respondents say their CSV platform is effective in finding security gaps

“Companies are spending far too much money on cybersecurity solutions without knowing if they are effective,” states Brett Galloway, CEO of AttackIQ.

“More than half of the experts surveyed admit they are in the dark about how well the technologies they have are working and if they’re truly effective, which is alarming considering companies are relying on these technologies to protect sensitive information including customer data.”

from Help Net Security https://ift.tt/2YChlFu