Thursday, October 31, 2019

New infosec products of the week: November 1, 2019

Jetico releases BestCrypt Volume Encryption Enterprise Edition for Mac

Jetico launched BestCrypt Volume Encryption – Enterprise Edition for Mac. Expanding on many years of Windows support, Jetico delivers the world’s only OS agnostic tool to encrypt Mac hard drive data with central management, both in cloud or on-premise. The tool can also run in the cloud, empowering Admins to control all disk encryption activities from anywhere without needing to configure and maintain a dedicated server.

infosec products November 2019

HITRUST CSF 9.3 adds CCPA, SCIDSA, and NIST SP 800-171 authoritative sources

HITRUST CSF 9.3 now incorporates and harmonizes 44 authoritative sources, most recently adding one new data privacy-related and two new security-related authoritative sources, as well as updating six existing sources as compared to the previous release.

infosec products November 2019

Baffle’s masking and exfiltration solution provides end-to-end data protection

Baffle Data Masking and Exfiltration Control is a solution that ties access control and usage to data-centric encryption, providing an end-to-end data protection solution. It extends access control capabilities to protect data as it leaves an organization and creates a simple way for businesses to responsibly share data with third parties.

infosec products November 2019

Jumio launches Jumio Go, a real-time, automated identity verification solution

Jumio Go is designed to remove friction from the user onboarding process, while still fighting online identity fraud and meeting AML and KYC compliance mandates. Jumio has integrated certified liveness detection to detect when photos, videos or even realistic 3D masks are used instead of actual selfies to create online accounts.

infosec products November 2019

Moogsoft unveils all-in-one AIOps and observability solution for DevOps teams

Moogsoft Express features intelligent noise-reduction, alert correlation, and native observability capabilities, including metrics collection and anomaly detection. It also offers out-of-the-box workflows and integrations with notification and alerting tools, helping DevOps teams resolve incidents quicker and meet service level agreements (SLAs) with their customers.

infosec products November 2019


from Help Net Security https://ift.tt/34ulj2z

How has your organization’s risk level changed in the past 12 months?

More than half of risk professionals worldwide say their organization’s risk levels have increased in the past 12 months, according to new research from ISACA, CMMI Institute and Infosecurity Group.

risk level change

The State of Enterprise Risk Management 2020 report reveals that only 29 percent of respondents have a high degree of confidence that their enterprise can accurately predict the impact of threats and vulnerabilities associated with emerging technologies.

Additionally, fewer than a third (31 percent) of security pros say their enterprises can respond quickly when new threats are identified, a problematic dynamic given today’s fast pace of business and technology-driven change.

The most critical categories of risk facing enterprises today are:

  • Cybersecurity (29 percent)
  • Reputation (15 percent)
  • Financial (13 percent)

The top five cybersecurity risk management challenges are changes/advances in technology, changes in types of threats, too few security personnel, missing skills in existing cybersecurity personnel, and increased number and frequency of threats.

Risk identification processes commonly adopted, but infrequently optimized

The study also found that nearly two-thirds of respondents have defined processes for risk identification, but only 38 percent believe that those processes are at either the managed or optimized level of the maturity spectrum. This high adoption, low optimization trend shows there is significant need for action and improvement.

Global regions face wide spectrum of cybersecurity threats

The State of Enterprise Risk Management 2020 study also reports diversity in the types of attacks seen across geographic locations and industry sectors. For example, respondents from Asia and India report more nation-state attacks than those in North America, Oceania and Europe.

When it comes to managing the fallout of an issue, only 43 percent of respondents’ enterprises employ insurance as a mitigation control. Organizations in North America and Africa are the highest adopters of insurance, with Latin America being the lowest.

Management and governance gap revealed

The study reveals a potential disconnect between management and governance of enterprises when it comes to risk. Respondents note that, on average, boards of directors are only updated on cybersecurity risk on a quarterly basis – sometimes even less.

CISOs are updated much more frequently, with 70 percent saying they receive updates at least once a month. This knowledge gap is a key opportunity for CISOs to expand their visibility at the governance level.

“Big risks can be ignored when the right people aren’t in the room for the conversation,” said Tracey Dedrick, ISACA board director.

“Start at the highest level within the organization and get the people in the room that own the risk from the top down. This will ensure the right themes are addressed and important organizational alignment takes place.”

risk level change

Five steps for mitigating and addressing risk

Use current trends and technology to predict future outcomes. “The trajectory of cloud—both its adoption dynamics and the risk it introduces—can serve as a bellwether for future technologies,” said ISACA Board Chair Brennan P. Baybeck.

“While cloud was initially seen as creating new risks and challenges to be solved, it also delivers incredible value. Strong governance and risk management helps ensure that the value exceeds the risk—and the same is true for newly emerging technologies.”

Clearly define risk. For enterprises that struggle with their risk management maturity, it is particularly important to refine and clearly define risk tolerances in order to advance along the maturity spectrum.

Know your business. Remember that no two companies face the same level of risk. For example, operational risk is significantly more difficult to forecast within manufacturing compared to other industries. Cybersecurity and technology risk, by contrast, are hardest (by a wide margin) to forecast for the financial services sector.

Don’t get siloed. Your stakeholders will have varying priorities when it comes to risk. That means taking a balanced approach to ensuring that multiple perspectives are acknowledged and addressed in your risk mitigation planning.

Set expectations and optimize risk. Clear and direct expectations about risk tolerance – along with corresponding guidance for risk decision-makers – can go a long way to helping optimize risk for the enterprise over the long term.


from Help Net Security https://ift.tt/2pxKdiF

IT teams are embracing intent-based networking, investing in AI technologies

The network is vital to today’s digital business. Whether maximizing employee productivity, optimizing customer experience or keeping data protected and secure, the network is foundational to business success.

OPIS

At the same time, the network is in the midst of one of its biggest evolutions since the introduction of the Internet, creating an opportunity for IT leaders and their teams to innovate. Cisco asked over 2000 IT leaders and network strategists how they plan to prioritize investment and the current state of their networks.

“IT teams today are running complex mission critical networks that are increasingly capable of providing rich data. But using that data to improve the operations, security, or business impact of the network requires new tools. That’s why IT teams are embracing intent-based networking, AI and machine learning — because the business demands it,” said Scott Harrell, SVP and GM, Cisco Enterprise Networking.

“AI will help IT break the cycle of maintaining the status quo. By embracing predictive analytics and AI-based operations, IT teams will pivot from being consumed with maintaining the status quo to becoming an enabler of new business innovation.”

IT leaders expect new wireless technologies, IoT and AI-enabled operations, threat detection and remediation to have the biggest impact on their network strategy and design over the next five years.

Maximize the business value of IT and more closely align to business needs

  • Almost 40 percent of IT leaders named maximizing IT’s business value as their number one priority, higher than simplifying operations, optimizing employee productivity and minimizing security events.
  • In order to achieve this, leaders and strategists believe investing in AI technologies is crucial. Almost 50 percent of network strategists believe increasing the use of analytics and AI will help enable the ideal network.

Intent-based networking is coming

  • 41 percent of those surveyed claim to have at least one instance of SDN in at least one of their network domains.
  • Only 4 percent of respondents believe their networks have moved beyond software-defined and are intent-based today. However, 35 percent believe their networks will be fully intent-based in two years’ time.
  • When asked to indicate where on Cisco’s Digital Network Readiness Model their networks currently operate, only 28 percent indicated they’ve reached a service-driven or intent-based network. However, when asked where their networks will be in two years, 78 respondents believed they would move beyond software-defined towards service-driven and intent-based networks.

Embracing AI and automation

  • Only 18 percent of IT leaders see lack of AI maturity as an obstacle to network modernization, the lowest level of concern indicated in their responses.
  • 72 percent of respondents plan to achieve AI-enabled predictive insights or prescriptive remediation within the next two years.
  • 94 percent of respondents believe they will have a software-defined wide area network (SD-WAN) in two years. Further, 47% of SD-WAN owners plan to have an AI-optimized WAN in two years.

OPIS

IT operations are struggling to move from reactive to proactive

  • Over 75 percent of IT leaders and strategists believe their organizations are not predictive or business-optimized.
  • One possible explanation as to why IT teams haven’t become more proactive is the amount of time spent on maintaining the status quo of the network. 73 percent of teams are spending more than half their time here.
  • Another barrier to achieving more proactive and business-optimized operations is operational silos. 29 percent of organizations identified coordinating with other IT teams as its top time-consuming operational activity. An additional 27 percent identified that a siloed design and operational approach across separate network domains was holding them back from being able to modernize their networks.

IT leaders and strategists aren’t concerned about a skills gap

  • Leaders and strategists expressed confidence in their teams’ abilities to address future network challenges. A third of IT leaders believe their teams are extremely well prepared to meet all the needs of an advanced network, another 40 percent believe they are well prepared and only 7 percent believe they are not prepared at all.
  • However, the skills gap remains a barrier for over a quarter of IT teams. 27 percent of IT leaders identified a lack of necessary skills as a main obstacle to transitioning to an advanced network.
  • 22 percent of IT leaders identified reskilling and upskilling to address the skills gap as a top priority.

from Help Net Security https://ift.tt/2Nr89fE

Security services and network security still top spending priorities for CISOs in MENA

Middle East and North Africa (MENA) enterprise information security and risk management spending will total $1.7 billion in 2020, an increase of 10.7% from 2019, according to a recent forecast by Gartner.

MENA security spending

“The double-digit growth is a reflection of how organizations in MENA region are coming up to speed with their global counterparts in adopting information security and risk management solutions,” said Sam Olyaei, research director at Gartner.

“More importantly, an evolving threat landscape and the advent of digital transformation is forcing local security and risk leaders to revaluate their spending priorities.”

Security services and network security continue to be the top two security and risk management spending priorities for CISOs in MENA. Both segments will account for 66% of total security and risk management spending in 2020.

Managed Security Services includes services that involve security processes such as monitoring, detection, and response.

“We continue to see a pervasive shortage of talent in the region, especially as it relates to tactical functions, and this has pushed leaders to leverage managed security service providers (MSSPs) and other consultants to manage their operational capabilities,” said Mr. Olyaei.

Despite smaller levels of spending, cloud security and data security will continue to remain the fastest growing segments for enterprise security and risk management spending. A shift to a cloud-first strategy remains a priority in MENA, especially as major cloud service providers set up shop in the region.

Additionally, The Data Protection Law (DPL) implemented in Bahrain in April 2019 and the possibility of United Arab Emirates (UAE) to deploy strict data privacy rules by the end of 2020 have compelled MENA organizations to rethink their data security framework to continue doing business in the region.

As a result, Gartner predicts that by 2020, investment in data security will total $72 million, an increase of 26% year over year.

The growing spending in security and risk management also showed that it has become a boardroom priority locally. CISOs in MENA are seeking to improve their communication with the board of directors who have more visibility on security, threats and vulnerabilities than ever.

“Simply put, executives are beginning to realize the true business impact of cybersecurity,” said Mr. Olyaei. “It is no longer a matter of if, but when and executives are demanding that their leaders continue to facilitate business outcomes”


from Help Net Security https://ift.tt/36mOczk

Threat Stack Application Security Monitoring now supported by Python

Threat Stack, the leader in cloud security and compliance for infrastructure and applications, announced Python support for Threat Stack Application Security Monitoring.

Included with no additional cost as part of the Threat Stack Cloud Security Platform, Threat Stack Application Security Monitoring extends security observability throughout the entire software development life cycle.

With support for both Python and Node.js, Threat Stack Application Security Monitoring identifies risk throughout the entire software development life cycle for both third-party and native code while helping developers learn secure coding practices with built-in eLearning capabilities.

After an application is put into production, Threat Stack Application Security Monitoring identifies and blocks attacks such as cross-site scripting (XSS) and SQL injection in real time.

Unlike other runtime application security solutions, Threat Stack Application Security Monitoring puts the application in context with the rest of the stack, allowing users to navigate in a single click from application to the container or host where it is deployed for deeper forensics in the case of an attack.

When combining Threat Stack Application Security Monitoring with the rest of the Threat Stack Cloud Security Platform, customers can achieve full stack security observability with contextual insights pulled from the cloud management console, host, containers, orchestration, and applications presented in a single, unified platform.

Full stack security observability provides Security and DevOps teams with the actionable intelligence needed to proactively reduce risk within their cloud environment and effectively respond to attacks in real time.

“Meeting the pace of innovation in modern application development is at the core of Threat Stack’s mission,” said Brian M. Ahern, CEO, Threat Stack.

“The addition of Python language support to the Threat Stack Application Security Monitoring functionality within the Threat Stack Cloud Security Platform is the latest in our efforts to innovate and meet the growing needs of security and development professionals alike.”


from Help Net Security https://ift.tt/335E4ZL

Tranquil data solves difficult data segmentation and contextualization challenges at scale

Tranquil Data, a startup that helps companies transform and scale by proactively ensuring data is used as intended, announced the release of its flagship product.

Sitting between applications and databases, Tranquil Data software monitors data as it’s being created to provide technical and business stakeholders clear insight into where data came from, how it was used and if it requires specific controls like isolation or segmentation.

The software doesn’t require any programming modifications or workflow interruptions, allowing developers to build new products or services quickly and scalably, and by continuously ensuring compliance, Tranquil Data enables organizations to be more nimble and innovative — all while preventing inadvertent data misuse and providing insights that offer new business value.

As the volume and power of data systems continues to mature, organizations from a variety of industries are struggling to maintain the underlying context for why their data exists.

Without a solid understanding of what they can do with data and if/how they can leverage it, organizations are unable to evolve their product offerings and expand their business.

A lack of proactive, policy-based data services not only makes developers less effective and hinders the execution of new business opportunities, it also leaves compliance officers and other business stakeholders in the dark, and leads to complex audit and diligence processes.

“The proliferation of data presents infinite possibilities for businesses and consumers alike, however regulations like GDPR, PCI-DSS and the California Consumer Privacy Act have made organizations wary of capitalizing on data-related opportunities,” said Seth Proctor, Co-Founder and CEO of Tranquil Data.

“Tranquil Data was created to invert this hesitation into opportunity by helping companies get the most value out of data while also making sure end-users aren’t surprised by how and where their data is being used.

“Of particular value is the alignment we provide that allows technical and business stakeholders to work together to realize the best data-based opportunities for their business.”

Tranquil Data software can be deployed in a single container on a laptop or scaled out as a service.

By providing proactive data rules via a visual front-end, compliance responsibilities shift away from developers, enabling technical teams to focus their talents on building new products and services, and giving business stakeholders confidence about how exactly customer and partner data is being used.

Last year, Tranquil Data raised $1.8 million in seed funding, with Hyperplane Venture Capital leading the round and First Star Ventures and PBJ Capital also participating.

With decades of combined experience building enterprise software, the Boston-based Tranquil Data team has previously held engineering and leadership roles at Amazon Web Services, EMC, HubSpot, IBM, NetApp, NuoDB and Microsoft.

As former classmates at Brown University, the founders share a core conviction that to scale technology and unlock the full potential of data, companies need transparent methods for governing how data is used.

Currently, Tranquil Data is working with several enterprise design and channel partners across the finance, insurance and healthcare sectors.


from Help Net Security https://ift.tt/2N6KjGU

Sysdig integrates Falco with Fluent Bit, enabling AWS users to stream Falco security data into FireLens

Sysdig, the secure DevOps leader, announced the availability of a Falco integration with Fluent Bit. This integration enables Amazon Web Services (AWS) users to stream Falco security data into AWS FireLens for a simplified log management experience.

Falco is the open source Kubernetes runtime security project started by Sysdig and donated to the CNCF. AWS asked Sysdig to write the Falco integration and to join the FireLens preview program.

AWS announced the general availability of FireLens, which collects logs across all AWS container services — Amazon Elastic Container Service (ECS), Amazon Elastic Kubernetes Service (EKS), and self-managed Kubernetes on Amazon Elastic Compute Cloud (EC2) — and consolidates them into a single log stream for unified management.

Together with Falco, FireLens facilitates the centralization of all security events, which enables cluster operations, incident response, DevOps, and security teams to spend less time wading through data, enabling them to draw conclusions about security risks faster.

Falco, the open source project, is the defacto Kubernetes runtime security tool. Falco detects abnormal application behavior and alerts on intrusions for containers and cloud-native applications.

In the event of abnormal behavior, Falco will generate security events defined by a customizable set of rules. Falco was created by Sysdig in 2016, and the project joined the CNCF as a Sandbox project in October 2018. Over the last year, Falco adoption has increased by more than 240 percent.

The FireLens integration with Falco is made possible using Fluent Bit, an open source log processor, which is also a CNCF project. With Fluent Bit, FireLens is able to automatically collect Falco event logs from any cluster and route them to Amazon CloudWatch, the monitoring and observability service for AWS environments.

CloudWatch takes the collected data and consolidates everything to provide one centralized log stream to track the security of all clusters from.

Key benefits:

  • Simplified log management: The Falco integration with FireLens enables DevOps teams to easily set up security event consolidation across all container services. By using two open source tools — Falco and Fluent Bit — the barrier to entry for adopting log management is lowered.
  • Accelerated incident response: By consolidating all logs into one feed, security teams are able to set alert policies based on importance to reduce alert fatigue. By alerting to only the most important abnormalities, DevOps teams are able to evaluate risk posture faster and expedite incident response.
  • Compliance records: CloudWatch consolidates all container security events, including Falco alerts, in one place for log retention over time for compliance and audit purposes.

“We are in the final frontier when it comes to Kubernetes innovation. Security is the last area that still requires work from the community. Falco is leading the charge in standardizing Kubernetes security,” said Kris Nova, Chief Open Source Advocate at Sysdig.

“AWS asked Sysdig to join the FireLens preview program because AWS values Falco’s ability to secure cloud-native environments. By integrating with FireLens, we hope to make it easier for all organizations to develop in the cloud, secure in the cloud, audit in the cloud, no matter their approach.”

Sysdig is committed to open source and ensuring all Kubernetes environments are able to securely run in production. Sysdig has created four open source tools, including Falco.

Falco is the engine that powers Sysdig Secure, which embeds security and compliance in the build, run, and respond stages of the Kubernetes lifecycle. The Sysdig platform is open by design, with the scale, performance, and usability enterprises demand.


from Help Net Security https://ift.tt/2CcJyGp

Snow Software’s enhanced Risk Monitor helps orgs strengthen cybersecurity and compliance

Snow Software, the global leader in technology intelligence solutions, announced enhancements to its Risk Monitor product to help organizations strengthen cybersecurity and compliance programs with complete insight across their technology landscape.

Part of Snow’s powerful technology intelligence platform, Risk Monitor automatically provides a comprehensive and contextual view of where high-stakes vulnerabilities and personally identifiable information (PII) reside, providing the visibility needed to proactively mitigate potential threats.

A recent Accenture study found that the number of security breaches has increased by 67% in the last five years, while the financial impact of cybercrimes has increased by 72% in the same period. Yet the majority of breaches still come from cybercriminals exploiting known vulnerabilities.

To counter these ongoing threats and help strengthen security protections, Snow’s Risk Monitor identifies and prioritizes critical vulnerabilities based on the National Institute of Standards and Technology’s (NIST) National Vulnerability Database (NVD).

It also helps organizations protect user data and comply with GDPR by identifying applications with PII based on Snow’s purpose-built database. Risk Monitor uses the same discovery agent for both asset management and vulnerability identification, providing organizations with a single source of truth that is augmented with trusted third-party as well as proprietary first-party data.

With Risk Monitor, organizations will be able to:

  • Identify and prioritize addressing, patching or remediating software vulnerabilities
  • Audit and augment existing security software with detailed IT ecosystem inventory data
  • Automate vulnerability identification and map to the technology estate, aligning with timelines mandated by cybersecurity frameworks and eliminating manual processes
  • Monitor and support management of software licenses with detailed metrics including end of life, end of support and vulnerability data
  • Discover and inventory software or applications containing PII to meet initial GDPR compliance mandates

With these enhancements, Snow’s platform provides the complete visibility required as a starting point for adherence to cybersecurity frameworks like NIST Cybersecurity Framework, Center for Internet Security (CIS), and those published by the International Organization for Standardization and International Electrotechnical Commission (such as ISO27001).

“The growing number of applications, software and devices running in IT environments – some without the knowledge of the IT team – makes it challenging for enterprises to get a thorough inventory of their hardware and software assets,” said Peter Björkman, Chief Technology Officer at Snow.

“IT asset managers and cybersecurity teams need to work together to achieve complete visibility and secure their IT environments. With Risk Monitor, enterprises can quickly identify, prioritize and remediate software vulnerabilities based on up-to-date data and intelligence on your current technology estate.

“The more you get a handle on the assets within your IT ecosystem, the better equipped you will be to protect them – which really gets to the heart of our mission to provide complete technology intelligence for every organization.”


from Help Net Security https://ift.tt/2NulHHf

D2iQ DC/OS 2.0 includes enhanced security, resource management and multi-tenant support

D2iQ, the leading provider of enterprise-grade cloud platforms that power smarter Day 2 operations, announced the release of DC/OS 2.0, a major release of the company’s distributed operating platform.

With security and resource management improvements, coupled with enhanced multi-tenant, operating system and workload support, DC/OS enables successful Day 2 operational experiences for enterprises across the globe.

As a leading integrated platform for managing data and containers across any enterprise infrastructure, DC/OS enables organizations to modernize applications and increase interoperability to ensure more efficient, highly reliable operations at scale.

DC/OS 2.0 now supports an agent footprint on Microsoft Windows, enabling expanded workloads on one of the world’s most popular operating systems. In addition, DC/OS 2.0 features a new data science engine with the power of cloud computing to streamline data science operations.

“Organizations have many technology choices on their cloud native journeys and D2iQ is dedicated to providing the enterprise-grade solutions, services and expertise that helps ensure project success from inception to Day 2 operations,” said Ben Hindman, founder and chief product officer, D2iQ.

“DC/OS 2.0 provides enterprises with full-base technology support, delivering SLAs around a wide array of cloud native technologies. Whether it’s DC/OS, Kubernetes or a collection of open source offerings, D2iQ is empowering enterprises across the globe to ensure successful outcomes for developers, architects and end users.”

DC/OS 2.0 features a number of improvements designed to bolster its enterprise capabilities, streamline operations and accelerate cloud native journeys, including:

Enterprise security–With exhibitor lockdown and TLS certificate verification, DC/OS delivers more stringent control and protection of organizational resources and more effective response to regularity and audit requirements, such as GDPR and PCI.

Day 2 operational resource management–Node draining and improved network and performance metric logging minimize downtime and deliver better operational experiences for all users.

Stronger multi-tenant support–With DC/OS 2.0, organizations can more effectively co-locate multiple business units, teams and services in a shared-services environment, while enabling lines-of-business and service owners to function autonomously.

Expanded operating system and workload support—With the delivery of DC/OS 2.0, D2iQ now provides formal technology support for workloads on Windows, along with a wide range of integrated data services such as Cassandra, Kafka and Spark as well as Data Science technologies such as Jupyter notebooks.

Additionally, DC/OS 2.0 features enhanced batch computing leveraging advanced cloud computing concepts, and UCR support for more effective governance of memory needs across workloads.


from Help Net Security https://ift.tt/3358Th9

15 companies join the Aspen Cybersecurity Group to address the cybersecurity skills gap

The Aspen Cybersecurity Group announced commitments from 15 companies – including Duke Energy, ​AIG, Apple, Cloudflare, Cyber Threat Alliance, Facebook, Google, IBM, IronNet, Johnson & Johnson, Northrop Grumman, Symantec, Unisys, Verizon and PwC – to address the mounting shortfall in the nation’s cybersecurity workforce.

The Aspen Cybersecurity Group is the nation’s highest-level, multidisciplinary convening of cybersecurity experts.

Co-chaired by IBM CEO Ginni Rometty, Congressman Will Hurd (R-TX), and Lisa Monaco – former White House Homeland Security and Counterterrorism Advisor – the Group comprises 38 business executives, security practitioners, researchers, and former government officials dedicated to devising and executing nonpartisan solutions to cybersecurity challenges. Its mission is to solve, not merely observe, cybersecurity problems.

According to IBM CEO Ginni Rometty, “IBM is proud to co-chair the Aspen Cybersecurity Group’s effort and lead the Group’s workforce initiative.

“By adopting these principles and scaling educational programs where skills matter more than degrees, businesses working together will create new economic opportunity in our communities and address cybercrime, one of the biggest threats facing the public and private sectors today.”

Cybersecurity skills are in short supply; unfilled cybersecurity positions have grown by 50% since 2015.

According to the Aspen Cybersecurity Group’s report on Principles for Growing and Sustaining the Nation’s Cybersecurity Workforce, there will be at least 500,000 unfilled cybersecurity jobs in the United States by 2021. Other research tells a similar story, with one study projecting 3 million cybersecurity job openings around the world by 2021.

Among the Group’s key findings are that employers are leaving large pools of skilled candidates untapped, in part because of overly complex job requirements that disqualify more than 50% of applicants.

Fifteen senior industry representatives in the Aspen Cybersecurity Group are committing to adopt three of the Principles for Growing and Sustaining the Nation’s Cybersecurity Workforce:

  • Widen the aperture of candidate pipelines, for example by expanding recruitment focus beyond applicants with four-year degrees or using non-gender biased job descriptions.
  • Revitalize job postings to be engaging and to focus on the core requirements; don’t ‘over-spec’ the requirements.
  • Make career paths understandable and accessible to current employees and job seekers, referencing models like the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework where applicable.

“For many years, the cybersecurity community has been struggling to build a more robust, inclusive cyber workforce pipeline,” said John Carlin, Chair of the Aspen Institute’s Cyber & Technology Program.

“With these commitments, some of the nation’s largest employers will demonstrate the relatively simple measures that others can take to expand their search for cybersecurity talent. For example, present hiring practices can overlook potential cybersecurity experts who do not come from a traditional computer science background. We want to change that.”

The Aspen Cybersecurity Group invites other employers in the private and public sectors to join the effort to widen the pool of candidates for roles in cybersecurity and to make the fast-growing, in-demand positions more accessible.


from Help Net Security https://ift.tt/2WxgZwH

Syapse and Sumo Logic deliver real-world data insights to health systems and life sciences companies

Sumo Logic, the leader in continuous intelligence, announced that Syapse has chosen Sumo Logic to support the delivery of valuable real-world data-based insights to its health system and life sciences partners.

Additionally, Sumo Logic’s standardized process, security and audit capabilities are helping Syapse, the leader in powering precision medicine through a global health system network, adhere to strict healthcare data regulations.

With a mission to deliver the best care for every cancer patient, Syapse delivers real-world data insights to health systems and life sciences companies. To accomplish its mission, the company must assemble a diverse array of molecular and clinical data that enable healthcare providers to manage and scale their precision medicine programs.

As a result, the company’s data platform ingests gigabytes of raw, highly diverse data, which feeds to its multi-terabyte library of existing information.

To produce high-value insights the company’s solutions must absorb and analyze thousands of data points across individual patients and health systems while also maintaining the highest standards of security, privacy and compliance.

With Sumo Logic, Syapse is able to implement the infrastructure and procedures necessary to continually meet stringent healthcare data regulations and attain vital industry certifications from industry governing bodies such as the Health Information Trust Alliance (HITRUST).

“Sumo Logic has been a strategic partner in helping Syapse manage and process our data, making it easier to streamline our operations and deliver value to our health system and life sciences partners,” said Vinod Subramanian, senior vice president, cloud operations at Syapse.

“The extensive dashboards and reporting capabilities available to us through the Sumo Logic platform play an important role in helping us achieve compliance standards, including HITRUST.

“Sumo Logic not only gives us the continuous intelligence we need to manage our business, but more importantly, they allow us to focus on what matters most: serving our health system and life sciences partners.”

Sumo Logic provides a unified platform to help Syapse automate real-time monitoring and troubleshooting. By automating tasks that once required manual resolution, the platform has enabled the company’s customer success and operations teams to decrease time spent on administrative tasks and accelerate support resolution times.

“While access to unique clinical and molecular data has been a driving force for continued technological innovation in the healthcare industry, trust and security remain a top priority,” said George Gerchow, CSO, Sumo Logic.

“Our platform was built with a privacy and security-by-design approach that allows us to provide valuable insights to customers like Syapse that rely on these data to help scale precision medicine programs focused on the delivery of quality patient care.

“We also undergo rigorous review and attestation of our HIPAA compliance by an independent auditor to ensure the security of our customers’ protected healthcare information.

“This reflects our ongoing commitment at Sumo Logic to provide a secure platform that allows healthcare providers to easily access and analyze data needed for providing optimal care today and in the future.”


from Help Net Security https://ift.tt/36pBEHe

Infocyte unveils its “Response Ready” program for certified IR partners

Infocyte, the leading cyber security incident response platform introduced their “Response Ready” program for certified IR partners. These elite partners have deployed Infocyte into multiple customer environments during cybersecurity incident response operations and proven their ability to address and remediate active attacks.

Additionally, Infocyte announced new platform Extensions today, enabling customers and partners to develop, deploy, and share custom collection and action capabilities built on top of Infocyte’s award-winning platform.

Extensions address key challenges faced by cybersecurity professionals and security teams around the globe during response operations—specifically containment, eradication, and recovery from security incidents, all worsened by a growing human resources and skills shortage in cybersecurity.

“As detection capabilities improve, automated incident response is becoming the differentiator,” commented Micheal Crean, CEO of MSSP, Solutions Granted.

“Leveraging Infocyte’s ability to provide immediate, automated response actions improves our efficiency and speed and lowers risk for our customers. We are deploying Infocyte’s platform broadly across our customer base.”

Extensions are grouped into two categories: Collection and Action Extensions, and include capabilities for detecting advanced threats, automating response actions, and streamlining security operations.

Extensions are developed by Infocyte, their customers and partners, or the cybersecurity community as a whole—fostering a collaborative ecosystem for cybersecurity professionals and enabling them to work together in addressing the changing threat landscape.

Among Extensions already deployed within Infocyte’s new collaborative ecosystem include an eDiscovery tool for PII forensics, local memory dump for offline analysis, host isolation, and Windows Volume Shadow Copy and restoration.

“With Infocyte, mid-market customers can automate deep forensic analysis, detection, and incident response — capabilities previously limited to enterprises with a fully equipped SOC,” added John Norden, Vice President of Engineering with Infocyte.

“Extensions give customers and partners the ability to build custom detection along with quick and efficient capabilities to contain, eradicate, and recover from security incidents. This functionality coupled with frequent inspection of an environment truly enables a Response Ready stance.”

Integrate and extend your EDR, SIEM, SOAR, and more with Infocyte Extensions.

Extensions introduce an open contribution system for submitting custom capabilities, which may be made available to the community or integrated into Infocyte’s platform.

The contribution model mirrors a standard Open Source methodology, leveraging GitHub as a tool for handling source code control, pull requests, issues, and features.


from Help Net Security https://ift.tt/2C6frA1

Claroty integrates its Continuous Threat Detection solution with FireEye Helix

Claroty, the global leader in industrial cybersecurity, announced the integration of their Continuous Threat Detection (CTD) solution with FireEye Helix.

The combination of Claroty’s asset discovery, threat detection and alerting for operational technology (OT/IoT) environments, and the security orchestration capabilities of the FireEye Helix security operations platform, helps joint customers realize greater value from their security solutions.

The integration enables industrial asset owners to improve their response times to OT security incidents, reduce exposure to cyber risk in their OT environment, and maintain consistent implementation of their security protocols when detecting and responding to OT cyber threats.

Claroty’s CTD provides complete and detailed discovery of OT and IoT assets on automated industrial control networks. FireEye Helix integrates disparate security tools and augments them with next generation SIEM, orchestration, and threat intelligence capabilities to capture the untapped potential of security investments.

The integration of the Claroty and FireEye technologies, made possible through a jointly developed “plug-in”, enables FireEye Helix to consume and integrate OT asset details and alerts from the Claroty platform and provide security staff with a consolidated view of both IT and OT related threats.

“Claroty’s asset discovery and threat detection are unmatched, but it is equally important that we enable security teams to work smarter and more efficiently by integrating with leading platforms like FireEye Helix,” said Benny Porat, Claroty’s Co-Founder and Chief Product Officer.

“This integration with FireEye ensures our joint customers not only receive detailed, early warning of potential OT/IoT security threats, but they can also orchestrate their response to ensure speed and consistency no matter where the threat originates.”

“One of the largest challenges in a security operations center is simply keeping up with the volume of incoming alerts and executing prompt response protocols. With our customers now taking responsibility for securing both IT and OT environments, the challenge has grown exponentially,” said Phani Modali, Vice President, Engineering at FireEye.

“Integrating the rich, contextual OT data from the Claroty platform into FireEye Helix makes this challenge much easier to manage and automate, increasing the ROI of both technologies.”


from Help Net Security https://ift.tt/2JAKHeD

CyberArk achieves Common Criteria certification by the National Information Association Partnership

CyberArk, the global leader in privileged access management, announced it achieved international Common Criteria certification by the National Information Association Partnership (NIAP).

The Common Criteria certification validates that the CyberArk Privileged Access Security Solution meets strict security requirements for U.S. National Security System (NSS) procurement. This certification is also used globally, by organizations in 31 member countries, to assess security solutions.

This acknowledgement from NIAP extends the list of CyberArk solutions that have achieved Common Criteria certification. CyberArk holds the industry’s most comprehensive set of privileged access management government certifications.

Most recently, the CyberArk solution was awarded a Common Criteria certification accepted by the Common Criteria Recognition Agreement (CCRA) under an Evaluation Assurance Level (EAL) 2+.

CyberArk is also included on the U.S. Department of Defense Information Network Approved Products List (DoDIN APL) and the U.S. Army Certificate of Networthiness (CoN) under the Cybersecurity Tools (CST) device type (Tracking Number (TN) 1712401).

CyberArk helps federal agencies meet compliance requirements including FISMA/NIST SP 800-53, Phase 2 of the Department of Homeland Security Continuous Diagnostics and Mitigation (CDM) program, NERC-CIP, HSPD-12 and more.

“Government agencies and other organizations in highly regulated industries are embracing digital transformation to improve efficiency and service delivery. However, those investments in areas like cloud and DevOps can dramatically expand the attack surface, making these organizations prime targets for cyber attackers,” said Adam Bosnian, executive vice president, CyberArk.

“This latest Common Criteria certification makes it easier for organizations to adopt the world’s leading privileged access management solution to reduce security risk and improve compliance.”

Governed by ISO/IEC standards bodies, the Common Criteria certification is the most widely recognized international evaluation standard for security in IT products and the U.S. government mandates Common Criteria certification for federal NSS purchases.

Evaluations are conducted by approved independent licensed laboratories using certified evaluators. Virginia-based Corsec Security was CyberArk’s strategic advisor in this certification process.

According to a recent study, 78% of public sector respondents said their organization prioritized cybersecurity, yet nearly half believed that attackers can get into their network each time they try, and 68% admit their organization is susceptible to carefully crafted attacks.

With the most damaging cyber attacks involving some level of privileged access, CyberArk helps government organizations better secure their critical infrastructure, reduce risk and protect against attackers and malicious insiders.

CyberArk delivers the most comprehensive solution for eliminating advanced cyber threats by identifying existing privileged credentials across networks and managing and monitoring those credentials to reduce risk and improve security and compliance.

By utilizing advanced analytics and continuous monitoring, CyberArk detects and isolates anomalous behavior and stops in-process attacks including those perpetrated through external attackers or malicious insiders.


from Help Net Security https://ift.tt/34twAQH

How to Use Chalk at a Gym That Doesn't Allow Chalk


Chalk helps your grip so much. Powerlifters know this, gymnasts know this, Olympic lifters know this. But if you lift at a commercial gym, you may have never gotten to know this wonderful substance; it’s pretty much never available, and often banned. Well, here’s how to bend the rules.

First, if you’ve never seen it, here’s how to use chalk. It comes in blocks or sometimes small chunks, and gyms typically store it in a bucket or bowl. You reach in and have your choice of rubbing a block on your skin or just dipping your hands into the powder that accumulates at the bottom of the container.

The problem with chalk is that it can be messy. If you’re using it properly, you shouldn’t be leaving trails on the floor or clapping clouds of it into the air. But chalk does have a tendency to get everywhere, and some gyms don’t like that. If you’re leaving white handprints everywhere, they’ll know it was you. So try one of these options instead:

Option 1: Sneak in a small piece

Unlike other powdery white substances, chalk isn’t actually illegal. You can buy it anywhere, including at sporting goods stores and online.

And because a little goes a long way, you can just bring a tiny piece with you. One guy I know at the gym always has a little piece of chalk in his pocket, just enough to give him some grip, and little enough that it’s barely noticeable on the bar after he leaves. Until he offered me some one day, I had no idea he even used it.

Option 2: Use liquid chalk

Actual elapsed time: about 30 seconds
Gif: Beth Skwarecki

“Liquid chalk” tends to make less of a mess, as long as you don’t spill it. (Many gyms that disallow chalk will make an exception for the liquid stuff.) This, too, can be purchased at a sporting goods store or online.

To use it, squirt a few drops onto your hand. It looks like watered-down milk, and you’ll think “How is this supposed to help me?” But rub it all over your palms, and then wave your hands around until they dry, and within 30 seconds or so your hands will be coated in a chalky white layer. It can still leave handprints on your black sweatpants, but at least there’s no loose chalk dust floating around you. And for that, your gym owners will be thankful.


from Lifehacker https://ift.tt/333Rh5i

How to Get Someone to Stop Reclining Their Seat On a Flight


In recent weeks, we here at Lifehacker HQ have had several important debates over the correct etiquette on flights, like which passenger has the right to close the window shade, access to the first-class bathroom, and the ability to deplane first.

But no subject has caused more controversy across social media than the debate over whether you should actually recline your seat on a flight—even the Washington Post recently chimed in on the issue (the New York Times and NPR have had takes in the past, too). We wrote about it back in July and opinions were generally mixed, though leaned in favor of reclining at your discretion and yours alone. “Unless it is their first flight, they know the score,” JasonMTracy wrote in our comments. “Often, the entire reason I’m reclining is that the person in front of me did, and now I need the extra room.”

I, too, am strictly pro-reclining. Of course, this should come with exceptions, like during take-off and landing for obvious safety (and comfort) reasons. And never recline during meal service; no one wants to eat with you in their lap. Unfortunately, these rules are hardly universal—but here’s an evil hack by way of Reddit that might solve your problem. “If the person sitting in front of you on a flight reclines their seat all the way back and leaves you with no room, turn on the air con above you to full blast and point it at the top of their head,” u/medievilmusician writes.

In other words, let your passive aggression out by forcing the passenger in front of you to endure the wrath of your freezing-cold airplane air until they relent. Of course, there’s a chance they might ask you not to do that, but the odds that they’ll adjust their seat to avoid a confrontation are likely higher.

If that doesn’t work, or the seat in front of you reclines just a few inches short of your air conditioning’s path, it might be time to get a little more aggressive. “.... the second I see it start to recline I try to put my knees up against it and so they can’t recline it and it’s funny to watch them struggle with it wondering why it won’t work,” u/drudown49 writes. If that fails, the occasional kick to the seat in front of you, or a case of feigned restless leg syndrome, might earn you an extra inch or two, at least.


from Lifehacker https://ift.tt/32ZidmC

Linux maintainer: Patching side-channel flaws is killing performance


Mirror, mirror on the wall, which is the worst side-channel vulnerability of them all?

For a while it was Meltdown and Spectre, the two biggies that kicked off the era of microprocessor security worry in early 2018, followed some months later by another contender, PortSmash.

In May this year, news emerged of more weaknesses with fancy names – ZombieLoad (CVE-2018-12130), RIDL, and Fallout (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091).

The thread loosely holding this list together is a new class of weaknesses known as Microarchitectural Data Sampling (MDS) flaws, in the case of PostSmash and ZombieLoad in Intel’s Simultaneous Multithreading (SMT) hyper-threading.

When it was introduced nearly 20 years ago by Intel, SMT multithreading was promoted as a clever way of boosting processor performance.

But if this created all these security problems, the simplest way to mitigate those was to turn off hyper-threading via the BIOS, something estimated by researchers to cause a performance drop of up to 30% for datacentre installations, depending on which flaw was being addressed.

Lock it up

For a while, this was just a debate, but it quickly started seeping into the real world. The deepest well of unhappiness has been in the Linux world, an influential sector for whom even theoretical security problems are a big deal.

During 2018, the maintainers of Linux distros such as OpenBSD started recommending turning SMT off if it was being used in certain types of installation – just patching it on a piecemeal basis wasn’t enough.

An easy-to-miss mainstream follow up to that was Google’s 2019 decision to disable MDS on Chrome v74 in its Chromebooks, a move it followed up with additional mitigations in later versions.

By now, the SMT fire was burning on several fronts, especially comments made by the maintainer of the stable branch of Linux, Greg Kroah-Hartman. In May, he summed up a year of doubt about SMT:

As I said before just over a year ago, Intel once again owes a bunch of people a lot of drinks for fixing their hardware bugs, in our software…

Only days ago, Kroah-Hartman came back with another salvo in comments to The Register:

A year ago, they said disable hyper-threading, there’s going to be lots of problems here. They chose security over performance at an earlier stage than anyone else. Disable hyper-threading. That’s the only way you can solve some of these issues. We are slowing down your workloads. Sorry.

And there is no way of jumping the performance shark either:

I see a slowdown of about 20 per cent. That’s real. As kernel developers we fight for a 1 per cent, 2 per cent speed increase. Put these security things in, and we go back like a year in performance. It’s sad.

Reducing performance by that big a hit could cause major issues for datacentres to the extent they might have to consider leaving it turned on and take the risk.

Encouraging the conservative response is the fact that reported attacks exploiting issues such as ZombieLoad are non-existent.

That might be because attackers have yet to figure out how to do that or because detecting side-channel attacks is inherently impossible once a compromise fundamental enough to reach microprocessor level has been attained.

But when someone like Kroah-Hartman starts talking about performance as a necessary sacrifice – possibly for many years to come – perhaps server users have reason to worry.

What’s become apparent is that patching side-channel issues is the microprocessor problem with no simple answer.

Customers will carry on patching the issues that pop up, caught in a sort of dented version of Moore’s Law where microprocessor performance continues to rise exponentially for some customers, but not others.


from Naked Security https://ift.tt/34gMb5H

Leading domain name registrars suffered data breach

Web technology company Web.com and its subsidiaries – domain name registrars Register.com and Network Solutions – have suffered a data breach.

domain name registrars breach

What happened?

According to the practically identical notices (1, 2, 3), attackers gained unauthorized access to a “limited” number of the organizations’ computer systems in late August 2019 and likely accessed account information for current and former customers.

The compromised info includes contact details such as name, address, phone numbers, email address and information about the services that they offer to a given account holder.

“We store credit card numbers in a PCI (Payment Card Industry) compliant encryption standard and do not believe your credit card information is vulnerable as a specific result of this incident. That said, it is good practice to monitor your credit card account and we encourage you to notify your credit card provider if you see any suspicious charges,” the organizations noted.

They did not say whether passwords (encrypted or not) were accessed.

Scope of the breach

An independent cybersecurity firm was called in to investigate the breach and federal authorities have been notified of it.

The scope of the breach is still unknown. DomainState says the number of domain names registered through Network Solutions is roughly 6.9 million and through Register.com 1.8 million.

“We are notifying affected customers through email and via our website, and as an additional precaution are requiring all users to reset their account passwords,” the companies added – though links to the notices are not prominently featured on their main pages.

The breach was apparently confirmed on October 16, 2019, meaning that the attackers have had quite some time to root through the compromised systems. Perhaps the scope of this breach will end up being much larger.

Until more details are known and shared, customers will have to make do with changing their account password and keeping an eye on their credit card account.


from Help Net Security https://ift.tt/2ozX8jR

Where to Get Free Food on Halloween 2019


Tonight you can get free candy from strangers. But you can also get some free sweets from Krispy Kreme and other chains. And it’s a big night for free kids meals—mostly regardless of whether the kids are in costume.

Free Stuff

  • Krispy Kreme: Free donut if you visit in costume
  • Insomnia Cookies: Free cookie if you visit in costume
  • Edible Arrangements: Free “spooky pineapple eyeball treat” if you visit in costume
  • Chuck E. Cheese: 50 free game tickets for kids in costume

Free Kids Meal With Adult Entree Purchase

  • Beef ‘O’ Brady’s: kids in costume
  • Bubba Gump Shrimp Co.
  • Carrabba’s Italian Grill
  • Cici’s Pizza: free kids buffet with adult entree and drink purchase
  • Cousins Subs: with purchase of 7.5" sub
  • IHOP: 4-10 P.M.
  • Jamba Juice: free kids smoothie with adult smoothie/bowl
  • Joe’s Crab Shack
  • McAllister’s Deli: kids in costume, up to two kids per adult entree
  • Mimi’s Cafe: up to two kids per adult entree, dine-in only
  • Rainforest Cafe: 99 cents
  • Ruby’s Diner
  • TooJay’s Deli: Oct 26-Nov 4

Other Deals

  • Pilot Flying J: BOGO on Reese’s pumpkin king size cups and Paqui haunted ghost pepper chips
  • Door Dash: Dress up as a takeout item for $10 off that item.

Deals via Promocodes.com. See more Halloween discounts at Promocodes, Offers.com, and RetailMeNot.


from Lifehacker https://ift.tt/3347VBR

Judge lambasts porn company for spewing copyright lawsuits


For years, people have handed thousands of dollars to copyright trolls in order to avoid the embarrassment of getting dragged through court over charges of downloading pirated videos from BitTorrent sites.

The trolls have pounced on downloaders, filing copyright lawsuits over illegal downloads against “John Doe” defendants, whom they only know by IP address.

But last week, a court in the US state of New Jersey refused to play ball, instead coming down on the side of the privacy rights of the ISP account holders who are targetted.

A federal judge in New Jersey denied a prolific copyright-filing porn video company from getting the expedited subpoena it wanted in order to reveal the identities of internet users whom it claims illegally downloaded pirated content over BitTorrent.

The company is Strike 3 Holdings – the company behind the adult entertainment videos produced by the Vixen, Tushy and Blacked studios. According to TorrentFreak, Strike 3 is the most active filer of piracy lawsuits in the US.

Judge Joel Schneider didn’t just deny Strike 3 its request to reveal the identities of people whose IP addresses it had connected to illegal downloads, he also became the latest in a string of judges to criticize the company’s strategy of filing a massive number of copyright lawsuits against anonymous downloaders.

In January 2019, TorrentFreak reported that Strike 3 had filed 2,092 cases over the previous 12 months.

This is how these copyright cases work:

  1. The company claiming to be a victim of piracy gets a list of allegedly infringing IP addresses from BitTorrent swarms – i.e., a group of computers downloading and uploading the same torrent.
  2. The copyright holder requests a subpoena from the court that will compel ISPs to hand over the customer data associated with the IP addresses.
  3. Once the copyright holder gets hold of the identities of people behind the ISP accounts, it starts chasing them down for cash settlements.

It works. They’ve been pulling in big bucks. Last year, in one of the first cases to signal how sick and tired judges are of seeing their courts flooded by these cases, Judge Royce C. Lamberth called Strike 3 a “cut-and-paste” serial litigant whose lawsuits “smack of extortion” – a company that turns tail at the first sign of a defense and which, he said, had been using his court “as an ATM”.

Both that decision, from November 2018, as well as last week’s decision from District Court Magistrate Judge Joel Schneider, outline a slew of problems with the way that copyright trolls have been unleashing swarms of lawyers to hound people who allegedly watch their content through BitTorrent.

First, because BitTorrent masks users’ identities, Strike 3 can only identify infringing IP addresses. From an IP address it can identify the ISP that allocated it and, using geolocation, the likely jurisdiction the IP address resides in.

That method is “famously flawed,” Lamberth wrote, given the flimsy links between an IP address, a person and a location. Multiple people might share the same IP address: family, neighbors, guests, roommates, for example, and an IP address can be reallocated at the whim of the ISP.

An IP addresses might also point to virtual private network (VPNs) or Tor node, or a home computer compromised by malware and being used without its owner’s knowledge.

Geolocation has its issues too – it’s far from pin-point accurate and, in extremis, it might randomly assign an address to a default location.

Case in point on that last item: the couple whose quiet rural farmhouse became associated with the geographic center of the US and who, because of an internet mapping glitch, have been accused of being identity thieves, spammers, and scammers, and who’ve found on their doorstep FBI agents, federal marshals, IRS collectors, ambulances searching for suicidal veterans, and police officers searching for runaway children, and who have been wrongfully punished by irate people who’ve published their names and addresses or left a broken toilet in their driveway.

In short, as Judge Schneider said last week in his detailed, 47-page decision, the only thing that Strike 3 actually knows is that an IP address is associated with downloading copyrighted work. That doesn’t mean that the ISP account holder has infringed anything.

But even if the infringement claim were based on sturdier evidence, Judge Schneider wrote, the requests for expedited discovery would still be denied, due to these additional issues:

  1. Strike 3 bases its complaints on unequivocal affirmative representations of alleged facts that it does not know to be true.
  2. Strike 3’s subpoenas are misleading and create too great of an opportunity for misidentification.
  3. The linchpin of Strike 3’s good cause argument, that expedited discovery is the only way to stop infringement of its works, is wrong.
  4. Strike 3 has other available means to stop infringement besides suing individual subscribers in thousands of John Doe complaints.
  5. The deterrent effect of Strike 3’s lawsuits is questionable.
  6. Substantial prejudice may inure to subscribers who are misidentified.
  7. Strike 3 underestimates the substantial interest subscribers have in the constitutionally protected privacy of their subscription information.

The “other available means” that Strike 3 isn’t bothering to use in order to stop infringement are Digital Millennium Copyright Act (DMCA) takedown notices.

From the decision:

One would think that Strike 3 would be eager to notify ISP’s that its subscribers are infringing their copyrights, so that an infringer’s internet service would be interrupted, suspended or terminated and infringement would stop. However, Strike 3 does not take this simple step but instead files thousands of lawsuits arguing that it has no other recourse to stop infringement.

But why would it? Copyright trolls find it easy, and highly lucrative, to simply shake down alleged infringers, particularly when courts go along with their requests for expedited subpoenas to get the subscribers’ identities.

In fact, in August 2018, we saw a lawyer plead guilty to creating a porn honeypot so he could cash in on the easy money you can make from copyright trollery. He and another lawyer made porn films, seeded them to BitTorrent websites, and then extorted those who downloaded them, threatening to file lawsuits unless they paid $3,000 to stay out of court.

From 2011 to 2014, the (now debarred) lawyers made more than $3m from lawsuits.

Judge Schneider concedes that the court’s decision might make it tough for Strike 3 to identify copyright infringers. Be that as it may, he said: people’s right to privacy trumps that difficulty:

To the extent this is the price to pay to assure compliance with the applicable law, so be it. A legal remedy does not exist for every wrong, and it is unfortunately the case that sometimes the law has not yet caught up with advanced technology. This is not the first time, nor will it be the last, where a party who believes it was wronged was denied discovery.


from Naked Security https://ift.tt/34iVC4S

Researchers find hole in EU-wide identity system


A flaw in a cross-border EU electronic identity system could have allowed anyone to impersonate someone else, a security consulting company has warned.

SEC Consult issued an advisory warning people of the flaw this week. It demonstrated the problem in the electronic identification, authentication and trust services (eIDAS) system by authenticating as 16th-century German writer, Johann Wolfgang von Goethe.

eIDAS came about because of a 2014 EU regulation that laid out the rules for electronic identification in Europe. The regulation, which came into effect in 2016, made it compulsory for EU countries to identify each other’s electronic IDs by the middle of last year. It covered a range of identification assets like electronic signatures and website authentication.

The problem is that there’s a flaw in the software used to manage this cross-border identification process, known as eIDAS-Node. Each country has to run a copy of this software to connect its own national identity management systems to others in the EU, creating a cross-border ID gateway. Using this gateway, citizens in the UK, say, could identify themselves to use electronic services in Germany, such as enrolling in a university or opening a bank account.

Like many federated identity systems, eIDAS uses the Security Assertion Markup Language (SAML). It’s an XML-based protocol from the nonprofit Organization for the Advancement of Structured Information Standards (OASIS). It lets users prove their identities across multiple service providers using a single login. Version 2, launched in 2005, includes support for features like encryption and the exchange of privacy information such as consent. It’s powerful but complex.

The flaw lay in the integration software that the EU provides for coupling eIDAS nodes together. Its SAML parsing allowed an attacker to avoid the signature verification process, meaning that they could tamper with a SAML message to impersonate anyone.

When an eIDAS node provides a service to someone in another country, it asks that country’s eIDAS node to send an authentication message. It must check that the message is signed by a trusted node to avoid imposters and it does this by looking for a digital certificate.

To do this, it first checks its local collection of trusted certificates, known as a trust store. If it can’t find the certificate there, it looks for other (supplemental) certificates in the SAML message.

The problem is that when the software looks for those other certificates, it only checks to see if the distinguished name (DN) of the authority that issued the certificate matches the DN of the other eIDAS system. The software misses an important step by not checking to see if the issuer’s certificate actually signed the other eIDAS system’s certificate. SEC Consult also said:

Moreover, other checks, such as whether the basic constraints of the issuer certificate allow it to act as a certificate issuer are not verified.

Luckily, the EU fixed the problem after SEC Consult contacted the relevant authorities on 4 July this year. It updated the software and released it for general download on Wednesday 28 October.

Exploiting the vulnerability would have required an attacker to have control of the eIDAS node or impersonate one, and the researchers point out that another study of eIDAS security last year didn’t pick up the bug. That makes it highly possible that it was only recently introduced, they concluded.


from Naked Security https://ift.tt/2r0j6gK

WhatsApp sues spyware maker for allegedly hacking phones worldwide


In May 2019, Facebook revealed its discovery of an “advanced cyber actor” that was spying on some users of its massively popular, end-to-end encrypted WhatsApp messaging app.

WhatsApp users were getting hacked due to what’s known as a zero-click vulnerability: one that allowed attackers to silently install spyware just by placing a video call to a target’s phone.

WhatsApp quickly fixed the vulnerability, and now it’s going after the maker of the cyberweapon it says is behind the attack – an attack that let somebody or somebodies call vulnerable devices to install spyware that could listen in on calls, read messages and switch on the camera.

On Tuesday, WhatsApp publicly attributed the attack to NSO Group, an Israeli company that sells off-the-shelf spyware and which also goes by the name of its parent company, Q Cyber Technologies.

Also on Tuesday, WhatsApp filed a complaint in the US District Federal Court in Northern California, accusing NSO of “unlawful access and use” of WhatsApp computers.

In a statement published by the Washington Post, Will Cathcart, head of the Facebook-owned WhatsApp, said that responsible companies report vulnerabilities, instead of exploiting them, and that companies have no business selling services to anybody who launches attacks.

At WhatsApp, we believe people have a fundamental right to privacy and that no one else should have access to your private conversations, not even us. Mobile phones provide us with great utility, but turned against us they can reveal our locations and our private messages, and record sensitive conversations we have with others.

Pegasus allegedly flies again

The lawsuit specifically refers to NSO Group’s notorious Pegasus – a type of spyware known as a remote access Trojan (RAT).

Pegasus enables governments to send a personalized text message with an infected link to a blank page. Click on it, whether it be on an iOS or Android phone, and the software gains full control over the targeted device, monitoring all messaging, contacts and calendars, and possibly even turning on microphones and cameras for surveillance purposes.

According to the lawsuit, NSO couldn’t get its spyware past WhatsApp encryption. In order to hack the messaging app, NSO created a Pegasus version that didn’t require that targets be spearphished with a rigged link.

Rather, NSO allegedly formatted call initiation messages containing malicious code to make the calls look legitimate, as if the calls originated from its signaling servers. By concealing the code within call settings, NSO allegedly used WhatsApp’s own servers – relay and signaling – to route the company’s spyware.

WhatsApp managed to tie certain WhatsApp accounts used during the attacks back to NSO, as it describes in the complaint. The accounts were created to place the calls that injected the spyware, the lawsuit says.

WhatsApp had first been tipped off to the attack by suspicious calls, but because of its privacy and data-retention rules, it had no idea whose numbers they were. Citizen Lab, a cybersecurity research laboratory based at the University of Toronto, volunteered to find out: as the New Yorker reports, its experts worked to determine whether any of the numbers belonged to civil society members.

Citizen Lab told Reuters that the targets included well-known TV personalities, prominent women who had been subjected to online hate campaigns, and people who had faced “assassination attempts and threats of violence.”

From Citizen Lab’s post:

As part of our investigation into the incident, Citizen Lab has identified over 100 cases of abusive targeting of human rights defenders and journalists in at least 20 countries across the globe, ranging from Africa, Asia, Europe, the Middle East, and North America that took place after Novalpina Capital acquired NSO Group and began an ongoing public relations campaign to promote the narrative that the new ownership would curb abuses.

Neither Citizen Lab nor WhatsApp have identified the targets by name.

Multiple lawsuits

NSO’s Pegasus and other spyware products have already been implicated in a series of human rights abuses. WhatsApp’s is just the latest to result from hacks allegedly tied to NSO’s products.

Pegasus has been unleashed against Mexican political activists and targeted at the human rights-focused NGO Amnesty International in a spearphishing attack.

NSO’s spyware also allegedly played a part in the death of Washington Post journalist Jamal Khashoggi, who was murdered at the Saudi Consulate in Istanbul a little over a year ago. In December 2018, Omar Abdulaziz – a Saudi Arabian dissident who was close to Khashoggi – joined with a group of seven activists and journalists who filed a lawsuit against NSO in Israel and Cyprus, charging that NSO helped the royal court take over the murdered journalist’s smartphone and intercept his communications and that all their phones had similarly been compromised.

Amnesty International is also suing NSO, calling a June 2018 spearphishing attack on an Amnesty staff member “the final straw.”

WhatsApp’s suit is looking for a permanent injunction to bar NSO from accessing or attempting to access WhatsApp and Facebook’s services. It also seeks unspecified damages.

NSO denies it all

NSO Group’s response to incidents of operators unlawfully using its software to persecute dissidents, activists and journalists has been consistent: it repeatedly points out that Pegasus is supposed to be used solely by governments, to enable them to invisibly track criminals and terrorists.

From the statement it put out in response to WhatsApp’s lawsuit:

In the strongest possible terms, we dispute today’s allegations and will vigorously fight them. The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime.


from Naked Security https://ift.tt/2oxKGRv

Apple releases fresh security updates for macOS, iOS

In the last few days, Apple has staggered security updates for many of its products, including the recently unveiled macOS Catalina.

apple security updates October 2019

Safari, tvOS, iPadOS, iOS, iCloud, iTunes updates

The Safari update delivered fixes for 14 CVE-numbered Webkit and WebKit Process Model vulnerabilities, most of which are memory corruption issues that may lead to arbitrary code execution if maliciously crafted web content is processed (i.e., users visit malicious web pages).

The same flaws were also fixed in the tvOS, iPadOS and iOS update (for iOS 13).

In addition to those, tvOS 13.2 fixes memory corruption issues in several other components, two kernel flaws, and an authentication issue (CVE-2019-8803) that may allow a local attacker to login to the App Store account of a previously logged in user without valid credentials.

Many of these have also been fixed in iOS 13.2 and iPadOS 13.2, including CVE-2019-8803. Other patched issues of note are those for:

  • CVE-2019-8793, discovered by a Florida 6th grader, which may allow a local user to record the screen without a visible screen recording indicator, and
  • CVE-2019-8789, a validation issue that may allow attackers to leverage a maliciously crafted iBooks file to get at user information.

The contents of the iOS 12.4.3 security update are currently unavailable, and so are those for watchOS 5.3.3, but the watchOS 6.1 update brings (among other things) the WebKit and kernel fixes, and fixes for CVE-2019-8803 (the App Store account issue) and CVE-2019-8747, a memory corruption flaw in the AppleFirmwareUpdate kernel extension, which could allow a malicious application to execute arbitrary code with kernel privileges.

The and iCloud updates (for Windows 7 through 10) are pretty lightweight: the Webkit fixes take most of the space.

macOS Catalina update

The macOS Catalina update (10.15.1) and the two security updates for macOS High Sierra and Mojave are, expectedly, more hefty. They contain (among other things):

  • Several kernel fixes
  • Updated third-party libraries (e.g., libxslt, libxml2)
  • Fixes for three flaws affecting CUPS, the maOS printing system
  • Fixes for the App Store account auth issue (CVE-2019-8803), a privilege escalation flaw in File Quarantine (CVE-2019-8509), a variety of memory corruption issues in the various drivers, two flaws in AppleGraphicsControl, one of which could allow an application to execute arbitrary code with system privileges (CVE-2019-8716).

from Help Net Security https://ift.tt/2NvtV1E

A Broken Random Number Generator in AMD Microcode

Interesting story.

I always recommend using a random number generator like Fortuna, even if you're using a hardware random source. It's just safer.


from Schneier on Security https://ift.tt/2C0YkzC

Office 365 users targeted with fake voicemail alerts in suspected whaling campaign

Office 365 users at high-profile companies in a wide variety of industries are being targeted with voicemail-themed phishing emails, McAfee researchers have found.

They say that a wide range of employees have been targeted, from middle management to executive level staff, and that these emails could be part of a “whaling” campaign.

The deception

The malicious emails take the form of (fake) Microsoft-branded notifications telling recipients of a missed call.

They contain an attachment: an HTML file that, when loaded, shows potential victims to a page that:

  • Autoplays a file that sounds like a truncated, recorded voice message
  • Tells them to wait while the entire voice message is downloaded from the server
  • Instructs them to log in to access the message.

Office 365 voicemail phishing

The sound file is hosted on and pulled from SoundBible.com. The phishing pages to which the potential victims are redirected are hosted on various domains (IoCs have been made available by McAfee).

“The email address is prepopulated when the website is loaded; this is another trick to reinforce the victim’s belief that the site is legitimate,” the researchers explained.

When the password is entered, the victim is presented with a “successful login” page and redirected to the legitimate Office.com login page.

Harvesting credentials

The malicious emails have been delivered to management and executives of organizations in the service, financial and insurance industry, IT services providers, educational institutions, healthcare organizations, charities, critical infrastructure providers.

Three different phishing kits have been used to generate the malicious websites, the researchers found, and the pages record information about the visitors: their email address, the entered password, their IP address, and the region (location) from which they accessed the page.

“The goal of malicious actors is to harvest as many credentials as possible, to gain access to potentially sensitive information and open the possibility of impersonation of staff, which could be very damaging to the company. The entered credentials could also be used to access other services if the victim uses the same password, and this could leave them open to a wider of range targeted attacks,” they noted.

“What sets this phishing campaign apart from others is the fact that it incorporates audio to create a sense of urgency which, in turn, prompts victims to access the malicious link.”

They advise enterprises to block .html and .htm attachments at the email gateway level and to mandate the use of two-factor authentication (2FA) for important accounts (especially Office 365 and G Suite accounts).

Users are advised not to open attachments in unsolicited emails from unknown senders.


from Help Net Security https://ift.tt/333f7y7

Wednesday, October 30, 2019

Container usage has grown in complexity, specific security controls are needed

Container usage has grown in scale and complexity, and doubled in density, according to Sysdig. As container technologies continue to transform how organizations deliver applications, it is important for enterprises to understand how to securely operate container workloads in production and take steps to prepare for the massive growth expected.

container security controls

50% of containers live less than five minutes

This is a dramatic change from last year, when only 20% of containers lived less than five minutes. Many containers need to only live long enough to execute a function and then terminate when complete.

The broader adoption of batch data processing with Kubernetes Jobs and serverless frameworks on Kubernetes have contributed to the growth of short-lived containers.

The ephemeral nature of containers is one of the unique advantages of the technology, yet at the same time can be a challenge in managing issues around security, health, and performance. This reaffirms the fact that enterprises need real-time threat prevention as well as detailed auditing and forensics tools.

52% of images scanned have known vulnerabilities

The report also finds that 40% of Sysdig customers’ images are from public sources. Considering less than one percent of Docker Hub images are certified trustworthy, using publicly sourced images exposes enterprises to risk.

Enterprises need to embed security into the CI/CD pipeline, including scanning during the build phase, as well as checking for new vulnerabilities at runtime.

Containers-per-host density increases 100%

Over the past year, the median number of containers per host doubled to 30, indicating a growth in the number of applications being transitioned to cloud-native infrastructure and an increase in compute “horsepower,” which has enabled more containers to run on each node.

Use of Prometheus metrics increases 130%

Year-over-year, Prometheus metric use grew 130% across Sysdig customers – increasing to 46%. As the use of new programming frameworks expands, alternatives like JMX metrics (for Java applications) and StatsD are diminishing, down 45% and 17% respectively.

Prometheus has been widely adopted as a metric standard in projects like Kubernetes, OpenShift, and Istio. In addition, an increasing number of “exporters” are available to provide metrics for a wide range of third-party applications and services.

The increased volume of containers and hosts drives the need for tools that enable Prometheus monitoring at scale across clusters and clouds, such as Sysdig Monitor.

11% of customers are operating in multi-cloud

Multi-cloud is here thanks to Kubernetes. Eleven percent of Sysdig customers operate containers across more than one public cloud. Because of Kubernetes, which has been cemented as the de facto operating system of the cloud, enterprises do not have to fear vendor lock in and they are able to make multi-cloud a reality.

container security controls

Go and Node.js overtake Java as top cloud application frameworks

There are clear winners for programming languages and frameworks. Go and Node.js overtook Java as top cloud app frameworks, neither of which made the top 10 list last year.

Java has long been one of the most prominent programming languages, but newer options like Go, created by Google engineers, have gained favor in part because of their ease of use.

“With container density doubling since our last report, it’s evident that the rate of adoption is accelerating as usage matures. With that said, containers are black boxes that work well as application building blocks, but they are invisible to conventional security and visibility tools,” said Suresh Vasudevan, Sysdig CEO.

“With this report, we hope to educate enterprises on existing challenges and how to run cloud-native environments in production, which should include a secure DevOps approach.”


from Help Net Security https://ift.tt/2JA4POj