Want to get around a CAPTCHA? That’ll be 0.00094c, please

Shopping or booking an appointment online can seem increasingly like busywork. Please prove that you’re not a bot: select all the photos that show traffic lights. Do some light arithmetic. Squint and retype these increasingly indecipherable letters (“Is that a lowercase H or a lowercase B?”).

With over half of web traffic automated, it’s increasingly important for businesses to tell which of their online visitors are real and which are bots. Not every bot that visits a website is there to cause trouble, but many are—scraping the content, trying to buy limited-edition goods before genuine customers can, or using card gateways to check if stolen credit card details are still valid. Even those bots that aren’t bad actors can cause problems when businesses use web analytics skewed by bots to make decisions.

CAPTCHAs are the most visible technique used by online businesses to differentiate between real customers and bots. Unfortunately, it’s a technology that’s under threat from a very old technology: outsourced manual labor.

The economics of CAPTCHA farms

If you are a bot operator and are faced with the problem of small repetitive tasks getting in the way of making serious money, then you have a couple of choices. One is to seek out or even build a bot that is capable of solving these CAPTCHAs, continuing the ongoing arms race. The other is to hire humans to solve tasks designed to be solved by humans.

CAPTCHA farms have been around for over a decade, pretty much since CAPTCHAs first became a way to protect against bots. CAPTCHA requests will be sent from the bot to the farm through an API, and at the other end a human will be available to solve the test.

It’s important to understand that these farms are not small organizations operating in shabby basements. They are established, well-run businesses akin to contact centers, with full employee training. They do, however, rely on inequality to thrive, as it is only lucrative when they are based in emerging markets and are, effectively, a digital sweatshop.

At the time of our most recent research, we found that employees earn around $0.18 for every 1,000 CAPTCHAs solved. Bot operators buy these services at around $0.94 for every 1,000 solved. This is a business model where the employees are doing lots of repetitive work for very little, and where bot operators are by comparison paying pennies to have their CAPTCHA problem solved. The farm owners need to operate at scale to be profitable—and they do.

The end result is that bot operators can see CAPTCHA as more of a speed bump than a barrier to achieving their aim.

An arms race with multiple weapons

Businesses and bots are in an escalating battle—but there are two fronts. As bots get more sophisticated, so do the techniques to identify and prevent bot attacks. And as bots get less effective, work will go into making them circumvent the new barriers erected to slow them down.

At the same time, businesses will rely on CAPTCHA to try and block bots – but when this becomes too much for bots to handle, outsourced labor will solve the problem.

Businesses are not helpless in the face of CAPTCHA farms, though admittedly it can seem like they are facing an impossible task. If bot operators can pose as ordinary users simply by spending some money, can they really be stopped at all? The answer lies in asking a new question. Businesses should still ask of their visitors “Is this a bot or a human?” but also ask “What does this visitor intend to do?”

All users, whether real or human, provide far more signals that can be analyzed than whether or not they have passed a CAPTCHA test. Where did they arrive from? How did they navigate through the site? What are they using to access the site? Is their behavior truly human-like, or simply trying to mimic that of a human?

For example, one way to mitigate against bots is rate-limiting, simply setting a maximum number of requests that a visitor can make in a certain amount of time. Sophisticated bots will figure out this limit and stay just below it, in a very inhuman way.

Analysis of behaviors like these will be key to sifting out the bad actors from the genuine users in the future. CAPTCHA will still have a place, but it’s important to remember that it will only deter those unwilling to spend a few extra pennies.

from Help Net Security https://ift.tt/3doPez1

The growing threat to CI/CD pipelines

Before the pandemic, most modern organizations had recognized the need to innovate to support developers’ evolving workflows.

Today, rapid digitalization has placed a significant burden on software developers supporting remote business operations. Developers are facing continuous pressure to push out software at high velocity. As a result, security is continuously overlooked, as it doesn’t fit into existing development workflows.

The way we build software is increasingly automated and integrated. CI/CD pipelines have become the backbone of modern DevOps environments and a crucial component of most software companies’ operations. CI/CD has the ability to automate secure software development with scheduled updates and built-in security checks.

Developers can build code, run tests, and deploy new versions of software swiftly and securely. While this approach is efficient, major data breaches have demonstrated a significant and growing risk to the CI/CD pipeline in recent months.

Theoretical threats are becoming reality

Despite increasing awareness around the need for securing code, securing the software build processes is often an afterthought. But high-profile supply chain attacks over the past year and a 430% surge in such attacks overall have underscored just how vulnerable software supply chains can be. Just recently, the UK’s National Cyber Security Center (NCSC) issued a warning about software build pipelines.

Organizations must be mindful of insider actors with access to source code. Verizon’s 2020 Data Breach Investigations Report found that one-third of data breaches originate from insider actors. These insider actors can include privileged IT administrators, disgruntled former employees, and managerial employees with the ability to commit code without review.

Malicious or not, insider threat is a tremendous risk to organizations’ overall security. 79% of security leaders worry that now, with remote work, users are more likely than ever to ignore security policies, thus making the organization more vulnerable to threats.

Another significant threat to the software supply chain is unpatched vulnerabilities in code. Attackers search for vulnerabilities in open-source code that they can use to attack any application that relies on that code. This is a considerable concern, as 99% of organizations use some open-source code in their software, and 91% of codebases contain components that were out of date or that had not seen developer attention in years.

Taking steps to CI/CD security

Supply chain attacks are growing in scale and frequency at an alarming rate. Organizations must consider the security of their CI/CD pipelines in addition to the security of their code. By hardening CI/CD pipelines and addressing security early in the development process, developers can deliver software faster and more securely.

It is crucial to maintain builds’ independence from one another to ensure that in the case of a compromise, uncompromised builds are not impacted by the affected ones. Organizations must conduct security checks frequently and make sure that the software shipped is the software developed. By inserting insider attack detection into the software supply chain, organizations can establish non-repudiation of the software shipped at every stage, eliminating the blind spot around the risk of software consumption that exists today.

Developers must secure pipelines by locking repository host systems, configuration managers, and build servers. Additionally, organizations should audit pipeline tools and repository access at random and make regular updates to limit potential internal or external threats. Builds should be scanned while the code is still fresh in the developer’s mind to guarantee any vulnerabilities found are quickly remediated before an application is off to production.

Organizations must maintain comprehensive visibility across various services to accurately identify anomalies and determine if an insider attack has occurred. This ensures they know what and where to monitor within their unique application architecture moving forward.

from Help Net Security https://ift.tt/3ufmHCG

SolarWinds breach severity perception increasing over time

(ISC)² has published the results of an online survey of 303 cybersecurity professionals from around the globe in which respondents compared their perception of the severity of the SolarWinds Orion software breach between when it was first reported and several weeks later as more information was revealed.

Respondents also relayed how the breach has impacted their jobs, recommended changes to organizational security practices and provided lessons learned.

The survey seeks to shed light on the complexities of supply chain security by gathering insights directly from cybersecurity practitioners who most often are responsible for mitigating the risk of third party security stacks in their organizations.

An increase in SolarWinds incident severity perception

86% of respondents said they would have rated the breach “very” or “extremely severe” when they first learned about it. However, roughly six weeks after the incident was reported, as more details emerged, the number of respondents who indicated that the breach was “severe” increased from 51% to 55%.

On a scale from 1 to 5, the perception of the severity of the breach also increased over time, from an average of 4.34 initially up to 4.37.

Prompting reviews of security tools and protocols

The incident has prompted reviews of security tools and protocols by many cybersecurity teams. Cybersecurity professionals said they have stepped up activities such as forensic analyses, re-architecting of systems, and making sure all patches are up to date.

Many respondents reported getting questions from their executive teams about their own security protocols, prompting time-consuming due diligence and reporting activities.

from Help Net Security https://ift.tt/2PmzOmQ

Why passwords are to blame for loss of revenue, identity attrition and poor customer experiences

Transmit Security has released a state of customer authentication report that includes customer experience insights based on its survey of 600 U.S. consumers. According to the report findings, organizations are losing potential customers and a substantial amount of revenue due to their dependency on traditional password systems and outdated customer authentication models.

Challenges connected to password-sharing habits

The report also underscores the challenges connected to password-sharing habits. More than 50% of the survey participants admit they have shared a password to, at least, one of their online accounts with someone else and 41% say they share their passwords often.

Not only does password-sharing pose a severe security risk, it impacts businesses in a number of ways, from the amount of revenue they’re able to generate to their ability to monitor usage and personalize services.

Traditional passwords also significantly impact customer experiences. The report revealed 55% of consumers have stopped using a website because the login process was too complex, and that 87.5% of consumers have found themselves locked out of an online account after too many failed login attempts. Worse, 92% of users will leave a website instead of recovering or resetting their login credentials.

Complicated, error-ridden password systems

In fact, for most customers the problems with passwords begin long before a failure. Data shows that 66% of users will leave a website if the registration process is too complex. And 64.5% will abandon the site if they are simply asked to create a username and login.

“The number of consumers getting blocked from their online accounts because of poor password experiences is staggering. Customers are dropping out of transaction processes – or failing to use a site at all – due to overly complicated, and oftentimes error-ridden, password systems,” says Transmit Security CEO Mickey Boodaei.

“These horrible customer experiences are costing businesses an unimaginable amount of money, not to mention the revenue that’s lost due to password-sharing between consumers. The market is ready for change. It’s time to eliminate our dependency on outdated password technology and evolve to a place where passwords are no longer necessary.”

from Help Net Security https://ift.tt/3rFXQX5

Worldwide 5G connections to reach 619 million by the end of 2021

5G networks are now nearing a critical mass of global commercial network deployments and subscribers, suggesting a rapid upward curve of technology adoption over the next few years, according to 5G Americas.

According to data provided by Omdia, the world added 385.5 million 5G subscribers between Q4 2019 and Q4 2020 to reach 401 million 5G connections globally, shrugging off the challenges of a global pandemic and economic headwinds.

5G connections growing steadily in 2021

As of December 2020, the fifth generation of wireless (5G) powered ahead at three times the adoption rate of subscriber growth as 4G LTE, which required a full five years to reach the same level of subscriber acceptance, which represents a 2500 percent increase in subscribers over last year. The number of 5G connections is expected to reach 619 million globally by the end of 2021.

Chris Pearson, President, 5G Americas said, “5G is in its early stages of fulfilling its full potential, as the industry has just finished the second inning of a nine-inning baseball game. In the second full year of commercially available 5G, the industry went from 15.4 million to 401 million subscribers. The uptake of 5G connections will accelerate significantly over the next few years.”

By the end of 2025, global 5G connections are projected to reach 3.4 billion. Regionally, the number of connections is forecast to reach 451 million in North America and 167 million in the Caribbean and Latin America by the end of 2025.

From a commercial availability standpoint, an additional 105 5G networks went live globally in 2020, bringing the total up to 163 5G networks. The number of commercial 5G networks is expected to reach 277 by the end of 2021, according to data from TeleGeography.

The growing availability of 5G-enabled devices has also blossomed, with the Global Mobile Suppliers Association (GSA) noting there are now 628 5G devices announced, of which 404 were commercially available by the end of February 2021.

4G LTE connections also experienced healthy growth

In addition to 5G, 4G LTE connections also experienced healthy growth in 2020, surpassing year-end projections of 5.73 billion to reach a total of 6 billion connections. Of those, 499 million 4G LTE connections are from North America and 407 million from Latin America and the Caribbean.

Broken down regionally, North America had 19.96 million 5G connections and 499 million LTE connections by the end of Q4 2020. For the region, this amounts to a 4098% annual growth in 5G, and a gain of over 19.5 million 5G connections over the year. Meanwhile, 4G LTE gained over 22 million connections in 2020, which represents 4.7% growth.

With 5G just beginning in Latin America and the Caribbean, the region saw 6340 5G subscriptions added in the year of 2020. In contrast, LTE continued its strong growth, ending Q4 2020 with 407 million LTE subscriptions (13% YoY growth).

According to Jose Otero, VP of Caribbean and Latin America for 5G Americas “Two elements can contribute to the proliferation of new commercial 5G networks in Latin America and the Caribbean. First, the increased availability of 5G-ready devices, especially for fixed wireless services. Second, governments’ efforts to accelerate the launch of 5G networks that include spectrum assignment processes, 5G incubator projects, spectrum auction announcements and incentives for 5G trials.”

from Help Net Security https://ift.tt/3sC1mmG

Cloud technology adoption gap between internal audit and other enterprise functions to narrow

Internal audit’s ongoing digital transformation will rapidly accelerate in 2021, with 22% of respondents reporting that they will implement cloud-based technology this year, resulting in a majority of internal audit teams using a cloud-based audit management or GRC software solution for the first time, an AuditBoard survey reveals.

Internal audit teams and cloud adoption

“Many internal audit teams that have not yet shifted to a cloud approach are now set to reap the benefits of modernization — including gaining greater bandwidth for strategic, value-add activities — and will be better positioned to protect their organizations from new and emerging risks,” said John Reese, AuditBoard’s CMO.

“They’ll also get to equal footing with other functions within their organization who have already made the move to cloud-based solutions.”

Their planned increase in the usage of cloud software shows that internal audit departments are moving closer to the cloud technology adoption rates of other enterprise functions like IT. The top challenges internal auditors said they experienced in 2020 provides an explanation for the substantial increase in their planned adoption of new cloud technology in 2021:

• 52% of respondents said identifying and evaluating new and emerging risks was their top challenge in 2020.
• Forty-three percent mentioned the need to collaborate remotely with internal and external audit stakeholders.
• Communication and follow-up with business owners was considered a top concern by 38% on internal audit respondents.

The top three use cases for audit management software

Internal auditors use audit management and GRC software to manage a wide variety of activities, from risk identification and evaluation, to the automation of administrative and repetitive tasks, which can free up teams to focus on bigger-picture items. According to the survey, the top three use cases for audit management software are: document management, issue and action plan management, and testing and work reviews.

“While automation of administrative functions offers clear and immediate benefits, internal audit is discovering the technology’s potential to drive departmental and business value,” said IIA COO William J. Michalisin, CIA.

“This survey shows a positive step forward, with 22% of respondents saying they plan to implement cloud-based technology this year. As this report suggests, technology doesn’t merely complement the internal audit function, it’s crucial to more effective practices, allowing us to focus where it matters most and to elevate our value to stakeholders.”

“Internal audit teams are clearly accelerating digital transformation in 2021, a sign that the challenges of working without cloud technology over the past year have been significant,” said Reese.

“As the world emerges from the pandemic, internal audit leaders are turning to contemporary audit and risk management solutions to stay on top of the dynamic risk environment, improve organizational responsiveness, and enable close coordination across their distributed workforces.”

Why cloud-based technology use continues to grow?

Cloud-based technology use by internal audit teams continues to grow for two major reasons, according to the survey: the need to modernize and a requirement for fewer manual processes. In particular, modern, cloud-based platforms offer improved agility, productivity, and collaboration across distributed organizations. Survey responses echo these benefits:

45% of internal audit professionals using manual technologies and methods agreed that their approach limited effectiveness and prevented the delivery of optimum value.

Thirty-one percent of internal audit functions that are already using audit management or GRC software increased their use of such software in 2020, most notably to collaborate remotely with internal and external stakeholders and avoid wasting time and resources on manual and administrative tasks.

Of organizations already using cloud-based technology, 46% increased their usage of the technology as a response to the 2020 pandemic.

from Help Net Security https://ift.tt/2PpTVAz

GuardDog PCS protects against threats outside the perimeter of the network or on attached devices

Guard Dog Solutions, dba GuardDog.ai, has formally released its Software-as-a-Service, ‘Protective Cloud Services’ (PCS) which includes a network security device called Fido.

guardDog PCS creates the first plug-and-protect proactive cybersecurity solution for edge networks and network attached devices in a space the company refers to as ‘Edge Territory’ – the space beyond where traditional remote network and device management solutions can offer visibility or protection.

guardDog protects against threats outside the perimeter of the network or on attached devices that other solutions can’t see, for wired and Wi-Fi networks.

Devices of every kind are inherently vulnerable to the networks they join. guardDog employs patent-pending artificial intelligence to pre-emptively recognize, expose, and shut down cybersecurity threats before an attack can happen.

After years of working to perfect the technology with enterprise and consumer customers, guardDog is taking network security into another dimension – simplicity.

Fido is simple for anyone to install, with or without a technology background, and Protective Cloud Services activates within a few minutes of registration.

guardDog CEO Peter Bookman said, “At any given point there are around 150,000 known vulnerabilities that devices are exposed to on the networks they join, and often these incidents go undetected,” he continued, “guardDog acts like a fire alarm for exposing these threats, and like a first responder for helping to solve cyber threats, where often businesses and consumers are lacking the expertise or resources to do either effectively.”

Customers simply plug in a Fido device to their network router and register it with Protective Cloud Services to activate protection. guardDog immediately goes to work securing homes and businesses Wi-Fi and wired networks, and the wireless devices attached to them.

The rise of ransomware, phishing, identity theft, hacking, scamming, computer viruses and malware, botnets and DDoS attacks require new approaches, which guardDog delivers.

Traditional approaches such as virtual private network (VPN) connections are vastly insufficient in a wild west of unsecured home Wi-Fi networks and the myriad of devices attached to them, likely leading to new breaches and losses for the companies involved.

These remote working environments accessing VPN from homes are dangerous, as end points on Wi-Fi systems make it alarmingly easy for hackers to access data through VPNs.

The guardDog solution is especially important as businesses struggle to manage the collision of two accelerating trends – an explosion of remote worker environments to manage, and a shortfall of talent to secure them.

Estimates are that as much as 30 percent of the global workforce may continue to work from home, while at the same time there is a shortage of 3.12 million cybersecurity professionals worldwide.

Even if businesses could attract the security talent, could they keep up with the increasingly complex and large attack surface? guardDog offers cloud service with dedicated security device to bridge these trends.

Baxter Financial Corporation, led by Mr. Donald H. Baxter, among other family office investors participated in this round of financing. Mr. Baxter has also joined the company’s board of directors.

from Help Net Security https://ift.tt/3ucFi2k

VMware Cloud enables orgs to accelerate app modernization across the data center, edge and cloud

For more than 20 years, VMware has powered essential business applications around the world. More than 300,000 organizations have built and run more than 85 million workloads on VMware, and more than five million developers build apps on VMware technology.

VMware is helping customers unlock the power of multi-cloud and deliver modern applications at the speed of business with the unveiling of VMware Cloud.

VMware Cloud is a distributed, multi-cloud platform that enables organizations to accelerate application modernization across the data center, edge, and any cloud.

It provides distinctive advantages to both developers and IT operators who are often forced to make tradeoffs. VMware Cloud boosts developer productivity by enabling them to build and deploy to any cloud.

The platform enables IT to modernize infrastructure and operations with better economics and less risk. With the launch of VMware Cloud, VMware is announcing new offerings that bring a more integrated experience to customers.

These offerings include:

• VMware Cloud universal: a flexible subscription that simplifies the purchase and consumption of VMware multi-cloud infrastructure and management services.
• VMware Cloud console: a single monitoring and management environment for VMware Cloud infrastructure regardless of where it’s deployed.
• VMware app navigator: a new offering for assessing and prioritizing app transformation initiatives across an entire application estate based on the value of each app.

“We are on the cusp of the next evolution of cloud and apps. Architectures are becoming distributed and increasingly multi-cloud, while modern applications will soon outnumber traditional apps.

“The challenge for any CIO is to take advantage of this new innovation without introducing more complexity and risk,” said Raghu Raghuram, chief operating officer, products and cloud services, VMware.

“VMware Cloud is the only cloud solution today that customers can use in the datacenter and on any cloud, accelerating their modernization journey with speed, simplicity, and better security.

“With VMware Cloud Universal, customers make a single purchase and gain the ability to deploy apps across any environment, then move them as business or application requirements change.”

Modular, multi-cloud services for all applications, everywhere

Application initiatives are driving better business outcomes, an elevated customer experience, innovative digital services, and the anywhere workforce.

Organizations surveyed by VMware report that 90% of app initiatives are focused on modernization, and 80% today deploy applications in a distributed model across data center, cloud, and edge.

VMware Cloud is the platform for both on-premises and cloud with unified security and operations; supporting traditional and modern applications; connecting to all native cloud services; and meeting the requirements of both developers and IT operators.

With VMware Cloud, customers gain the simplicity of a single cloud operating model for their multi-cloud reality, and gain portability to help minimize to help address the challenges of single cloud silos.

VMware Cloud customers can realize substantive benefits including as much as 80% better developer productivity with VMware Tanzu Application Service, 59% lower operational costs, and 46% faster cloud migration.

With VMware Cloud, customers can deploy apps to VMware Cloud Foundation running in Amazon Web Services (AWS), Azure, Google Cloud, IBM Cloud, and Oracle Cloud; on VMware Cloud on Dell EMC; and across hundreds of VMware Cloud Verified partners.

VMware Marketplace provides customers access to thousands of validated third party and open-source developer solutions. VMware Cloud customers can also deploy and operate across native public clouds, and give developers access to all native cloud services.

“Fiserv helped small businesses access the funding they needed to continue operating through the Paycheck Protection Program,” said Keith Fulton, senior vice president and CIO, Account Processing at Fiserv.

“Upon the launch of the program we quickly deployed a portal to enable thousands of our financial institution clients to accept PPP applications, and as requirements evolved, we built new capabilities that helped banks assess risk levels for tens of thousands of applicants and deliver application confirmation in a matter of seconds.

“Utilizing VMware Cloud and with just 15 developers working on the Paycheck Protection solutions, we created more than 100,000 lines of code, using CI/CD pipelines, to deliver 436 releases to production in just 28 calendar days.”

Better economics, simplified operations and faster app modernization

With the new VMware Cloud Universal subscription, customers gain greater flexibility and portability to adopt cloud at their own pace and benefit from a single operating model across clouds.

VMware Cloud Universal is ideal for customers committed to a hybrid cloud architecture; that have extended or variable cloud migration timelines; that have cloud bursting requirements; or desire an OPEX model for on-premises infrastructure.

With VMware Cloud Universal, customers purchase credits for VMware’s multi-cloud infrastructure and management and apply these credits to deployments of VMware Cloud Foundation on premises, VMware Cloud on AWS, or VMware Cloud on Dell EMC.

Benefits of VMware Cloud Universal will include:

• Choice and flexibility: buy once and deploy any eligible service at any time during the contract.
• Convertibility: convert and apply unused on-premises Cloud Foundation credits deployment towards VMware Cloud on AWS or VMware Cloud on Dell EMC at any point during the term.
• Cloud acceleration benefits (CAB): provides flexibility for customers transitioning to multi-cloud by leveraging their existing investments in VMware perpetual licenses towards VMware Cloud Universal credits.
• Built-In Kubernetes: VMware Tanzu Standard edition for simplified deployment and operation of Kubernetes.
• Multi-cloud management and operations: VMware vRealize Cloud Universal for SaaS-based multi-cloud management.
• VMware Success 360: designed to help customers continually realize value and achieve faster outcomes, Success 360 includes success planning, ongoing adoption guidance, design workshops and proactive support.

Supporting this new subscription is VMware Cloud Console, delivering end-to-end visibility and control of all VMware Cloud infrastructure across on-premises, cloud, and edge environments.

Cloud Console is an integrated portal where customers can allocate, manage, and better optimize all VMware Cloud resources. Through Cloud Console, customers can redeem credits, provision deployments of VMware Cloud Universal eligible offerings, and reach out to VMware support organizations.

The new VMware App Navigator service engagement helps organizations prioritize app modernization initiatives and deliver results faster.

Other portfolio rationalization services attempt to plan “everything”, are slow to complete, and include many assumptions that often end up being wrong. App Navigator takes an agile approach to portfolio analysis.

It uses automated tooling and hands-on experimentation to plan just enough to get started, then quickly scale app and cloud transformation initiatives.

During an engagement, customers work alongside VMware practitioners to rationalize their app portfolio, identify modernization strategies and environments for different apps based on business and IT goals, and build an outcome-oriented roadmap.

This enables customers to deliver on business needs faster, regardless of who does the work, and enables self-sufficiency to help minimize risk.

“VMware Cloud on AWS gave us a safe landing zone for our applications. We could pick up our VMware Cloud platform and drop it right into AWS,” said Sarah Lucas, Head of Infrastructure and Platforms, William Hill.

“We were able get to the public cloud quickly without having to upskill our engineering teams to learn another cloud environment. To date we’ve migrated more than 3,000 VMs and hundreds of applications.

“Now we have more elastic scale, with the ability to roll out services quickly and consistently across the VMware Cloud platform. With VMware Cloud Universal, we believe the offering will provide us with an even more flexible model to grow and operate our VMware Cloud environment.”

“AWS is VMware’s preferred public cloud provider for vSphere-based workloads, and VMware Cloud on AWS is the preferred service from AWS for vSphere-based workloads,” said Matt Garman, vice president, sales and marketing, AWS.

“Customers love how fast and easy it is to adopt a VMware-based hybrid environment that spans their on-premises data centers and AWS. We are seeing significant global adoption across all industries from customers who are adopting VMware Cloud on AWS to enable faster application modernization.

“With this announcement, customers have the ability to use the same VMware Universal Credits towards the deployments of VMware Cloud on AWS as well as VMware on premises.”

“Dell Technologies and VMware are committed to driving the future of IT infrastructure through deep collaboration,” said Arthur Lewis, president, Solutions and Portfolio Management for Dell Technologies Global Infrastructure Solutions Group.

“VMware Cloud on Dell EMC is a fully managed, secure and scalable cloud platform that provides all the benefits of on-premises infrastructure, delivered as-a-Service. For customers who prefer to manage their private cloud infrastructure, we offer a portfolio of solutions tightly integrated with VMware Cloud Foundation.

“VMware Cloud Universal simplifies the choice by enabling customers to invest in hybrid and multi-cloud solutions while maintaining flexibility in deployment.”

Availability

VMware Cloud Universal is available in all English-speaking countries and regions. The offering is expected to be available in Japan in 2HFY22.

VMware Cloud Foundation Subscription is only available through VMware Cloud Universal.

Convertibility of VMware Cloud Foundation Subscription to VMware Cloud on AWS is expected to be available in VMware’s Q1FY22 and convertibility to VMware Cloud on Dell EMC is expected to be available in VMware’s 1HFY22. VMware Cloud Console and VMware App Navigator are also available.

from Help Net Security https://ift.tt/2O9jXre

Seagate Lyve Data Transfer Services helps businesses quickly move mass data from edge to cloud

Seagate Technology launched Lyve Data Transfer Services with its fleet of Lyve Mobile data shuttles, arrays, and services, enabling businesses to move mass data quickly, securely, and simply from edge to private, public, or hybrid clouds.

The new Lyve Data Transfer Services on-demand, web-based purchasing model enables customers to pay only for what they need, when they need it.

Businesses are generating massive amounts of data. Seagate’s Rethink Data report notes that enterprise data is expected to grow at an average annual rate of 42.2% over the next two years.

And a new Seagate-commissioned IDC survey found that enterprises frequently move this data among different storage locations, including endpoints, edge, and cloud.

In over a thousand businesses surveyed, more than half move data between storage locations daily, weekly, or monthly, and their average total of physical data transferred is 473TB.

The faster they can move this data from edge to core to cloud, the more quickly they can unlock insights and derive value from their data.

Seagate’s Lyve Data Transfer Services solution consists of Lyve Mobile modular and scalable hardware, purpose-built for simple and secure mass-capacity edge data storage, lift-and-shift initiatives, and other data movement for the enterprise.

These products are cloud-vendor agnostic and can be integrated seamlessly with public or private cloud data centers and providers.

Lyve Data Transfer Services are now available through Seagate’s web site; customers simply sign up for Seagate’s data transfer services via a flexible subscription that scales up or down to meet evolving storage needs.

Florian Baumann, chief technical officer of Automotive and AI at Dell, stated, “Moving hundreds of terabytes of data from a fleet of vehicles to the data center poses numerous challenges for our customers.

“Seagate’s Lyve Data Transfer Services offer a great solution by physically moving data. It’s a simple and scalable solution and fills a gap that our customers had in the data gravity process.”

“We have a remote production project called ‘The Ripple Effect’ in which we have a network bandwidth of only 35Mbit/sec, making it difficult to push 4K ARRI raw video footage through,” said Dane Brehm, production technologist & digital imaging technician of the Entertainment Technology Center.

“Lyve Data Transfer Services make it possible to transfer and move 4K production footage to our cloud data center at the end of each day, quickly ingesting and moving the data, saving us time and money.”

Ashish Naik, principal business development manager, ADAS & Autonomous Driving at NI, noted, “Our focus is on increasing the quality of data while minimizing the total cost of data.

“We achieve this through precise and smart acquisition from new sensor interfaces as well as accurate and tight synchronization. These datasets are increasing exponentially in volume, velocity, and length.

“Seagate’s Lyve Data Transfer Services enable us to move mass data using Lyve Mobile to a centralized point, giving engineers simple and easy access to the mass data our testing processes collect.”

“With only a fraction of enterprise data being put to work due to economics and storage complexities, Seagate has simplified how mass capacity data is securely captured, aggregated, transported, and managed,” said Jeff Fochtman, senior vice president of marketing at Seagate Technology.

“Our Lyve portfolio gives the distributed enterprise a simple and innovative mass-data storage solution to lower overall storage TCO, move, scale, and monetize data, helping them drive value and growth.”

from Help Net Security https://ift.tt/3dndfX9

Cisco introduces infrastructure agnostic, passwordless authentication by Duo

Cisco Secure unveiled the future of simple and effective security with infrastructure agnostic, passwordless authentication by Duo.

Integrated seamlessly into the existing Duo authentication experience used by more than 25,000 organizations globally, Duo passwordless authentication will enable enterprise users to skip the password and securely log into cloud applications via security keys or biometrics built into modern laptops and smartphones.

The consequences of using passwords are well known. Passwords are easily compromised and difficult to manage, costing enterprises billions of dollars annually.

Users are inundated with passwords in their personal and professional lives. Password reset requests comprise a lion’s share of IT help desk tickets, resulting in lost productivity for users and increased support costs for the business.

Duo passwordless authentication is part of Cisco’s zero trust platform, securing access for any user, from any device, to any IT application or environment.

The product is designed to be infrastructure agnostic, paving the way to a passwordless future while ensuring that enterprises can seamlessly protect any combination of cloud and on-premises applications without requiring multiple authentication products or leaving critical security gaps.

“Cisco has strived to develop passwordless authentication that meets the needs of a diverse and evolving workforce and allows the broadest set of enterprises to securely progress towards a passwordless future, regardless of their IT stack,” said Gee Rittenhouse, SVP and GM of Cisco’s Security Business Group.

“It’s not an overstatement to say that passwordless authentication will have the most meaningful global impact on how users access data by making the easiest path the most secure.”

Duo passwordless authentication will:

• Simplify and strengthen authentication for accessing cloud applications protected by Duo single sign-on (SSO) and third-party SSO and identity providers, by leveraging security keys and platform biometrics such as Apple FaceID and TouchID, and Windows Hello. Pairing passwordless authentication with Duo SSO enables organizations to consolidate hundreds of passwords and authentications into one easy login for users to cloud applications.
• Provide one security tool for all authentication scenarios thanks to Duo’s compatibility with hundreds of applications and identity providers, with no infrastructure change required.
• Reduce risk of password-related threats and vulnerabilities such as phishing, stolen or weak passwords, password reuse, brute-force, man-in-the-middle attacks and password database compromise.
• Add layers of security to the authentication with device health and behavior monitoring controls via Duo’s secure access product suite, further reducing risk in the event a biometric is stolen or not effective.
• Reduce administrative burden of password-related help desk tickets and password resets.

“Cisco is well-positioned to accelerate the adoption of passwordless authentication as enterprises seek to alleviate the password-related headaches that for years have plagued their users and IT teams,” said Jay Bretzmann, Program Director for Identity & Digital Trust and Cloud Security, IDC.

“While the transition will be a process for organizations due to legacy infrastructure, passwordless authentication is a key stepping stone to enabling a zero-trust security architecture and a feature that organizations must begin looking into.”

Workforces are ripe for the adoption of passwordless authentication. According to the 2020 Duo Trusted Access Report, 80 percent of mobile devices used for work have biometrics configured, up 12 percent the past five years.

Duo passwordless authentication leverages the Web Authentication (WebAuthn) standard, based in asymmetric cryptography, enabling biometrics to be securely stored on and validated by the device, locally, as opposed to a centralized database.

Duo helped drive WebAuthn’s ratification as an official web standard and adoption across platforms as a member of the World Wide Web Consortium (W3C) working group.

“Passwordless is a journey requiring incremental changes in users and IT environments alike, not something enterprises can enable overnight,” said Wolfgang Goerlich, Advisory Chief Information Security Officer, Duo Security at Cisco.

“Duo can help enterprises transition their environments and workforces securely and minimize user friction while simultaneously increasing trust in every authentication.”

Duo’s security practices are built on ISO 27001, NIST’s Cyber Security Framework, and AICPA’s Trust Service Principles and are designed to meet GDPR and other privacy laws around the world.

Duo is committed to the highest level of security for its customers – both public and private, and currently holds SOC2 Type II, ISO27001:2013, ISO27017:2015, and ISO27018:2019 certifications, as well as being FedRAMP authorized.

Duo passwordless authentication will be available for public preview beginning summer 2021.

from Help Net Security https://ift.tt/31I2BVr

Alcatel-Lucent Enterprise and RingCentral launch Rainbow Office, a UCaaS solution

Alcatel-Lucent Enterprise and RingCentral are joining forces to launch Rainbow Office, powered by RingCentral, a Unified Communication as a Service (UCaaS) solution, in Ireland.

Stemming from a strategic partnership between RingCentral and Alcatel-Lucent Enterprise, announced in August 2020, Rainbow Office, powered by RingCentral, will combine the very latest in UCaaS technology from RingCentral, with market-leading networking, communication, and cloud solutions and services from Alcatel-Lucent Enterprise’s portfolio, making it a unique offering in the market.

Alcatel-Lucent Enterprise’s mission is to deliver customized technology experiences to enterprises with a verticalized business approach.

Rainbow Office, powered by RingCentral, will enrich the company’s cloud portfolio enabling customers to accelerate their digital transformation with Unified UCaaS.

With Rainbow Office, users can efficiently and securely collaborate from anywhere and on any device via a single enterprise solution, leveraging RingCentral’s industry-leading integrated Message Video Phone (MVP) capabilities.

Rainbow Office provides users HD audio and video, screen share capabilities, the ability to check presence, share files, and seamlessly switch between devices with integrated carrier-grade voice.

“We are delighted to partner with RingCentral to address the needs of business customers in Ireland,” says Heather Zhang, Alcatel-Lucent Enterprise Country Business Leader for UK, and Ireland.

“This public UCaaS solution, which includes traffic, represents a fantastic opportunity for companies who want to accelerate their transformation to the cloud. These businesses can benefit from a secure business communication platform, which is both easy to implement and to use.

“The Rainbow Office carrier-grade communication suite, provides an all-in-one solution with multiple security layers, offering protection for applications and devices from potential attacks.”

“We are delighted to launch Rainbow Office, powered by RingCentral, to Ireland,” said Steve Rafferty, country manager, UK & Ireland, RingCentral.

“By bringing together RingCentral’s leading cloud communications portfolio and Alcatel-Lucent’s ability to deliver customized technology experiences to enterprises, we are confident that customers can accelerate to their digital transformation.

“Additionally, customers will now have access to a powerful UCaaS solution that will meet their growing communications needs and enable them to work from anywhere.”

“Alcatel-Lucent Enterprise is already the number one player in Western Europe in terms of PBX, IPPBX licenses sold.

“We see this UCaaS solution as a tremendous growth opportunity for integrators and channel partners alike,” Eamon Connaughton, head of sales for Alcatel-Lucent Enterprise in Ireland.

“This is very relevant, both for companies who are beginning their journey to the cloud as well as for those who are looking for a cloud communication solution including traffic.

“Over the past few months, we have been very pleased with the interest and engagement of partners in Ireland who recognize the significant business benefits of offering this solution to their end customers.”

Rainbow Office is available in Ireland as well as in Austria, Belgium, France, Germany, Italy, Spain, and in The Netherlands from March 31st, 2021.

from Help Net Security https://ift.tt/3wiilfV

Optiv Security Enterprise IoT Lab helps identify, assess, and mitigate IoT device security challenges

Optiv Security unveiled its Enterprise Internet of Things (IoT) Lab in response to a growing and ever-present pain point for client security leaders – the proliferation of IoT devices on organizational networks.

Chief information security officers (CISOs) are dealing with sizeable blind spots and have expressed the clear need for support in discovering those devices and bringing them into their existing vulnerability management programs with an expanded objective of total network protection that goes beyond simple device discovery and assessment.

Optiv’s Enterprise IoT Lab will:

• Show organizations how to discover IoT devices present in their environment, assess devices for vulnerabilities, and mitigate outstanding security issues.
• Provide a baseline platform for development of automated vulnerability management and incident response solutions for IoT.
• Position IoT/OT/ICS security solutions where their integrations into other technologies can be developed and tested end-to-end.

“Current technologies focused on traditional network assets can fall short when trying to assess IoT targets, and solutions focused on the OT/ICS space don’t always integrate with the enterprise vulnerability management solutions,” said Sean Tufts, practice director, IoT Security, Optiv.

“We’re now able to prove out these solutions in an environment that provides access to a wide spectrum of partner technologies.”

Optiv has partnered with Palo Alto Networks, Tenable, and Armis to highlight how these solutions react in a real-world environment of live devices. In addition, Gigamon has been leveraged to enable each solution’s monitoring requirements.

“Our Unit 42 IoT threat research, based on analysis of 1.2 million devices, found that nearly 98 percent of IoT traffic is unencrypted and more than half of all IoT devices are susceptible to severe cyber-attacks.

“This is why a prevention-first approach is the need of the hour instead of alert-only solutions,” said Muninder Singh Sambi, senior vice president, product management, Palo Alto Networks. “Optiv’s Enterprise IoT Lab is a welcomed development.”

The Lab will drive solutions from real-world sources and/or data supplied from a client environment.

More than 50 common corporate IoT targets are in the environment and will be tested and demonstrated on to highlight vulnerability management best practices in live-time as they relate to source (insiders, third parties, bad actors) and threat (unsecured remote access, weak passwords, legacy technologies, pre-installed spyware, hackable devices).

“Optiv has substantial experience in embedded device vulnerability analysis,” said Mark Thurmond, chief operating officer, Tenable.

“We’re excited to be a part of Optiv’s IoT lab to lend our converged IT/OT expertise in exploitation techniques and best practices to continue driving innovation in the IoT security space for our shared clients.”

from Help Net Security https://ift.tt/3m7BbSq

NETGEAR announces GS316EP and GS316EPP switches with larger PoE budgets

NETGEAR announced the availability of the GS316EP and GS316EPP PoE+ Gigabit Ethernet Plus switches that deliver small businesses, retail shops, and home-based businesses with larger Power-over-Ethernet (PoE) budgets and more convenience.

Businesses are increasing the use of IP surveillance cameras, WiFi access points, and many other network-based devices. In addition, home networks have transitioned from primarily facilitating entertainment, to additionally supporting work-from-home and on-line learning.

With so many devices connecting and competing for bandwidth, there is a heightened need for a higher capacity, secure, and easy to setup, operate, and manage network switch at a reasonable price point.

Simplicity of Power-over-Ethernet (PoE)

Both models are equipped with PoE+ for up to 30 watts of Power over Ethernet (PoE) per port. PoE’s ability to supply both data and power over a single cable enables devices to be placed just about anywhere regardless of the availability of a power outlet.

This lowers the cost of deployment by eliminating the need for an electrician while leveraging existing IT infrastructure.

The GS316EP has a total PoE budget of 180 Watts while the GS316EPP supports a maximum PoE budget of 231 Watts, making them amongst the most versatile switches for powering WiFi 5 and WiFi 6 access points, IP cameras, IoT devices, IP speakers, IP phones, IP LED lights, point of sale systems, and other IP devices.

Attractive price, new features, intuitive UI and compact design

The GS316EP and GS316EPP Plus switches offer new and valuable features and an intuitive user-interface to access and configure the features, at very attractive price points.

Among the many features are VLANs (Virtual Local Area Networks) which enable secure separation of different network traffic loads, for example, separating work-from-home traffic from student learn-from-home traffic, camera surveillance network traffic, visitor WiFi traffic, and general home entertainment network traffic.

Turning on or off a PoE port or maintaining power to connected devices during a switch reboot is made easier via a new intuitive browser-based User Interface (UI).

PoE scheduling allows the creation of customized schedules to control when PoE connected devices are powered on/off automatically to enhance network security, better utilize network resources, and conserve energy.

The responsive and user-friendly web browser-based UI makes it easier to enable L2 network features like VLANs and Network QoS (Quality of Service). Advanced per port PoE controls, including power allocation override, PoE scheduling, and remote enable/disable/power cycle, can be accessed through the web UI.

The compact size of the switches makes them suitable for desktop or wall-mount placement. Additionally, the two new switches also have one SFP fiber port for a long-distance uplink to a core switch, or to connect to another non-PoE device that may be located more than 100 meters away.

“Small and Medium Business owners pick NETGEAR because we offered them robust, reliable, and easy to operate network switches at very cost-effective price points; and we make these products easy to acquire through popular e-Commerce channels like Amazon”, said Alexandra Mehat, Director of Product Marketing for SMB, NETGEAR.

“With the GS316EP and GS316EPP we’ve retained all those positives while packing a bigger PoE budget, enhancing security, and making it even simpler to setup and operate these switches.”

Support when you need it

The GS316EP and GS316EPP come with an industry-leading 5-year limited hardware warranty and 90 days of free phone and chat support for when you need a helping hand.

Availability

The GS316EP PoE+ Gigabit Ethernet Plus and GS316EPP High-Power PoE+ Gigabit Ethernet Plus switches are available and shipping for North America. Worldwide availability will be announced later in the year.

from Help Net Security https://ift.tt/3sEJsQo

Cisco simplifies networking and security operations with an expanded SASE offer

Cisco expanded Secure Access Service Edge (SASE) offer. This is the next important step in Cisco’s journey to radically simplify security and networking by helping network operations (NetOps) and security operations (SecOps) teams securely connect users to applications.

Additionally, Cisco announces enhancements to its cloud-native platform, SecureX to more quickly and effectively manage new and emerging threats.

Work is no longer a location but an experience, and the global events of the last year have made working from anywhere the norm.

At the same time, this trend increased the complexity of managing networks and security across an expanding attack surface of users, devices, applications, and data.

As the hub shifts from the data center to the user, a SASE architecture has emerged as a top organizational priority to provide seamless connection to applications.

Cisco SASE today and in the future

Cisco introduces the ability to purchase all core SASE product components in a single offer with the flexibility to easily transition to a single subscription service in the future, enabling organizations to start using Cisco’s integrated architecture immediately.

Cisco provides all the building blocks of a SASE architecture, including best-in-class networking, remote access, cloud security, zero trust network access, and observability.

Cisco’s vision is to combine these capabilities into a single subscription service, and deliver seamless, secure access to any application, over any network or cloud, anywhere users work.

“As the workforce is increasingly hybrid, traditional network and security frameworks can no longer keep pace with this new way of doing business.

“There has never been a more critical time to deliver something radically different, as every customer is unique and needs flexibility when determining how a SASE architecture fits into their environment.

“When it comes to transformation, there is no one-size-fits-all approach and moving to a SASE framework is no different,” said Gee Rittenhouse, SVP and GM of Cisco’s Security Business Group.

“Today’s announcement enables organizations to start using all of the core building blocks of a SASE architecture immediately, making it simpler than ever to continue your journey to SASE.”

In addition, Cisco continues to rapidly deliver features that unlock new SASE use cases, including:

• Data loss prevention: Cisco Umbrella data loss prevention (DLP) enables organizations to discover and block sensitive data being transmitted to unwanted destinations, while preventing data exfiltration and supporting compliance mandates.
• Remote browser isolation: Cisco Umbrella remote browser isolation enables users to safely browse websites while protecting end user devices and corporate networks from browser-based exploits.
• Cloud malware detection: Cisco Umbrella cloud malware detection finds and removes malware from cloud-based file storage applications. As more organizations move business-critical data to cloud-based applications, they need to ensure that users can access them, even from unmanaged devices, and that those cloud applications are safe.
• Expanding Cisco SD-WAN cloud onramp: The release of SD-WAN 17.5 powered by Viptela expands cloud onramp capabilities for predictable and secure application experiences. Cisco expands beyond Amazon and Azure to now add new cloud integrations including Google Cloud and Megaport. In addition, Cisco SD-WAN powered by Meraki further extends connectivity from branch sites to resources in public cloud environments such as AWS, Azure, Alibaba Cloud.
• New SD-WAN and cloud security integration: Expanding our current networking and security integrations, Cisco SD-WAN powered by Meraki and Umbrella now integrates with Cisco Umbrella to speed cloud-native security deployments across distributed locations with simplified Internet Protocol Security (IPSec) tunnel connectivity.
• Observability: Part of the new SASE offer, ThousandEyes’ internet and cloud intelligence continues to enable organizations’ visibility and actionable insights into every network, from any user to any application, so they can remediate incidents quickly and maintain reliable connectivity and digital experience.
• Passwordless authentication: Today Duo unveiled infrastructure agnostic, passwordless authentication, available for public preview this summer. The vision is to enable zero trust with a frictionless login experience, ensuring that enterprises can seamlessly protect a mix of cloud and on-premises applications without requiring multiple authentication products or leaving critical security gaps.

“When it comes to SASE, the implementation will vary widely by customer type. Also, the needs of customers will vary over time based on companies’ digital transformation plans,” said Zeus Kerravala, Founder and Principal Analyst with ZK Research.

“By offering different consumption options, Cisco has the most flexible SASE offering, enabling customers to deploy what they need today but then evolve it as their needs change.”

Continued SecureX innovation to radically simplify security

In addition to simplifying the SASE journey for customers, Cisco is also on a mission to further simplify and protect against emerging threats.

Cisco is delivering complete protection from endpoint to the cloud with SecureX platform enhancements that reduce dwell time for SecOps and automate tasks involved with detecting and remediating threats.

New automated workflows include SolarWinds supply chain attack investigation, phishing investigations and threat investigations using latest intel from Cisco Talos, one of the largest commercial threat intelligence teams in the world.

These enhancements reduce time to detect threats by 95 percent, and time to remediate by 85 percent. Building on the numerous Cisco technology integrations in SecureX ranging from Cisco Secure Endpoint to Cisco Umbrella, the open platform also provides turnkey configuration with more than 35 third-party technologies including Google, ServiceNow, Splunk, and more.

On top of adding simplicity at the platform level, Cisco is also announcing integration and automation at the endpoint.

Cisco Secure Client, a newly integrated connector for Cisco Secure Endpoint, AnyConnect, and Umbrella, simplifies deployment and management for greater efficiency and efficacy.

Cisco Secure Client serves as a local control point and early warning system for advanced threats in solutions such as SASE, zero trust, and Extended Detection and Response (XDR).

“Adopting a SASE framework and reducing complexity overall are one of clients’ top priorities as they transition to a sustained and flexible work environment.,” said Rob Parsons, Practice Director, Network and Integrated Security, Cloud + Data Center Transformation at Insight.

“With today’s announcements, Cisco is continuing to position themselves as the leading provider for a complete SASE framework.

“Additionally, Cisco’s simplified and integrated security platform, SecureX, helps us tackle our clients’ most complex IT and security challenges. We are excited about the opportunity ahead and the direction Cisco is going.”

from Help Net Security https://ift.tt/3mhn4u0

WitFoo releases Precinct 6.1.5, adding advanced indexing and search algorithms

WitFoo announced the release of version 6.1.5 of its Precinct product. This latest version introduces various new capabilities and features.

High speed search

The 6.1.5 release adds advanced indexing and search algorithms that leverage the innovations from natural language processing (NLP) to find infrequent records in the data lake with efficiency improvements greater than 99 percent. “Needle in the haystack” queries that could take hours in earlier releases can now be resolved in seconds.

Intelligent object-oriented SOAR

Precinct 6.1.5 utilizes real-time object-oriented analysis that updates incident data as evidence is received, comprehended and contextualized. Intelligent, responsive playbooks that learn from user and data inputs automatically adapt to the circumstances of a specific investigation to deliver comprehensive investigation while optimizing the use of human labor.

“Performing law enforcement quality investigations requires acumen, evidence, organization and proper tactics. It also requires imagination, flexibility and collaboration.

The dynamic playbooks in Precinct 6.1.5 help move SECOPS philosophies closer to those used by seasoned law enforcement agents,” remarked WitFoo law enforcement advisor, Detective Bill Ritch.

Resilient federated operation

Precinct 6.1.5 expands capabilities for managed security services provider (MSSP), military units, cybersecurity insurers and distributed organizations in delivering federated security operations.

This latest version adds the capability of one-way transmission of incidents to support diode operation to move data from security isolated enclaves to centralized security operation centers for analysis.

“The federated data and operations sharing of Precinct 6.1.5 enables users even in disconnected, intermittent, and limited bandwidth (DIL) environments to share data and coordinate while operating in challenged environments.

“Furthermore, the ability of one-way transmission and offline capabilities enables security operations centers (SOCs) to leverage an isolated enclave approach to protecting security operations,” said Ardalyst CTO, Josh O’Sullivan.

Framework inventory

Through message comprehension, Precinct 6.1.5 detects coverage of security products and maps the coverage to compliance frameworks including PCI, NIST 800-53, CMMC and CIS Critical Security Controls.

“Mapping machine data to the CIS Critical Security Controls has already been of great help to us in assisting our mutual customers in driving toward sustainable SECOPS.

“The ability to toggle between multiple frameworks in version 6.1.5 of Precinct gives us the capability to have an objective, pragmatic discussion on building a roadmap that delivers standards-based compliance while also delivering meaningful protection that reduces security spend,” said CyberOpz CTO, Tom Rudolp.

from Help Net Security https://ift.tt/3m8OlhU

Cloudentity partners with Okta to deliver zero trust authorization for open banking services

Cloudentity and Okta are delivering on the promise of zero trust authorization for open banking services.

Open banking is a hot topic in development today, driven by digital transformation and the modernization of applications to manage customer access and consent, and the need to dynamically share data within the business and partner ecosystems.

Open banking enables customers, partners and employees to access applications, data and services regardless of their location, device or network.

The open banking market is expected to grow to $43.15 billion by 2026, as it is rapidly becoming the security cornerstone for enterprises adopting cloud and building the next generation of business, partner and consumer services.

Cloudentity delivers on the open banking promise with dynamic authorization and security and privacy guardrails that reduce development costs by up to 85%.

Powered by Cloudentity’s Dynamic Authorization, automated governance and machine learning technology, and combined with Okta’s CIAM platform, the integrated solution automates the onboarding of APIs and cloud services into Okta’s CIAM ecosystem.

These APIs and services are protected with dynamic access control policies that are pre-configured to meet the needs of heavily regulated industries such as finance and healthcare.

“Zero trust Dynamic Authorization is a critical component in the move to an API economy,” said Nathanael Coffing, cofounder of Cloudentity.

“It enables financial services companies to solve complex challenges with open banking APIs while also managing fine-grained consent to protect users’ privacy and sensitive data.”

The integrated solution from Cloudentity and Okta is available in the Dynamic Authorization Open Banking Sandbox, a proven model environment that offers a reference architecture and the infrastructure for enterprises deploying API-driven services.

The Sandbox allows enterprises to quickly and securely add Open Banking and Payments Services Directive 2 (PSD2) support via Cloudentity’s fine-grained Dynamic Authorization and Okta’s identity platform.

This enables organizations to manage consent, authorization and data lineage utilizing dynamic data sharing and consent agreements across organizations in real-time.

from Help Net Security https://ift.tt/2QWNMMQ

HYAS Protect integrates with Microsoft Defender to offer comprehensive endpoint protection

HYAS announced technology integration between HYAS Protect and Microsoft Defender for Endpoint.

The combined solution increases Microsoft Defender for Endpoint’s proven security coverage and efficacy, offering comprehensive endpoint protection for our joint customers.

Cybersecurity threats continue to proliferate, and according to Gartner research, “The growth of ransomware, fileless and phishing attacks has urged technology providers to innovate.”

HYAS Protect provides a generational leap forward utilizing authoritative knowledge of attacker infrastructure to proactively protect enterprises from cyberattacks.

HYAS Protect complements Microsoft Defender for Endpoint security capabilities by identifying communication with malicious destinations, enabling Microsoft Defender for Endpoint to block the attacks.

With the combined capabilities, enterprises have one of the industry’s most proactive solutions for identifying adversary communication and intercepting attacks before damage occurs.

Attacks by adversaries, whether malware, ransomware, phishing, fileless, or supply chain attacks, involve communication to adversary infrastructure.

HYAS Protect preempts attacks by combining infrastructure expertise, a unique data lake processing over 3.3B data points per day, and multi-variant communication pattern analysis to deliver reputational verdicts for internet infrastructure.

HYAS Protect, a SaaS protective DNS solution, identifies and blocks network communication to command and control (C2) infrastructure and phishing sites used in cyber attacks.

The HYAS Protect integration enables enterprises with Defender for Endpoint to block attacker communications and helps stop attacks against their endpoints.

Additional joint solution benefits

• Improved endpoint security by blocking phishing, malware, and ransomware communications
• Enhanced security operations center (SOC) productivity by reducing false positive alerts and resulting alert fatigue
• Cloud-native and highly scalable solution deployed using Microsoft Azure and Azure Event Hub
• Optimal device performance leverages Defender for Endpoint and avoids additional endpoint agents
• Improved network governance through visibility to DNS traffic

“Attackers continue to be creative in causing damage, and a mobile workforce increases the enterprise attack surface. HYAS turns the table on attackers by exposing and blocking their infrastructure and communication channels,” said Dave Ratner, CEO, HYAS.

“The combination of HYAS Protect and Microsoft Defender for Endpoint enables enterprises to quickly deploy a unique solution that shuts the door on multiple attack vectors.”

“Members of the Microsoft Intelligent Security Association, like HYAS, offer solutions that supercharge defense work against a world of increasingly sophisticated, fast-moving threats,” said Rob Lefferts, Corporate Vice President for Microsoft Defender.

“The integration of Microsoft Defender for Endpoint with HYAS Protect allows us to work together to help customers navigate the security landscape.”

from Help Net Security https://ift.tt/3drNwge

OneCloud launches Anaplan BizApp to support Transactional APIs and help manage enterprise data

OneCloud announced the Anaplan BizApp to support Anaplan Transactional APIs, expanding the company’s Anaplan integration connector.

OneCloud joined Anaplan’s technology partner ecosystem in 2020 and enables Anaplan customers to seamlessly access additional data integrations for a truly connected planning experience.

OneCloud is a provider of iPaaS technology through its precision platform to integrate and manage enterprise data.

Launched in September 2020, Anaplan Transactional APIs enable users to read and write granular data, quickly zero in on the precise data they need, exactly when they need it, and deliver deeper insights into their workspaces and models.

These Transactional APIs are comprised of both data and metadata APIs and help businesses extend Anaplan’s platform capabilities through rich integrations, while also gaining a deeper understanding of their modeling constructs.

The Anaplan BizApp from OneCloud is now enhanced to leverage these new APIs, providing users with near real-time access to their most relevant data so they can model scenarios and make agile, intelligence-driven decisions.

“As the first Anaplan technology partner to offer Transactional API support, we’re well positioned to support powerful use cases around procurement, sales, and capacity planning that connect source-system data to Anaplan in a more timely and precise manner,” said Brian Meyers, OneCloud’s chief product officer.

“Users can manage data streams to create precise plans and make better decisions to result in the best outcomes.”

OneCloud BizApps provide administrators and users the ability to automate complex workflows and simplify bi-directional integrations with Anaplan across a hybrid mix of on-premises and cloud business-critical applications.

Now that OneCloud can support transactional updates to and from Anaplan, data can be exchanged more seamlessly between systems, extending a streaming data ecosystem.

“At Anaplan, we want to make it easy for business leaders to access data from every corner of their organization so they can model scenarios effectively and make decisions with confidence,” said Sampath Gomatam, SVP, Technology partnerships, Anaplan.

“We introduced Anaplan Transactional APIs last year to simplify advanced data integrations and arm business leaders with deeper insights into the data they need most.

“We are excited to see OneCloud leverage these APIs through the Anaplan BizApp to help customers seamlessly exchange data across their business-critical platforms and applications.”

from Help Net Security https://ift.tt/3rCjawF

Get Super Mario 3D All-Stars for $50 Before Mario Draws His Last Dying Breath

Best Gaming DealsBest Gaming DealsThe best deals on games, consoles, and gaming accessories from around the web, updated daily.

Super Mario 3D All-Stars | $50 | Walmart

Lets’a go! Super Mario 3D All-Stars is down to $50 at Walmart today, a familiar price for anyone who grew up playing the games included in the collection. Back in 2002, I remember getting $50 from my mom so I could go to the mall and gleefully pick up a copy of Super Mario Sunshine. Then there was 2007's Super Mario Galaxy, one of the first games I bought on my own when I went off to college. At the time $50 seemed like a real investment. Seeing that price tag on these classic games is kind of nostalgic, isn’t it? Okay, I’m reaching. It’s a little bizarre that the collection was $60 to begin with, but the price reduction here is a welcome one. Super Mario 3D All-Stars will literally vanish from shelves starting today, so if you’ve been hoping for a discount, this is your last chance.

G/O Media may get a commission

This deal was originally published by Giovanni Colantonio on 11/26/20 and updated with new information on 03/29/21.

---

G/O Media may get a commission

from Lifehacker https://ift.tt/3q3mwJx

Cohesity announces valuation of $3.7B following a growth in annual recurring revenues

Cohesity announced a new company valuation of $3.7 billion, which is $1.2 billion higher than its valuation less than 12 months ago.

This dramatic growth in valuation continues to validate the incredible trajectory and momentum Cohesity is seeing as the modern multicloud data management company.

The valuation was established in line with a $145 million tender offer made by investors to Cohesity employees who want the option to sell a small portion of their equity for liquidity.

This non-dilutive transaction was led by STEADFAST Capital Ventures and supported by a syndicate of new and existing investors, including Premji Invest.

“We are pleased to enable this liquidity opportunity for our employees,” said Mohit Aron, CEO and Founder, Cohesity.

“We believe the oversubscribed, non-dilutive tender offer based upon this increased company valuation speaks volumes about Cohesity’s performance and future outlook as the leading, modern data management company.”

The valuation comes as Cohesity is reporting results from its fiscal second quarter ending Jan. 31, 2021.

The company saw significant year-over-year (YoY) growth in annual recurring revenues (ARR), a continued surge in customer wins globally, and a rapidly increasing number of customers spending $5 million or more in total lifetime spend on Cohesity software.

Cohesity also saw exceptional traction across its partner and service provider ecosystem.

“Cohesity is firing on all cylinders with significant increases in annual recurring revenues, exceptional customer and partner momentum, and impressive growth in overall customer spend,” said Karan Mehandru, Managing Director and Head of Venture Capital, STEADFAST Capital Ventures.

“The company also continues to introduce software innovations that are transforming data management — including Data Management as a Service.

“This game-changing SaaS technology is unleashing new opportunities for midsize and enterprise customers to simplify data management and do more with their data.

“At STEADFAST, our goal is to partner with exceptional entrepreneurs building iconic and durable companies that are built to last, and our partnership with Mohit and the Cohesity team is a shining example of that strategy at work.”

“Cohesity continues to disrupt the data management market. The Cohesity Helios multicloud data platform uniquely empowers organizations to easily manage their data, mitigate the risks of ransomware attacks, eliminate infrastructure silos, and solve mass data fragmentation,” said Sandesh Patnam, Managing Partner, U.S., Premji Invest.

“Given Cohesity’s continued innovation, excellent NPS customer support scores, strong leadership, and vision for the future, we are very optimistic about Cohesity’s continued success in the market. We believe the new valuation is a fraction of the value Cohesity will be worth long-term.”

Expanded company valuation follows strong Q2 results

The following metrics highlight record-breaking results Cohesity achieved during Q2, its most recently completed quarter.

• Exceptional ARR growth: Cohesity achieved a nearly 90 percent increase YoY (Q2/Q2) in ARR, further emphasizing the success of the company’s subscription-based software model.
• Strong net expansion rate: Cohesity’s net expansion rate — or the rate of expansion net of churn from existing customers over the last year — continues to exceed 130 percent, a benchmark for leading subscription/SaaS companies. This means that ARR from Cohesity’s existing customer set grew over 30 percent over the last 12 months.
• Rapid customer growth: Cohesity saw a 50 percent increase YoY (Q2/Q2) in the number of customers doing business with Cohesity, with rapid adoption in the Americas, EMEA and Asia Pacific/Japan regions. More than 2,300 customers trust their data with Cohesity.
• Continued strength among the Fortune 500: Cohesity customers include two of the top five Fortune 500, two of the top five U.S. banks, more than 300 financial services organizations globally, and three of the top five pharmaceutical companies globally.
• Massive growth in customer spend: Cohesity realized an 84 percent increase YoY (Q2/Q2) in the number of customers that spent between $1 million and $5 million on Cohesity software in total lifetime spend, and a 300 percent YoY (Q2/Q2) increase in customers with more than $5 million in total lifetime spend.
• Success with channel partners: The number of partners that have booked $1 million or more in business with Cohesity grew 46 percent YoY (Q2/Q2). Cohesity is not only expanding its base of partners, but going significantly deeper with partners as more customers embrace Cohesity’s multicloud platform and data management offerings.
• Record-breaking quarter with service providers: Cohesity realized its biggest quarter ever with service providers, seeing a 208 percent growth in bookings YoY (Q2/Q2). Cohesity also signed 16 new service providers globally in Q2, including Move AS, NetNordic, and US Signal.

Cohesity customers span a wide array of verticals including financial services, healthcare, government/ public sector, pharmaceutical, retail, technology, transportation, education, and media and entertainment.

Customers include: Cisco, Northumbria Police (UK), Novartis, Proliance Surgeons, Siemens AG, SiteOne Landscape Supply, Sky Lakes Medical Center, Stockport NHS Foundation Trust, the National Aeronautics and Space Administration (NASA), the San Francisco Giants, U.S. Department of Homeland Security, and U.S. Department of Labor.

Q2 product innovations and industry accolades

Cohesity introduced innovative SaaS offerings in Q2 and received accolades for its cloud leadership, unique partner program, and recognition from industry analyst firms.

• New SaaS offerings: In December, Cohesity announced the general availability of Cohesity DataProtect delivered as a Service. This SaaS-based offering, the first of many to come as part of Cohesity’s comprehensive Data Management as a Service (DMaaS) solution, gives customers an easy way to make sure their on-premises and cloud-based data is backed up and protected.
• Partner Program of the Year: In December, Cohesity won the “Partner Program of the Year” award from Channel Partner Insight (CPI). These annual awards recognize the companies that are powering the U.S. IT channel.
• Partner Program of the Year: In December, Cohesity won the “Partner Program of the Year” award from Channel Partner Insight (CPI). These annual awards recognize the companies that are powering the U.S. IT channel.
• Cloud leadership: In February, CRN named Cohesity one of its 100 Coolest Cloud Companies for 2021 for the second year in a row. The annual list recognizes the leading cloud technology providers in five critical categories: infrastructure, monitoring and management, security, storage, and software.

from Help Net Security https://ift.tt/2PgERFG

How Often Should You Clean Your Sheets, Really?

You’re probably not washing your sheets as often as you should. A survey done by the Mattress Advisor found that, on average, people will wait about 24 days before changing them—and the number was even higher for pillowcases. Here’s how often you should be washing your linens, and why.

Read more...

from Lifehacker https://ift.tt/3ug5A41

How to Jellify Your Favorite Beverages

Photo: tarapong srichaiyos (Shutterstock)

I wish I had a noble reason for lying in bed and sampling jellified beer from a cocktail glass on a Friday morning—but the actual explanation is, well, anime. Anime has served as my and my spouse’s pandemic hobby, and we have watched at least two dozen series in the past year. We recently finished The Disastrous Life of Saiki K., a show about an all-powerful high school psychic desperately trying (and failing) to be mediocre. The titular character has a soft spot for dessert—specifically coffee jelly, a gelatinized coffee dessert. Gelatin has always grossed me out a little, and I’ve only made Jell-O once or twice before, but I wanted to try coffee jelly myself.

What started as an earnest attempt to recreate this actually good dessert quickly devolved into a barely scientific mission to gelatinize whatever liquids I could think of. The results were always surprising, often palatable, and occasionally terrible, but I’ve gained the confidence to use gelatin when a recipe calls for it, at least.

Gelatin comes from collagen, a common protein with a wound triple-helix shape that helps give structure to connective tissue in animals. Heating up gelatin in water induces a hydrolysis reaction that breaks the proteins down into smaller pieces. If you mix a powder made from those pieces into solution with some sort of liquid, then heat the solution to activate it and allow it to cool, “the gelatin molecules wind back up and form this beautiful gel network” that encases the liquid, said E. Allen Foegeding, Emeritus Professor from the North Carolina State University department Food, Bioprocessing and Nutrition Sciences, who graciously offered explanations for my failures. (Scientists measure the strength of a gelatin’s network forming abilities with a measure called “bloom number,” named after scientist Oscar T. Bloom.)

Gelatin dishes date back to medieval Europe, reported Sarah Grey for Serious Eats, though back then, rendering the collagen from bones made them time-consuming to produce. Peter Cooper filed a patent to improve gelatin’s convenience in 1845, while the famous brand name Jell-O originates from a cough syrup maker’s 1897 patent, and—according to Julie Thompson for the Huffington Post—coffee jelly specifically appeared in a British cookbook as early as 1817. Today, the dish appears more frequently in Japan, where jelled liquids have a centuries-long history. Rather than using gelatin, these desserts incorporate agar, a substance derived from red algae that behaves similarly to gelatin.

G/O Media may get a commission

Photo: Ryan F. Mandelbaum

Recreating this coffee jelly was extremely easy; I followed this recipe from Allrecipes.com. I first “bloomed” the gelatin (no relation to Oscar T.) by dissolving a 0.25-ounce sachet of Knox Unflavored Gelatin in a little warm water, then mixed it with two cups of my favorite coffee and some sugar and brought it to a boil. I poured the mixture into individual serving-size cups and refrigerated it to let it set before serving it with whipped cream.

The result was a refreshing dessert with a softer texture than the Jell-O one might find at a diner, and a pleasant way to get my morning caffeine boost. I ate coffee jelly for breakfast for several days before realizing that, if turning coffee into jelly was this easy, I could probably turn a lot of other liquids into jelly, too. I devised a list of the liquids I encounter most frequently—coffee, tea, soda, wine, beer, and miso soup—and decided to gel them all.

The London fog, my favorite tea drink and a mixture of Earl Gray tea, milk, and vanilla, served as the first gelled liquid I tried on my own. I prepared the ingredients using the ratios of the trusty coffee jelly recipe: two cups of London Fog, one sachet of gelatin powder, and three tablespoons of sugar. I made a huge mess—the protein molecules in milk acted as foaming agents, causing it to boil over the small pot I was using. I tried again, moving to a bigger pot.

Photo: Ryan F. Mandelbaum

The results were…fine. A film of unappetizing and somewhat rubbery milk fat formed at the surface of each serving dish. The texture was more or less the same as the coffee jelly, though perhaps a little more unctuous from the milk. It tasted like a London fog, but the sweetness felt overpowering—I’d forgotten about the lactose in the milk. I tossed the rest of the jiggling mixture into the trash after a few bites.

I tried Dr. Pepper jelly next, making a few tweaks from my prior test. I’d noticed that a lot of gelatin dessert recipes online called for one gelatin sachet per cup of liquid, rather than the one sachet per two cups ratio I’d been using. I also figured, after the London fog incident, that Dr. Pepper was sweet enough on its own so as not to require any extra sugar. Finally, I had seen that some recipes—specifically those geared toward children, used a microwave to heat the gelatin.

I prepared the solution of soda and gelatin, microwaved it in three one-minute increments (stirring between each), and then allowed the mixture to set. The result was...abhorrent.

By doubling the gelatin powder ratio, I’d created a stronger gelatin network—the Dr. Pepper had turned into a thick, jiggling block that felt tough to chew compared to the melt-in-your-mouth texture I’d enjoyed from the coffee jelly. Additionally, while advertised as “flavorless,” the higher ratio began to express a slightly meaty essence, akin to the aftertaste of pork rinds. Though it tasted sweet as a liquid, the mixture tasted barely sweet as a gelled solid, and the sugar of the Dr. Pepper wasn’t enough to mask the pigginess.

When I asked Foegeding over the phone why the Dr. Pepper gelatin didn’t taste sweet, he explained that creating a firmer gel decreased my perception of sweetness by decreasing the amount of contact that the gel made with the taste receptors on my tongue. Additionally, at least one study found that we seem to perceive firmer textures as having less flavor, regardless of the amount of food aroma molecules in our noses.

Luckily, these less than successful experiments had a bright side—I had established two principles I’d bring into the next round of jellies:

1. The ideal ratio for a gelatin-based dessert is one 0.25-ounce sachet to two cups of liquid, and
2. Finding the optimal sweetness is a moving target based on the context and texture.

Feeling somewhat deflated after two failures, I had low expectations going into the wine jello, and gagged thinking about the idea of beer jello. But I pressed forward—one sachet of jello to two cups of red wine. The wine tasted dry and I didn’t feel like thinking about the flavor chemistry of alcohol, so I went with three tablespoons of sugar. I liked the microwave method, so I went with that.

I’d hit the sweet spot, this time. The texture was ideal, and while the flavor bordered on that of Manischewitz, the wine’s own flavor shone through enough to make the experience enjoyable. I gave one of the cups to my neighbors, who finished and enjoyed it. I later learned that Thomas Jefferson wrote out a recipe to wine jelly of his own.

The beer was even more of a surprise; I scaled back the sugar to slightly more than two tablespoons, and the result tasted great, like something I’d happily eat while sitting on the beach. Granted, I had used a nice craft—a sour ale with guava—which did most of the lifting in terms of flavor. I don’t think I could stomach a Coors Light Jell-O.

There are plenty of other considerations when it comes to making a jelly from your favorite beverage—too much alcohol and the gel network might not properly form. Foegeding reminded me in our conversation that certain fresh fruits like pineapple and kiwi have protease enzymes that break down protein molecules. These enzymes are great for tenderizing meat, but will also inhibit the gelling properties of gelatin.

For the final step of the powdered gelatin journey, I attempt a savory dish. I try not to eat meat (despite the powdered bone protein journey I was amid completing) so I went with this vegan sweet corn and miso aspic recipe, swapping gelatin for the recommended agar since I already had gelatin on hand. I noticed that this recipe used a sachet-per-cup of liquid ratio, which I figured was acceptable for a savory dish.

This final recipe was my ultimate gelatin failure. I poured the gelatin sachet directly into boiling water rather than dissolving it in the liquid first. This set off a reaction that caused the gelatin to turn into hideous rubbery beige globs—by dumping the packet into heated water without dissolving it first, the gelatin network started forming without having trapped any water. It was “like nailing into a stack of 2x4s before lining them up to form the structure,” Foegeding told me. I restarted, dissolving the gelatin first this time, and then slowly pouring the miso soup and jello mixture into cups full of corn and nori.

I’m pretty sure the result came out as it was supposed to, and I can’t pinpoint any specific complaints with it. It tasted like miso soup and corn, and the texture was clearly gelatin and corn. However, I could not take more than a full bite without gagging. Savory gelatin dishes are not for me. [Editor’s note: Aspic can take some getting used to if you weren’t raised on it. —Claire Lower]

All of this gelling left me with a few general powdered gelatin tips for other novices hoping to gel beverages:

• start with 0.25 ounces of gelatin powder per two cups of liquid, take into account that firmer gels will decrease your perception of flavor and will require more sugar than you think.
• Know that fresh fruit with lots of protease like pineapple, kiwi, papaya, and fig will inhibit the gel formation.
• Once you’ve mastered grocery store gelatin powder, there’s a whole world to explore, including gelatin powders and sheets with various bloom numbers, agar, and other cooking agents that thicken foods and produce gels in the kitchen.

Gelatin is amazing from a chemistry perspective, and small changes to various components of your recipe or to the kind of gelatin you’re using can have big impacts on texture and mouthfeel. I certainly learned from my many failures as well, though I actually found the experience of seeing the proverbial sausage get made somewhat off-putting. There’s some overall lesson here—diving in deep on the science and history of an unfamiliar ingredient, running experiments, and recording where you messed up and why is a great way to grow as a home chef. But I also don’t plan on eating any more gelatin for a while.

from Lifehacker https://ift.tt/3rDUC6r