Home > Resources > Articles > Active Directory Recovery and Its Impact on ROI

Active Directory Recovery and Its Impact on ROI

Aashish Yadav | June 28, 2022 | 664 views | Read Time : 8 min

Active Directory Recovery and Its Impact on ROI
Active Directory manages users, apps, and resources and handles user authorization and authentication.

Cyberattacks are on the rise throughout every sector, disrupting consumer goods and services, organizations, and endangering public safety. Businesses that haven't been attacked can have trouble justifying a cyber-first business recovery strategy.

However, as more cyberattacks make headlines and the cost of ransom payments and cyber insurance grows, corporate leaders must prioritize building a proven cyber-first business recovery strategy. The first step is to safeguard the Active Directory (AD), which is most businesses’ primary identity database globally.

Active Directory is the primary access point for cybercriminals: 90% of the cyberattacks Mandiant reported, include Active Directory as the first attack vector or the gateway to elevated access. Most attacks in recent years, including SolarWinds, included compromised credentials.

Cyberattack victims soon realize that every minute matters during a breach. Failure to effectively restore Active Directory would lead to a second assault using the same strategies as the first.

The issue is not whether a company can afford a rapid, cyber-first Active Directory approach. The question is how Active Directory can help businesses safeguard their data and also boost their ROI.

What Benefits Does Active Directory Hold for Businesses?

There are several ways in which Active Directory can help businesses:

Centralized Data Repository

In a multi-master database, Active Directory holds the identification information of apps, users, and resources. The Active Directory database stores data as objects and has a capacity of 2 billion objects. Users can use this identification data to access resources from anywhere on the network. Administrators can handle corporate application authentication and permission from a centralized place. Identity would be copied across numerous systems without directory services, making it impossible for administrators to oversee operations.


Minimized Data Replication

Multiple domain controllers are necessary for complicated business needs like branch offices. Sub-domain controllers are aware of changes made to the Active Directory database if identities are controlled from a centralized approach. With a centralized domain controller, Active Directory can delegate duties across the business, as well as tools and utilities for adding, removing, and modifying active identities and objects. It employs a synchronization method to guarantee that data is consistent across all domain controllers. As a result, it enables making company-wide adjustments with a few mouse clicks.


Security Auditing Capabilities

Regular audits assist you in understanding new security dangers. Active Directory enables the collection and auditing of identity infrastructure events like authentication, directory service changes, and access violations. It also facilitates the collection of data from a centralized place for the purpose of debugging authentication and authorization difficulties that users can encounter.


Network Security

Active Directory improves security across an organization. Higher-level management authorities can delegate authorization for resources and apps to other administrators or users through delegation. Active Directory items are linked in a hierarchical manner. Permissions are inherited by an object in the AD tree from its parent objects. These features guarantee that users are uniquely and securely recognized. Administrators can build and update permissions from a single database, decreasing the possibility of inaccurate or outdated configuration.


Calculating Your Active Directory Recovery ROI

Although every IT manager or administrator understands that an effective Active Directory recovery plan is a critical component of any business-developed standard, assessing the practical ROI (return on investment) of an optimized Active Directory recovery plan is frustratingly complex. Here are important ways:


Operational Losses

It's probable that a significant portion of your operations depend on Active Directory to authenticate users as the foundation for delivering access to apps, systems, and data. How much money or productivity will your company lose for every hour Active Directory is down? How many hours, days, or weeks would it require before the company reaches a point of no return and is unable to recover financially? Remember the City of Baltimore's ransomware attack? Their operational recovery took several months and cost more than $18 million.


Lack of Plan That Includes AD

If your company is mature enough, it has a BC/DR strategy to restore business activities after an outage. Most disaster plans account for the loss of infrastructure or location. Few organizations have a strategy for recovering operations following a hack, particularly ransomware. How you restore Active Directory depends on what hackers changed in Active Directory. How far back must you go to get a known secure Active Directory version? What Active Directory-dependent systems, services, and apps won't work if Active Directory is recovered to an earlier state? Do you have a recent malware-free backup to restore? Without a strategy or understanding of what changed in Active Directory before recovery, your company will spend immeasurable time correcting all the issues.


Recovery Might Not Be an Answer

If all the modifications performed by the bad dudes during an assault are, say, adding an account to the Domain Admins group, then restoring Active Directory to a few days ago or last month would not be the best solution. Instead, perhaps a less expensive approach would be to monitor changes in Active Directory and have the option to either prevent changes to "protected" accounts (such as the Domain Admins group) or immediately return a change to a sanctioned configuration.


Closing Lines

In other words, the ROI of Active Directory recovery is significantly more dependent on your present capacity to return to a known-productive and known-secure state post-attack than it is on an online ROI calculation that ignores the various factors involved in a ransomware attack. By running through certain situations and considering your present recovery capabilities, you will uncover expenses that can be avoided by implementing a suitable Active Directory recovery solution—one that is intended to guard against, prevent, and recover from malicious modifications to Active Directory.


QNA

How to restore the Active Directory?

  • Restart the server
  • From the boot menu, press F8 to access advanced settings
  • Scroll down to the Directory Services Restore Mode option
  • Press the Enter key to restart the computer in safe mode. It will not launch the directory services


How can I restore a failed domain controller?

Restoring a Domain Controller in non-authoritarian mode
  • In the GUI, choose the Restore wizard
  • Find the required DC
  • From the recovery menu, choose Restore Entire VM
  • Then, choose a recovery point
  • Select whether the restoration should take place in the original location or a new one
  • Complete the steps necessary to complete the procedure.


For Active Directory, what is "Recovery Manager"?

The Recovery Manager for Active Directory allows you to automate backups and easily compare a backup to the present value of Active Directory to identify changes and restore data immediately.

Spotlight

Softcat plc

Softcat is a market-leading IT infrastructure reseller, delivering solutions across eight solution areas: asset management, business intelligence & analytics, collaboration, commodity sourcing, digital workspace, datacentre, networking & security, software licensing and IT services to organisations in both private companies and public sector organisations in the UK.

OTHER ARTICLES
Network Threat Detection, Platform Security, Software Security

Transformative Cybersecurity Detection Reshapes the Battle Against Constantly Evolving Cyber Threats

Article | July 18, 2023

Embrace cybersecurity as transformative detection techniques to revolutionize the fight against ever-changing cyber threats. In an interconnected world, cybersecurity poses a growing threat to businesses, capable of wreaking havoc on their operations, reputations, and financial standings. Cyber threats have reached alarming levels, affecting every industry. Successful attacks can lead to data theft, financial losses, reputational damage, and business disruption. These sophisticated attacks exploit vulnerabilities in digital infrastructure. Yet, the challenge of cybersecurity extends beyond the mere presence of threats. It lies in the relentless evolution and adaptability of these malevolent forces. Traditional security measures, once considered sufficient, are now rendered ineffective against their cunning tactics. The landscape of cybercrime is a perpetually shifting entity, leaving organizations in a constant state of vulnerability. At the onset of the COVID-19 pandemic, organizations witnessed a significant surge in cyber threats or alerts, with 61% reporting a substantial increase of 25% or more. With users accessing cloud applications and corporate networks remotely, hackers actively sought to exploit potential security gaps. Protecting Businesses: The Importance of Cybersecurity Detection Early threat detection is a fundamental aspect of effective cybersecurity. By closely monitoring network traffic, system logs, and user behavior, businesses can swiftly detect suspicious activities that may signal an ongoing or imminent cyber-attack. Such proactive detection enables organizations to respond promptly, mitigating potential financial losses from data breaches, system downtime, regulatory fines, legal battles, and reputational damage. For businesses entrusted with sensitive customer data, cybersecurity detection plays a vital role in maintaining trust and complying with data protection regulations. By monitoring data access, identifying unauthorized activities, and promptly detecting breaches or data exfiltration attempts, organizations can safeguard customer information and avoid legal complications. Moreover, cybersecurity detection protects a company's intellectual property, ensuring the integrity of trade secrets, proprietary algorithms, and other confidential information. By effectively identifying and preventing unauthorized access or theft attempts, businesses can maintain their competitive advantage. Compliance with industry regulations is an essential consideration for businesses. Cybersecurity detection helps companies demonstrate proactive measures in detecting security incidents and potential data breaches, ensuring adherence to data security and privacy requirements and avoiding penalties, legal liabilities, and reputational damage associated with non-compliance. Furthermore, effective cybersecurity detection enhances reputational trust. Businesses that invest in robust detection measures are committed to safeguarding sensitive information, thus fostering trust among customers, partners, and stakeholders. Guard Against Cyber Threats with onShore Security’s Panoptic Cyberdefense Panoptic Cyberdefense by onShore Security is a Managed Cybersecurity Detection solution that recognizes security as an ongoing process, not just a mere product. For effective cybersecurity operations, round-the-clock monitoring is required using Security Operations Center (SOC) offered by onShore’s cyberdefence solution. To maximize visibility, businesses need to immediately respond to security threats while also requiring to identify non-threatening data. Leveraging Panoptic Cyberdefense helps streamline identifying, monitoring, and detecting cyber threats. During a conversation with Media 7, Stel Valavanis, CEO, onShore Security highlighted the impact of cyber threats and talked about cybersecurity detection solutions. We have developed our detection platform, the Panoptic Sensor and the Panoptic SIEM over many battle-hardened years. And the process is well-oiled, as you can imagine, involving tiers and workflow communication for alerting, analysis, tuning, and threat-hunting. As cyber threats evolve in complexity and frequency, businesses must remain vigilant in safeguarding their digital assets. onShore Security's Panoptic Cyberdefense offers a comprehensive suite of solutions, including Panoptic Sensor and the Panoptic SIEM, to help organizations mitigate risk, protect sensitive data, elevate their security team, and meet compliance requirements. Through Panoptic Sensor, organizations gain proactive threat intelligence, enabling the early detection and prevention of potential security breaches. Complementing this, the Panoptic SIEM provides powerful analytics and monitoring capabilities, empowering businesses to swiftly identify, investigate, and respond to security incidents. To navigate complex data protection and privacy regulations, minimizing the risk of non-compliance penalties and legal ramifications is needed. Panoptic Cyberdefense offers three levels of cybersecurity detection. The levels of detection, response and analysis include managed detection and response (MDR), second level has both network detection response (NDR) + MDR, and the third level is security orchestration. Harness the Power of Detection By integrating detection capabilities into every layer of protection systems, including user involvement, businesses can establish a formidable defense against cyber threats. Consolidating data from various sources into a centralized platform for analysis becomes essential. Implementing a managed detection and response process enables continuous analysis of this data, empowering early detection of potential attackers and facilitating ongoing security enhancements. Collaborating with government and industry partners can further demonstrate a commitment to high-security standards and compliance requirements. Remaining prepared for potential attacks is crucial. In the event of an incident, prompt response becomes paramount. Equipped with comprehensive data providing attestation of methods and impact, organizations can swiftly and effectively address any cybersecurity breaches.

Read More
Enterprise Identity, Platform Security, Software Security

Identity-Based Authentication Sets New Industry Standards for Secure and Streamlined User Onboarding

Article | August 16, 2023

Embrace the transformative power of identity-based authentication to establish new industry standards for safe and seamless user onboarding processes, enhancing security, workflows & user experience. The increasing adoption of decentralized identity systems, including blockchain-based solutions, introduces intricate challenges in the verification and authorization of identities across distributed networks. During interoperability, the threat to privacy and security within these systems is emerging at an alarming rate that requires urgent attention. Additionally, combating synthetic identity fraud poses a significant hurdle as fraudsters adeptly combine genuine and false information, making it arduous to differentiate between authentic and fraudulent identities. Deepfakes are the rising concern, which generate remarkably realistic audio, video, or images, mimicking genuine individuals and heightening the difficulty of detecting and preventing impersonation attacks. Password fatigue stems from the constant need to create and remember multiple passwords, leading users to choose weak or reused ones. Reusing passwords increases the risk, as compromising one account grants access to others. Password theft is a concern, with attackers employing phishing attacks and malware. A study by Google found that passwordless authentication can reduce password-related help desk tickets by up to 60%. (Source: PYMNTS) Complex password requirements can be challenging, pushing users towards weaker options. Password resets are time-consuming and frustrating. Solutions should alleviate fatigue, promote secure practices, and offer robust protection against theft and unauthorized access. All service providers or product companies confront a common challenge in this novel era of vulnerabilities, the question of creating an optimal and seamless user onboarding cycle while adhering to the necessary standards. This keeps them up at night as they attempt to find the optimal balance between seamless and secured-data onboarding. In this digital age, identity-secure data is the most valuable asset and a transformative resource. Organizations with data stored in cloud storage and password-based authentication systems are vulnerable to cybercrime. These are susceptible to numerous security threats, including phishing, social engineering, and brute-force attacks. These hazards may result in security breaches and sensitive data loss. Additionally, password management becomes burdensome for users, resulting in password fatigue, weak practices, and IT department involvement for password resets. This impacts user experience and productivity. Identity-Based Authentication (IBA) comes into action while implementing this secure identity verification. To ensure widespread adoption of IBA, the industry must standardize two crucial aspects of identity: ‘Identification Verification’ and ‘Passwordless Authentication’. Automating identity verification fundamentally transforms the onboarding work processes by shifting administrative burden to user endpoints and automating data capture, credential validation, and document workflow. This leads to increased user satisfaction and faster access to required services, driving efficiency and reducing the time to generate revenue for customers. BlockID Verify by 1Kosmos prevents such fraudulent accounts through an identity proofing process that verifies identity anywhere, anytime, and on any device with over 99% accuracy, thereby preventing the use of stolen or synthetic identities during customer onboarding. During a conversation with Media 7, Michael Cichon, CMO, 1Kosmos stressed on the implementation of identity proofing and authorization. At 1Kosmos we bring our solutions to the market through three distinct products. One product focuses on workforce authentication, another caters to business-to-consumer use cases, and the third product revolves around self-service identity proofing. These give organizations the ability to remotely verify an identity on the web with a high level of assurance, and then verify that identity at every access attempt. Onboarding users with security and data protection is a critical activity. It is a one-time action that must be combined with an authentication mechanism for long-term identity to be genuinely effective. Organizations with data stored in cloud storage and password-based authentication systems are vulnerable to cybercrime. While these are susceptible to numerous security threats, including phishing, social engineering, and brute-force attacks, these hazards can result in security breaches and sensitive data loss. A recent report by Verizon demonstrated that 61% of all data breaches are caused by compromised credentials. (Source: 1Kosmos) The catch that robust identity verification alone does not guarantee future authentication, calls for FIDO (Fast Identity Online). It is backed by an industry-leading organization 1Kosmos, which provides solutions for Identity Based Authentication. FIDO uses cryptography in the form of a public and private key to authenticate a user. With FIDO2 authentication, employees can authenticate into corporate systems and applications using their personal devices. This eliminates the need for conventional passwords and reduces the likelihood of security vulnerabilities resulting due to password-related attacks. With FIDO2, the user's keys are stored on their devices and not the service provider's server and thus proves to be less vulnerable to identity theft and phishing attempts. This is where the password to cryptographic passkeys adoption comes into picture. BlockID Workforce by 1Kosmos implements password-less authentication using FIDO, and has thus become a necessity, adopting self-service identity verification serving as a credential service provider. The ‘Identity Proofing’ together with ‘Passwordless Authentication’ results in a seamless user experience addressing credential theft, eliminating unauthorized users logging in corporate IT network and thus preventing data breaches, financial fraud, and ransomware.

Read More
Network Threat Detection, Platform Security, Software Security

Urgent Redefinition of Data Loss Prevention to Address Increasing Global Data Threats

Article | June 28, 2023

Discover the significance of data protection in today's vulnerable world. Gain insights into the far-reaching impacts of data loss and the importance of proactive data security practices for businesses. Understanding Data Protection’s Significance in an Ever-Vulnerable World In today's highly competitive business landscape, organizations must recognize the immense value of their data resources and prioritize implementing robust data protection measures. Safeguarding data from external threats and internal vulnerabilities is paramount to ensuring businesses' smooth and secure operations. In an era of increasingly complex IT environments, data protection becomes an increasingly challenging endeavor, necessitating organizations to maintain a vigilant stance in safeguarding their critical information. According to Ponemon Institute statistics, 77% of companies are woefully ill-prepared and planned when it comes to thwarting an attack or a data breach. Protecting sensitive data, such as intellectual property, personally identifiable information, and financial records, poses a significant challenge for organizations. The modern workplace, characterized by extensive data collaboration across networks, devices, and applications, further amplifies the risk of data security incidents. Furthermore, limited resources often hinder organizations from keeping pace with the ever-growing array of data security risks. However, as data volumes continue to expand, the escalating concerns surrounding data protection highlight the severe consequences organizations face in terms of financial loss, reputational damage, and legal repercussions resulting from data breaches. To mitigate these risks, they must adopt a proactive approach to data protection. This encompasses the implementation of robust security protocols, using encryption technologies, conducting regular security audits, and providing ongoing employee training on data security best practices. This proactive approach enables businesses to operate with greater confidence, trust, and resilience. It is important to note that organizations must view data protection as an essential aspect of their overall business strategy and continually adapt and improve their data security practices. Only by protecting their data can organizations maintain a competitive edge, preserve customer trust, and uphold their reputation as reliable and secure entities in the marketplace. The Far-Reaching Impacts of Data Loss Data protection is a critical concern that applies to organizations of all sizes, and falling into the trap of thinking it only affects large enterprises can have devastating consequences. In fact, small businesses are often targeted by data theft attempts, as they may have fewer resources and can be more susceptible to attacks. Failing to keep up with data security measures and strategies results in severe repercussions for businesses. It damages their reputation, increase operational downtime, leave sensitive data unprotected, and even attract legal action. With organizations increasingly relying on cloud and online transactions, cyber threats now pose a significant risk to data integrity. Data breaches can lead to the theft of valuable information, which can be sold to other parties or used for fraudulent activities. The financial impact of these breaches and losses is substantial. When a company fails to protect its sensitive information and allows data breaches to occur, it not only incurs financial losses but also experiences a significant blow to its reputation. Dissatisfied customers may take their business elsewhere, resulting in decreased revenue. Communicating a data loss incident to customers, while essential, can also erode trust and lead to discontentment. This can further drive customer churn and harm the business's overall reputation, especially if customer data is compromised. Rebuilding customer relationships in the aftermath of a data loss incident requires significant time and resources, as the consequences can persist for years. Data Loss Prevention: An Essential Ingredient Data loss prevention (DLP) is an integral part of a comprehensive data protection strategy, aiming to prevent unauthorized access, use, or disclosure of sensitive data. A well-implemented DLP system can help organizations proactively safeguard their data, mitigate risks, and avoid the aftermath of data loss incidents. As Alexey Raevsky, CEO, Zecurion rightly stated in an interview with Media7, If any organization has a mature DLP in place, there is no need of combating the aftermath of data loss. A robust DLP system comprises advanced security protocols, encryption technologies, and continuous monitoring mechanisms. These components work together to identify vulnerabilities, prevent data breaches, and address potential threats. The other key advantage of an effective DLP system is establishing and enforcing stringent access controls. This ensures that only authorized individuals can access and manipulate sensitive data, reducing the risk of data breaches caused by internal or external factors. Encryption technologies employed by DLP systems further enhance data protection by securing data at rest and in transit, making it challenging for malicious actors to compromise sensitive information. Navigating Data Protection World with Enterprise DLP ‘Zecurion’ An enterprise DLP system offers a comprehensive solution designed to address organizations' complex data landscapes and security challenges. It provides centralized control and visibility over data across multiple systems, networks, and endpoints within the enterprise. Organizations can effectively manage and protect data throughout its lifecycle, regardless of location or format, by implementing a unified DLP framework. This is where Zecurion becomes essential. It is a next-gen DLP provider that specializes in researching, investigating, and monitoring activities to prevent data loss incidents. Its DLP solution offers various features to enhance data protection and incident response: User Behavior Analytics (UBA) with fast risk-based assessment: This feature provides visibility into employee activities and evaluates them based on parameters such as risk, productivity, policies, and emotional state. The Security Officer can closely monitor high-risk employees while allowing low-risk ones to operate with fewer limitations. Screen Photo Detector: This feature detects attempts to photograph a screen using a smartphone by utilizing webcams. It employs two neural networks to ensure reliable smartphone detection and quickly identifies cybersecurity incidents in a fraction of a second. Investigation Workflow Automation: This module simplifies investigations and streamlines the incident response cycle. It provides a comprehensive view of ongoing tasks, including their statuses, relevant data, assigned personnel, and deadlines. Cybersecurity team members can collaborate, leave comments, discuss progress, and attach supporting documents and incidents for efficient and effective incident resolution. Stand Out from Completion with the Next-Gen DLP Zecurion stands out from its competitors due to its ease of implementation and successful use cases demonstrating its instrumental value. One notable example is its pivotal role in a recent forensic investigation conducted for an oil refinery. The investigation uncovered fraudulent activities by intermediaries selling the refinery's products at inflated prices. Zecurion's DLP solution played a critical role in identifying the involvement of a group of managers, including a C-level executive, who had gone to the extent of forging documents to conceal their actions. A financial and legal audit conducted with the help of Zecurion revealed that the fraudsters' actions had resulted in a loss of over $25 million for the organization. The DLP solution proved invaluable in enabling the refinery to take legal action against the perpetrators and terminate the employment of the three key individuals involved in the scam. The success of Zecurion's DLP solution in this particular use case further establishes its reputation as a trusted and effective solution for safeguarding organizations against data loss and fraudulent behavior. Privacy and Protection: Balance is Crucial It is important to note that while organizations must prioritize data security, balancing security measures and respecting employee privacy and autonomy is equally important. While a robust data security framework is essential and ensures that sensitive information is adequately protected, employees must feel that their personal information is handled with care and that their privacy is respected. This can be achieved through clear and transparent data usage policies, consent-based data collection practices, and strict adherence to data protection regulations. Organizations can create a culture of trust and accountability by establishing these guidelines and practices, instilling confidence among employees that their privacy is valued and protected. Additionally, organizations can foster a culture of data security awareness and education among employees. Regular training and updates on data security best practices can turn employees into proactive participants in maintaining a secure work environment. This not only enhances data security but also cultivates a sense of shared responsibility and accountability among employees. When employees feel that their privacy is respected and they are given the autonomy to perform their duties effectively, they are more likely to adhere to data security protocols and actively contribute to the organization's overall security posture.

Read More
Network Threat Detection

Software Supply Chain Attacks: How Can Code Signing Help?

Article | July 12, 2023

Software supply chain attacks, such as the recent one involving MOVEit Transfer, are a serious issue for modern enterprises. Their dependency on third-party software makes it difficult to successfully vet the security integrity of every product used by enterprises. Software is especially difficult to assess securely, as it can be modified through updates throughout its lifecycle. For threat actors, targeting popular enterprise software tools is a lucrative and time-efficient way to gain access to the systems of a large number of corporate users. Verifying the integrity of software, and using attestation services, is one way to minimize the threat surface. So how can these concepts be leveraged in software? Software integrity (also known as code integrity) refers to the quality of the source code and allows the determination of the safety, security, and reliability of the software. It can mean that the code is unaltered by unauthorized parties, or it can also provide protection against hacks and guarantee privacy. Integrity checking can be relatively complex, but includes, at a minimum (from a security perspective), security features and ensures that security vulnerabilities have been eliminated. It does what it should, can be tested, and is easy to understand and edit, without introducing new errors or flaws. There are code analysis tools that can enable this. Beyond that, the code can be signed through the application of a digital signature to seal that integrity check. This can happen several times during the lifetime of that software: at production, for upgrades and patching, etc. This provides assurance that the software came from the developer and that it has not been changed in an unauthorized manner. This proof of authenticity becomes important in supply chain scenarios, and can be an important tool for brand protection of the developers. Code signing makes use of digital certificates; the signature is cryptographically hashed and packaged in a certificate. This certificate can then be verified by the user of the software through a Public Key Infrastructure (PKI), with a certificate authority validating (or refuting) the applied signature. There are various types of code signing certificates: standard and extended. The latter involves a more complex process and stricter requirements for validation and key management. Software attestation is essentially the other side of that process. It’s a trust mechanism that allows the user to independently validate the integrity asserted by a provider. Attestation might require not just the vendors name, version of the software, and origins of the code, but also other software artifacts, such as statements to the effect that they have followed secure development practices, information on external dependencies used to build it, the build process itself, the test suites that were run, and any security checks passed. Together, these artifacts form the metadata of the software, which then can be independently signed. A PKI can then be leveraged to verify the applied digital signature. There are software attestation standards that can be leveraged, including open ones (in-tot and Binary Authorization being two popular ones). The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is working on a self-attestation form (Secure Software Development Attestation Common Form) for software producers serving the federal government. The form will require them to confirm implementation of specific security practices. This was following the White House’s 2021 Executive Order 14028 and the Office of Management and Budget’s (OMB) M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices.” Digital signatures for code integrity and software attestation will increasingly be in demand, especially as governments on both sides of the Atlantic (in the European Union and the United States) are pushing for policy and regulation on mandatory Software Bills of Materials (SBOMs). The goal is to make software developers and device manufacturers accountable for the components that make up their products. An SBOM will have to list known vulnerabilities associated with each component (open source and third party), pushing security rights to the forefront of product development. This visibility will allow for product development teams, DevOps, and implementers to address vulnerabilities and thereby strengthen security. SBOMs will likely form part of the software’s metadata, so signing will have a role to play here. In short, code signing and software attestation can both confer a level of security that can minimize the threat of a supply chain attack. It’s important to keep in mind, however, that they won’t address all issues, and will not be 100% fool-proof either. Of course, threat actors know this, and many are already targeting the code signing process in order to inject malicious code. This requires threat actors to compromise development platforms where code signing takes place. Ultimately, the use of digital signatures, from creation to management, is another aspect that will need to be secured from a developer perspective. DevSecOps will also have an important role to play here in order to avoid such malicious tactics, thereby providing a holistic security context for using digital signatures. But there is no doubt that digital signatures are a key technology for code integrity and software attestation, and will have a positive impact on thwarting the progress of supply chain attacks, if used widely. Sources: CISA WH EO 14028 OMB

Read More
Network Threat Detection, Platform Security, Software Security

The Elite 10: Unveiling Top Network Security Solutions in 2023

Article | July 18, 2023

Embrace cybersecurity as transformative detection techniques to revolutionize the fight against ever-changing cyber threats. In an interconnected world, cybersecurity poses a growing threat to businesses, capable of wreaking havoc on their operations, reputations, and financial standings. Cyber threats have reached alarming levels, affecting every industry. Successful attacks can lead to data theft, financial losses, reputational damage, and business disruption. These sophisticated attacks exploit vulnerabilities in digital infrastructure. Yet, the challenge of cybersecurity extends beyond the mere presence of threats. It lies in the relentless evolution and adaptability of these malevolent forces. Traditional security measures, once considered sufficient, are now rendered ineffective against their cunning tactics. The landscape of cybercrime is a perpetually shifting entity, leaving organizations in a constant state of vulnerability. At the onset of the COVID-19 pandemic, organizations witnessed a significant surge in cyber threats or alerts, with 61% reporting a substantial increase of 25% or more. With users accessing cloud applications and corporate networks remotely, hackers actively sought to exploit potential security gaps. Protecting Businesses: The Importance of Cybersecurity Detection Early threat detection is a fundamental aspect of effective cybersecurity. By closely monitoring network traffic, system logs, and user behavior, businesses can swiftly detect suspicious activities that may signal an ongoing or imminent cyber-attack. Such proactive detection enables organizations to respond promptly, mitigating potential financial losses from data breaches, system downtime, regulatory fines, legal battles, and reputational damage. For businesses entrusted with sensitive customer data, cybersecurity detection plays a vital role in maintaining trust and complying with data protection regulations. By monitoring data access, identifying unauthorized activities, and promptly detecting breaches or data exfiltration attempts, organizations can safeguard customer information and avoid legal complications. Moreover, cybersecurity detection protects a company's intellectual property, ensuring the integrity of trade secrets, proprietary algorithms, and other confidential information. By effectively identifying and preventing unauthorized access or theft attempts, businesses can maintain their competitive advantage. Compliance with industry regulations is an essential consideration for businesses. Cybersecurity detection helps companies demonstrate proactive measures in detecting security incidents and potential data breaches, ensuring adherence to data security and privacy requirements and avoiding penalties, legal liabilities, and reputational damage associated with non-compliance. Furthermore, effective cybersecurity detection enhances reputational trust. Businesses that invest in robust detection measures are committed to safeguarding sensitive information, thus fostering trust among customers, partners, and stakeholders. Guard Against Cyber Threats with onShore Security’s Panoptic Cyberdefense Panoptic Cyberdefense by onShore Security is a Managed Cybersecurity Detection solution that recognizes security as an ongoing process, not just a mere product. For effective cybersecurity operations, round-the-clock monitoring is required using Security Operations Center (SOC) offered by onShore’s cyberdefence solution. To maximize visibility, businesses need to immediately respond to security threats while also requiring to identify non-threatening data. Leveraging Panoptic Cyberdefense helps streamline identifying, monitoring, and detecting cyber threats. During a conversation with Media 7, Stel Valavanis, CEO, onShore Security highlighted the impact of cyber threats and talked about cybersecurity detection solutions. We have developed our detection platform, the Panoptic Sensor and the Panoptic SIEM over many battle-hardened years. And the process is well-oiled, as you can imagine, involving tiers and workflow communication for alerting, analysis, tuning, and threat-hunting. As cyber threats evolve in complexity and frequency, businesses must remain vigilant in safeguarding their digital assets. onShore Security's Panoptic Cyberdefense offers a comprehensive suite of solutions, including Panoptic Sensor and the Panoptic SIEM, to help organizations mitigate risk, protect sensitive data, elevate their security team, and meet compliance requirements. Through Panoptic Sensor, organizations gain proactive threat intelligence, enabling the early detection and prevention of potential security breaches. Complementing this, the Panoptic SIEM provides powerful analytics and monitoring capabilities, empowering businesses to swiftly identify, investigate, and respond to security incidents. To navigate complex data protection and privacy regulations, minimizing the risk of non-compliance penalties and legal ramifications is needed. Panoptic Cyberdefense offers three levels of cybersecurity detection. The levels of detection, response and analysis include managed detection and response (MDR), second level has both network detection response (NDR) + MDR, and the third level is security orchestration. Harness the Power of Detection By integrating detection capabilities into every layer of protection systems, including user involvement, businesses can establish a formidable defense against cyber threats. Consolidating data from various sources into a centralized platform for analysis becomes essential. Implementing a managed detection and response process enables continuous analysis of this data, empowering early detection of potential attackers and facilitating ongoing security enhancements. Collaborating with government and industry partners can further demonstrate a commitment to high-security standards and compliance requirements. Remaining prepared for potential attacks is crucial. In the event of an incident, prompt response becomes paramount. Equipped with comprehensive data providing attestation of methods and impact, organizations can swiftly and effectively address any cybersecurity breaches.

Read More
Enterprise Identity, Platform Security, Software Security

Beyond Basics: Advanced Strategies for Enhancing Zero Trust Networking

Article | August 16, 2023

Embrace the transformative power of identity-based authentication to establish new industry standards for safe and seamless user onboarding processes, enhancing security, workflows & user experience. The increasing adoption of decentralized identity systems, including blockchain-based solutions, introduces intricate challenges in the verification and authorization of identities across distributed networks. During interoperability, the threat to privacy and security within these systems is emerging at an alarming rate that requires urgent attention. Additionally, combating synthetic identity fraud poses a significant hurdle as fraudsters adeptly combine genuine and false information, making it arduous to differentiate between authentic and fraudulent identities. Deepfakes are the rising concern, which generate remarkably realistic audio, video, or images, mimicking genuine individuals and heightening the difficulty of detecting and preventing impersonation attacks. Password fatigue stems from the constant need to create and remember multiple passwords, leading users to choose weak or reused ones. Reusing passwords increases the risk, as compromising one account grants access to others. Password theft is a concern, with attackers employing phishing attacks and malware. A study by Google found that passwordless authentication can reduce password-related help desk tickets by up to 60%. (Source: PYMNTS) Complex password requirements can be challenging, pushing users towards weaker options. Password resets are time-consuming and frustrating. Solutions should alleviate fatigue, promote secure practices, and offer robust protection against theft and unauthorized access. All service providers or product companies confront a common challenge in this novel era of vulnerabilities, the question of creating an optimal and seamless user onboarding cycle while adhering to the necessary standards. This keeps them up at night as they attempt to find the optimal balance between seamless and secured-data onboarding. In this digital age, identity-secure data is the most valuable asset and a transformative resource. Organizations with data stored in cloud storage and password-based authentication systems are vulnerable to cybercrime. These are susceptible to numerous security threats, including phishing, social engineering, and brute-force attacks. These hazards may result in security breaches and sensitive data loss. Additionally, password management becomes burdensome for users, resulting in password fatigue, weak practices, and IT department involvement for password resets. This impacts user experience and productivity. Identity-Based Authentication (IBA) comes into action while implementing this secure identity verification. To ensure widespread adoption of IBA, the industry must standardize two crucial aspects of identity: ‘Identification Verification’ and ‘Passwordless Authentication’. Automating identity verification fundamentally transforms the onboarding work processes by shifting administrative burden to user endpoints and automating data capture, credential validation, and document workflow. This leads to increased user satisfaction and faster access to required services, driving efficiency and reducing the time to generate revenue for customers. BlockID Verify by 1Kosmos prevents such fraudulent accounts through an identity proofing process that verifies identity anywhere, anytime, and on any device with over 99% accuracy, thereby preventing the use of stolen or synthetic identities during customer onboarding. During a conversation with Media 7, Michael Cichon, CMO, 1Kosmos stressed on the implementation of identity proofing and authorization. At 1Kosmos we bring our solutions to the market through three distinct products. One product focuses on workforce authentication, another caters to business-to-consumer use cases, and the third product revolves around self-service identity proofing. These give organizations the ability to remotely verify an identity on the web with a high level of assurance, and then verify that identity at every access attempt. Onboarding users with security and data protection is a critical activity. It is a one-time action that must be combined with an authentication mechanism for long-term identity to be genuinely effective. Organizations with data stored in cloud storage and password-based authentication systems are vulnerable to cybercrime. While these are susceptible to numerous security threats, including phishing, social engineering, and brute-force attacks, these hazards can result in security breaches and sensitive data loss. A recent report by Verizon demonstrated that 61% of all data breaches are caused by compromised credentials. (Source: 1Kosmos) The catch that robust identity verification alone does not guarantee future authentication, calls for FIDO (Fast Identity Online). It is backed by an industry-leading organization 1Kosmos, which provides solutions for Identity Based Authentication. FIDO uses cryptography in the form of a public and private key to authenticate a user. With FIDO2 authentication, employees can authenticate into corporate systems and applications using their personal devices. This eliminates the need for conventional passwords and reduces the likelihood of security vulnerabilities resulting due to password-related attacks. With FIDO2, the user's keys are stored on their devices and not the service provider's server and thus proves to be less vulnerable to identity theft and phishing attempts. This is where the password to cryptographic passkeys adoption comes into picture. BlockID Workforce by 1Kosmos implements password-less authentication using FIDO, and has thus become a necessity, adopting self-service identity verification serving as a credential service provider. The ‘Identity Proofing’ together with ‘Passwordless Authentication’ results in a seamless user experience addressing credential theft, eliminating unauthorized users logging in corporate IT network and thus preventing data breaches, financial fraud, and ransomware.

Read More
Network Threat Detection, Platform Security, Software Security

Digital Defense 2023: Top Network Security Trends for Businesses

Article | June 28, 2023

Discover the significance of data protection in today's vulnerable world. Gain insights into the far-reaching impacts of data loss and the importance of proactive data security practices for businesses. Understanding Data Protection’s Significance in an Ever-Vulnerable World In today's highly competitive business landscape, organizations must recognize the immense value of their data resources and prioritize implementing robust data protection measures. Safeguarding data from external threats and internal vulnerabilities is paramount to ensuring businesses' smooth and secure operations. In an era of increasingly complex IT environments, data protection becomes an increasingly challenging endeavor, necessitating organizations to maintain a vigilant stance in safeguarding their critical information. According to Ponemon Institute statistics, 77% of companies are woefully ill-prepared and planned when it comes to thwarting an attack or a data breach. Protecting sensitive data, such as intellectual property, personally identifiable information, and financial records, poses a significant challenge for organizations. The modern workplace, characterized by extensive data collaboration across networks, devices, and applications, further amplifies the risk of data security incidents. Furthermore, limited resources often hinder organizations from keeping pace with the ever-growing array of data security risks. However, as data volumes continue to expand, the escalating concerns surrounding data protection highlight the severe consequences organizations face in terms of financial loss, reputational damage, and legal repercussions resulting from data breaches. To mitigate these risks, they must adopt a proactive approach to data protection. This encompasses the implementation of robust security protocols, using encryption technologies, conducting regular security audits, and providing ongoing employee training on data security best practices. This proactive approach enables businesses to operate with greater confidence, trust, and resilience. It is important to note that organizations must view data protection as an essential aspect of their overall business strategy and continually adapt and improve their data security practices. Only by protecting their data can organizations maintain a competitive edge, preserve customer trust, and uphold their reputation as reliable and secure entities in the marketplace. The Far-Reaching Impacts of Data Loss Data protection is a critical concern that applies to organizations of all sizes, and falling into the trap of thinking it only affects large enterprises can have devastating consequences. In fact, small businesses are often targeted by data theft attempts, as they may have fewer resources and can be more susceptible to attacks. Failing to keep up with data security measures and strategies results in severe repercussions for businesses. It damages their reputation, increase operational downtime, leave sensitive data unprotected, and even attract legal action. With organizations increasingly relying on cloud and online transactions, cyber threats now pose a significant risk to data integrity. Data breaches can lead to the theft of valuable information, which can be sold to other parties or used for fraudulent activities. The financial impact of these breaches and losses is substantial. When a company fails to protect its sensitive information and allows data breaches to occur, it not only incurs financial losses but also experiences a significant blow to its reputation. Dissatisfied customers may take their business elsewhere, resulting in decreased revenue. Communicating a data loss incident to customers, while essential, can also erode trust and lead to discontentment. This can further drive customer churn and harm the business's overall reputation, especially if customer data is compromised. Rebuilding customer relationships in the aftermath of a data loss incident requires significant time and resources, as the consequences can persist for years. Data Loss Prevention: An Essential Ingredient Data loss prevention (DLP) is an integral part of a comprehensive data protection strategy, aiming to prevent unauthorized access, use, or disclosure of sensitive data. A well-implemented DLP system can help organizations proactively safeguard their data, mitigate risks, and avoid the aftermath of data loss incidents. As Alexey Raevsky, CEO, Zecurion rightly stated in an interview with Media7, If any organization has a mature DLP in place, there is no need of combating the aftermath of data loss. A robust DLP system comprises advanced security protocols, encryption technologies, and continuous monitoring mechanisms. These components work together to identify vulnerabilities, prevent data breaches, and address potential threats. The other key advantage of an effective DLP system is establishing and enforcing stringent access controls. This ensures that only authorized individuals can access and manipulate sensitive data, reducing the risk of data breaches caused by internal or external factors. Encryption technologies employed by DLP systems further enhance data protection by securing data at rest and in transit, making it challenging for malicious actors to compromise sensitive information. Navigating Data Protection World with Enterprise DLP ‘Zecurion’ An enterprise DLP system offers a comprehensive solution designed to address organizations' complex data landscapes and security challenges. It provides centralized control and visibility over data across multiple systems, networks, and endpoints within the enterprise. Organizations can effectively manage and protect data throughout its lifecycle, regardless of location or format, by implementing a unified DLP framework. This is where Zecurion becomes essential. It is a next-gen DLP provider that specializes in researching, investigating, and monitoring activities to prevent data loss incidents. Its DLP solution offers various features to enhance data protection and incident response: User Behavior Analytics (UBA) with fast risk-based assessment: This feature provides visibility into employee activities and evaluates them based on parameters such as risk, productivity, policies, and emotional state. The Security Officer can closely monitor high-risk employees while allowing low-risk ones to operate with fewer limitations. Screen Photo Detector: This feature detects attempts to photograph a screen using a smartphone by utilizing webcams. It employs two neural networks to ensure reliable smartphone detection and quickly identifies cybersecurity incidents in a fraction of a second. Investigation Workflow Automation: This module simplifies investigations and streamlines the incident response cycle. It provides a comprehensive view of ongoing tasks, including their statuses, relevant data, assigned personnel, and deadlines. Cybersecurity team members can collaborate, leave comments, discuss progress, and attach supporting documents and incidents for efficient and effective incident resolution. Stand Out from Completion with the Next-Gen DLP Zecurion stands out from its competitors due to its ease of implementation and successful use cases demonstrating its instrumental value. One notable example is its pivotal role in a recent forensic investigation conducted for an oil refinery. The investigation uncovered fraudulent activities by intermediaries selling the refinery's products at inflated prices. Zecurion's DLP solution played a critical role in identifying the involvement of a group of managers, including a C-level executive, who had gone to the extent of forging documents to conceal their actions. A financial and legal audit conducted with the help of Zecurion revealed that the fraudsters' actions had resulted in a loss of over $25 million for the organization. The DLP solution proved invaluable in enabling the refinery to take legal action against the perpetrators and terminate the employment of the three key individuals involved in the scam. The success of Zecurion's DLP solution in this particular use case further establishes its reputation as a trusted and effective solution for safeguarding organizations against data loss and fraudulent behavior. Privacy and Protection: Balance is Crucial It is important to note that while organizations must prioritize data security, balancing security measures and respecting employee privacy and autonomy is equally important. While a robust data security framework is essential and ensures that sensitive information is adequately protected, employees must feel that their personal information is handled with care and that their privacy is respected. This can be achieved through clear and transparent data usage policies, consent-based data collection practices, and strict adherence to data protection regulations. Organizations can create a culture of trust and accountability by establishing these guidelines and practices, instilling confidence among employees that their privacy is valued and protected. Additionally, organizations can foster a culture of data security awareness and education among employees. Regular training and updates on data security best practices can turn employees into proactive participants in maintaining a secure work environment. This not only enhances data security but also cultivates a sense of shared responsibility and accountability among employees. When employees feel that their privacy is respected and they are given the autonomy to perform their duties effectively, they are more likely to adhere to data security protocols and actively contribute to the organization's overall security posture.

Read More
Network Threat Detection

Software Supply Chain Attacks: How Can Code Signing Help?

Article | July 12, 2023

Software supply chain attacks, such as the recent one involving MOVEit Transfer, are a serious issue for modern enterprises. Their dependency on third-party software makes it difficult to successfully vet the security integrity of every product used by enterprises. Software is especially difficult to assess securely, as it can be modified through updates throughout its lifecycle. For threat actors, targeting popular enterprise software tools is a lucrative and time-efficient way to gain access to the systems of a large number of corporate users. Verifying the integrity of software, and using attestation services, is one way to minimize the threat surface. So how can these concepts be leveraged in software? Software integrity (also known as code integrity) refers to the quality of the source code and allows the determination of the safety, security, and reliability of the software. It can mean that the code is unaltered by unauthorized parties, or it can also provide protection against hacks and guarantee privacy. Integrity checking can be relatively complex, but includes, at a minimum (from a security perspective), security features and ensures that security vulnerabilities have been eliminated. It does what it should, can be tested, and is easy to understand and edit, without introducing new errors or flaws. There are code analysis tools that can enable this. Beyond that, the code can be signed through the application of a digital signature to seal that integrity check. This can happen several times during the lifetime of that software: at production, for upgrades and patching, etc. This provides assurance that the software came from the developer and that it has not been changed in an unauthorized manner. This proof of authenticity becomes important in supply chain scenarios, and can be an important tool for brand protection of the developers. Code signing makes use of digital certificates; the signature is cryptographically hashed and packaged in a certificate. This certificate can then be verified by the user of the software through a Public Key Infrastructure (PKI), with a certificate authority validating (or refuting) the applied signature. There are various types of code signing certificates: standard and extended. The latter involves a more complex process and stricter requirements for validation and key management. Software attestation is essentially the other side of that process. It’s a trust mechanism that allows the user to independently validate the integrity asserted by a provider. Attestation might require not just the vendors name, version of the software, and origins of the code, but also other software artifacts, such as statements to the effect that they have followed secure development practices, information on external dependencies used to build it, the build process itself, the test suites that were run, and any security checks passed. Together, these artifacts form the metadata of the software, which then can be independently signed. A PKI can then be leveraged to verify the applied digital signature. There are software attestation standards that can be leveraged, including open ones (in-tot and Binary Authorization being two popular ones). The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is working on a self-attestation form (Secure Software Development Attestation Common Form) for software producers serving the federal government. The form will require them to confirm implementation of specific security practices. This was following the White House’s 2021 Executive Order 14028 and the Office of Management and Budget’s (OMB) M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices.” Digital signatures for code integrity and software attestation will increasingly be in demand, especially as governments on both sides of the Atlantic (in the European Union and the United States) are pushing for policy and regulation on mandatory Software Bills of Materials (SBOMs). The goal is to make software developers and device manufacturers accountable for the components that make up their products. An SBOM will have to list known vulnerabilities associated with each component (open source and third party), pushing security rights to the forefront of product development. This visibility will allow for product development teams, DevOps, and implementers to address vulnerabilities and thereby strengthen security. SBOMs will likely form part of the software’s metadata, so signing will have a role to play here. In short, code signing and software attestation can both confer a level of security that can minimize the threat of a supply chain attack. It’s important to keep in mind, however, that they won’t address all issues, and will not be 100% fool-proof either. Of course, threat actors know this, and many are already targeting the code signing process in order to inject malicious code. This requires threat actors to compromise development platforms where code signing takes place. Ultimately, the use of digital signatures, from creation to management, is another aspect that will need to be secured from a developer perspective. DevSecOps will also have an important role to play here in order to avoid such malicious tactics, thereby providing a holistic security context for using digital signatures. But there is no doubt that digital signatures are a key technology for code integrity and software attestation, and will have a positive impact on thwarting the progress of supply chain attacks, if used widely. Sources: CISA WH EO 14028 OMB

Read More
MORE ARTICLES

Spotlight

Softcat plc

Softcat is a market-leading IT infrastructure reseller, delivering solutions across eight solution areas: asset management, business intelligence & analytics, collaboration, commodity sourcing, digital workspace, datacentre, networking & security, software licensing and IT services to organisations in both private companies and public sector organisations in the UK.

Related News

Platform Security

SentinelOne Launches RemoteOps Forensics for Faster Incident Response

SentinelOne | September 18, 2023

SentinelOne, a global leader in autonomous cybersecurity, is addressing the pressing need for rapid and effective responses to the escalating wave of cyber breaches. Today, the company announced the launch of Singularity RemoteOps Forensics, a pioneering digital forensics product designed to streamline and accelerate incident response readiness. This innovative solution promises to empower organizations of all sizes, ushering in a new era of efficient and scalable investigation and response capabilities in the face of evolving cybersecurity challenges. Integrated seamlessly with the SentinelOne Singularity Platform and as an add-on to Sentinel One's Endpoint and Cloud Workload Security solutions, RemoteOps Forensics offers a rapid, adaptable digital forensics and incident response solution. Security teams can leverage this tool to enhance efficiency by optimizing resources and accelerating Mean Time to Resolution. With the capability for targeted investigations on various assets, including endpoints and server workloads, it enables conditional trigger-based evidence collection. This automation efficiently gathers evidence, such as process data, ports, service listings, MFT, Amcache, JumpLists, and memory dumps, orchestrating them in under a minute. Consolidating evidence into the Singularity Security DataLake allows for the correlation of SentinelOne and partner data with forensics data in a unified search, facilitating a comprehensive view of attacks, rapid root cause identification, and risk mitigation. Furthermore, it provides the ability to analyze collected evidence alongside Endpoint Detection and Response (EDR) data within a single console, empowering proactive defense against future threats. The integration and analysis of this combined data unveil concealed indicators of compromise, detect advanced attack patterns, and offer insights into threat actors' tactics, techniques, and procedures. RemoteOps Forensics is a cost-effective and resource-efficient solution that seamlessly integrates with the SentinelOne agent. This integration alleviates the necessity of deploying and provisioning multiple tools throughout the investigative process, resulting in significant time and resource savings for organizations. In addition, this innovative solution prioritizes the maintenance of forensic integrity by minimizing changes made to the disk, and it leverages SentinelOne's anti-tampering and metadata collection capabilities to safeguard data integrity. In doing so, it streamlines investigations and upholds the highest standards of forensic rigor, reinforcing organizations' cybersecurity defenses with a comprehensive and efficient approach. Jane Wong, Senior Vice President of Products and Strategy at SentinelOne, said, As timelines for reporting and responding to breaches shrink, it is imperative that the security teams have advanced forensics capabilities that can make investigations faster and more efficient, and with Singularity RemoteOps Forensics, the team is delivering them. [Source – Business Wire] SentinelOne's new forensic capabilities help develop incident response by enabling security teams to conduct thorough investigations more quickly, Jane also mentioned eliminating the requirement for specialized expertise or additional tools. About SentinelOne SentinelOne is a leading provider of autonomous cybersecurity solutions. With its identified Singularity Platform, the company excels at detecting, preventing, and responding swiftly to cyber threats. SentinelOne enables businesses to protect their endpoints, cloud workloads, containers, and identities, as well as their mobile and network-connected devices, with unparalleled speed, accuracy, and ease of use. With a formidable clientele comprising over 11,000 customers, SentinelOne has proven itself as the trusted guardian of a secure digital future.

Read More

Data Security, Platform Security

Laminar Expands Data Security Platform with Support for Microsoft OneDrive and Google Drive

GlobeNewswire | August 31, 2023

Laminar, the leading data security posture management (DSPM) company, recently acquired by Rubrik, the Zero Trust Data Security™ Company, today announced that it has added support for Microsoft OneDrive and Google Drive. Customers can now use Laminar to continually discover overexposed and unprotected sensitive data in OneDrive and Google Drive, enabling proactive risk remediation and data leak detection. With this expanded support, organizations can safeguard sensitive data across their entire digital landscape, including major cloud service providers Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure as well as Snowflake, BigQuery, and other SaaS applications. As organizations increasingly leverage cloud file-sharing services like Google Drive and OneDrive for seamless data sharing and storage, the potential risks associated with data breaches, unauthorized access, and compliance violations have grown significantly. Data security and governance teams’ limited visibility into the contents of these files can lead to unprotected sensitive data. Additionally, unintentional file sharing and incorrect permissions can lead to oversharing internally and externally. To address these challenges, the Laminar Data Security Platform takes an agnostic approach to data security; discovering, classifying, and securing sensitive data as it moves across an organization’s digital environment, including collaborative cloud-based services. Laminar provides secure scanning, ensuring data is not removed from the customer environment. With the platform, data security and governance teams can see and secure enterprise data consistently across the entire digital landscape. "Today’s businesses are powered by cloud file-sharing services, which enable easy and rapid collaboration. This is why it is so critical to have a comprehensive approach to data security, so as to not leave these important files unprotected. With the integration of Microsoft OneDrive and Google Drive support into the Laminar Data Security Platform, we believe this is a giant step towards solving this sensitive data security challenge," said Amit Shaked, CEO and co-founder at Laminar. "We recognize that data security is a collective responsibility, encompassing every individual within an organization. Laminar is now positioned to provide an agile platform that safeguards sensitive information, no matter where it resides or whether it's utilized by developers, data scientists, or any employee across an organization." The news follows the acquisition of Laminar by Rubrik, the Zero Trust Data Security Company™. Together, Rubrik and Laminar create the industry’s first complete cyber resilience offering of its kind bringing together cyber recovery and posture across enterprise, cloud, and SaaS. About Laminar Laminar, a Rubrik company, combines cloud-native design with deep security expertise to provide the visibility and control organizations need to protect their most sensitive data. The Laminar Data Security Platform continuously discovers and classifies cloud data, structured and unstructured, across managed and self-hosted data stores, including unknown shadow data, without the data ever leaving your environment. It analyzes access, usage patterns, and security posture, and provides actionable, guided remediation for data security risk. Together, Rubrik and Laminar enable organizations to be even more proactive in the fight against cyberattacks and provide businesses with a complete cyber resilience solution. About Rubrik Rubrik is a cybersecurity company. We are the pioneer in Zero Trust Data Security™. Companies around the world rely on Rubrik for business resilience against cyber attacks, malicious insiders, and operational disruptions. Rubrik Security Cloud, powered by machine intelligence, enables our customers to secure data across their enterprise, cloud, and SaaS applications. We automatically protect data from cyber attacks, continuously monitor data risks, and quickly recover data and applications.

Read More

Software Security

Cyolo Unveils Key Insights into OT Cybersecurity Threat Landscape from KuppingerCole and Releases Cyolo 4.3 for Enhanced Security

Business Wire | September 27, 2023

Today, Cyolo, provider of the fastest and most secure zero-trust access and connectivity solution for hybrid organizations with IT and OT, in partnership with KuppingerCole, released an industry analysis focused on zero trust and remote access for operational technology (OT) environments. The analysis reveals key insights about the OT cybersecurity threat landscape, outlines high-level security architecture for OT, critical infrastructure systems (CIS) and industrial control systems (ICS), and evaluates key requirements of security regulations and frameworks. OT environments experience the same kinds of threats as enterprise IT – including ransomware, account takeovers, APTs, and Supply Chains as vectors – while experiencing expanded OT-specific threats. While traditional IT security tools may be adapted, developing robust security architectures for OT environments is inherently complex compared to their IT counterparts. Its unique nature, from equipment and software to communication protocols requires dedicated OT security solutions. Cyolo can help organizations with OT infrastructure to define and manage access control to those complex environments, said John Tolbert, Lead Analyst at KuppingerCole. Overall key insights include: OT Threat Landscape. Heightened geopolitical factors have intensified attacks on OT and ICS, posing significant consequences ranging from operational disruptions and service denial to financial repercussions and potential harm to human well-being. Core Cybersecurity Regulations. The risks and consequences of cyber-attacks against critical infrastructure advanced regulations globally mandating secure architectures and technical controls. KRITIS and the follow-on IT Security Act 2.0 are related examples of such regulations, as well as the NIST Cybersecurity Framework. OT Security Architectures and Key Functionalities. There are eight areas of functionality that are central to effective OT security architectures. Cybersecurity architectures for OT must address asset discovery, access control, IT security tool integration, detection and response capabilities, and OT protocol level threats. As the analysis breaks down, within critical infrastructure interruptions and downtime are not an option. To address the increasing need for secure access in OT environments, Cyolo introduced Cyolo 4.3, which expands key capabilities with more layers of security and making the product easier than ever to use for both administrators and end users in the industrial space. With Cyolo 4.3, industrial organizations will be able to extend their multi-factor authentication (MFA) across environments through an integration with Duo Security to support their physical tokens as required. Additionally, the company has implemented another layer of security for file transfer within the OT/ICS environment, through query anti-virus software to scan files before they are delivered to their destination. Cyolo is also adapting for further usability, allowing teams to securely invite external users by generating a secure one-time password; and import groups from existing IdPs, using SCIM. “Ensuring the security of critical infrastructure and industrial processes has become increasingly critical as organizations unite their IT and OT systems. This convergence has expanded the OT threat landscape and introduced significant cybersecurity challenges, as the once-isolated OT networks are now vulnerable to the same threats that have targeted IT networks for years” said Joe O'Donnell, Vice President ICS/OT of Cyolo. “With Cyolo 4.3, industrial entities can confidently navigate the complexities of the modern threat landscape and fortify their defenses against evolving cyber threats.” The announcement of Cyolo 4.3 highlights the company’s commitment to advancing zero-trust capabilities and it comes on the heels of Cyolo being listed as a Representative Vendor in the 2023 Gartner® “Market Guide for Zero Trust Network Access” report for the second consecutive year and recognized by Frost & Sullivan with the 2023 North American New Product Innovation Award for Secure Remote Access to Operational Infrastructure and Industrial Control Systems (OT/ICS). As the threats to critical infrastructure continue to evolve, Cyolo zero-trust access solution continues to provide the utmost protection and ease of use. To learn more about Cyolo 4.3, visit here. Access the report for a full view of the industry here. Register here to attend the joint webinar from Cyolo and KuppingerCole on how to achieve secure remote access for OT environments, to be held on Tuesday, October 10 at 7 a.m. PT. About Cyolo Cyolo helps hybrid organizations in the IT and OT spaces to stay safe, secure and productive in an era of distributed workforces and unprecedented cyberthreats. Cyolo’s next-generation zero-trust access solution enables all users, including employees, third parties as well as remote and on-site workers, to connect to their working environments seamlessly and securely via modern identity-based access. Providing one unified solution that integrates with the existing tech stack and deploys easily in the cloud, on-premises or in a hybrid model, Cyolo empowers the global workforce to securely access anything from anywhere.

Read More

Platform Security

SentinelOne Launches RemoteOps Forensics for Faster Incident Response

SentinelOne | September 18, 2023

SentinelOne, a global leader in autonomous cybersecurity, is addressing the pressing need for rapid and effective responses to the escalating wave of cyber breaches. Today, the company announced the launch of Singularity RemoteOps Forensics, a pioneering digital forensics product designed to streamline and accelerate incident response readiness. This innovative solution promises to empower organizations of all sizes, ushering in a new era of efficient and scalable investigation and response capabilities in the face of evolving cybersecurity challenges. Integrated seamlessly with the SentinelOne Singularity Platform and as an add-on to Sentinel One's Endpoint and Cloud Workload Security solutions, RemoteOps Forensics offers a rapid, adaptable digital forensics and incident response solution. Security teams can leverage this tool to enhance efficiency by optimizing resources and accelerating Mean Time to Resolution. With the capability for targeted investigations on various assets, including endpoints and server workloads, it enables conditional trigger-based evidence collection. This automation efficiently gathers evidence, such as process data, ports, service listings, MFT, Amcache, JumpLists, and memory dumps, orchestrating them in under a minute. Consolidating evidence into the Singularity Security DataLake allows for the correlation of SentinelOne and partner data with forensics data in a unified search, facilitating a comprehensive view of attacks, rapid root cause identification, and risk mitigation. Furthermore, it provides the ability to analyze collected evidence alongside Endpoint Detection and Response (EDR) data within a single console, empowering proactive defense against future threats. The integration and analysis of this combined data unveil concealed indicators of compromise, detect advanced attack patterns, and offer insights into threat actors' tactics, techniques, and procedures. RemoteOps Forensics is a cost-effective and resource-efficient solution that seamlessly integrates with the SentinelOne agent. This integration alleviates the necessity of deploying and provisioning multiple tools throughout the investigative process, resulting in significant time and resource savings for organizations. In addition, this innovative solution prioritizes the maintenance of forensic integrity by minimizing changes made to the disk, and it leverages SentinelOne's anti-tampering and metadata collection capabilities to safeguard data integrity. In doing so, it streamlines investigations and upholds the highest standards of forensic rigor, reinforcing organizations' cybersecurity defenses with a comprehensive and efficient approach. Jane Wong, Senior Vice President of Products and Strategy at SentinelOne, said, As timelines for reporting and responding to breaches shrink, it is imperative that the security teams have advanced forensics capabilities that can make investigations faster and more efficient, and with Singularity RemoteOps Forensics, the team is delivering them. [Source – Business Wire] SentinelOne's new forensic capabilities help develop incident response by enabling security teams to conduct thorough investigations more quickly, Jane also mentioned eliminating the requirement for specialized expertise or additional tools. About SentinelOne SentinelOne is a leading provider of autonomous cybersecurity solutions. With its identified Singularity Platform, the company excels at detecting, preventing, and responding swiftly to cyber threats. SentinelOne enables businesses to protect their endpoints, cloud workloads, containers, and identities, as well as their mobile and network-connected devices, with unparalleled speed, accuracy, and ease of use. With a formidable clientele comprising over 11,000 customers, SentinelOne has proven itself as the trusted guardian of a secure digital future.

Read More

Data Security, Platform Security

Laminar Expands Data Security Platform with Support for Microsoft OneDrive and Google Drive

GlobeNewswire | August 31, 2023

Laminar, the leading data security posture management (DSPM) company, recently acquired by Rubrik, the Zero Trust Data Security™ Company, today announced that it has added support for Microsoft OneDrive and Google Drive. Customers can now use Laminar to continually discover overexposed and unprotected sensitive data in OneDrive and Google Drive, enabling proactive risk remediation and data leak detection. With this expanded support, organizations can safeguard sensitive data across their entire digital landscape, including major cloud service providers Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure as well as Snowflake, BigQuery, and other SaaS applications. As organizations increasingly leverage cloud file-sharing services like Google Drive and OneDrive for seamless data sharing and storage, the potential risks associated with data breaches, unauthorized access, and compliance violations have grown significantly. Data security and governance teams’ limited visibility into the contents of these files can lead to unprotected sensitive data. Additionally, unintentional file sharing and incorrect permissions can lead to oversharing internally and externally. To address these challenges, the Laminar Data Security Platform takes an agnostic approach to data security; discovering, classifying, and securing sensitive data as it moves across an organization’s digital environment, including collaborative cloud-based services. Laminar provides secure scanning, ensuring data is not removed from the customer environment. With the platform, data security and governance teams can see and secure enterprise data consistently across the entire digital landscape. "Today’s businesses are powered by cloud file-sharing services, which enable easy and rapid collaboration. This is why it is so critical to have a comprehensive approach to data security, so as to not leave these important files unprotected. With the integration of Microsoft OneDrive and Google Drive support into the Laminar Data Security Platform, we believe this is a giant step towards solving this sensitive data security challenge," said Amit Shaked, CEO and co-founder at Laminar. "We recognize that data security is a collective responsibility, encompassing every individual within an organization. Laminar is now positioned to provide an agile platform that safeguards sensitive information, no matter where it resides or whether it's utilized by developers, data scientists, or any employee across an organization." The news follows the acquisition of Laminar by Rubrik, the Zero Trust Data Security Company™. Together, Rubrik and Laminar create the industry’s first complete cyber resilience offering of its kind bringing together cyber recovery and posture across enterprise, cloud, and SaaS. About Laminar Laminar, a Rubrik company, combines cloud-native design with deep security expertise to provide the visibility and control organizations need to protect their most sensitive data. The Laminar Data Security Platform continuously discovers and classifies cloud data, structured and unstructured, across managed and self-hosted data stores, including unknown shadow data, without the data ever leaving your environment. It analyzes access, usage patterns, and security posture, and provides actionable, guided remediation for data security risk. Together, Rubrik and Laminar enable organizations to be even more proactive in the fight against cyberattacks and provide businesses with a complete cyber resilience solution. About Rubrik Rubrik is a cybersecurity company. We are the pioneer in Zero Trust Data Security™. Companies around the world rely on Rubrik for business resilience against cyber attacks, malicious insiders, and operational disruptions. Rubrik Security Cloud, powered by machine intelligence, enables our customers to secure data across their enterprise, cloud, and SaaS applications. We automatically protect data from cyber attacks, continuously monitor data risks, and quickly recover data and applications.

Read More

Software Security

Cyolo Unveils Key Insights into OT Cybersecurity Threat Landscape from KuppingerCole and Releases Cyolo 4.3 for Enhanced Security

Business Wire | September 27, 2023

Today, Cyolo, provider of the fastest and most secure zero-trust access and connectivity solution for hybrid organizations with IT and OT, in partnership with KuppingerCole, released an industry analysis focused on zero trust and remote access for operational technology (OT) environments. The analysis reveals key insights about the OT cybersecurity threat landscape, outlines high-level security architecture for OT, critical infrastructure systems (CIS) and industrial control systems (ICS), and evaluates key requirements of security regulations and frameworks. OT environments experience the same kinds of threats as enterprise IT – including ransomware, account takeovers, APTs, and Supply Chains as vectors – while experiencing expanded OT-specific threats. While traditional IT security tools may be adapted, developing robust security architectures for OT environments is inherently complex compared to their IT counterparts. Its unique nature, from equipment and software to communication protocols requires dedicated OT security solutions. Cyolo can help organizations with OT infrastructure to define and manage access control to those complex environments, said John Tolbert, Lead Analyst at KuppingerCole. Overall key insights include: OT Threat Landscape. Heightened geopolitical factors have intensified attacks on OT and ICS, posing significant consequences ranging from operational disruptions and service denial to financial repercussions and potential harm to human well-being. Core Cybersecurity Regulations. The risks and consequences of cyber-attacks against critical infrastructure advanced regulations globally mandating secure architectures and technical controls. KRITIS and the follow-on IT Security Act 2.0 are related examples of such regulations, as well as the NIST Cybersecurity Framework. OT Security Architectures and Key Functionalities. There are eight areas of functionality that are central to effective OT security architectures. Cybersecurity architectures for OT must address asset discovery, access control, IT security tool integration, detection and response capabilities, and OT protocol level threats. As the analysis breaks down, within critical infrastructure interruptions and downtime are not an option. To address the increasing need for secure access in OT environments, Cyolo introduced Cyolo 4.3, which expands key capabilities with more layers of security and making the product easier than ever to use for both administrators and end users in the industrial space. With Cyolo 4.3, industrial organizations will be able to extend their multi-factor authentication (MFA) across environments through an integration with Duo Security to support their physical tokens as required. Additionally, the company has implemented another layer of security for file transfer within the OT/ICS environment, through query anti-virus software to scan files before they are delivered to their destination. Cyolo is also adapting for further usability, allowing teams to securely invite external users by generating a secure one-time password; and import groups from existing IdPs, using SCIM. “Ensuring the security of critical infrastructure and industrial processes has become increasingly critical as organizations unite their IT and OT systems. This convergence has expanded the OT threat landscape and introduced significant cybersecurity challenges, as the once-isolated OT networks are now vulnerable to the same threats that have targeted IT networks for years” said Joe O'Donnell, Vice President ICS/OT of Cyolo. “With Cyolo 4.3, industrial entities can confidently navigate the complexities of the modern threat landscape and fortify their defenses against evolving cyber threats.” The announcement of Cyolo 4.3 highlights the company’s commitment to advancing zero-trust capabilities and it comes on the heels of Cyolo being listed as a Representative Vendor in the 2023 Gartner® “Market Guide for Zero Trust Network Access” report for the second consecutive year and recognized by Frost & Sullivan with the 2023 North American New Product Innovation Award for Secure Remote Access to Operational Infrastructure and Industrial Control Systems (OT/ICS). As the threats to critical infrastructure continue to evolve, Cyolo zero-trust access solution continues to provide the utmost protection and ease of use. To learn more about Cyolo 4.3, visit here. Access the report for a full view of the industry here. Register here to attend the joint webinar from Cyolo and KuppingerCole on how to achieve secure remote access for OT environments, to be held on Tuesday, October 10 at 7 a.m. PT. About Cyolo Cyolo helps hybrid organizations in the IT and OT spaces to stay safe, secure and productive in an era of distributed workforces and unprecedented cyberthreats. Cyolo’s next-generation zero-trust access solution enables all users, including employees, third parties as well as remote and on-site workers, to connect to their working environments seamlessly and securely via modern identity-based access. Providing one unified solution that integrates with the existing tech stack and deploys easily in the cloud, on-premises or in a hybrid model, Cyolo empowers the global workforce to securely access anything from anywhere.

Read More

Events