Defeat Evasive Malware | VMRay

| November 3, 2017

article image
Sandboxes are automated behavior-based malware analysis systems that are at the core of most network security solutions today. The deployment of sandboxes to detect advanced threats began over a decade ago.

Spotlight

LogRhythm

LogRhythm, a leader in security intelligence and analytics, empowers organizations around the globe to rapidly detect, respond to and neutralize damaging cyber threats. The company’s award-winning platform unifies next-generation SIEM, log management, network and endpoint forensics and advanced security analytics. In addition to protecting customers from the risks associated with cyber threats, LogRhythm provides innovative compliance automation and assurance, and enhanced IT intelligence. LogRhythm is consistently recognized as a market leader. The company has been positioned as a Leader in Gartner’s SIEM Magic Quadrant report for five consecutive years, named a “Champion” in Info-Tech Research Group’s 2014–15 SIEM Vendor Landscape report and ranked Best-In-Class (No. 1) in DCIG’s 2014–15 SIEM Appliance Buyer’s Guide. In addition, LogRhythm has received Frost & Sullivan’s SIEM Global Market Penetration Leadership Award and been named a Top Workplace by the Denver Post. LogRhythm is

OTHER ARTICLES

Top Three Cybersecurity Threats You Should Mitigate Before It Is Too Late

Article | December 15, 2020

There are three significant and disruptive cybersecurity threats that are catching organizations of all types and sizes by surprise: Ransomware; Cloud misconfigurations; and Supply chain backdoors. Let me explain with recent examples and guide you on what you can do to avoid making other’s mistakes and falling victim to the threats. Let’s start with ransomware. It is one of the most disruptive risks facing your organization today. Why? Because it can literally bring your operations, no matter who you are, to a standstill and inflict significant cost, pain and suffering. Just look at the recent example of one organization. It was infected with ransomware, and IT systems were shut down for several weeks, bringing operations to a standstill. It had to gradually re-start systems over several more weeks. It estimates it will cost around $95 million from lost sales, recovery and remediation, impacting profitability. Also, it announced it will not be able to attain its growth plans for the year. Take another recent example. A three-hospital system was infected and IT systems were shut down and it could not accept any incoming patients for several days. It had to operate using paper, until gradually the IT systems were re-started over several days. Fortunately, in this case, the incoming patients turned away did not suffer any loss of life and were able to be diverted to other hospitals timely, but it could have been tragic. No organization is immune to ransomware and it can rear its ugly head anytime and inflict severe pain. There are many variants and each can be tweaked easily by the attackers to evade the defense. The Ryuk ransomware is an example of one that has already inflicted significant pain to hundreds of organizations this year in the U.S. and across the globe. Previously, the SamSam ransomware attacked a variety of organizations in the U.S. and Canada, and provided over $6 million in ransom payments and inflicted over $30 million in losses. Prior to that, NotPetya ransomware rapidly inflicted hundreds of organizations in various parts of the world, and caused over $10 billion in damages. The attackers are seeing that with ransomware it is quicker and easier to make the intrusion, and encrypt some of the data than try to exfiltrate all of it. They are asking themselves, why take all the time and trouble to look for all of the data and try to steal it, when only some critical systems and data can be locked up, until a ransom is paid? They are seeing that with ransomware there will be immediate adverse impact since the victim will not be able to access critical data and systems, and will not be able to operate. So, there is high probability the ransom will be paid to stop the pain and suffering, especially if the victim has cyber insurance in place. The organization is likely to use the insurance policy to pay the ransom, rather than continue to have its operations disrupted or shut down. They are also seeing that while most organizations have put in place various controls to prevent and detect data theft, they have not placed an equal weight to preventing and detecting ransomware. Most organizations have a lot of data and given all of the data thefts that have occurred and continue to occur and reported in the press, the bias has been to focus on data theft. But ransomware risk cannot be ignored or approached less seriously. Imagine that you are infected with ransomware and your people cannot access documents, files or systems, and operate. All critical files and systems are locked out from the ransomware encryption, and a ransom payment is demanded by the hacker for the keys to unlock the encryption. What if, it will take you days, weeks or months to recover? What impact would it have on your organization? You may think that you will be able to recover quickly from back up files and systems, but are you sure? The new ransomware variants are devised to hunt down and delete or encrypt backup files and systems also, and in some cases, first, before encrypting rest of the files and systems. The organization that was recently infected that estimates $95 million in financial impact from the ransomware thought it had the risk under control, until it was hit with the ransomware and realized it was not prepared to manage the risk. Now, let’s move to the threat from cloud misconfigurations. You are most probably in the cloud completely or partially. Whether you have completely outsourced your infrastructure and services to a cloud provider or are utilizing one partially, remember, ultimately, you own the cybersecurity and that you are responsible for security in the cloud, while the cloud provider is responsible for security of the cloud. While the cloud provider will provide perimeter security, you are responsible for security of your data, IP and other assets in the cloud, and are equally susceptible to attackers in the cloud as you are on the premises. Even if any of the “big six” cloud providers, such as Amazon Web Services or Microsoft Azure or others, provide the cybersecurity, attackers can exploit weak links in the chain, break in and steal data or cause other harm. A common weak link in the chain are misconfigurations of the various systems that the cloud provider makes available as part of its service. You are responsible for all of the configurations, not the cloud provider. So, if your team does not take the time to fully understand all of the configurations that are necessary and complete them timely, security holes will arise and remain open for the attackers to exploit. Just look at the recent example of an organization that fell victim where the data of over 100 million customers was stolen. This organization was using one of the “big six” cloud providers, but missed making all of the necessary configurations. A former employee of the cloud provider, who was familiar with the systems and configurations, discovered a misconfiguration in a web application firewall and exploited it to break in. The attacker then was able to query a metadata service to obtain keys and tokens, which allowed the attacker to query and copy storage object data and eventually exfiltrate it. This was a case where configuration errors in a web application firewall coupled with unrestricted metadata service access and other errors handed the attacker the keys to the kingdom for the theft of 100 million customers data. Other common cloud misconfigurations that create opportunities for attackers to exploit include: Unrestricted in bound access on uncommon ports Unrestricted outbound access Unrestricted access to non-http/https ports Unrestricted metadata service requests Inactivate monitoring of keys and tokens You may think that you do not have any misconfigurations in your cloud environment, but how do you know? The organization that recently lost 100 million customers data thought it had strong security in its cloud infrastructure, until it was hit with the data theft and realized it was not prepared to manage the risk. Now, let’s move to the threat from supply chain backdoors. No matter what type of organization you are or your size, you most probably have a supply chain, comprised of independent contractors, vendors or partners. Each of these could be the weakest link in the chain. In other words, the attackers may find that one of your suppliers may be easier to break into first because of weaker cybersecurity and may have privileged access to your organization, given their role and responsibilities. So why not first attack the weaker supplier, steal their privileged user credentials and use it to break into your organization and eventually attain the ultimate objective, steal data or commit other harm? Or they may find that one of your suppliers has part of your data in order to provide the outsourced service, so they can steal the data simply by breaking into the supplier with the weaker cybersecurity, so no need to attack you directly. There are many examples of supply chain risk, such as with a government agency, where the credentials of a background check vendor were first stolen to access the agency’s systems, then to move laterally and find other unprotected privileged users credentials to access databases and steal data of 21.5 million individuals, including fingerprints data of 5.6 million individuals. But just look at the recent example of an organization that had outsourced billing and collections to a supplier. This is a case where the attackers did not have to attack directly. In this case, attackers broke into the supplier and injected malicious code into the payments webpages managed by the supplier and stole credit card, banking, medical and other personal information, such as social security numbers, of 11.9 million consumers. The attackers had access to the supplier’s system for eight months, during which it skimmed the data being input by consumers on the payments webpages. So, while your cybersecurity may be in good shape, the weakest link in the chain may be one of your suppliers, who may unwittingly provide the attackers the backdoor into your organization or to your data or IP. So, ransomware, cloud misconfigurations and supply chain backdoors are three significant and disruptive threats facing your organization today that you should mitigate. What c

Read More

Cybersecurity Product Marketing Strategy

Article | July 20, 2021

People dealing in cybersecurity knows that it is a challenging market. A specifically designed business model is not there in cybersecurity on which you can market products and services. Over the past years, the B2B Cyber Security industry has witnessed immense growth and will continue in the future. The growth can be attributed to many aspects, including growing instances of cybercrime and the emergence of interconnected devices in the IoT revolution. New security solutions are coming into the market every day. As a result, the demand for B2B digital marketersis also on the rise to keep with the unexpected growth in products, services, and competitors. To stand out from the competition, you need a sound cybersecurity product marketing strategy leveraging all digital channels. You have to focus on various productive marketing tactics to reach, engage, and nurture all your potential clients as an ongoing process with all the relevant information about business and products. For example, the B2B cloud-security service provider,IBM Security, uses paid ad campaigns and webinars, which are excellent cybersecurity product marketing strategies. They could maketheir expertise and solutions stand out from the rest of the crowd with this excellent strategy. Reading further will give you insights on how to market your cybersecurity products effectively to generate leads and boost profit. Make your Marketing Effective with Unique Content To demonstrate the effectiveness of your solutions and the significance of your cybersecurity, your company should ensure your content has real-world examples. This will make your content more influential. Apart from being data-driven and comprehensive, your content also should be unique. Credibility can be surly built up by revamping your content strategy. You can create educational content that clearly shows how your product can help solve a real-life cybersecurity attack. Then, you may back it up with independent industry reviews,case studies, etc. Instead of reusing the same content, experiment with new content that describes and solves different cyber threats and relates it with your products and solutions. The following types of content can be a practical part of your cybersecurity product marketing strategyat different points in the buyer’s journey: Blogs In every stage of the cybersecurity buyer’s journey, blogs are great for attracting prospects. Developing some evergreen and universally relevant content will be highly useful. Describing topics about cybersecurity in your blogs, such as phishing, DNS encryption, will be a great thing for clients who have just started their research and want to learn more, starting from basics. Case Studies As CNI says, the mostcritical tactic for B2B companies iscase studies. These are exemplary and the best to engage leads who are already aware of their problems and know what solutions can solve them. Videos According to HubSpot, at least once a week, 75% of executives watch work-related videos on business websites. Additionally, 59% of executives prefer watching a video over reading text. So, it’s the best strategy to include videos in your cybersecurity product marketing efforts. Explanatory videos will work the best to tell your potential cybersecurity product clients what your cybersecurity offerings are and why they could be the most valuable solution for their situations. Additionally, when you’re trying to target C-level executives, this can be a beneficial tactic. This is because they need more education regarding this. You may also utilize various statistics on cyber-attacks, loss due to cyber-attacks, recovery expenses, and the value of cybersecurity solutions. Additionally, again, providing practical and real-life examples in your video will help you make the statistics more relevant and inject a sense of urgency into the minds of your potential clients. Effective Email Marketing Strategy Education and awareness are significant barriers to selling your solutions. Due to these barriers, it can often take a reasonable amount of time for a potential lead to reach the point where they can contact a B2B sales representative or request a demo. Meanwhile, it is your time to have a tactic to nurture these leads to move them to the next level of the sales funnel. It can be an effective email marketing strategy. It is a strategic and effective way to connectto those potential leads who have not decided to purchase your products. However, with many emails in your potential client's inboxes, they may unsubscribe or delete your email if they don’t find your email content valuable and worthwhile. So make sure to analyze often and monitor your email marketing campaigns. Content, subject lines, images, and copy in your email should be practical and attractive regarding open and click-through rates. Flooding your prospects’ inbox with emails about various cyber threats they face may result in losing their interest in your emails as they may have desensitization towards your emails. Staying connected with your prospects through email marketing is an effective cybersecurityproduct marketing strategy. First, however, be mindful of how many emails you are sending to your prospects. Interactive Sessions The tremendous interactive session you can have online today with your potential client is webinars. It is an excellent way for you in the cybersecurity domain to connect with your potential leads. The interactive element is a vital part of a webinar. Q&A session at the end of each webinar makes it more interactive where the participants can ask you questions and raise queries about the topic and your services. Accumulating all those questions asked by the attendees can be an excellent starting point for creating new content to address your audience's challenges. These attendees now are interested in learning more about your products and services and the threats it protects against. They also might have engaged in some research. This means they will do further in-depth research and be more engaged with your presentation topics. Thus, it is a valuable opportunity to demonstrate other helpful content or have a CTA for demo sign-ups. You can respond to the queries of the participants in a follow-up, even if your webinar is a pre-recorded one. This effective cybersecurity product marketing tactic will help you accumulate many potential clients and take them to the next stage of the salesfunnel. Paid Campaigns Two significant goals can be accomplished through B2B paid campaigns: • They help you get prospects to arrive at your demo request landing page • They amplify your content marketing efforts Content marketing amplification is possible through paid campaigns. Most cybersecurity marketers think that you do not mix inbound marketing and paid campaigns. But the truth is when you combine both, you end up with a very effective and powerful campaign. Once you start a paid campaign with your content, you will notice more excellent and quick results and get the best out of your developed content. Getting prospects to request a demo is a major goal for any B2B cybersecurity marketer. Cybersecuirty paid marketing campaigns, as a successful cybersecurity product marketing strategy, help the marketer to accelerate the process. Summing up The cybersecurity landscape has recently undergone many changes. Over the next five years, global demand for cybersecurity products and solutions will reach $167.7 billion. So, it calls for a remodeling of your cybersecurity product marketing strategynow more than ever to target and attracts more prospects to your business. Frequently asked questions How to start with cybersecurity marketing? The best way to start your cybersecurity marketing is by educating your prospects about the potential cyber threats they may face in their business. In addition, you can educate them about the latest news in the industry regarding cybersecurity. Why is cybersecurity essential for marketers? Neglecting cybersecurity or taking it for granted may cause privacy risks for you and your clients. In addition, cyber threats can be detrimental for businesses. How can marketing help to improve cybersecurity products? While marketing, you may understand the quality of your product, competing with your counterparts in the market. Also, you may get feedback from potential customers. It calls for the necessity of product improvement. { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{ "@type": "Question", "name": "How to start with cybersecurity marketing?", "acceptedAnswer": { "@type": "Answer", "text": "The best way to start your cybersecurity marketing is by educating your prospects about the potential cyber threats they may face in their business. In addition, you can educate them about the latest news in the industry regarding cybersecurity." } },{ "@type": "Question", "name": "Why is cybersecurity essential for marketers?", "acceptedAnswer": { "@type": "Answer", "text": "Neglecting cybersecurity or taking it for granted may cause privacy risks for you and your clients. In addition, cyber threats can be detrimental for businesses." } },{ "@type": "Question", "name": "How can marketing help to improve cybersecurity products?", "acceptedAnswer": { "@type": "Answer", "text": "While marketing, you may understand the quality of your product, competing with your counterparts in the market. Also, you may get feedback from potential customers. It calls for the necessity of product improvement." } }] }

Read More

A COVID-19 Cybersecurity Poll: Securing a Remote Workforce

Article | March 17, 2020

As the coronavirus pandemic continues to sweep the globe, and cities and states impose social-distancing measures, businesses are sending their users home to work. And this massive, unprecedented shift to distance working brings with it a whole new set of cybersecurity challenges. For instance, a lack of IT resources can bite many organizations as they move to enable remote strategies. And when workers and students are sent outside the normal perimeter, managing device sprawl, and patching and securing hundreds of thousands of endpoints, becomes a much a bigger challenge. Threatpost editors wanted to learn more about challenges and best practices from the IT and security professionals on the front lines of this. Please take a few minutes to take the Threatpost poll. The answers will be collected the results will be published in an article later this week.

Read More

Work From Home: Cyber Security During Covid-19

Article | April 14, 2020

COVID-19 has significantly affected individuals and organizations globally. Till this time more than 1.7 million people in 210 countries have bore the brunt of this mysterious virus. While this crisis is unparalleled to the past crises that have shaken the world and had lasting impacts on different businesses, economies and societies but the one domain that had remained resilient through all the past crises and is going solid in COVID-19 as well is Cyber security. While most of the sectors globally have been affected, Cybersecurity’s importance to organizations, consumers and home users have not only remained strong but have been increased drastically.

Read More

Spotlight

LogRhythm

LogRhythm, a leader in security intelligence and analytics, empowers organizations around the globe to rapidly detect, respond to and neutralize damaging cyber threats. The company’s award-winning platform unifies next-generation SIEM, log management, network and endpoint forensics and advanced security analytics. In addition to protecting customers from the risks associated with cyber threats, LogRhythm provides innovative compliance automation and assurance, and enhanced IT intelligence. LogRhythm is consistently recognized as a market leader. The company has been positioned as a Leader in Gartner’s SIEM Magic Quadrant report for five consecutive years, named a “Champion” in Info-Tech Research Group’s 2014–15 SIEM Vendor Landscape report and ranked Best-In-Class (No. 1) in DCIG’s 2014–15 SIEM Appliance Buyer’s Guide. In addition, LogRhythm has received Frost & Sullivan’s SIEM Global Market Penetration Leadership Award and been named a Top Workplace by the Denver Post. LogRhythm is

Events