2020 Campaign Staffers Being Trained to Handle Cyber Threats

SecurityWeek | May 06, 2019

While candidates were focused on campaigning in 2016, Russians were carrying out a devastating cyber operation that changed the landscape of American politics, with aftershocks continuing well into Donald Trump’s presidency. And it all started with the click of a tempting email and a typed-in password. Whether presidential campaigns have learned from the cyberattacks is a critical question ahead as the 2020 election approaches. Preventing the attacks won’t be easy or cheap. “If you are the Pentagon or the NSA, you have the most skilled adversaries in the world trying to get in but you also have some of the most skilled people working defense,” said Robby Mook, who ran Hillary Clinton’s campaign in 2016. “Campaigns are facing similar adversaries, and they don’t have similar resources and virtually no expertise.” Traditionally, cybersecurity has been a lower priority for candidates, especially at the early stages of a campaign. They need to raise money, hire staff, pay office rents, lobby for endorsements and travel repeatedly to early voting states.

Spotlight

Most enterprises are at least discussing security analytics. But how are they actually deploying these tools? And with what levels of automation and orchestration? Drew Gidwani of ThreatConnect shares insight on how to maximize analytics. How are security analytics commonly deployed today? “It really depends on the pattern you’re looking for and what you’re trying to predict,” says Gidwani, director of analytics at ThreatConnect. “It’s interesting to slice and dice it based on the size of the data you’re looking at, or the computational nature of the problem at hand.” Gidwani looks at data in three categories: “regular” data, big data and “too-big-for-you” data.

Spotlight

Most enterprises are at least discussing security analytics. But how are they actually deploying these tools? And with what levels of automation and orchestration? Drew Gidwani of ThreatConnect shares insight on how to maximize analytics. How are security analytics commonly deployed today? “It really depends on the pattern you’re looking for and what you’re trying to predict,” says Gidwani, director of analytics at ThreatConnect. “It’s interesting to slice and dice it based on the size of the data you’re looking at, or the computational nature of the problem at hand.” Gidwani looks at data in three categories: “regular” data, big data and “too-big-for-you” data.

Related News

SOFTWARE SECURITY

Exabeam Partners with Google Cloud

Exabeam | June 09, 2022

Exabeam, a pioneer in Next-Generation SIEM and XDR, announced today its intention to construct and evolve its modern cloud-native security information and event management (SIEM) and cybersecurity analytics solutions on Google Cloud. The move provides global security teams with endless data ingestion, speed, and scale options in their continuous battle against more sophisticated cybersecurity threats over an ever-expanding attack surface. “Exabeam is unlike any other SIEM vendor in that we leverage our machine learning-based, cyber analytics product to help security teams be more efficient. With this next version of our product, we will now become completely cloud-native offering unparalleled performance, scale, and cost efficiency. Exabeam is built by security people for security people.” Michael DeCesare, CEO and president, Exabeam Gerrit Kazmaier, Vice President and General Manager, Data Analytics and Business Intelligence at Google Cloud said that “Addressing and protecting data from security threats and attacks is a business-critical focus that is constantly evolving. We look forward to continuing our work together to create products that help companies securely leverage their data at cloud scale.” Adam Geller, chief product officer, Exabeam said that “After looking at several cloud players in the market, we selected Google Cloud, specifically the Data Analytics family of products including BigQuery, Dataflow, and Looker, because of its hyperscale, speed, and ability to support the type of technically advanced products we build at Exabeam. Google Cloud has enabled us to greatly accelerate our own security platform and product innovation resulting in state-of-the-art features and capabilities that can finally overcome the data proliferation and threat detection, investigation, and response (TDIR) challenges faced by security operations teams today.” Exabeam has been named a Leader with the highest ability to execute in the 2021 Gartner Magic Quadrant for SIEM for the third time in a row, joining a rapidly growing list of technology companies that power their products and businesses with Google data cloud products like BigQuery, Looker, Spanner, and Vertex AI.

Read More

DATA SECURITY

Snowflake Launches New Cybersecurity Workload

Snowflake | June 08, 2022

Snowflake, the Data Cloud provider, announced today the release of a new Cybersecurity workload that helps cybersecurity teams to better secure their organizations using the Data Cloud. Cybersecurity teams can rapidly acquire visibility and automation at cloud-scale by using Snowflake's platform and a wide ecosystem of partners offering security capabilities with linked apps. According to Forrester*, 55% of security professionals said that their business encountered an incident or breach involving supply chains or third-party suppliers in the last 12 months. Current security architectures based on outdated security and information management systems (SIEMs) are really not intended to handle the amount and diversity of data required to keep up with cyberthreats. Legacy SIEMs impose stringent ingest fees, short retention periods, and proprietary query languages, making it difficult for security professionals to acquire the insight they need to safeguard their enterprises. Customers that utilize Snowflake's Cybersecurity workload receive access to the platform's capability and adaptability to natively manage structured, semi-structured, and unstructured logs. Customers can store years of high-volume data effectively, search using scalable on-demand computing capabilities, and obtain insights utilizing universal languages like SQL and Python, which are now in private preview. Businesses can also use Snowflake to combine their security data with company data in a single source of truth, allowing contextual data from HR systems or IT asset inventories to feed detections and investigations for greater fidelity alerts and conducting quick queries on vast volumes of data. Teams receive unified insight into their security posture, removing data silos without incurring prohibitive data input or retention expenses. Aside from threat detection and response, the Cybersecurity workload covers a wide variety of use cases such as security compliance, cloud security, identity and access management, vulnerability management, and more. TripActions, the premier all-in-one travel, corporate card, and expense management system, is using the Data Cloud to invest in its long-term cybersecurity data strategy. Prabhath Karanth, Sr. Director of Security, Compliance & Trust, TripActions said that “With Snowflake as our security data lake, we are able to simplify our security program architecture and remove data management overhead. Snowflake has been vital in helping us gain a complete picture of our security posture, eliminating blind spots and reducing noise so we can continue to provide user trust where it matters most. Deploying a modern technology stack from Snowflake is a pivotal piece of our cybersecurity strategy.”

Read More

DATA SECURITY

SentinelOne and Cribl Partner to Deliver Data Flexibility Across Cybersecurity and Observability

Cribl | August 04, 2022

Cribl, the leader in enabling open observability, today announced a new partnership with SentinelOne, an autonomous cybersecurity platform company. The partnership enables SentinelOne customers to leverage Cribl's observability product suite to streamline cybersecurity triage, optimize data collection, and provide security teams control of their data. By integrating Cribl's observability product suite with Singularity XDR, SentinelOne customers can now unlock the value of all observability data. Key benefits include the ability to: 1) Operationalize endpoint and extended detection and response (EDR & XDR) of data sources in joint customer environments, 2) Streamline for triage and investigative functions in the Security Operations Center (SOC), and 3) Progress cybersecurity programs with enhanced threat intelligence, threat hunting, and adversary simulation. "Today's cybersecurity risk levels are increasingly associated with the ability to understand data across enterprise assets. "Our partnership with Cribl helps optimize data collection at scale, enabling security teams to minimize risk and save time." Chuck Fontana, SVP Business Development at SentinelOne "We're excited to partner with the SentinelOne team," said Zac Kilpatrick, VP of Channel and Alliances at Cribl. "To keep up with persistent threats and the ever-changing security landscape, SOC activity must move from reactivity to proactivity. SentinelOne's autonomous and proactive approach to cybersecurity is differentiated in the market and aligns with Cribl's objective of optimizing analytics platform cost and performance." Integration with SentinelOne's Cloud Funnel Cribl's product suite now integrates with SentinelOne's Cloud Funnel, a data subscription enabling XDR data to be stored locally in an enterprise's data lake. This solution works with any data type, such as file, process, DNS, flow, behavioral, registry, commands, scripts, and more. Cloud Funnel's flexibility provides SentinelOne customers the ability to choose which data type they need, optimize it to find the right signal, and route it for maximum efficiency - all at machine speed. Integration with DataSet Cribl Stream now supports SentinelOne's DataSet as a destination to seamlessly route data from legacy log analytics solutions. DevOps and IT teams choose DataSet to analyze data in real-time, effortlessly scale to petabytes, and cost-effectively retain data for longer periods of time for compliance and audit purposes. The new integration enables Cribl customers to pipeline their data to DataSet without changing their data instrumentation, collection, and ingestion. SentinelOne and Cribl will also continue bringing new offerings to market, including integrating Cribl Stream into SentinelOne's Singularity XDR platform. About Cribl Cribl makes open observability a reality for today's tech professionals. The Cribl product suite defies data gravity with radical levels of choice and control. Wherever the data comes from, wherever it needs to go, Cribl delivers the freedom and flexibility to make choices, not compromises. It's enterprise software that doesn't suck, enables tech professionals to do what they need to do, and gives them the ability to say "Yes." With Cribl, companies have the power to control their data, get more out of existing investments, and shape the observability future. Founded in 2017, Cribl is a remote-first company with an office in San Francisco, CA.

Read More