DATA SECURITY

Arctic Wolf Selects AWS to Power Global Cybersecurity Offering at Scale

Arctic Wolf | September 03, 2021

Arctic Wolf Selects AWS to Power Global Cybersecurity Offering at Scale
Amazon Web Services, Inc.  an Amazon.com, Inc. company announced that Arctic Wolf Networks has selected AWS as its primary cloud provider to power the company’s innovative, cloud-native security operations platform. Arctic Wolf is one of the leading cybersecurity technology innovators in the world. The company provides turnkey, managed threat detection and response, risk management, cloud monitoring, and security training and awareness services to organizations. The company’s hybrid approach to security combines the scale, speed, and processing power of cloud-based automation with the experience of trained security experts to transform how organizations protect themselves. Using AWS’s unmatched portfolio of cloud capabilities, including containers, serverless, analytics, database, compute, and storage, Arctic Wolf can cost-effectively process more than 1.4 trillion unique security events a week from its global and fast-growing customer base. In addition, Arctic Wolf plans to leverage AWS’s proven global infrastructure to continue to expand its operations across Europe, the Asia-Pacific region, and beyond.

Under the traditional cybersecurity model, companies typically relegate security to IT teams that rely on disparate technology solutions in an attempt to keep up with rapidly evolving threats. These systems can flood IT teams with security notifications, making it hard to differentiate between meaningful threats and noise and leaving organizations vulnerable to attack. In contrast, Arctic Wolf’s approach uses AWS to power and deliver its cloud-native Arctic Wolf Platform, which is remotely managed by Arctic Wolf’s “Concierge Security Team” (CST) in the cloud. The platform collects, enriches, and analyzes security data at scale and flags the CST when a potential threat requires additional scrutiny. The CST, in turn, alerts a customer only after they have validated a security incident and can provide recommended response options. In July 2021, Arctic Wolf used AWS to process and analyze more than 200 billion security events per day, including threats such as viruses, ransomware attacks, and compromised websites.

Arctic Wolf uses the breadth and depth of AWS services to elastically scale their offerings and meet global customer demand with low latency. The company typically runs more than 60,000 containers on Amazon Elastic Container Service (Amazon ECS) and Amazon Elastic Kubernetes Service (Amazon EKS) to provide its detection services. AWS Auto Scaling provides the elasticity and availability required to handle peak loads and events such as zero-day security incidents that often affect multiple customers over different geographical regions. When Arctic Wolf registers a security observation as suspicious activity, their CST leverages AWS Lambda (AWS’s serverless compute service that lets customers run code without provisioning or managing servers) to trigger further automated analysis, review the findings, and validate threats before escalating to the customer. The company also uses AWS’s managed database services, including Amazon DynamoDB and Amazon Relational Database Service (Amazon RDS), to process security observation data at scale, looking for outliers or unexpected patterns of activity that could indicate potential threats. Arctic Wolf then automatically references that data against historical activity and serves the analysis to their CST to evaluate in the context of emerging threats.
“As repeatedly demonstrated by recent ransomware incidents, the digital threat landscape continues to evolve, with attack surfaces that include consumer devices and public infrastructure that connects to corporate networks. Organizations and consumers alike feel the impact when data and personal information falls into the wrong hands, yet businesses can easily become overwhelmed trying to manage security alerts on their own. Arctic Wolf combines the best of technology and human intelligence to help our customers stay ahead of threats. Our hybrid security approach powered by AWS is enabling more organizations around the world to innovate with the confidence that their systems and data are secure,” said Nick Schneider, CEO, Arctic Wolf. “AWS’s proven performance and security, global reach, and breadth of services, as well as the agility we gain by running in the cloud, are critical to achieving our mission to end cyber risk. The Arctic Wolf Platform was born in the cloud, and we look forward to continuing our work with AWS as a customer and a partner to help organizations across industries protect themselves and those they serve.”

Moving forward, Arctic Wolf will use AWS’s proven global infrastructure to expand their managed services quickly and cost effectively. Running on AWS, Arctic Wolf can replicate its IT architecture in additional AWS Regions in a matter of weeks rather than construct new data centers. The company recently announced plans to launch their first European security operations center by the end of 2021, which will be located in Germany and use the AWS Europe (Frankfurt) Region.

Arctic Wolf is an ISV Partner in the AWS Partner Network (APN) and an AWS Level 1 Managed Security Service Provider (MSSP), a new designation that AWS announced last week. It means Arctic Wolf is a cybersecurity business that has met or exceeded 10 managed security service specializations that protect and monitor essential AWS resources, are delivered as a 24/7 fully managed service, and span vulnerability management, cloud security best practices and compliance, threat detection and response, network security, host and endpoint security, and application security. In addition, through an expanding technical relationship, Arctic Wolf and AWS are committed to better integrating their security services to keep joint customers secure from advanced attacks.

“The cloud-native nature of Arctic Wolf’s comprehensive security operations platform, coupled with the performance and reliability of AWS, gives us the agility and broad visibility we need in an ever-expanding cyber threat environment,” said Bill Berzinskas, Director of Reliability and Security at Teamworks, a customer of Arctic Wolf. “We’re scaling our SaaS platform from a simple web application to a mature business with hundreds of thousands of users, and the security operations approach pioneered by Arctic Wolf and powered by AWS gives us the confidence and security posture we need to grow our business.”

“Arctic Wolf is elevating security operations to help organizations of all sizes reliably and cost-effectively protect themselves in a constantly shifting threat landscape. AWS makes it possible for Arctic Wolf to expand their service to benefit customers around the world and rapidly adapt to emerging threats,” said Stephen Schmidt, Vice President of Security Engineering and Chief Information Security Officer, Amazon Web Services, Inc. “By running on AWS, Arctic Wolf has the performance, elasticity, breadth of services, and go-to-market support they need to keep their customers safe and scale with demand. We’re delighted to deepen our collaboration and congratulate them on their managed cloud security capabilities and distinction of AWS Level 1 MSSP Competency.”

About Amazon Web Services
For over 15 years, Amazon Web Services has been the world’s most comprehensive and broadly adopted cloud offering. AWS has been continually expanding its services to support virtually any cloud workload, and it now has more than 200 fully featured services for compute, storage, databases, networking, analytics, machine learning and artificial intelligence (AI), Internet of Things (IoT), mobile, security, hybrid, virtual and augmented reality (VR and AR), media, and application development, deployment, and management from 81 Availability Zones within 25 geographic regions, with announced plans for 21 more Availability Zones and seven more AWS Regions in Australia, India, Indonesia, Israel, Spain, Switzerland, and the United Arab Emirates. Millions of customers—including the fastest-growing startups, largest enterprises, and leading government agencies—trust AWS to power their infrastructure, become more agile, and lower costs. To learn more about AWS, visit aws.amazon.com.

About Amazon
Amazon is guided by four principles: customer obsession rather than competitor focus, passion for invention, commitment to operational excellence, and long-term thinking. Amazon strives to be Earth’s Most Customer-Centric Company, Earth’s Best Employer, and Earth’s Safest Place to Work. Customer reviews, 1-Click shopping, personalized recommendations, Prime, Fulfillment by Amazon, AWS, Kindle Direct Publishing, Kindle, Career Choice, Fire tablets, Fire TV, Amazon Echo, Alexa, Just Walk Out technology, Amazon Studios, and The Climate Pledge are some of the things pioneered by Amazon.

Spotlight

Cybersecurity education is more important today than it has ever been. In this insightful interview, In Cyber Defense Managing Editor Wes O'Donnell speaks with American Public University System's Program Director for Information Systems Security and Information Technology Management Dr. Kevin Harris. Dr. Harris' career encompasses diverse experiences both in information technology and academia.

Related News

DATA SECURITY

Vulcan Cyber Makes a New Cloud Security Module for Risk-Based Remediation Platform

Vulcan Cyber | July 26, 2021

The only risk-based remediation platform for developers for infrastructure, application, and cloud security, Vulcan Cyber®, has announced today that the new Cloud Security module of Vulcan Cyber provides a consolidated view across traditional IT infrastructure and cloud application environments cyber risks. With various inputs from the AWS Security Hub Identity, Aqua Security, and Access Management (IAM) service, the module will enable IT security teams, to prioritize, consolidate, track, and remediate all cyber vulnerabilities. Within a single platform, Vulcan Cyber Cloud Security supports enterprise cloudsec teams to manage and remediate cloud configurations in container and Kubernetes deployments, Microsoft Azure, Amazon Web Services, Google Cloud, and more. By adding cloud configuration data to the Vulcan Cyber risk-based remediation platform, the company is deepening the vulnerability and risk insights and control available to users, offering the only remediation orchestration capabilities for all sources of digital risk, including IT networks, infrastructure, application surfaces, and cloud. The update expands the reach of Vulcan Cyber customer risk remediation efforts to include any cloud environment for a full measure of cyber risk in enterprises. IT security teams can identify and mitigate various risks and vulnerabilities generated by human error in cloud environments using Vulcan Cyber Cloud Security. The new Cloud Security module of Vulcan Cyber is available in beta now, and, in August, it will be generally available to Vulcan Pro and Vulcan Enterprise customers. About Vulcan Cyber Vulcan Cyber developed the industry's first risk-based remediation platform. It was built to help businesses reduce cyber risk through the measurable and efficient cloud and application security programs and infrastructure. The Vulcan platform orchestrates and tracks the remediation lifecycle from scan to fix by curating and delivering the best remedies, prioritizing vulnerabilities, and automating processes and fixes through the last mile of remediation.

Read More

How CSOs Can Protect Users from Phishing Attacks Related to COVID-19

Microsoft | May 12, 2020

The biggest threats are phishing attacks related to Covid-19 attackers are also setting up Covid-19-related domain names . Remote users in particular are vulnerable to coronavirus-themed phishing attempts, malicious domains and repurposed malware . Attackers are also impersonating official organisations to wiggle into user inboxes, while SmartScreen tracked more than 18,000 malicious Covid-19 themed. Attackers are using this time of crisis to go after victims with targeted campaigns. The biggest threats are phishing attacks related to Covid-19. Attackers are also setting up Covid-19-related domain names and enticing people to click on them. Anomali recently released a report that identified at least 15 distinct pandemic-related campaigns associated with 11 threat actors distributing 39 different malware families and employing 80 MITRE ATT&CK techniques. In January, the attacks typically were malicious emails that appeared to be notifications from welfare providers and public health sectors. Meanwhile in February, the attacks shifted to include remote access trojans (RATS). CheckPoint reported in March an increase of fraudulent Covid-19-themed domains. In mid-March, researchers noted that attackers were mimicking the Johns Hopkins coronavirus map. Recently, Microsoft noted several themed attack trends on the networks that it monitors, claiming that every country is seeing at least one pandemic-themed threat with China, the US and Russia the most targeted. In addition, Trickbot and Emotet malware are re-bundling and rebranding themselves to take advantage of the threats through reusing various lures, with roughly 60,000 emails including Covid-19-related malicious attachments or malicious URLs. Learn more: CYBERSECURITY AND CORONAVIRUS: KEEPING YOUR BUSINESS SAFE . “Microsoft noted several themed attack trends on the networks that it monitors, claiming that every country is seeing at least one pandemic-themed threat with China, the US and Russia the most targeted." ~ Microsoft say Attackers are also impersonating official organisations to wiggle into user inboxes, while SmartScreen tracked more than 18,000 malicious Covid-19 themed URLs and IP addresses. Microsoft Office 365 Advanced Threat Protection (ATP) prevented a big phishing attack that intended to use a fictitious Office 365 sign-in page to harvest credentials. Furthermore, attackers have targeted health care businesses, prompting Microsoft to make its AccountGuard threat notification service available at no cost to healthcare providers and human rights and humanitarian organisations. “Phishlabs reported that cyber criminals are using Covid-19 related voicemail notifications to trick people to log in and steal credentials." Phishlabs reported that cyber criminals are using Covid-19 related voicemail notifications to trick people to log in and steal credentials. Trustwave reported that Covid-19-themed business email compromise (BEC) scams are increasing. The UK's National Cyber Security Centre (NCSC) indicates that attackers also target remote access and home user entry points. Protect endpoints: Enable Microsoft Defender ATP, which is available with a Windows 10 E5 license or Microsoft 365 Enterprise licence, or a third-party endpoint protection tool. This includes home machines. Enable multi-factor authentication (MFA) for online Exchange and email: Microsoft recently pushed off disabling basic authentication as a result of the Covid-19 impact on organisations, a decision I disagree with. Attackers go after POP, IMAP and basic authentication on Office 365 targets. They will use password spray attacks and password reuse to break into the network.This is why CSOs should disable basic or legacy authentication and support modern authentication. Also, security leaders must use conditional access policies to block older vulnerable authentication methods. Having MFA on email ensures that attackers can’t use the easy attacks on an organisation. CSOs can set a rule that anyone logging in from the static IP addresses of the office locations are not prompted by MFA prompts, ensuring that this protection is focused on remote entry points that attackers target the most. Also, security leaders must consider adding geographic log in limitations via conditional access rules to better protect your network as well. Learn more: THE CORONAVIRUS IS ALREADY TAKING EFFECT ON CYBER SECURITY– THIS IS HOW CISOS SHOULD PREPARE .

Read More

NETWORK THREAT DETECTION

Axonius Integrates with the New, Enhanced Amazon Inspector to Deliver Comprehensive Cyber Asset Attack Surface Management

Axonius | December 06, 2021

Axonius, a leader in cybersecurity asset management, today announced an integration with the new Amazon Inspector, an automated security assessment service. The integration will enable mutual customers to better understand and manage vulnerabilities across their Amazon Web Services (AWS) infrastructure. Amazon Inspector is a vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. The solution automatically discovers all running Amazon Elastic Compute Cloud (Amazon EC2) instances and container images residing in Amazon Elastic Container Registry (Amazon ECR), at any scale, and immediately starts assessing them for known vulnerabilities. Because Axonius delivers a complete inventory of assets from many correlated data sources, customers can gain a comprehensive view of their cloud security posture, including vulnerability data found from Amazon Inspector. "Customers are burdened by the increasing number of security tools to protect the sprawl of cloud, physical, and virtual assets in their environments,It's not easy for them to surface which assets are not covered by their security controls that should be, or if they are covered, whether the control is actually working. Customers are exhausted with the highly manual, slow, and error-prone processes that negatively impact their risk mitigation, threat management, and compliance. With Axonius, customers can get a unified view of their assets and dramatically accelerate the process of strengthening security posture across all of their assets.” Mark Daggett, vice president of worldwide channels and alliances, Axonius Comprehensively Track and Assess the Security of AWS Assets: In just a few clicks, the Axonius Query Wizard can identify any AWS assets that have not been assessed with Amazon Inspector. Customers can also easily search for a set of assets based on their last scan time, or segment AWS assets with known vulnerabilities by common vulnerabilities and exposures (CVE) severity, CVE ID, and more. It can also be used to track the Amazon Inspector usage and coverage. Manage Vulnerabilities Within a Broader Context: Beyond simply identifying known vulnerabilities, Axonius delivers correlated data from tools such as endpoint detection and response, privilege access management, and more to help cloud security, DevOps, and security operations teams prioritize which vulnerabilities to remediate first. With an endless backlog of vulnerabilities to manage, this level of context is imperative to helping teams mitigate the vulnerabilities that are more likely to be exploited, or that would have the most impact if exploited. Improve Cloud Compliance Based on Industry Benchmarks: Customers can also ensure that their AWS assets adhere to security best practices, such as the CIS AWS Foundations Benchmark. Using Axonius and Amazon Inspector, cloud security teams can prioritize which assets pose the most risk due to any detected vulnerability or deviation from security standards and best practices. “To be effective, security and DevOps teams need to prioritize vulnerability remediation based on business impact”, said Michael Fuller, director of product management, AWS Security Services. “With the new Amazon Inspector, we’ve dramatically simplified continuous and automated vulnerability assessment for customers across their entire organization, whether they have one AWS account or five thousand. The Axonius integration then brings developers more contextual asset data to help prioritize vulnerability remediation.” About Axonius Axonius is the cybersecurity asset management platform that gives organizations a comprehensive asset inventory, uncovers gaps, and automatically validates and enforces policies. Deployed in minutes, the Axonius cyber asset attack surface management (CAASM) solution integrates with hundreds of data sources to give customers the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, automating response actions, and informing business-level strategy. Cited as one of the fastest growing cybersecurity startups, with accolades from CNBC, Forbes, and Fortune, Axonius covers millions of devices for customers around the world.

Read More

Spotlight

Cybersecurity education is more important today than it has ever been. In this insightful interview, In Cyber Defense Managing Editor Wes O'Donnell speaks with American Public University System's Program Director for Information Systems Security and Information Technology Management Dr. Kevin Harris. Dr. Harris' career encompasses diverse experiences both in information technology and academia.