Enterprise Security, Platform Security, Software Security

SANS Institute Introduces Volume 3 of the ICS Cybersecurity Field Manual, Featuring Actionable Guidance to Protect Against Evolving Threats

Prnewswire | May 15, 2023 | Read time : 05:00 min

SANS Institute Introduces Volume 3 of the ICS Cybersecurity

SANS Institute, the global leader in cyber security training and education, has announced the latest SANS ICS Cybersecurity Field Manual Volume 3, a continuation from Volumes 1 and 2, providing Industrial Control Systems (ICS) cybersecurity professionals and ICS risk managers with more advanced insights into industrial control system specific incident response, risk-based ICS vulnerability management, ICS defender skillsets, team management, and ICS security tools and protocols to defend these systems.

The first two volumes, released in 2022 and 2023, offered a comprehensive overview of ICS security, and the third volume provides more detailed, actionable guidance in the areas of active incident response, environment and safety concerns, vulnerability management and patching, threat detection, system design, network architecture, and effective risk management. Volume 3 also shares the security skillset recipe for the best ICS security team defenders.

"The SANS ICS Cybersecurity Field Manual series is an essential tool for all Industrial Control Systems (ICS) security professionals," said ICS expert, field manual author, and Certified SANS Instructor, Dean Parsons, "and it should find a home on the desk of every control system operator, critical infrastructure cyber defender, and ICS/OT risk manager, in all industrial control system sectors globally. Security professionals must up defenses and staff skillsets to meet the evolving threats, so the ICS Cybersecurity Field Manual should be a necessity in the ICS Incident Response jump bag."

SANS will be hosting a webcast featuring Parsons to discuss the new edition of the manual on Wednesday, May 10, 2023, at 10:00 AM EDT. Attendees will learn about the latest manual edition and gain insights on how to best protect ICS systems.

To join the webcast, please register here: https://www.sans.org/webcasts/discover-ics-cybersecurity-field-manual-vol-3/

Continue to enrich your ICS Security career by downloading the new ICS Cybersecurity Field Manual Vol. 3 as well as ICS Cybersecurity Field Manuals Vol. 1 and 2 here: https://www.sans.org/mlp/ics-resources/

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cybersecurity training and certification to professionals in government and commercial institutions worldwide. Renowned SANS instructors teach more than 60 courses at in-person and virtual cybersecurity events and on demand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on technical certifications in cybersecurity. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's and bachelor's degrees, graduate certificates, and an undergraduate certificate in cybersecurity. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to manage their "human" cybersecurity risk easily and effectively. SANS also delivers a wide variety of free resources to the InfoSec community, including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system-the Internet Storm Center. At the heart of SANS are the many security practitioners representing varied global organizations, from corporations to universities, working together to support and educate the global information security community.

Spotlight

HPE GreenLake for Backup and Recovery is backup as a service designed for hybrid cloud. It simplifies how you protect your on-premises and cloud-native workloads bringing with it the cloud experience and flexibility of software delivered as a service.

Spotlight

HPE GreenLake for Backup and Recovery is backup as a service designed for hybrid cloud. It simplifies how you protect your on-premises and cloud-native workloads bringing with it the cloud experience and flexibility of software delivered as a service.

Related News

Enterprise Security, Platform Security, Software Security

SonicWall Introduces Monthly Firewall Security Services Bundles for MSSPs, MSPs

Prnewswire | July 03, 2023

SonicWall, a 100% channel cybersecurity leader, today announced the availability of monthly firewall security services bundles for Managed Security Service Providers (MSSPs) and approved Managed Service Providers (MSPs). "Managed security services are critical for organizations of all sizes to protect against today's ever-evolving threat landscape," said SonicWall President and CEO Bob VanKirk. "Driven by our outside-in approach, our new monthly billing option makes it even easier for MSSPs and MSPs to offer their customers the best protection available, without the upfront investment required for an annual subscription." The bundles, which include SonicWall's currently available security offerings, empower MSSPs and approved MSPs to provide their customers with flexible, cost-effective cybersecurity solutions. "Given the current state of the market, offering a diverse range of billing options can help empower businesses to tailor their payment structures and align with business needs," said Logically CEO Joshua Skeens. "With SonicWall embracing this flexibility, it will not only enhance customer satisfaction but also cultivate long-term partnerships that fuel growth and success." SonicWall MSSPs and approved MSPs can now bill customers monthly for SonicWall's popular security services included in three cost-effective protection tiers for SonicWall Generation 7 appliances: Threat Protection Security Suite, Essential Protection Security Suite and Advanced Protection Security Suite. SonicWall protection suites bundle a range of critical firewall security services, including the Capture Advanced Threat Protection (ATP) sandbox service, patented Real-Time Deep Memory Inspection™ (RTDMI), as well as intrusion prevention and application control, content filtering and reporting capabilities. "We are committed to providing MSPs and MSSPs with the technology and support they need to succeed," said Chief Revenue Officer Jason Carter. "Our firewall security services with monthly billing will help our partners deliver advanced cybersecurity services to their customers, while also simplifying their own billing and administration processes." New monthly billing models align with how MSSPs and MSPs go to market and have the following benefits: Never miss a renewal. With bundled firewall security services conveniently billed monthly, MSSPs and approved MSPs never need to worry about missing a renewal from multi-year agreements. This equals a smoother customer experience and fewer service interruptions. Simplify the PO process. Offering a no-commit, in-arrears billing option for firewall services provides integrated billing and license provisioning — all while reducing upfront costs. Bring or buy the hardware. Choose to add monthly services to existing current-generation TZ and NSa firewalls, or provision licenses on new firewalls for customer deployments. Gain 24x7 support. Each firewall security services bundle includes 24x7 SonicWall support for end customers, including a world-class online support portal. Streamline billing processes. Simplify monthly customer billing via supported Professional Services Automation (PSA) tools, such as ConnectWise and Autotask. Leverage powerful reporting and analytics. When SonicWall Network Security Manager (NSM) licenses are added to firewall security services, partners can leverage additional management, reporting and analytics capabilities. Standardize service offerings. Leverage the convenience of SonicWall's new MySonicWall APIs to execute configuration scripts to provision standard security bundles for all customers. Accelerate workflow automation. Use new APIs to extend existing MSP workflow automations for end-to-end customer onboarding across Professional Service Automation (PSA) and Remote Monitoring & Management (RMM) tools. SonicWall's new monthly billing model is available now for SonicWall MSSPs and approved MSPs. SonicWall partners may apply for access via the SonicWall Partner Portal. The SecureFirst Partner Program demonstrates SonicWall's continuing commitment and investment in the channel, providing a multi-tiered approach with a broad range of benefits for partners. The program accelerates SonicWall partners' ability to provide the industry's best security efficacy with TCO that matches real-world expectations. About SonicWall SonicWall delivers Boundless Cybersecurity for the hyper-distributed era in a work reality where everyone is remote, mobile and unsecure. SonicWall safeguards organizations mobilizing for their new business normal with seamless protection that stops the most evasive cyberattacks across boundless exposure points and increasingly remote, mobile and cloud-enabled workforces. By knowing the unknown, providing real-time visibility and enabling breakthrough economics, SonicWall closes the cybersecurity business gap for enterprises, governments and SMBs worldwide.

Read More

Enterprise Security, Platform Security, Software Security

Detectify Improves Attack Surface Risk Visibility With New IP Addresses View

Business Wire | August 14, 2023

Detectify, the leading External Attack Surface Management platform powered by elite ethical hackers, today announced enhancements to its platform that can significantly help to elevate an organization’s visibility into its attack surface. Many organizations need help gaining visibility into the IP addresses across their whole environment. Detectify's new capabilities enable organizations to uncover unauthorized assets and ensure regulatory compliance. The attack surface has grown exponentially, not least in how decentralized organizations have become. Over 10% of Detectify customers are hosting data across three continents, illustrating how their products and services are more global than ever. Detectify also notes that 30% of their customer base is leveraging more than 5 service providers, which reflects the growing trend in vulnerabilities as a result of human errors, like server misconfigurations. Moreover, organizations are quickly expanding their digital footprint, with 73% of Detectify customers using IPv6 addresses. With the introduction of the new IP Addresses view, Detectify users gain seamless access to a comprehensive list of all IPs associated with their domains, accompanied by valuable insights, including hosting provider details, geographical locations, and Autonomous System Numbers (ASNs). This update is further complemented by interactive charts, enabling users to detect outlier countries or providers, and streamlining the process of identifying potential security concerns. "It's not uncommon for our customers to encounter instances where unauthorized geolocations are used to spin up new machines or witness sudden spikes in hosting activities from approved countries,” said Danwei Tran Luciani, Interim VP of Product at Detectify. “These anomalies can expose organizations to risk, particularly when traditional automated detection methods fall short. Our new IP Addresses view empowers security teams to proactively address these challenges, strengthening their overall cybersecurity posture." Detectify's new IP Addresses view provides security teams with tangible benefits to navigate complex attack surfaces, such as: Uncovering unauthorized assets: For organizations with large attack surfaces, this capability allows users to identify unauthorized assets hosted by unapproved vendors. By instantly detecting an asset being hosted by a non-approved provider, security teams can take swift action and mitigate potential threats. Ensuring regulatory compliance: For businesses operating in highly regulated environments where compliance is paramount, the new view is critical in determining the hosting locations of specific customer data. This enhanced visibility ensures adherence to regulatory requirements and fortifies data privacy measures. The new IP Addresses view is now available to all Detectify customers, reinforcing the company's commitment to empowering security teams with cutting-edge solutions to safeguard organizations’ ever-evolving attack surfaces. For more information visit www.detectify.com About Detectify Detectify sets the standard for External Attack Surface Management (EASM), providing 99.7% accurate vulnerability assessments. Product security and AppSec teams trust Detectify to expose exactly how attackers will exploit their Internet-facing applications. The Detectify platform automates continuous real-world, payload-based attacks crowdsourced through its global community of elite ethical hackers, exposing critical weaknesses before it’s too late. Go hack yourself: detectify.com.

Read More

Platform Security, Software Security, Cloud Security

Lookout Launches New Endpoint Agents to Facilitate Full Replacement of Legacy Virtual Private Networks

Businesswire | July 26, 2023

Lookout, Inc., the endpoint-to-cloud security company, today announced new Windows and macOS endpoint agents for its Zero Trust Network Access (ZTNA) solution, Lookout Secure Private Access, that facilitate the full replacement of overextended virtual private networks (VPNs) with cloud-delivered security. Businesses can now fully realize the benefits of a zero trust architecture while ​​dramatically simplifying network design. According to Gartner, at least 70% of new remote access deployments will be served mainly by ZTNA instead of VPN services by 2025 – up from less than 10% at the end of 2021.1 Early ZTNA products offer only limited traffic forwarding capabilities. Legacy VPN solutions, on the other hand, support an expansive set of protocols and complex use cases, making full VPN replacement impractical in many enterprise environments. IT security teams are often forced to run both ZTNA and VPN architectures simultaneously in support of certain legacy applications, such as VoIP phones. This constraint leads to a complex network design that's costly to operate and maintain. Lookout's new endpoint agents for Windows and macOS facilitate the full transition to zero trust architecture with support for traffic steering at both the network and application levels. When deployed in conjunction with cloud-delivered Lookout Secure Private Access, IT security teams can now fully replace the myriad of use cases supported by legacy VPNs, taking full advantage of the benefits a Zero Trust Architecture offers. The core principle behind Zero Trust is “never trust, always verify.” All users and devices are considered potential threats and must be continuously verified and restricted to only the resources needed to complete a required task. VPNs, on the other hand, take an all-or-nothing approach to connectivity by allowing users to authenticate only once and roam freely throughout the network thereafter. This full network-level access sets the stage for lateral attacks. If a bad actor, or malware, can make it past the VPN, they have full access to all applications and sensitive data on the corporate network. Lookout Secure Private Access with Windows and macOS endpoint agents provide important security benefits, including: Unparalleled visibility into private application traffic: IT security teams can better understand how their users interact with private applications, with visibility up and including actual data accessed. Advanced Data security: The agent helps facilitate the use of advanced data security controls for private enterprise apps, including our data loss prevention (DLP) and enterprise digital rights management (EDRM). Granular traffic steering to meet heterogeneous environments: The agent can be configured to steer traffic to specific destinations, based on user, device, and location. This helps to ensure only authorized users have access to sensitive data. Enhanced user experience with multi-tunnel traffic steering: The agent steers traffic to one of Lookout's many cloud-edge locations distributed worldwide, providing the shortest path between the user and the enterprise. Highly available redundant multi-path routing: The agent leverages our globally distributed Cloud Security Platform to offer end users a highly available security service edge (SSE) experience by leveraging advanced path selection and routing algorithms. Consistent zero-trust enforcement with integrated endpoint security: The agent continuously monitors endpoint posture when integrated with endpoint protection platforms (EPPs), OS security centers and other endpoint security products. “For more than two decades, VPNs have been the go-to technology for enterprise remote access. While their effectiveness has declined as applications have shifted to the cloud, the alternatives have been limited because of the myriad of complex use cases they support," said Sundaram Lakshmanan, Chief Technology Officer, Lookout. "Now, with the introduction of Windows and macOS endpoint agents on our Cloud Security Platform, Lookout facilitates full VPN replacement while filling inherent security gaps in these legacy architectures." About Lookout Lookout, Inc. is the endpoint-to-cloud cybersecurity company that delivers zero trust security by reducing risk and protecting data wherever it goes, without boundaries or limits. Our unified, cloud-native platform safeguards digital information across devices, apps, networks and clouds and is as fluid and flexible as the modern digital world. Lookout is trusted by enterprises and government agencies of all sizes to protect the sensitive data they care about most, enabling them to work and connect freely and safely. To learn more about the Lookout Cloud Security Platform, visit www.lookout.com and follow Lookout on our blog, LinkedIn and Twitter.

Read More