DATA SECURITY

New Microsoft Security Podcast Debuts on the CyberWire Network

CyberWire | May 18, 2021

The CyberWire confirmed recently that Microsoft Security's newest podcast, "Security Unlocked: CISO Series with Bret Arsenault," has debuted as part of the CyberWire's increasingly growing podcast network. The show's host, Microsoft's Chief Information Security Officer (CISO), Bret Arsenault, will speak one-on-one with industry peers as well as Microsoft executives about the most pressing cybersecurity issues today. He and his colleagues will discuss new ideas and perspectives, as well as provide practical advice to security professionals.

The first show of the inaugural season features a candid and informative discussion with Mark Russinovich, CTO of Azure and Technical Fellow at Microsoft. Arsenault and Russinovich immediately delve into two important issues of the day, cloud security and zero trusts, providing insights into how technology is changing and the unique challenges imposed by the coronavirus pandemic have prompted developments in recent years.

"Microsoft Security is at the forefront of building a secure cyberspace for individuals and organizations alike, and we're delighted to have their amazing new podcast join our network," said Peter Kilpe, CEO and Executive Editor of the CyberWire. "With the rapid pace of change in our industry and the ever-changing threat landscape, there is an urgent need for practical guidance and insights that security teams can use to defend their organizations. Bret's show is an excellent resource for business professionals."

"I am a listener and fan of CyberWire's podcasts, and I am glad the team was open to sharing the Microsoft Unlocked CISO series with its listeners, who are the same security professionals I speak to every day," said Bret Arsenault, Microsoft's Chief Information Security Officer. "My vision for the podcast is that it would be another helpful outlet for me to expand the conversations I have both externally and internally with some of the brightest security minds in the industry, providing listeners with practical advice they can put into effect right away."

About the CyberWire

CyberWire easily brings users up to date on cyber and holds them one step ahead of an ever-changing industry. The services are built around situational awareness, continuing education, and professional development. Many of the world's most influential leaders and experts in the public and private sectors have long relied on CyberWire. We separate the signal from the noise.

Spotlight

Distributed denial of service (DDoS) malware and tools threaten an organization's Internet-facing systems. This technical brief covers DDoS-enabled malware and several DDoS-specific tools, their capabilities and the network indicators they generate while performing the attack methods. It includes new attack vectors observed in 2013 with regard to highly publicized and targeted DDoS attacks.


Other News
DATA SECURITY

CloudCover Continues to Move Into a New Era of CyberSafety with the Launch of CloudCover’s Cyber Liability

CloudCover | December 27, 2021

The cybersecurity insurance market is in trouble, fueled by a rapid increase in cyber attacks – up 486% from the beginning of 2018 through the end of 2021, according to Aon. As a result, insurers have little choice but to raise rates and scrutinize policy terms and conditions, as there’s no historical data to set policies and premiums like traditional insurance products. CloudCover, the company Reimagining CyberSecurity, is making strides to improve cyber safety by creating the first end-to-end cyber security technology and insurance platform. Today, the company announces the continued rollout of its suite of CloudCover insurance products with the launch of a new insurance offering: CloudCover Cyber Liability (CCCL) and Information Systems Business Interruption (ISBI) insurance. The release of the cybersecurity insurance coverage brings forward an entirely new market category: cybersecurity network and data insurance cover that utilizes the CC/B1 PlatformTM to obtain the data analytic set required to efficiently underwrite and set accurate premiums. CloudCover’s $1 Million Ransomware Warranty was launched in September 2021. Through its CCCL insurance, CloudCover will issue a $1 million cover per occurrence and a $10 million aggregate policy. This insurance option covers: First-party response costs, including any costs associated with the investigation and remediation of cybersecurity breaches, as well as payment for costs associated with notifying affected parties of the breach, Third-party liability and regulatory costs, including any costs associated with the defense of lawsuits, regulatory fines, and penalties in addition to the costs associated with any judgements rendered from those activities, and Cover for any ransom demanded by cyber criminals who have locked the insured company’s network or computer systems. Similar to the CCCL coverage, CloudCover will also issue $1 million coverage per occurrence and a $10 million aggregate policy for its ISBI coverage. The insurance policy provides payment for lost revenue in the event that a Distributed Denial of Service (DDoS) attack disrupts or compromises the insured party’s network. Both insurance covers are powered by CloudCover’s CC/B1 Platform, an advanced Intelligent Threat ManagementTM security solution. The CC/B1 relies on a patented AI/ML (automated intelligence/machine learning), X-NDR (extended network detection and response), SOAR (security, orchestration, automation and response) technology that empowers risk awareness, risk control, and risk transfer in near real time. The platform operates as a Firewall EverywhereTM, collecting data from all corners of an organization’s network, streamlining and utilizing machine learning to detect, analyze, and stop suspicious activity – all while using the collected network patterns with risk scoring and building actuarial models for incremental cybersecurity network insurance. “This marriage of cybersecurity technology and cyber insurance represents the creation of a new market,No other security vendor is able to provide cybersecurity risk scoring, risk event mitigation and mediation, accurate identification and threat stopping, and cyber risk insurance underwriting and auto-adjudication for claims in one platform. Using cybersecurity technology to learn about a company’s network and utilizing that data to create more accurate premiums and better coverage gives our industry the opportunity to better control cybersecurity insurance losses in the future, as we’ll be able to detect threats and issue micro-policies in a fraction of a second.” Stephen Cardot, founder and CEO of CloudCover In the months ahead, CloudCover plans to debut the final product in its initial CyberSafety Insurance Coverage portfolio: Cybersecurity Network Data Insurance, which will be the first insurance policy to insure data in motion with both first- and third-party liability coverage. This insurance, which will launch in February 2022, makes it possible for organizations to insure and thereby value their intangible assets, i.e., data, just as they would other company assets – something that’s been long seen as impossible in the FASB/GAAP industry. In order to purchase CloudCover’s insurance offerings, a company will need to have the CC/B1 Platform installed on its network in addition to completing CloudCover’s CyberSafety Registry. About CloudCover CloudCover is an AI-driven, virtual machine-learning cybersecurity platform. CloudCover has reimagined cybersecurity as a risk-predictive CyberSafety Platform – delivering real-time extended network detection and response through a patented, math-based security orchestration automated response risk aware/control solution. The CloudCover SOAR capability accumulates data between an organization’s diverse security technologies and environments and streamlines them into holistic actions on potential risks. The CC/B1 Platform provides an ever-evolving, protective security layer to your existing cybersecurity tech stack – meaning network threats are detected in near zero-second speed with near zero-threat accuracy. With CloudCover, the elusive “single pane of orchestration” capability of an organization’s network security isn’t a myth – it’s reality.

Read More

SOFTWARE SECURITY

iboss Joins Microsoft Intelligent Security Association (MISA)

iboss, Inc. | June 02, 2022

iboss, a leader in Zero Trust Edge, announces the expansion of its relationship with Microsoft by joining the Microsoft Intelligent Security Association (MISA), an ecosystem of independent software vendors (ISV) and managed security service providers (MSSP) that have integrated their security products and services with Microsoft’s security products. Through this collaboration with Microsoft, joint customers benefit from secure, fast access to resources from anywhere, which also allows customers greater visibility and immediate response to threats. iboss has integrations with Microsoft Azure Active Directory, Microsoft Sentinel, Microsoft Defender for Cloud Apps and Microsoft Purview Information Protection to further enhance an organization’s value of their Microsoft 365 E5 investment. These solutions offer new capabilities that are fully integrated and simple to deploy. Identity: iboss forces modern authentication to all resources, including legacy applications under the Azure Active Directory (AAD) Umbrella. When users authenticate through Azure Active Directory, iboss grants or denies resource access on a per transaction basis, with real-time Conditional Access policies applied to reauthenticate or step-up Multi-factor Authentication with Azure Active Directory. Security: iboss integration with Microsoft Sentinel, now available in the Azure Marketplace, integrates high fidelity logs about users and resources being requested, also comes complete with real-time active defense workflows allowing SOC analysts fast automated responses to threats that matter. Deployment is live after only a few mouse clicks. In addition, iboss integration with Microsoft Defender for Cloud Apps extends visibility and protection with advanced CASB capabilities by automatically syncing policies and signatures from Microsoft Defender for Cloud Apps to enforce governance actions for secure cloud application access. Compliance: iboss detects and automatically prevents transfer of files tagged with Microsoft Purview Information Protection unified labels and leverages them with iboss Zero Trust DLP rules. In addition, full visibility into the denied transfer request between the user and resource is made available in Microsoft Sentinel to take additional steps as well as Conditional Access rules in Azure Active Directory Cloud: Protection of Azure resource workloads with iboss service being deployed and running directly inside the Azure on a per tenant basis is now available on Microsoft Azure Marketplace. With the ability of iboss service to now be deployed directly in Azure, allows for a customer’s unique IP address to be anchored to each Azure tenant ID, thus creating a tight Zero Trust linkage unmatched by any other Secure Service Edge vendor. “Our Zero Trust Edge platform enables Microsoft customers, and distributed workforces everywhere, to connect securely and directly to all applications from wherever they work. “We help Microsoft customers complete their Zero Trust journey by granting users secure access to critical resources on a per request basis. The depth and breadth of our integrations is unmatched and provides the most use-case protection scenarios. iboss is purpose-built to prevent breaches by shifting the focus from protecting the network perimeter to protecting resources, and we are proud to be expanding to cover Microsoft Security E5 applications through highly differentiated integrations.” Paul Martini, co-founder and CEO of iboss “Preventing unauthorized access to critical resources is essential for Zero Trust." said Desmond Forbes, General Manager of Business Development at Microsoft. "iboss capabilities ensure that trusted users are able to connect to protected resources from anywhere with advanced integrations across Microsoft’s Identity, Security and Compliance platform to help meet our joint customers’ Zero Trust objectives." The iboss Zero Trust platform is a purpose built, patented, cloud delivered security and has more than 100 points of presence globally. A Zero Trust Architecture built on iboss consolidates network security technologies (SWG, CASB, DLP, IPS, malware defense, browser isolation, firewall) into a single unified cloud platform and eliminates the need for a VPN while securing any device, regardless of location. By making all applications private, iboss eliminates the top three initial ransomware infection vectors as identified by Cybersecurity and Infrastructure Security Agency (CISA). With applications, data and services made only accessible through the iboss Zero Trust Edge, cyber risk is greatly reduced, breaches and data loss are prevented, and visibility and security are delivered consistently throughout an organization. About iboss, Inc. iboss is a cloud security company that enables organizations to reduce cyber risk by delivering a Zero Trust service designed to protect resources and users in the modern distributed world. Applications, data and services have moved to the cloud and are located everywhere while users needing access to those resources are working from anywhere. Built on a containerized cloud architecture, iboss delivers security capabilities such as SWG, malware defense, browser isolation, CASB and data loss prevention to protect all resources, via the cloud, instantaneously and at scale. This shifts the focus from protecting buildings to protecting people and resources wherever they are located. Leveraging a purpose-built cloud architecture backed by 230+ issued and pending patents and more than 100 points of presence globally,���iboss processes over 150 billion transactions daily, blocking 4 billion threats per day. More than 4,000 global enterprises trust the iboss Cloud Platform to support their modern workforces, including a large number of Fortune 50 companies. iboss was named one of the Top 25 Cybersecurity Companies by The Software Report, one of the 25 highest-rated Private Cloud Computing Companies to work for by Battery Ventures, and CRN’s Top 20 Coolest Cloud Security Companies of 2022.

Read More

SOFTWARE SECURITY

GTT Launches Secure Connect to Enhance Enterprise Cloud Security

GTT | March 23, 2022

GTT Communications, Inc., a leading global cloud networking provider to multinational clients, has announced its new Secure Connect offering to extend and strengthen the protection of the enterprise network connecting to the internet and accessed by users from any location. The new service is based on the SASE framework and integrates with GTT Managed SD-WAN. GTT Secure Connect leverages a single cloud platform for agile and ubiquitous delivery of network security, offering a range of features that include CASB (Cloud Access Security Broker), SWG (Secure Web Gateway), ZTNA (Zero Trust Network Access) and FWaaS (Firewall as a Service) capabilities. GTT Secure Connect addresses the growing requirement for secure access to enterprise resources in an environment characterized by the widespread use of digital technologies, broad adoption of cloud applications and a remote workforce. GTT Secure Connect utilizes a cloud delivery model that provides centralized policy control at a site and user level for improved scalability and extends the security perimeter to any network endpoint. Additionally, the integration of security with the functionality of GTT Managed SD-WAN improves performance and simplifies network management. The comprehensive SASE-based feature set can be tailored to meet individual enterprise requirements for anti-virus, firewall and anti-malware protections, more effective blocking of malicious sites, augmented cloud security monitoring, and prevention of unauthorized access to network resources in a work-from-anywhere model. With GTT Secure Connect, network access is based on user, device and application identity — rather than the physical location or IP address — enabling seamless and secure networking between users, private, SaaS and public clouds, and the enterprise data center. “In an enterprise environment where digital business and the use of cloud applications has become more critical, coupled with the challenge of supporting a hybrid workforce and an intensifying cyber-threat landscape, customers are demanding network integrated security solutions that are comprehensive with an improved user experience. GTT Secure Connect has been designed to meet these customer requirements, leveraging our industry-leading SD-WAN capability combined with state-of-the-art, cloud-based security technologies, delivering a more effective and efficient solution that provides next-generation connectivity and protection managed all in one place.” Don MacNeil, GTT COO According to industry research firm Omdia, only 15 percent of enterprises globally have a fully developed approach to cybersecurity and digital risk. Further research by the firm shows that when SD-WAN is combined with security, enterprises report an extra boost in perceived value over just SD-WAN. “Omdia finds securing networks a consistent area of enterprise concern and investment. Enterprise network transformation needs to address the complexity of securing internet VPNs, cloud applications and a remote workforce,” said Cindy Whelan, practice leader, enterprise network services at Omdia. “GTT’s new Secure Connect brings together network and security, supported by professional services, to help enterprises with their security and performance needs in a period of rapid digital transformation and an intensifying cyber-threat landscape.” The underlying technology platform of GTT Secure Connect is Prisma® Access provided by Palo Alto Networks, an industry leader in global cybersecurity. GTT Secure Connect integrates Prisma Access with GTT’s software-defined networking solutions and global Tier 1 IP network. GTT Secure Connect is complemented by GTT Professional Services, which offers the technical expertise and operational experience to support the complete solution from initial design to installation and ongoing service management. This includes project management, technical management and incident management support. Through EtherVision, GTT’s unified customer management portal, GTT Secure Connect provides customers with the insights and control they need to operate their network and manage their security environment. About GTT GTT provides secure global connectivity, improving network performance and agility for your people, places, applications and clouds. We operate a global Tier 1 internet network and provide a comprehensive suite of cloud networking and managed solutions that utilize advanced software-defined networking and security technologies. We serve thousands of businesses with a portfolio that includes SD-WAN and other WAN services, internet, security and voice services. Our customers benefit from a customer-first service experience underpinned by our commitment to operational excellence.

Read More

PLATFORM SECURITY

CrowdStrike and Mandiant Form Mission-Focused Strategic Partnership to Protect Organizations Against Cyber Threats

CrowdStrike | April 08, 2022

CrowdStrike , a leader in cloud-delivered protection of endpoints, cloud workloads, identity and data, and Mandiant , announced a strategic partnership that will help joint customers investigate, remediate and defend against increasingly sophisticated cybersecurity events that plague organizations globally. As part of the collaboration, Mandiant will utilize the CrowdStrike Falcon® platform and subscription offerings for its incident response (IR) services and proactive consulting engagements for joint customers. Further, the Mandiant Managed Defense offering intends to include support for customers leveraging the Falcon platform later this year.As two of the most respected leaders in the cybersecurity industry, CrowdStrike and Mandiant share a common mission to stop breaches and put customers' needs first. Both companies have long operated under the practice that in order to defend against tenacious cyber adversaries, there must be a combination of cutting edge products and elite cybersecurity experts. Because of this, both companies have embraced an open and collaborative approach with high caliber partners and technologies to provide organizations superior protection. Today’s complex threat environment calls for a collaborative approach that brings together industry-leading technologies and world class teams to build the strongest defense for customers, which is exactly what this partnership is about,” said George Kurtz, co-founder and chief executive officer of CrowdStrike. “CrowdStrike has worked with Mandiant many times over the years and there is a mutual respect for the caliber of technical and team expertise we both bring to the fight. We are proud to establish this alliance with them and to more effectively enable the people, processes and procedures necessary to secure the modern organization. “CrowdStrike and Mandiant have developed reputations as go-to cybersecurity resources for public and private sector entities across the globe,This partnership between two mission-focused companies strengthens cyber defenses at a time when cyber attacks have become a notable business issue faced by organizations every day.” -Kevin Mandia, chief executive officer of Mandiant. About CrowdStrike CrowdStrike , a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk — endpoints and cloud workloads, identity and data.Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value. About Mandiant, Inc. Since 2004, Mandiant® has been a trusted partner to security-conscious organizations. Effective security is based on the right combination of expertise, intelligence, and adaptive technology, and the Mandiant Advantage SaaS platform scales decades of frontline experience and industry-leading threat intelligence to deliver a range of dynamic cyber defense solutions. Mandiant’s approach helps organizations develop more effective and efficient cyber security programs and instills confidence in their readiness to defend against and respond to cyber threats.Join the conversation.

Read More

Spotlight

Distributed denial of service (DDoS) malware and tools threaten an organization's Internet-facing systems. This technical brief covers DDoS-enabled malware and several DDoS-specific tools, their capabilities and the network indicators they generate while performing the attack methods. It includes new attack vectors observed in 2013 with regard to highly publicized and targeted DDoS attacks.

Resources