Magazine menu Close Magazine menu

cyberattacks

Latest stories

cybersecurity new team sport

Why cybersecurity is the new team sport

  • min read
    • The pace of technological change is accelerating, and we readily adopt its many advantages. But despite this massive technological change, approaches to the threats it brings have changed little. The result is, we're losing the battle against constant attacks and breaches. For CEOs and Chief Information Security Officers (CISOs,) history may supply an answer – not in the form of technological genius, but in the form of humanity. Our recent history and deepest past show why cybersecurity must become the new team sport. The futuristic wild west of IT When I started working with computers in the early 1980s, they were controlled by men with beards in woolen tank tops. They ruled from a refrigerated IT throne – refrigerated because the IT team would often share the room with servers that need to be kept cool – knowing everything that went on in their realm. If something happened that was not allowed, it was fixed and hidden from the outside world with a combination of embarrassment and corporate secrecy. Today, we're in more of a futuristic wild west. The business perimeter contains many more applications, devices and entry points. Specialist 'gun slingers' – in the form of CISOs – have the IT administrator's security responsibilities. Each tries their best to cope with the onslaught of potential threats – anything from a nation-state attack to an employee accidentally sending data somewhere they shouldn't. Start-up mentality not all it's cracked up to be "Fail fast" and "move fast and break things" are often hailed as mantras of tech start-up success. But history also shows bad people have these same mentalities. They don't worry about due diligence or putting new ideas and technologies through rigorous testing. They try anything they think will work without considering if it will breach compliance. Meanwhile, budget, resources and red tape often tie CISO hands. They can feel held hostage by a board that doesn't understand the need for rapid reaction to combat the latest advance in 'dark tech.' We've seen this challenge before Up to now, I've described a futile, dystopian, 'Mad Max' world. But I think the battles CISOs fight today are our history, not of our future. Companies, and those in cybersecurity, often call their critical data and intellectual property the 'crown jewels,' referencing the ceremonial treasures acquired by English kings and queens. Those crown jewels are protected by thick walls, with guards and few entry points – like how IT administrators guarded our data back in the 80s. CISOs are inevitably 'outgunned,' under-resourced and underfunded in a battle against an agile and risk-indifferent enemy. So how do we 'fight the good fight' and win? Again, history has answers. Early 1900s business theorist Harrington Emerson is sometimes paraphrased, "Methods are many, principles are few. Methods may change, but principles never do." So let's go back to first principles. We're stronger together Humans first formed settlements as they started farming some 14,000 years ago. Having individuals in these settlements with different skillsets and abilities facilitated their growth. Some of us have an aptitude for the cerebral, like designing and inventing. Others are more physical, excelling in building and protecting. Settlements developed when we used complementary skills to advance a common goal, like making a safer, more prosperous place to live. Settlements collaborated – sometimes merging, sometimes building coalitions. And in times of crisis, while a few favored 'everyone for themselves,' most joined together for the greater good. Charles Darwin said, "It is the long history of humankind (and animal kind, too) that those who learned to collaborate and improvise most effectively prevailed." History has countless examples of international teamwork, from expeditions into unchartered territory to the allied nations of World War II, and more recent history. COVID-19: Each taking on a little During the recent COVID-19 pandemic, as individuals, we took precautions to keep ourselves and our families safe. But our actions of self-isolation, social distancing and complying with lockdowns knowingly served to protect society. Some countries legally enforced these measures. In others, it was a request. Regardless, most adhered, each playing their part by taking on a little of the responsibility to keep everyone safe. Eventually, the infection rate dropped and with much help from modern medical science, the world could open up. During the pandemic, countries teamed up, sharing information about infections – different strains, different consequences and symptoms. The data grew as individuals and teams combined findings, leading to the creation of vaccines to reduce the impact of the virus. It didn't stop there – sharing goes on, so vaccines can be tweaked to ensure continued efficacy. Extrapolating from this, the roadmap for cybersecurity should see the CISO as part of a team – not just within one organization, but within a global network, openly sharing intelligence and insight. On the other side of the planet, a CISO who has seen similar adds more context. As the chain passes from CISO to CISO, value increases. Quantity and depth of data grow, like crowdsourced security. This level of open collaboration may sound far-fetched, but intelligence agencies worldwide have shared information on threats similarly since September 11, 2001. This operating model may be closer than we think. CISOs already attend lunches or drinks where they swap 'war stories' under the Chatham House rule: You may use the information, but you may not disclose its source. Cybersecurity researchers in different companies and institutions worldwide combine their findings, writing shared reports. We already collaborate this way, instinctively reaching out for help, as we did in the days of early human settlements, but mostly we do it individually. Corporate legalities and organizational culture tend to restrict rather than encourage inter-company information exchange – it doesn't have to be that way. History shows collaboration naturally happens between groups with a common cause, and today is no different. By encouraging CISOs, staff and researchers to exchange knowledge and skills through a system for sharing threat information, we can nurture the communication of cooperation. We are better together, and together we can play the new team sport of cybersecurity.
managed-endpoint detection response

How to know what level of endpoint protection you need

  • min read
    • Endpoints – meaning, any end of a digital communications connection, like servers, laptops and mobile devices – are cybercriminals' favorite way to get inside your infrastructure. Market data analysis firm IDC's 2019 study found 70 percent of breaches started on an endpoint. There are a few types of threats: traditional, complex or advanced, and targeted or advanced persistent threats (APTs.) Classic Endpoint Protection Platforms (EPPs) do a great job at protecting against traditional threats like malware, but complex or advanced threats are becoming more common as more cybercriminals get hold of advanced tools. Those digitizing their https://www.kaspersky.com/enterprise-security/endpoint-productbusiness also often want to add a few more security strings to their bow. And these days, cybercriminals aim advanced and complex threats at all kinds of businesses, not just household-name companies and nation states. That's why adding Endpoint Detection and Response (EDR) to your EPP is fast becoming the standard. And then, Managed Detection and Response (MDR) offers a way to achieve the same protection in a different way. We'll cover what these advanced options do, their benefits and which types of organizations need them. What is endpoint detection and response (EDR) and when do you need it? Once you've got an EPP you're happy with, think about whether you need EDR on top. EDR offers organizations of all sizes greater ability to protect themselves against complex and advanced threats. Although they're less common than traditional threats, they're costly and disruptive to business. EDR gives you better visibility of and instant response to complex threats. It continually monitors endpoints, aiming to identify, investigate and respond. Your EDR may include tools like advanced detection engines, real-time analytics and the ability to hunt, investigate and centrally respond to evasive threats across the protected infrastructure. There should be applied threat intelligence and visibility into endpoints. Level up your endpoint protection with detection and response gives a full list of what to expect. EDR gives you tools for visibility, investigation and response. Your team can see what's happening on all endpoints and understand the scale of the threat. Investigation capabilities let you understand the root cause of a threat. Threat-hunting tools let your cybersecurity experts actively seek out any threats hiding in your infrastructure. After detecting and analyzing the threat, a fast response matters. Each organization is different. While some might have extensive cybersecurity expertise, others need a simpler solution. If your business has in-house cybersecurity expertise, you may benefit from better threat discovery, threat hunting and centralized incident response, such as Kaspersky Endpoint Detection and Response, also available as part of Kaspersky Anti-Targeted Attack Platform. Alternatively, Kaspersky Endpoint Detection and Response Optimum is a simpler solution for the IT department without cybersecurity specialists on hand. When do you need managed detection and response (MDR?) EDR provides advanced defensive capabilities, but you need to have your own cybersecurity experts to use it. MDR, on the other hand, means external experts manage your defense. With MDR, skilled professionals give you continuous protection 24 hours a day, seven days a week. It's ideal for organizations that struggle to find expertise or with limited in-house resources. Many organizations that opt for MDR are small- to medium-sized. For large organizations, MDR means you can outsource detecting, validating and prioritizing incidents rather than having as many cybersecurity specialists in house. If you're not sure whether EDR or MDR is best for your business, this infographic lays out the benefits of each. Endpoints are often vulnerable because they're what we use to create, communicate and store information. Our people using them can be manipulated by social engineering or make the wrong decision during moments of inattention, so security awareness training will help strengthen your endpoint. But as threats increase, your EPP may not be strong enough. That's why EDR is fast becoming the new standard. If you don't have the cybersecurity expertise in house, or want to free them up, MDR lets you bolster your security without the struggle of bringing new people on board.
endpoint detection response automation

Level up your endpoint protection with detection and response

  • min read
    • Effective – and cost-effective – cybersecurity is an art of balance. Complex cyberthreats are becoming more common, but every organization faces different risks. How likely are you to be attacked and by which threats? How should you use your time, money and resources to address these? How much expertise do you have, and how much could you expand it? Getting these answers right is where minimizing cybersecurity risk and improving efficiency begins. Recently, having more employees working from home has highlighted the importance of endpoint protection. The growing incidence of more disruptive advanced and complex threats adds further concern. Organizations of every size need safe and reliable ways to communicate and share information. But that's not all. Many businesses now find they're at greater risk now attacks are more complex and frequent so they're looking for a more advanced security tool: Endpoint Detection and Response (EDR.) All EDR products aim to better identify, investigate and respond to advanced and complex threats like ransomware and fileless threats. It's an extra layer on top of endpoint protection that's continuously looking for and responding to advanced threats. What does EDR do? EDR can have a range of capabilities, depending on the product and vendor. There may be a detection engine, for example, analyzing threats using machine learning and executing possible threats in a sandbox. It may include a real-time analytics engine, monitoring memory and searching for behavior patterns. The most important EDR feature may be visibility into your endpoints. With visibility, you can investigate past attacks or current threats on endpoints. You can involve cybersecurity experts in threat hunting using advanced tools. And once you've identified and analyzed threats, you can respond fast, preferably in an automated way, saving time and resources. EDR doesn't replace your Endpoint Protection Platform (EPP.) If you feel your EPP isn't up to the job, upgrade it before you add EDR into the mix. Multi-layered threat response saves time Cyberthreats are best addressed with multiple layers. As the threat enters the host, an endpoint protection engine uses approaches like structural machine-learning models and behavior analysis to identify and neutralize traditional threats. EDR comes into play after EPP has filtered out most malware through these automated processes. It lets you concentrate resources on the more dangerous complex and advanced threats. Using EDR's investigation, threat hunting and response capabilities, your cybersecurity team can efficiently address these more serious threats. For example, when a threat is detected, a cybersecurity officer can perform a root cause analysis to see if it's a complex threat and find out where it came from. If it is a complex threat, they can respond right away and set up a task to search for similar threats, automatically applying the same response. According to Kaspersky's IT Security risks survey, 28 percent of companies using EDR could detect cyberattacks immediately after or within a few hours of an incident. How EDR saves time and resources Automating and simplifying processes saves time and resources, and improves security. Even partial automation leads to faster responses, which could be crucial to mitigate a more serious impact for cases like ransomware. Together with a more simplified workflow, less will get missed because of 'alert fatigue' from dealing with many similar incidents. You can then give more attention to incidents that need human intervention, using EDR's enhanced visibility, investigation and response capabilities. You should see a happier IT team, freed from routine tasks and able to work better. They can deal with complex incidents quickly and efficiently, significantly improving your security and preventing business disruption. Choosing the right EDR for your business All EDR tools on the market are different. Some provide better threat hunting, while others focus on streamlining workflow and better integration. Here are some examples of Kaspersky products that could help. For better threat visibility, investigation and response capabilities when your IT department doesn't have access to highly skilled security officers, use Kaspersky Endpoint Detection and Response Optimum. For better threat discovery, threat hunting and centralized incident response when you have a specialized security team, try Kaspersky Endpoint Detection and Response, perhaps as part of Kaspersky Anti-Targeted Attack Platform. The broadening landscape of advanced and complex attacks has made many companies reexamine their endpoint protection. These businesses realize they need to do more to reduce the risk from cyberattacks. In a market where there's strong competition for cybersecurity skills, EDR capabilities help make the best use of your team's abilities. Investigation tools and visibility into all endpoints are intelligent additions to your endpoint security.
business reputation data breach

How to strengthen your IT security operations after a data breach

  • min read
    • The aftermath of a data breach can be measured in many ways, depending on who you are. For those outside the organization, the public perception that an organization has been compromised, known as reputational damage, is often quoted as the most significant long-term aspect of a data breach. To measure the effect of a breach on a company's health, Comparitech analyzed the long-term impact on the share prices of breached companies. This research is nuanced and worth reading in full, but one of the headlines from the September 2019 edition is telling: after about a month, share prices rebound and catch up, on average, to NASDAQ performance. And most importantly, the companies keep operating. The companies in the analysis include many brands we continue to use every day in our digital lives: Yahoo!, eBay, LinkedIn and Facebook. So what's the real cost of a data breach? According to research by Adrian Sanabria, a well-regarded former senior analyst in the information security community, there are a relatively small number of companies that are hacked out of existence. Examples of severe consequences for companies of all sizes are few and far between. So for the board, it's easy to under-estimate the impact of a breach by looking at share price or sales targets alone. However, the real impact and costs from loss of continuity go much further. For Kaspersky's Global Corporate IT Security Risks Survey, organizations of all sizes across the globe were asked about the broader costs they have to deal with when recovering from attacks. For enterprises, it's now, on average, a cool $1.4M to clean up a data breach. Beyond the financials, if you want your decision-makers to see all the consequences of a compromise, there are other factors to review. These are harder to define in absolute numbers, but they all affect the company's performance and reputation. Keep these points in mind when assessing risk or advocating for an additional budget for defense. Internal reputation damage The internal reputation of the security team can be hit hard. Regardless of the actual cause, they can be seen as responsible. This has even more risks to the long-term success of the team: Loss of continuity A CISO (Chief Information Security Officer) is often expected to resign after a significant breach; they carry the can as their position is viewed as taking responsibility for the failure. I would argue the removal of a single leader as a way to solve often systemic and complex problems is a strategy only good for Hollywood villains. Next time you're at the cinema, notice how successful their organizations are by the end of the movie. Scapegoating your CISO is an unwise strategy. It will take months, or even years, for the new CISO to be hired then acquire the knowledge of their predecessor, the established relationships, ways of working, and so on. The new CISO, as with any incoming C-suite leader, tend to make changes to make their mark, which can cause further disruptions in continuity and additional strains on the InfoSec team. Low morale Morale is tricky to measure and account for, but from the conversations I have with members of the InfoSec community, your IT staff can be despondent after a breach, particularly the security team. This may be in part due to the implication that their efforts didn't protect the company, and in part, due to burnout from the increased efforts to recover after a breach. The negative effect on Equifax staff is a particularly good example. Individuals were criticized in social media and even received death threats, and without appropriate support from the organization to safeguard team member's reputations and mental health. Increased auditor scrutiny For both your internal audit teams and the third party auditors you bring in, they will all increase their efforts to ensure they're not seen as missing something, and therefore being the party to blame for any future compromise. That sampling approach you used before that saved hours of unnecessary analysis? That won't be allowed anymore. More internal bureaucracy Organizations often respond to a breach by imposing new requirements on all staff, rather than by making the existing requirements easier to understand and follow. This may increase your employees' chances of understanding and following instructions or their willingness to bypass them to get their job done, which, in turn, could increase your organization's exposure to risk. So what should you do differently? With all these potential consequences and risks, here are some tactics you could try to have a happier ending after a breach. Keep your CISO Unless the incident can be directly attributed to an irreversible failure on the part of the CISO, don't fire them to appease customers or shareholders or any other aggrieved group holding a short-term view. Your CISO will have the experience and knowledge you need to see you through this issue. According to Kaspersky's 2019 survey based on more than 20 personal interviews with CISOs, unless the incident was directly their fault, the majority felt their employer would support them. Invest in building a cyber-aware culture Strengthen cyber-awareness training for all employees. This can help your employees work together more effectively in the face of a common enemy (cybercriminals), and appreciate the difficulties the security team faces keeping the organization safe. Plan your breach recovery strategy The best time to prepare for your recovery from a breach is before it happens. Take one step today, maybe start to look at how your organization would detect a breach, or how you can test the detection capabilities you have. Re-examine your existing strategies. For example, Kaspersky's IT Security Economics report highlights the benefits of having a DPO (Data Protection Officer) and SOC (Security Operations Center) in reducing the financial impact of an incident. When estimating impact, at any point before or after an incident, make sure you and your stakeholders appreciate these factors and consider them alongside the financial assessment. Ensure everyone has all the facts, not just those that are easiest to quantify. Any organization today has to "assume breach," from the smallest company keeping an offline backup away from the office to the largest enterprise looking to implement an advanced defense solution stack, which includes EDR (endpoint detection and response) and an anti-targeted attack solution. But a side effect of this wise approach can be an undue pessimism about the effect of being compromised. By giving your CISO confidence to make longterm plans because they'll survive short term problems, by improving the security awareness within your organization and by preparing in advance, you can make it through a compromise relatively unscathed. With a more planned and supportive approach to safeguarding the reputation and strengthening the performance of your InfoSec team, you will build a more secure and resilient organization in the long run. This article was published in Jan, 2020.
cyberthreats as a physical stronghold

Whether protecting the physical or the cyber world, savvy security works the same way

  • min read
    • There's not much difference between an advanced cyberattack and a thief breaking into your company's premises. A corporate building has a fence, entrances, corridors, offices and server rooms. IT infrastructure is similar, only here we have a network, workstations, servers, virtual machines and so on. If someone wants to steal from, spy on or disrupt a business, they must sneak into its territory or its network. Judging by the massive security breaches that have dominated the headlines in the past year, attackers favor the latter these days. Fighting targeted cyberattacks has a lot in common with physical protection. Let's consider the three fundamental principles for dealing with a physical breach, and see how these can improve a company's cyber defenses. 1.    Realize you're under attack Before dealing with any attack, you need to know you're under attack. That means noticing suspicious activity and linking it to a plot. Let's say you're at the office late in the evening, and the alarm system goes off on the second floor. A security officer goes to find out what's wrong. At the same time, a pizza delivery person arrives and hands a pizza over to someone from accounting, gets their money and leaves. That's all perfectly normal, but if you look closer, you may notice a string of coincidences. The alarm went off at about the same time a few days ago, accountants (unlike IT staff) don't typically order pizza, and this one usually complains about gluten intolerance. Putting these clues together, a perceptive security officer might ask some questions. The same principle applies to detect cyberattacks. Separate activities inside the network might not, on face value, show an organization is under attack. But look at the bigger picture, and it might suddenly seem critical to investigate. Threat management and defense do just that: automatically detects and flags malicious patterns behind separate, simpler, seemingly unrelated activities in the network. 2.     Start investigating Coming back to our mystery pizza scenario, to begin investigations, the security officer could go to the camera room and look through the recordings. She would know there are smart cameras all around, letting her see any corner of the office at any time, and the records can't be erased. On the footage, the security officer sees the pizza delivery person jumped out of a black minivan… not the usual vehicle for pizza delivery, right? The gluten-intolerant accountant didn't order a pizza; he ordered spy equipment that he's planning to plant under the CEO's desk. Like smart cameras, anti-targeted attack software reviews network traffic for security purposes. Endpoint Detection and Response (EDR) software watches for cyber-threats too. It sees what's going on at end-user devices (desktops, laptops, mobile devices) and gives the retrospective data needed for an investigation, even when devices are compromised, or when cybercriminals have destroyed or encrypted data to cover their tracks. 3.     Know where to look To spot the right things at the right time, you need to know where to look. That's why it's so crucial that security teams in large corporations get the right training and experience. There's also information. Access to police reports and databases is helpful in physical corporate security. In the scenario I've described, the security guard could run the minivan license plate numbers through the police system to see if it's been stolen or used in similar operations. And once again, the same applies to investigate cybersecurity incidents. You can use threat intelligence data tailored to your industry or location, and you can get specialized training for your IT security team; you can even outsource cyberthreat protection to an experienced third party. Build your cyber fortress We've seen that in many respects, you can use the basics of protecting your premises when building your cyber fortress. With these solutions and services combined, your teams will get ahead of the cybersecurity agenda. You will always have the answer to even the most advanced attacks.
picking right tech

When there’s too much choice in tech, get your focus right

  • min read
    • We have too much tech and too much choice. Many of tech's challenges are in choosing the product, and only afterward realizing its limitations and the consequences of our choice. I understood this only recently, after working in tech nearly 40 years. I don't know why it's taken me so long to make this brilliant deduction. I enjoy helping others make these choices. Almost every day, I'm either writing, researching or discussing tech choices for others. But just as the shoemaker's children go barefoot, my own tech choices are often fraught with indecision, or worse, no decision. It all rests on human foibles Yesterday, I was on a phone call with a friend who is as technical as they come. He helped create some of the internet's early protocols – ways transferring data between networks that more or less create the internet. We were commiserating about the quirkiness of the video conferencing application Webex when trying to support a hundred-person conference call. It's fine for the video conference itself. The video and audio quality are usually solid. But the 'soft support' rests on the foibles of how humans use tech, like holding a practice session for the conference, notifying everyone of the call and sending out the slide deck. It's real work to explain what to do to organizers and how to create standards to make the call go smoothly. Learn from the 1980s' portable PC wars Let's draw a dotted line back to when I worked in the bowels of the end-user IT support department of Gigantic Insurance in the early 1980s. We bought PCs by the truckload to place on the desks of thousands of IT staff who, until then, had a telephone and, if they were lucky, a mainframe terminal. We bought IBM PCs because back then because that was the only choice for corporate USA. Then Compaq came along with something IBM didn't yet have: a portable PC. Well, sort of portable. It was enormous. It weighed about 30 pounds (14 kilograms) and didn't quite fit into airplane overhead lockers. When Compaq announced their portable PC, selling for more than $5000, our executives felt conflicted. Our IBM sales reps, who had invested many years in golf games with them, were trying to convince us to wait for a year until the IBM portable PC would come to market. But once we got our hands on the IBM prototype, we could see the Compaq was superior. It was already available. It was lighter, smaller and ran the same apps. We recommended Compaq and started buying them in droves. That was the start of the 'clone wars' that unleashed a new era of technology choices on the corporate world. By the time IBM finally came out with their portable PC, Compaq had improved theirs again, so they kept ahead of IBM. It's why we get frustrated when we finally choose our technology and then live with the consequences. Knowing which questions to ask How does this apply to buying business cybersecurity products? Many of us are still looking at the wrong things when deciding what to buy, or don't know which questions to ask. Know what problem you want to solve, and you'll choose your tech differently. Here are some common examples. Have you picked an email encryption product or VPN based on something other than ease of use? Don't be surprised when your staff rebel against using them. Are you running regular phishing awareness programs and cybersecurity training across your business? Phishing is one of the most destructive attacks, and getting users to understand their behavior is risky is the best prevention. Have you recently tested your disaster recovery procedures to find out why your backups don't protect key data elements? Don't wait until you have a ransomware situation to find out you missed a collection of files. Spend the time now to find these and ensure they're well protected. Can you find out if your cloud storage is secure enough? Do you even know which clouds you're using? Do the hard work now rather than waiting for something bad to happen. Have you examined your whole software supply chain? It's easy to overlook a few spots and then suffer data loss, ransomware or denial of service attacks. You might find personal Github pages, or resellers running tools whose security you can't easily verify. The time to work this out is now. Going beyond the specs means taking a step back and throwing out assumptions. Before you start looking at solutions, do the hard work of understanding the problem you really need to solve. This article reflects the opinion of the author.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries