Stalwart consumer advocacy group says it intends to educate people about cybersecurity and how to choose the safest products.

Consumer Reports (CR) has announced it will expand its advocacy work to help people protect themselves from cyberattacks, thanks to a $5 million grant from Craig Newmark Philanthropies.

The new initiative will scale up its capacity to evaluate a range of cyber threats, including phishing, ransomware, and other malware, as well as how to protect online services and endpoints, such as Internet of Things (IoT) devices and mobile products, from compromise. The imperative to educate consumers on how to choose the most secure solutions is "urgent," the group said in its announcement. 

The new Consumer Reports cybersecurity initiative will include an experimental "nutritional label" to help shoppers understand various products' security and data-collection practices, in addition to free digital tools and the expansion of its existing Security Planner to include personal cybersecurity, the organization said. 

"Today, we know that consumers are increasingly vulnerable to cyber threats, and the tools to secure our data are often complicated, or they don’t even work," said Marta Tellado, DR president and CEO, in an announcement of the new effort to push consumer cybersecurity awareness. "This new initiative will help us educate people so they can better protect themselves, and stand up to demand that industry and government do better.”

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Consumer Reports Launches IoT Cybersecurity 'Nutrition Label'

Advice from women and nonbinary security leaders on creating well-rounded security teams, stronger CISO leadership, and a more resilient industry.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

10 No-BS Tips for Building a Diverse and Dynamic Security Team

**Woburn, MA – June 1, 2022 —** The new release of Kaspersky’s Threat Intelligence (TI) Portal unifies all vendors’ TI services, sources and cyber-reconnaissance capabilities in a single and convenient interface. The updated portal supports real-time search across various threat intelligence resources, including Kaspersky’s databases, Dark Web and Surface Web. New features include the visualization of cyber-investigations and extended opportunities for analysis of complex malicious objects.

Threat intelligence, which provides insights on the threat landscape and allows organizations to anticipate risks, has become one of the most evolving and in-demand specialties as confirmed by IT security leaders’ surveys and market predictions. However, the diverse set of TI capabilities and the variety of available sources and services have made it difficult for security specialists to assemble a unified threat intelligence solution which matches their needs.

The renewed Kaspersky Threat Intelligence Portal\[1\] is a single pane of glass for threat intelligence. In addition to cyberthreat data, it also delivers validated information from external sources and new features that facilitate incident investigation as well as detection and attribution of previously unseen malicious objects.

**Unified search across all threat intelligence resources**

Kaspersky TI Portal now supports search across different sources\[2\], all in a single UI, making access to valuable insights easily accessible. Through real-time master search customers are able to get information across Kaspersky’s databases, including APT, crimeware, ICS and Digital Footprint Intelligence reports and actor profiles as well as across Dark Web, Surface Web and validated OSINT IoCs sources\[3\].

New **Dark Web search** offers instant access to insights from a comprehensive range of deep and dark web sources allowing organizations to get tailored evidence of planned attacks, discussions around vulnerabilities and successful data breaches in order to reduce the attack surface, secure online brand value and take appropriate actions.

To offer security practitioners a reliable source of information about global security events that can potentially or are already threatening company’s assets, brand or organization, Kaspersky TI Portal introduces **Surface Web search**. The service allows investigators to search for security-related news, discussions or other content across a validated range of relevant open web sources, such as theme-based newswires, blogs or forums.

**Better visibility for in-depth investigation**

Graphical visualization is an extremely useful tool for researchers when they are looking for indicators and try to find connections between them. The **Research Graph** introduced in Kaspersky TI Portal is designed to explore data stored inside the portal, discover threat commonalities and generate new related IoCs. It provides a clear picture of the relationship between web addresses, domains, IP addresses, files and other context encountered during investigations. It also allows for an in-depth view of information without losing the context of the conducted investigation.

**Complex threat analysis**

Kaspersky TI Portal delivers a unified interface for complex file analysis via a merged “Threat Analysis” tab that leads to Cloud Sandbox and Threat Attribution Engine (TAE), which now runs completely in the cloud. The tab offers access to the results of Dynamic, Static, Anti-Virus and Attribution analysis for objects considered suspicious, offering enriched Threat Intelligence within a single place and providing a powerful tool for faster detection of previously unseen malicious objects.

_“We see that customers are looking for a consolidated threat intelligence offering that can_ _deliver_ _a holistic and global perspective on the threat landscape as well as fit their specific needs,”_ comments Anatoly Simonenko, head of technology solutions product management at Kaspersky. “_Our renewed Threat Intelligence Portal meets these requirements as it unifies our unique and broad knowledge about threats with external threat data and allows companies to customize our offering by choosing services and sources that are most beneficial for their existing IT security function.”_

More information about Kaspersky Threat Intelligence Portal is available via this link

**About Kaspersky  
**

Kaspersky is a global cybersecurity company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 240,000 corporate clients protect what matters most to them. Learn more at usa.kaspersky.com.

Enhanced Threat Intelligence Portal Provides Consolidated Access to Kaspersky Threat Intelligence Expertise

Industry-first report finds zero trust segmentation eliminates 5 cyber disasters per year and saves $20+ million annually.

**Sunnyvale, CA — June 1, 2022 —**  Illumio, Inc., the Zero Trust Segmentation company, today released The Zero Trust Impact Report, the industry’s first research on market perspectives of Zero Trust strategies and the business impact of Segmentation technology. Conducted by The Enterprise Strategy Group (ESG), which surveyed 1,000 IT and security professionals in eight countries, the report discovered that 47 percent of security leaders do not believe they will be breached despite increasingly sophisticated and frequent attacks, broad adoption of Zero Trust technologies, and the proven business and security impact of Zero Trust Segmentation, which isolates workloads and devices across the hybrid attack surface to stop breaches from spreading. Key findings include:

*   **Severity and Frequency of Attacks Are Still Rising:** In the past two years alone, more than three-quarters of organizations surveyed (76 percent) have been attacked by ransomware and two-thirds (66 percent) have experienced at least one software supply chain attack. More than half (52 percent) believe cyberattacks will result in catastrophic breaches.
*   **Zero Trust is Now the Standard:** 90 percent state that advancing Zero Trust strategies is one of their top three security priorities this year as a way to improve cyber resiliency and reduce the rising threat of attacks turning into disasters.
*   **Segmentation is a Critical Pillar of Every Zero Trust Strategy:** 75 percent of segmentation pioneers, those who are classified as advanced users, believe purpose-built segmentation tools are critical to Zero Trust and 81 percent say segmentation is an important technology to Zero Trust.
*   **Zero Trust Segmentation Has a Quantifiable Business Impact:** Organizations that have adopted Zero Trust Segmentation as part of their Zero Trust strategy save an average of $20.1 million in application downtime, avert 5 cyber disasters per year, and plan to accelerate 14 more digital and cloud transformation projects over the next year.

“Catastrophic breaches keep happening despite another year of record cybersecurity spending. Money will not make the problem go away until security leaders move beyond the legacy approach to only focus on detection and perimeter protection,” said PJ Kirner, Illumio co-founder and CTO. “I’m shocked that nearly half of those surveyed in The Zero Trust Impact Report do not think a breach is inevitable, which is the guiding principle for Zero Trust, but I am encouraged by the hard business returns Zero Trust and Segmentation deliver. Zero Trust Segmentation is emerging as a true market category that is transforming business operations and strengthening cyber resiliency.”

**Attacks Abound in a Hyperconnected World**

Hyperconnectivity created by digital transformation has expanded the attack surface and exposed organizations to risks never faced before. While respondents have significant concerns about many attack types, supply chain, zero-day, and ransomware attacks top the list.

*   Respondents say software supply chain attacks (48 percent), zero-day exploits (46 percent) and ransomware attacks (44 percent) are the three threats that keep them up at night.
*   More than one-third of respondents (36 percent) have been the victims of a successful ransomware attack over the past two years.
*   82 percent of respondents who were victims of a successful attack paid a ransom (42 percent paid ransom directly; 40 percent paid via cyber insurance) with the average ransom netting $495,000.

**Organizations Must Assume Breach and Adopt Zero Trust**

A Zero Trust approach, rooted in an assume breach mindset, is the modern strategy to reduce risk and increase cyber resiliency. 52 percent of security teams believe that their organization is ill-prepared to withstand the cyberattacks to come (22 percent say a breach would “definitely” result in business disaster; 30 percent say it “probably” would be a disaster), but Zero Trust adoption is rising fast:

*   Nine in ten (90 percent) report Zero Trust is one of their top three cybersecurity priorities, and 33 percent say Zero Trust is their top cybersecurity priority.
*   39 percent of all security spending over the next 12 months is earmarked to advance Zero Trust initiatives.
*   Segmentation pioneers are nearly twice as likely to be able to stop breaches from spreading than peers who do not fully utilize segmentation (81 percent vs. 45 percent).  
    

A whopping 96 percent of buyers prefer technologies with best-of-breed capabilities as opposed to broad platforms. 75 percent of segmentation pioneers believe purpose-built segmentation tools are critical to Zero Trust.

**You Cannot Achieve Zero Trust without Zero Trust Segmentation**

Zero Trust Segmentation is a modern approach to stop breaches from spreading across hybrid IT, from the cloud to the data center. Today, a vast majority of respondents consider Zero Trust Segmentation essential to any successful Zero Trust initiative (81 percent), and the report found that segmentation pioneers:

*   Are 2.7X more likely to have highly effective attack response processes.
*   Are 2.1X more likely to have avoided a critical outage during an attack over the last 24 months.
*   Save $20.1M in annual cost of downtime.
*   Are able to free up 39 person-hours per week.
*   Avert 5 cyber disasters annually.
*   Are accelerating digital transformation for competitive advantage with 14 more digital and cloud transformation projects planned over the next 12 months.

For more information, download a copy of The Zero Trust Impact Report.

**Research Methodology**

In February 2022, Illumio commissioned ESG to conduct a 1,000-person global study on the current state of Zero Trust strategies and the impact of segmentation. The findings incorporate sentiment from senior information security and IT professionals across North America, Europe, Asia Pacific, and Japan.

**About Illumio**  

Illumio, the Zero Trust Segmentation company, prevents breaches from spreading and turning into cyber disasters. Illumio protects critical applications and valuable digital assets with proven segmentation technology purpose-built for the Zero Trust security model. Illumio ransomware mitigation and segmentation solutions see risk, isolate attacks, and secure data across cloud-native apps, hybrid and multi-clouds, data centers, and endpoints, enabling the world’s leading organizations to strengthen their cyber resiliency and reduce risk.

Zero Trust Research Reveals Nearly Half of All Security Leaders Do Not Believe They Will Be Breached Despite Increasing Attacks and Adoption of Zero Trust Strategies

Vectra offers a free of charge security assessment for your cloud tenant.

SAN JOSE, Calif. , June 1, 2022 /PRNewswire/ -- Vectra AI, a leader in AI-driven threat detection and response for hybrid and multi-cloud enterprises, today announced the launch of Vectra Protect, a posture management tool designed to discover and mitigate security risks in Microsoft 365 (M365). Vectra Protect combines 50,000+ hours of expert research and development with automation to analyze an organization's M365 security posture and provide customized implementation plans to remediate risk. To ensure all organizations, regardless of security staffing or resources, can have access to the solution, Vectra is extending a free sign-up for an Azure Active Directory scan until September 30, 2022.

With the accelerated use of M365 collaboration tools, which now have over 270 million users, cyber attackers are actively targeting access management tools like Azure AD to enter other SaaS tools and enterprise network assets. They then establish a foothold to launch ransomware attacks, steal intellectual property and gain unauthorized access to sensitive user data. With its scanning engine, Vectra Protect combines insights from the M365 Graph API with PowerShell module data to provide a truly holistic view into the integrity of every identity in an organization's M365 environment. As the only scan designed to uncover identity security issues in M365, Vectra Protect provides organizations with:

*   **Quick, actionable remediation insights:** With its multi-stage methodology, the scan provides organizations with actionable results within hours. Rather than hindering the security team with more alerts, the scan creates a comprehensive risk mitigation map that provides a path to implementation with clear guidance on risk and operational impact.
*   **Tailored cloud support:** Organizations can gain insight into the severity of vulnerabilities, material changes to their configuration state, the operational impact of the required solution, and the steps for remediation aligned to their applicable industry standards and regulatory requirements.
*   **Configuration correction and compliance:** Vectra Protect delves deep into the configuration complexities of M365, highlighting misconfigurations with clear context to guide companies to complete risk resolution and provide security teams with the proof they need to show their policies are effective and compliant.
*   **Confidence in collaboration:** By understanding areas where risks and configuration issues persist, organizations can fulfill the promises of cloud technology without creating unmanaged risk. Organizations can gain efficiencies in implementing and using SaaS tools like M365 by eliminating default settings and aligning operations, information technology, security, and audit teams on security priorities.

"Azure AD has become a large attack vector as cybercriminals look to exploit the lack of security controls and solutions currently available for the tool," said Aaron Turner, CTO of SaaS Protect at Vectra AI. "Organizations must understand that Microsoft's default security settings are not specifically tailored to their business operations or industry, which introduces waves of unnecessary risk. Combining this with the constant changes in M365, both internally and externally, leaves a host of potential vulnerabilities and configuration issues that organizations are responsible for correcting. Vectra Protect helps unravel this complexity to deliver the visibility and assurance organizations need to protect these essential business tools."

The free Vectra Protect for Azure AD scan, a value up to $50,000, will be readily available to any M365 customer operating in any M365 environment\*. The scan focuses on a common foothold for unauthorized access and risk: access management in the active directory. Turner will be showcasing the technology and enumerating how to protect the M365 tenant and hunt for threats during RSAC 2022 in San Francisco, CA. You can register for his session here.

For more details about Vectra Protect for Azure AD and to request a free scan, please visit: https://www.vectra.ai/azure-ad-scan

\*Exclusions apply.

**About Vectra AI  
**Vectra® is a leader in cyber threat detection and response for hybrid and multi-cloud enterprises. The Vectra platform uses AI to detect threats at speed across public cloud, identity, SaaS applications, and data centers. Only Vectra optimizes AI to detect attacker methods—the TTPs at the heart of all attacks—rather than simplistically alerting on "different". The resulting high-fidelity threat signal and clear context enables cybersecurity teams to respond to threats sooner and to stop attacks in progress faster. Organizations worldwide rely on Vectra for cybersecurity resilience in the face of dangerous cyber threats and to prevent ransomware, supply chain compromise, identity takeovers, and other cyberattacks from impacting their businesses. For more information, visit vectra.ai.

Help Organizations to Mitigate Risk in Microsoft 365 with 'Vectra Protect'

Rising threat of data breaches and ransomware attacks drives need for complete and accurate real-time information about devices and their risks.

ANTA CLARA, Calif., June 1, 2022 /PRNewswire/ -- Ordr has raised an additional $40 million to meet the growing need for organizations to understand, manage, and secure the growing number of connected devices in their environment, including Internet of Medical Things (IoMT), Internet of Things (IoT), and Operation Technology (OT). The funding round was co-led by Battery Ventures and Ten Eleven Ventures, with participation from new investor Northgate Capital and continuing investors Wing Venture Capital, Unusual Ventures, Kaiser Permanente Ventures, and Mayo Clinic. Other investors in Ordr's Series C include Silicon Valley entrepreneurs René Bonvanie, former CMO of Palo Alto Networks, Dan Warmenhoven, former Chairman and CEO of NetApp, and Dominic Orr, former Chairman and CEO of Aruba Networks. With this funding, Ordr has raised more than $90 million to date.

Ordr addresses two key enterprise initiatives associated with a growing reliance on and adoption of connected devices: **digital transformation** and **Zero Trust**. Each new device connection increases an organization's attack surface, along with the potential for a breach or ransomware attack. In industries such as healthcare and manufacturing, a cyberattack impacting an IoT device can easily disrupt the entire business or become a life-threatening situation. For organizations to move quickly from "detection" to "response" requires insights into the compromised device, where it's located, and what policies can be applied.

Ordr has raised an additional $40 million in Series C funding.

Ordr offers complete and accurate asset visibility, automates and enforces Zero Trust policies, and accelerates incident response by hours with insights into devices and risks. As a result, Ordr experienced more than **140% year-over-year growth** in new customer revenue in its most recent quarter ending on March 31, 2022, is **deployed in 3 of the world's top 6 hospitals**, and has been adopted across more than **150 manufacturing sites**.

"Ordr has built a platform that not only solves an important market issue - the need to definitively understand and protect what is connecting to your organization's network - but is truly scalable to keep pace with the speed of today's businesses. We've worked with Ordr's team and seen firsthand how well they've executed against aggressive goals. This additional funding will accelerate Ordr's market leadership and success in the market," said Dharmesh Thakker, general partner at Battery Ventures.

"We believe the connected device security market needs a strong, open, and independent player that prioritizes customer success, focuses on time-to-value, and integrates with all the key components of a customer's security and network infrastructure. This funding validates our best-in-class approach and solidifies our leadership in the market," said Greg Murphy, Ordr CEO.

Ordr plans to use the Series C funding to accelerate its sales and marketing efforts, especially in vertical markets such as **healthcare**, where the company has been named a market leader in the Healthcare IoT security industry by analyst firm KLAS Research for three consecutive years. The company will also look to further capitalize on steadily increasing demand from **manufacturing and financial services**, expand its channel and partnership programs, and accelerate investments in customer success.

"In order to advance their digital transformation goals, every organization needs to enable the visibility and security of connected devices, including IoT, IoMT, and OT. Ordr is a much-needed innovator in the market, with the ability to not only deliver granular visibility into devices, risks, and behaviors, but also automate and enforce Zero Trust policies to secure these devices from attacks," said Justin Stebbins, partner, Northgate Capital.

"As an early investor in the company, I have witnessed Ordr's impressive product evolution and growing traction within critical sectors, including healthcare, manufacturing, education, and extended enterprise IoT. They have developed one of the most scalable and technically robust platforms in the market, and some of the world's leading organizations depend on it to fulfill important security needs and deliver business insights. The time is right to accelerate the company's mission to be the leader in connected device security. We believe in their success and look forward to the next chapter." said Alex Doll, Founder and Managing Partner of Ten Eleven Ventures.

Since its last round of funding, Ordr has experienced tremendous growth, coinciding with an increased understanding of the organizational risk represented by unknown connected devices. Some additional highlights since the last funding round include:

*   Named a KLAS Research Healthcare IoT Security Market Leader for an unprecedented three years in a row.
*   Named a Representative Vendor in the 2022 Gartner Market Guide for Medical Device Security Solutions for the second year in a row.
*   Continued product innovation and market leadership in the healthcare industry with the launch of Clinical Defender, streamlining management of connected medical devices.
*   Enhanced the company's integrations with Cisco, making it even easier for Cisco customers to roll out Ordr across their network environments.
*   Launched the Ransom-Aware Rapid Assessment to help companies quickly and accurately assess their ransomware risks.
*   Successfully achieved SOC2 compliance to keep customer data secure.

"Data privacy and security are imperative IT initiatives within the healthcare industry with connected device security in particular as a critical need given the increase in connected devices in health care facilities. Kaiser Permanente Ventures is pleased to continue its investment in Ordr as a key technology leader in this space, to help protect connected devices automatically, preemptively and at scale across the enterprise," said Chris Stenzel, executive managing director, Kaiser Permanente Ventures.

Continuing the momentum of the past year, Ordr today also strengthened its executive team with the addition of Paul Davis as the company's new vice president of customer success. Paul has decades of experience in customer-facing roles at Axis Security, Splunk, Cisco, and other leading organizations. At Ordr, he will be responsible for managing customer relationships and ensuring the successful implementation and use of Ordr technology.

**About Ordr**

Ordr makes it easy to secure every connected device, from traditional IT devices to newer and more vulnerable IoT, IoMT, and OT. Ordr Systems Control Engine uses deep packet inspection and advanced machine learning to discover every device, profile its risk and behavior, map all communications and protect it with automated policies. Organizations worldwide trust Ordr to provide real-time asset inventory, address risk and compliance and accelerate IT initiatives. Ordr is backed by top investors including Battery Ventures, Wing Venture Capital, Ten Eleven Ventures, Northgate Capital, Kaiser Permanente Ventures, and Unusual Ventures.

For more information, visit www.ordr.net and follow Ordr on Twitter and LinkedIn.

SOURCE Ordr

Ordr Secures $40 Million in Series C Funding to Answer Increased Demand for Connected Device Security

EZ-NAS also provides add-on data backup, cloud connector and ransomware anomaly detection.

Sunnyvale, Calif., June 1, 2022 – StorCentric, a data-centric security company, offering a comprehensive portfolio of secure data management solutions, today announced the general availability (GA) launch of Nexsan EZ-NAS, network attached storage (NAS). Featuring an easy to configure 1U form factor and four drives with up to 72 TB of raw capacity and 1.5 GB/s of throughput, the new EZ-NAS array is ideal for small and medium sized businesses (SMBs) and large enterprises’ edge deployments.

The Nexsan EZ-NAS platform delivers advanced enterprise-class features such as in-line compression, AD support and data-at-rest encryption. EZ-NAS also comes with the Retrospect software for optional add-on services, including data backup, cloud connector and ransomware anomaly detection.

“The new Nexsan EZ-NAS product stands apart from every other solution in its class because of its ease of use, functionality, and price point,” said Rommel Caparanga, Technology Director, TIM Engineering Systems Solutions Corporation. ”This platform is what our customers have been asking for as a solid NAS solution to accommodate current and future data management needs. Further, the reliability of the brand speaks for itself.”

“The new EZ-NAS, which delivers Nexsan’s award-winning enterprise storage in a form factor and at a price ideal for SMBs and edge use cases, is the perfect fit for many data center applications such as edge repositories, digital video and media workflows, as well as video surveillance deployments,” said Surya Varanasi, CTO, StorCentric. “EZ-NAS can also protect high-value data from the unexpected, as a file backup target. With the optional Retrospect software license, the EZ-NAS enables secure backups, data sharing and disaster recovery use cases.”

To learn more about the Nexsan EZ-NAS, please visit: nexsan.com/ez-nas.

Tweet this: @StorCentric Launches EZ-NAS - Network-Attached Storage for SMBs and Enterprise Edge Deployments https://www.nexsan.com/nexsan-news-and-press/ #Affordable #Easy #Management #NAS #Data #Backup #DataServices

**About Nexsan**

Nexsan® is a global enterprise storage leader, enabling customers to securely store, protect and manage business data. Established in 1999, Nexsan has earned a strong reputation for delivering highly reliable and cost-effective storage while remaining agile to deliver purpose-built storage. Its unique and patented technology addresses evolving, complex enterprise requirements with a comprehensive portfolio of unified storage, block storage and secure data protection. Nexsan is transforming the storage industry by turning data into a business advantage with unmatched security and compliance standards. It is ideal for a variety of use cases including Government, Healthcare, Education, Life Sciences, Media & Entertainment, and Call Centers. Nexsan is part of the StorCentric family of brands. For further information, please visit: www.nexsan.com.

**About StorCentric**

StorCentric provides world-class, award-winning, and data security-focused data management solutions. The company has shipped over 1 million storage solutions and has won over 100 awards for technology innovation and service excellence. StorCentric innovation is centered around customers and their specific data requirements, and delivers quality solutions with unprecedented flexibility, data protection, high-performance and expandability. For further information, please visit: www.storcentric.com.

StorCentric Launches Nexsan EZ-NAS -Network-Attached Storage for SMBs and Enterprise Edge Deployments

AI and ML are important SecOps tools, but human involvement is still required.

Artificial intelligence (AI) can be used to enhance the efficiency and scale of SecOps teams, but it will not solve all your cybersecurity needs without the need for some human involvement — at least, not today.

Most commercial AI successes have been associated with supervised machine learning (ML) techniques specifically tuned for prediction tasks that yield business value. These use cases for ML, such as spoken language understanding for your smart-home assistant and object recognition for self-driving cars, make use of vast amounts of labeled data and computation required to train complex deep learning models. They also focus on solving problems that barely change. This is in contrast to cybersecurity, where we rarely have the millions of examples of malicious activity needed to train deep learning models, and we face intelligent adversaries that frequently change their tactics to try to outmaneuver our latest detection capabilities, including those using ML.

In addition, the digital exhaust from human behavior in enterprise environments is extremely hard to predict. Anomalies in these systems are common and very rarely represent malicious threat actor behavior. It is therefore unreasonable to expect that unsupervised anomaly detection can be used to learn about an enterprise environment’s normal behavior and be able to generate meaningful alerts about malicious activity without creating false alarms on unusual but benign events.

Finally, the degree of data imbalance in threat detection is unlike many other use cases for ML. Imagine for a moment that you are a midsize to large enterprise collecting 1 billion potentially security-relevant telemetry events per day and expect to find one incident worth seriously investigating. Nobody wants to lose the ransomware lottery and have their business grind to a halt with the potential for even worse reputational damage by missing that one security incident. However, if you build an ML-based threat detector processing each event by itself that is 99.9% accurate, you would be searching for that one true positive in a sea of 1 million false positives. Conquering this data imbalance requires significant expertise and a multipronged detection strategy.

Despite these challenges, there are ways for SecOps teams to leverage the technical power of AI/ML to gain operational efficiencies. The following principles should be considered when doing so.

**1\. Symbiotic Humans and Machines Work Better Together**

Consider ML a complement to human intelligence rather than a substitute for it. In the context of complex systems, especially when combatting intelligent adversaries that adapt quickly, automation will deliver the greatest value with active learning at its core. Humans should regularly review the results of ML-based systems, provide feedback, add additional examples of new malicious behaviors, retune the models, and constantly iterate. Anyone who has ever had to face an intelligent adversary, whether it be in cyberspace or in combat, should be familiar with the OODA loop, developed by US Air Force Colonel John Boyd. It has many similarities to active learning techniques that can be exceptionally useful in ensuring that automatable decisions made in each loop are using the best insights, optimizing the utility of manual analysis performed in some loops, and scaling it to assist in processing more loops than humanly possible.

**2\. Pick The Right Tool for the Job**

You do not have to become an AI expert to make good AI-related decisions for your team, but you should be reasonably informed about the basics to ensure that you are picking the right tool for the job.

First, it is important to know the difference between anomalous and malicious behaviors because they are rarely the same and require very different techniques when it comes to detection. The former is easy to discover with unsupervised anomaly detection that does not require labeled training data, but the latter requires supervised learning that typically requires many historical examples.

Second, alerts with a high signal-to-noise ratio are critical for SecOps teams, and you need to fully understand the downstream effects of any probabilistic system that will not be 100% accurate.

Finally, while nearly every ML technique has been applied to cybersecurity, it is still important to have thousands of signatures from threat intelligence that operate like a minefield of trip wires. When constantly tuned by an expert team of security researchers, signatures provide a critical baseline for detecting known threats that needs to be a part of every security program for the foreseeable future.

**3\. Use AI Where It Can Be Most Successful**

It is ironic that many cybersecurity professionals who might trust AI to drive their car are skeptical about AI executing remedial containment actions. Automated action, after all, is one of the best ways to make your SecOps team more efficient. Automation frees the creative human mind from getting bogged down in time-consuming operational tasks — which are right in AI's wheelhouse. ML is useful in detecting advanced threats, especially when you can aggregate evidence, and it is also useful when prioritizing alerts from a variety of detectors that may come from different systems. AI can automate low-risk containment actions, such as quarantining suspicious files or requiring users to re-authenticate, which can dramatically increase your SecOps efficiency and lower your cyber-risk.

With all that said, AI/ML cannot be your only cybersecurity strategy — at least, not in 2022. When you are searching for important needles in immense haystacks, the most effective strategy still comes from pairing machine intelligence with the human intuition of expert analysts.

Distinguishing AI Hype From Reality in SecOps

SAN DIEGO, May 31, 2022 /PRNewswire/ -- ESET, a global leader in cybersecurity, has announced a new suite of products for the Telecommunications and Internet Service Provider (Telco and ISP) industry, with the aim of offering extensive protection to consumers. Cybercrime is a borderless problem and ESET telemetry shows that the volume of cyberattacks is increasing, with a trend toward attacks against smartphones. ESET's newly launched NetProtect suite ensures that service providers and their end users have the tools they need to combat these advanced and evolving mobile threats.

**About the new ESET NetProtect products  
**The new offering includes ESET NetProtect for Mobile and ESET NetProtect for Mobile Advanced, which offer security via mobile networks, and ESET NetProtect for Home Advanced, which helps secure fixed network connections. These solutions protect customer devices connected to Telco and ISP networks (fixed or mobile) against malicious web domains or domain categories such as malware, phishing and potentially unwanted content. With ESET NetProtect Advanced (fixed or mobile), parents also have full control of their children's filters through Web Content Filter. The management portal for end users allows them to manage the ESET NetProtect settings of their connected devices, manage their domain whitelists and blacklists, and generate security reports, giving users an insight into how ESET protects their devices as well as summary information about detected threats, blocked webpages and more.

Thanks to easy integration into Telco and ISP network services and existing activation processes, network-level solutions do not require any software installation on end user devices, and are compatible with both Android and iOS. The solutions are provided as a one-click service activation from the users' trusted internet provider and automatically provide protection to any connected device. Security tailored to customers' needs is ensured by offering robust local customer and partner support coverage along with comprehensive protection that is a step ahead of online threats via ESET's first access to a unique set of malware detected and pooled at a worldwide network of research and development centers.

"We are thrilled to launch this new suite of advanced cybersecurity products designed for service providers and their customers, which represents a critical threat vector for bad actors," said Brent McCarty, President of ESET North America. "At ESET, we always develop products with our customers in mind, and with our ESET NetProtect offering we have created an easy-to-use and elegant solution not only for the industry leaders in the Telco and ISP sector, but for the consumers who are the actual end users of our products."

For more than 30 years, ESET has invested heavily in multiple layers of proprietary technology that prevent breaches of its customers' endpoints and systems, by both known and never-before-seen threats. These products are informed by world-class threat analysis and expertise from the company's global research team. With a presence in over 200 countries worldwide and 13 research and development centers around the world, ESET offers its over 400,000 business customers peace of mind that their interests are protected at all times. ESET also helps protect the Google Play store and is trusted by millions of consumers around the world. To read more about the new offering for Telcos and ISPs or to contact the ESET team for more information, please click here.

**About ESET  
**For more than 30 years, ESET® has been providing enterprises across the globe with industry-leading IT security software and services, including endpoint detection and response, encryption and authentication, and comprehensive security services packages. With high-performing, easy-to-use solutions that cater to businesses of all sizes, ESET protects customers from increasingly sophisticated digital threats in an ever-evolving landscape. ESET delivers to the enterprise market the people, expertise, and cutting-edge technology required to keep businesses safe and running without interruption. For more information, visit www.eset.com or follow us on LinkedIn, Facebook, and Twitter.

SOURCE ESET

ESET Launches NetProtect Suite of Advanced Cybersecurity Offerings for Telcos and ISPs

Researchers from Shadowserver recommend removing the servers from the Internet to shrink external attack surface.

Shadowserver researchers scanning the Internet for exposed MySQL servers said they received more than 2.3 million IPv4- and 1.3 million IPv6 addresses in response to their connection requests on port 3306/TCP, indicating the connected servers were wide open to attack. 

Of the more than 3.6 million exposed MySQL servers, most were located in the US, with more than 740,000; followed by China, with more than 296,000; and Poland, with more than 207,000 accessible devices.   

"It is unlikely that you need to have your MySQL server allowing for external connections from the Internet (and thus a possible external attack surface)," Shadowserver said in a post about the MySQL findings. "If you do receive a report on your network/constituency, take action to filter out traffic to your MySQL instance and make sure to implement authentication on the server."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading