Managed detection and response (MDR) provider Blackpoint Cyber has announced a new partnership with NinjaOne.

The collaboration aims to enhance and streamline cybersecurity for MSPs as they continue to navigate an evolving threat landscape.

By combining Blackpoint’s MDR expertise with NinjaOne’s endpoint management platform, the move promises to simplify security and deliver improved response times through rapid threat detection. For MSPs, that means greater visibility, security, and control across every endpoint in their IT estate.

In an announcement, Blackpoint Cyber CEO Gagan Singh said the partnership is built on a shared commitment to helping IT teams tackle modern security threats.

“By aligning our expertise in threat detection and response with NinjaOne’s leadership in endpoint management, we’re laying the foundation for a smarter, more unified approach to cyber security—one that reduces complexity while strengthening resilience,” he explained.

Founded in 2014 by former NSA cybersecurity expert Jon Murchison, Blackpoint Cyber specializes in MDR services for MSPs and security teams, backed by an around-the-clock, human-led Security Operations Center (SOC) for continuous monitoring and threat response.

NinjaOne provides a cloud-native automated endpoint management platform that works to provide visibility, security, and control across all customer endpoints, simplifying management, patching, and environments at scale.

The pair’s collaboration targets SMBs and MSPs as they expand their digital footprints and face increasingly sophisticated security threats in the era of AI.

According to a forthcoming survey from payment giant Mastercard, which quizzed more than 5,000 SMB owners across four continents, almost half of its respondents said their business had been hit by a cyber attack, with one in five of those impacted either filing for bankruptcy or closing their doors for good.

“In the face of increasingly sophisticated and dynamic cyber security threats, MSPs require robust, enterprise-grade solutions that support rapid threat detection, response orchestration, and enforcement of a consistent security posture across distributed environments,” commented Erzan Uygur, NinjaOne’s vice president of strategy and operations.

“Blackpoint Cyber shares our customer-first mindset, and together we are delivering a modern security experience built on proactivity, adaptability, and reliability.”

MORE FROM CHANNELPRO

• Okta acquires Axiom Security to enhance privileged access management
• NinjaOne appoints industry veteran Paul Redding to lead MSP partnerships
• Hexaware partners with Replit to take secure 'vibe coding' to the enterprise

Finnish company WithSecure offers a complete suite of security solutions all easily managed from its Elements Security Center cloud portal. Its Endpoint Protection (EPP) module provides a firm foundation and a modular approach allows you to enhance it with other WithSecure components as required.

In this review, we test EPP and take a closer look at the Endpoint Detection and Response (EDR) module. EDR takes a proactive stance on cyberattacks, providing advanced threat detection capabilities, full attack analysis, and automated responses for isolating compromised systems.

WithSecure Elements EPP and EDR: Setup 

EPP offers great platform support, too: it protects Windows and macOS workstations, Android and iOS mobiles, plus Windows and Linux servers. And it includes patch management for Windows OSes as standard. Workstation deployment is swift; we used our portal's EPP dashboard to email a download link to users, with the agent taking three to four minutes to install and link up with the portal account.

Protection starts immediately. The agent grabs a predefined profile that enables essential security functions such as real-time malware scanning, a firewall, and browsing protection. Customizing profiles is simple: you clone the read-only ones provided, tweak their settings as desired, and use the devices page to assign them to multiple endpoints.

There's a lot to play with: profiles enforce web protection with a list of 32 URL categories, can stop users from interacting with the agent, and control access to all kinds of local hardware such as USB sticks, optical drives, and wireless and Bluetooth devices.

An EPP Premium subscription enables application controls and WithSecure's DataGuard, which uses behavioral rules to detect potential ransomware activity. Rollback is a smart new feature that provides instant ransomware protection for Windows systems. It tracks apps classed as unknown and, if they exhibit any dubious behavior, it closes them down and automatically rolls back all the file and Registry changes they made.

Don't worry if the app turns out to be legit, as all changes are stored in locally protected quarantine areas and can be restored by users. It can also initially run in safe mode, where it only reports on unauthorized changes.

You can keep a close eye on the action using the security events view and set up email alerts for multiple recipients. EPP has fast reaction times: when we introduced malware to our test clients events were posted in the portal almost immediately, with alert messages winging in three or four minutes later.

EDR provides deep analysis of detected threats and uses the same agent as EPP, so adding this module later on automatically activates it for all endpoints. It features WithSecure's broad context detection (BCD), which cuts through alert avalanches by highlighting suspicious events so you can see clearly if an attack is taking place.

BCD shows a filtered view of all detected threats. Selecting one takes you to a threat analysis page, with a process tree showing how the potential malware developed and what it interacted with. If you don't like what you see, you can isolate all affected devices with one click.

An EPP/EDR subscription also enables the new outbreak control feature. The modules team up to track device changes, and if anything occurs to critical areas such as IP addresses and reverse DNS or new malware is detected, a stricter rule is applied automatically to affected devices.

Its high levels of automation make WithSecure a great choice for SMBs that want endpoint protection on a plate. It's simple to deploy, offers a wealth of security features, and all modules are easily managed from the Elements cloud portal.

This content originally appeared on ITPro's sibling magazine PC Pro. For more information and to subscribe, please visit PC Pro's subscription site. 

Eset Protect is a versatile endpoint protection solution, and it can be run either on-premises or in the cloud. That said, Eset's focus is clearly on the latter, and it makes more sense for SMBs as Protect Cloud is easier to deploy and doesn't need a dedicated hosting server.

The product is available in four versions. Entry delivers a cloud console and protection services for workstations, servers, and mobiles, while the Advanced version on review adds full disk encryption and advanced protection against zero-day threats with cloud sandboxing. Mail and MS365 protection appears in the Complete version but endpoint detection and response (EDR) is available only in the top-of-the-line Elite enterprise option.

Eset Protect Cloud Advanced: Setup  

Installation is simple. After creating our cloud account, we pushed the agent to our Windows workstations and servers by downloading them from the portal or sending an email to users so they could handle it themselves. Either way, the agent took only two minutes to load and then ran a full system malware scan in the background.

Protection is instant, with the agents being assigned a default set of security profiles that enable essential functions such as real-time malware scanning, Eset's LiveGrid cloud-based reputation system, host-based intrusion prevention (HIPS), and Ransomware Shield services. Blanket protection is achieved as Eset initially places every client in a top-level computer group that has all the built-in default policies assigned to it.

Groups add extra flexibility. You can create static or dynamic ones where the latter are automatically populated with systems based on criteria such as their OS version if they're a mobile device or have a problem. In either case, you can add custom policies to each group and fine-tune their settings as required.

There are settings aplenty: you can customize the scanning engine, password-protect the agent, add firewall rules, activate phishing protection, block botnets, and apply removable device access rules. One drawback is that there are so many policy options it took us a while to figure out what some of them do and how to set them up. There's a heap of web-browsing protection features, with filtering rules offering a choice of over 140 URL categories to block or allow. Eset's LiveGuard can also be enabled so suspicious files are sent to its cloud sandbox first to see if they harbor anything unpleasant.

The portal offers a range of dashboards, with the default non-customizable view showing the status of all protected devices and alerts. The security overview page is even more informative; it displays unresolved threat detections, scanning engine performance, and the top ten systems at most risk. Clicking on any element takes you to the relevant page for more information.

Reporting services are outstanding, with a wide range of options provided for all security aspects, and 23 for malware detection activity alone, all of which can be run with one click. You can create your own using templates, schedule them to run regularly, and send their output to multiple email addresses.

Notification features are equally impressive, as you can choose from a list of 24 predefined alerts, add your own, and decide who to email them to. Eset doesn't hang around sending them, either; when we triggered its scanners with genuine malware and web threats, events were posted in the portal in one minute and alert emails landed two minutes later.

Eset Protect Cloud Advanced: Is it worth it? 

Eset Protect Cloud Advanced is good value, with a three-year subscription for 50 devices panning out at only $31 (£26) per device per year. Policy management is overly complicated, but Eset delivers an impressive arsenal of endpoint protection features backed up by great reporting and alerting tools.

This content originally appeared on ITPro's sibling magazine PC Pro. For more information and to subscribe, please visit PC Pro's subscription site. 

Security has transformed as enterprises have become more flexible organizations with widely dispersed workforces, with this shift demanding a new approach to endpoint security for channel suppliers. 

There’s an effort to integrate robust cyber security into a plethora of digital devices typically used across a company's processes and workers. Workers migrating to their homes and other remote sites has shifted the debate towards integrated approaches that include a core hardware component. 

A more holistic approach is needed to make sure comprehensive security is available for every digital device, says IDC in a report assessing the security landscape, in partnership with HP. It highlights hardware-based “root-of-trust” technologies that can bake security in below the level of the operating system, in particular.

Ransomware, phishing, malware, and compromised email systems are all clear and present dangers for enterprises and their digital devices in use. With multi-channel attacks also becoming more common, VARs and MSPs are pivoting to incorporating a hardware-based approach into cyber security defences. 

"Customers are increasingly looking to purchase services rather than just devices, and channel partners can offer those who have concerns about hybrid workers’ security add-ons like remote management capabilities for desktop as a service (DaaS) models,” Dr Ian Pratt, HP’s global head of security for personal systems tells ITPro. “Services like these, which add an extra layer of protection at the endpoint for their customers, are a great opportunity to generate a recurring revenue stream for the Managed Service Provider.”

An end-to-end approach to digital security is a clear trend in the channel marketplace. Enterprises are looking to reduce their tech stack to reduce costs and improve efficiency, and enhance digital security in a landscape business owners see as increasingly risky to their operations.

Built-in endpoint security 

One attack vector that’s continued to expand is firmware updates, with examples including LoJax and MosaicRegressor. Hardware used by dispersed workforces has been under sustained attack for several years, and having firmware authentication built into the hardware is a robust response to this level of cyber attack. Channel suppliers are increasingly seeing demand for this kind of integrated security as businesses look to create a more robust and flexible cyber security envelope.

Increasing the availability of devices with built-in endpoint security for channel suppliers is a differentiator in the marketplace. Businesses have always bought best-of-breed, and when their security needs are considered, the choice available is expanding. VARs are progressively being asked to simplify the procurement of devices and, with these purchases, also support more comprehensive security. VARs' relationship with vendors lets them influence how security hardware architectures should advance to meet the defensive needs of their clients.

Built-in endpoint security including HP’s Wolf Security for Business, as well as Intel’s Boot Guard and Hardware Shield protect devices by defending the BIOS. Vendors are also embracing artificial intelligence (AI), with notebook PCs from Lenovo and Asus embedding this technology to deliver built-in security that VARs can offer to businesses seeking to boost cyber security through hardware procurement.

“Advanced security tooling can work alongside network security and user authentication to protect endpoint devices by increasing visibility, prevent tampering, or malware infections utilising machine learning techniques to move beyond signature-based protection,” says Rick Hemsley, UK&I government and public sector cyber security lead, EY. “This combined approach will enhance the overall security posture of the business and provide greater protection against evolving threats.”

The channel’s role in safeguarding enterprises

Nearly a third (29%) of businesses attribute a data breach in hardware to an external attack, according to Forrester. For many companies protecting their remote workers have become a priority. Deploying VPNs, for example, has formed the basis of secure remote network connectivity. However, as threat actors have become more sophisticated, and workers now use multiple devices in several locations, a hardware approach to digital security is expanding to become the foundation onto which all other defenses are built.

“Hardware-based security offers better protection from manipulation and interference than its software-based counterpart because it’s more difficult to alter or attack the physical device or data entry points,” says Michela Menting, digital security research director at technology research firm ABI Research.

In addition, Chris Vaughan, VP, technical account manager, Tanium, also points out that enhanced hardware security doesn't add more complexity for users: "The good news is that while it takes a lot of work to hack hardware security devices, it doesn’t require reskilling on the employees’ part to take advantage of the added security.”

Moving forward, the channel will play a vital role in ensuring their customers have the latest hardware that defends their businesses from the expanding threat landscape enterprises see expanding.

“Consider the threat landscape, security requirements, scalability, integration, performance impact, ease of deployment and management, vendor reputation and support, TCO, future-proofing and training,” says Nathan Charles, head of customer experience at cyber security specialist OryxAlign. 

“Choose a hardware-based endpoint security solution that aligns with your needs, protects endpoints, and integrates well with existing infrastructure, all while being cost-effective and providing reliable support.”

For business leaders looking to enhance their digital security at the time of new hardware purchases, the built-in endpoint security options now available across channel providers are expanding.

The accepted approach to creating robust cyber security has been to protect devices with security software that runs above the operating system, with that layer increasingly vulnerable. Channel partners are now critical to create the zero-trust security all enterprises need. This level of protection must begin at the hardware level to ensure comprehensive defenses are always operational.

Zero trust strategies are one in which nothing and nobody can use an organization’s digital resources without being verified. This isn’t just about verification upon entry into the system, but also when individuals are moving around within the system.

Such a strict regime is required because a cyber criminal or an automated agent might breach a system and move about freely within it if, once inside, there were no verification checks. Zero trust has, therefore, become a gold standard for cyber security in today’s enterprise landscape. 

Implementing zero trust requires a root and branch examination of the entire technology estate. The organization needs to identify its vulnerabilities, both technological and human, and figure out how to best plug the holes. This should be done in the context of minimal disruption to everyday workload, and an understanding that zero trust is not a one-time fix but an evolving idea. 

Implementing such a regime, however, isn’t without its potential pitfalls and pain points. It’s a time-consuming and complex process that requires input from many roles across the organization, as well as external expertise. 

1. Failing to look beyond the corporate network

When hybrid working is the norm, people will be using all manner of locations to work including their homes and public networks. Everything is part of the attack surface and the organization should trust nothing. Every endpoint is a potential vulnerability. 

This also, by the way, includes devices that might sit outside the network such as printers, security cameras, and other Internet of Things (IoT) devices.

A thorough audit of devices will be required before work begins, with a strategy in place to protect each device and to ensure that each device is updated as regularly as needed. 

2. Implementing zero trust too quickly

Implementing a Zero Trust approach might require significant changes to technologies and also to how people go about their daily business. Go too fast and it’s easy for mistakes to happen. Single devices or applications might slip through the net of compliance assurance at the time of implementation or later. Security hygiene – ensuring that all hardware and software is up to date and patched – is a central aspect of zero trust.

Ensuring every piece of hardware and software is known and its security can be optimized at all times takes time. It is important to allocate enough time to managing everything from the outset, and to develop processes for ensuring existing and new acquisitions are accommodated going forward. 

3. Ignoring the principles of least privileged access

Least privileged access refers to the policy of ensuring users only have the bare minimum permission level to do what they need to do. It’s designed to keep access to resources tightly controlled and prevent the kind of sprawling access through systems that can be most helpful to bad actors. 

However, it can be difficult to implement, particularly in the case of multi-cloud environments in which data and apps are hosted with different providers, each with different policies and security protocols. In the end, budget, available time, and sheer workload can mean in-house teams assign wider privileges than necessary.

Using a class of software called entitlement management, or cloud infrastructure entitlement management, access to a multitude of software, systems, devices, and cloud platforms can be managed centrally. 

4. Failing to focus on users

An organization’s employees are not the only stakeholders it’ll have to work with. There may also be contractors, suppliers, purchasers, delivery partners, and others. Presenting users with new protocols, hoops to jump through, and processes – without understanding whether these are seen as barriers – can cause resentment and foster non-compliance strategies. Users who work around security protocols are users who create risk. 

High-quality user education on how to achieve compliance with security protocols is only part of the solution. People must also understand why certain behaviors are required, and be comfortable with any required actions or approaches. Creating a ‘culture of security’ across the organization takes time, effort, and leadership – from chief officers, senior managers, and line managers. 

5. Assuming zero trust is bought into by default

Every organization is different. Its technology setup will be unique. How people use technology will vary too. Where its people work will vary too, including in-office, remote or hybrid, one city, with national offices, or multinational. The variables are many and complex. While certain principles and approaches apply to zero trust, their implementation in any one organization will be unique. Simply going to a vendor and expecting them to do everything without any input is a fallacy.  

Organizations need to commit their own staff resource to work alongside vendors and understand that the implementation of zero trust will take time. This is and will continue to be an ongoing process.

With cyber attacks showing no signs of slowing down, and with organizations of all sizes and in all markets potentially vulnerable, securing data and networks is paramount. It’s no longer adequate to take a piecemeal approach to this challenge. A zero trust approach can help an organization implement a risk-based strategy toward data security. It isn’t without pitfalls, and organizations should be alive to these, and willing to commit the time and energy required to work them through. 

System administrators have reported an abudance of alerts from Microsoft Defender for Endpoint, with multiple sites falsely flagged as having reused passwords.  

A number of admins complained that they are receiving alerts that read “Password reuse activity was detected by Microsoft Defender for Endpoint” with no clear explanation from the software.

Users denied having reused passwords on the sites flagged by the system, while others have stated that multiple subdomains of software as a service (SaaS) platforms have been flagged as containing password reuse.

Many admins indicated that the problem could have arisen from Defender for Endpoint incorrectly flagging single sign-on (SSO) domains as needing attention.

“We now have 17 alerts today for Password Reuse. Everyone I have looked at is a false positive,” one user wrote.

They also noted that some alerts come with “about:blank” as the supposed domain containing password reuse, and that in one case a user was accused of “password reuse over three services, listing three subdomains of the same SaaS”.

The warning message itself is seemingly absent from Microsoft documentation.

"We determined these are false positive results and we have resolved this," a Microsoft spokesperson told ITPro.

"No customer action is needed."

According to accounts from multiple commenters, the alerts appear to only be coming from Windows 11 devices and almost all relate to supposed password reuse on Microsoft domains.

“Yup same here, we are getting obliterated with alerts. The alerts are only coming from Win 11 devices,” wrote another.

Dozens of new commenters have appeared in a six-month-old thread covering the same issue, seeking help with inexplicable alerts that they too have received.

In a Twitter exchange on the issue, one user suggested that the problem could be linked to enhanced phishing protection brought in by Microsoft in September 2022.

This is intended to warn users against reusing passwords.

Microsoft Defender has incorrectly inundated users with warnings on multiple prior occasions. 

In September 2022, the app caused confusion after flagging software as ransomware, including popular browsers and productivity apps such as Chrome, Slack, and Microsoft Edge.

Further false positives were addressed by Microsoft in January 2023, after a faulty update deleted shortcuts that had been incorrectly identified as malware. 

Microsoft released scripts to fix the issue, though some administrators stated that these were imperfect and failed to fully rectify matters.

A recent update for Microsoft Defender Antivirus also led to confusion among devs, who upon updating received a warning stating that Local Security Authority (LSA) Protection - a process used to authenticate and oversee user logins - had been disabled.

Microsoft released a workaround for the issue, though a subsequent update appears to have disabled LSA altogether on Windows 11 systems in favor of a new process titled ‘Kernel-mode Hardware-enforced Stack Protection’.

This article has been updated to include a statement from Microsoft.

Enterprise cyber security provider ZeroFox has announced it has struck a definitive agreement to acquire LookingGlass Cyber Solutions for $26 million.

Headquartered in Reston, Virginia, LookingGlass specializes in external attack surface management (EASM) and global threat intelligence that provides organizations with curated intelligence on critical assets, risks, and sectors.

These capabilities will now be integrated into ZeroFox’s External Cybersecurity Platform to enable visibility into external attack surface assets and vulnerabilities, as well as serve up improved actionable intelligence.

“The acquisition of LookingGlass is a natural extension of our strategy to provide our customers with a single end-to-end platform for protecting their external attack surface from increasingly sophisticated cyber attacks,” said James C. Foster, chairman and CEO of ZeroFox. 

“We are bringing together passionate teams that have been partners for years, and proven world-class capabilities across attack surface management, digital risk protection, threat intelligence, and breach response to continue our leadership in external cyber security.”

LookingGlass’ internet-facing surface intelligence data lakes provide public sector organizations, large enterprises, and industry security alliances with extensive discovery, intelligence, and cyber defense capabilities. 

The firm said these tools allow organizations to identify and assess threats in support of remediation strategies against the most sophisticated cyber attacks.

“The mission at LookingGlass is to protect our customers by providing unmatched attack surface intelligence for global threat visibility and cyberattack disruption,” said Bryan Ware, LookingGlass CEO, who will join the ZeroFox executive team as part of the transaction. 

“Joining ZeroFox allows us to expand the capabilities we provide security teams to defend against cyber criminals and nation-state actors.”

As a SaaS-based cyber security provider, ZeroFox’s wider platform combines advanced AI analytics, digital risk and privacy protection, and full-spectrum threat intelligence, with a portfolio of breach, incident, and takedown response capabilities to help organizations protect themselves against cyber threats.

Back in August 2022, the company began trading publicly on the Nasdaq stock market, in a move uncommon for a pure-play cyber threat intelligence company. 

However, last month it was reported that ZeroFox Holdings had dipped 11% in the wake of increasing losses, with the company seeing an overall share price decline of 75% over the last twelve months.

Despite this, the firm continues to make moves through acquisitions and partnerships. Earlier this month, it announced a new partnership with Google Cloud to detect phishing domains and warn users of dangerous URLs. 

Websites marked by ZeroFox as malicious will see Google send out a warning message to its 5 billion-strong userbase advising them not to click.

Alerts for new malware strains and active ransomware groups were spread widely across the security industry throughout March and the first half of April.

New strains of malware targeting organizations of all kinds were discovered, harnessing infection vectors that may not already be in their threat models.

It’s highly important that organizations stay on top of emerging threats and patch their systems against the most prevalent types of attacks. 

Patching isn’t always an easy task to do, especially in large organizations, but as a bare minimum, it’s advised that active threats are protected against if a more comprehensive patch operation isn’t feasible.

Knowing what cyber security vulnerabilities and zero days to patch is one thing, but it’s equally important to pay close attention to the ways malware is evolving to bypass security detections so the workforce can be aware of what suspicious activity to look out for.

Here you’ll find a complete list of the most dangerous malware and ransomware threats of April 2023.

OneNote exploited to bypass macro attacks

Ever since Microsoft made the long-awaited decision to disable VBA macros in Office documents by default last year, cyber attackers have been experimenting with inventive ways to deliver malware in a trusted way.

Microsoft OneNote is installed on Windows by default, unlike Word, Excel, and PowerPoint, and can therefore allow all Windows users to open email attachments in the OneNote format regardless of whether they have a Microsoft 365 subscription.

The combination of using a malware-laden OneNote file to seem more legitimate and the weaker detection measures the application provides against embedded malware, now makes OneNote a more reliable threat vector than Office documents.

Zscaler’s ThreatLabz researchers found that a variety of scripts and malware have been observed running after successful phishing attacks led victims to download and open the files.

Remote access trojans (RATs) and information stealers have been installed following successful attacks. 

Researchers also said that MSHTA, WSCRIPT, and CSCRIPT can be executed from within OneNote, using multi-layered obfuscation techniques to evade detection. 

CHM, HTA, JS, WSF, and VBS scripts are also supported via OneNote documents.

Organizations should inform their staff about the dangers of OneNote attachments in emails. If an email seems suspicious, it should be checked by the organization’s security team before downloading any attachments.

Emotet returns again with new tricks

Trend Micro announced in March that the Emotet botnet has returned once again after another of its trademark periods of downtime.

Emotet was observed mimicking replies in existing email chains, increasing the perceived legitimacy of responses rather than it being a cold email from an unrecognized sender.

While OneNote is being exploited to bypass Microsoft’s VBA macro defenses, Emotet instead deploys social engineering tactics to trick victims into manually re-enabling macros, allowing malicious Office documents to execute commands, like downloading DLLs, and install malware.

The new version of Emotet also uses binary padding - crafting large files, such as 500MB Word documents, to bypass security scans.

The prevailing advice is that workers should remain mindful that attempts to re-enable VBA macros will likely lead to malicious activity and should be flagged to the security team as soon as possible.

Cl0p overtakes LockBit in ransomware rankings

Cl0p’s exploitation of the vulnerability in GoAnywhere MFT propelled it to the top of Malwarebytes’ ransomware rankings for April, overtaking LockBit by a small margin.

The group claimed to have breached more than 130 organizations in a month including Proctor and Gamble, Virgin Red, Saks Fith Avenue, and the UK’s Pension Protection Fund (PPF).

Although Cl0p operates its own namesake ransomware program, many of the GoAnywhere-related breaches are thought not to have involved ransomware.

Regardless, it overtook LockBit this month after it dominated in March with 126 attacks. For context, the second-place gang from last month, ALPHV, only registered 32 attacks.

The reliability of LockBit was questioned earlier this month by DarkTracer International, accusing it of running an inefficient website on the dark web.

LockBit responded by attempting another of its ‘pranks’, like it has done in the past with the likes of Mandiant and Thales, but it ultimately backfired when its team, which doe snot speak English natively, confused DarkTracer with Cambridge, UK-based Darktrace. 

This forced Darktrace to publicly deny that it had been attacked by LockBit, and the vent prompted many in the community to mock the ransomware gang’s mistake.

A patch for the GoAnywhere MFT vulnerability has been available since February and should be applied as a priority if it hasn’t been already to prevent further attacks from Cl0p.

Microsoft signals new ransomware gang on the block in Patch Tuesday

In yet another error-strewn Patch Tuesday from Microsoft, it highlighted an actively exploited zero-day vulnerability.

Researchers identified the new ransomware gang, known as Nokoyama, exploiting the vulnerability since February.

Trend Micro’s report on the group linked the operation to the recently taken down Hive group, which claimed attacks on the likes of New York Racing Association, Tata Power, and Altice.

The researchers said the two groups share a number of similarities in their attack chain such as the use of Cobalt Strike and phishing emails, but noted Hive’s double extortion technique hasn’t been used by Nokoyama yet.

FusionCore malware as a service operation

Researchers at CYFIRMA detailed an emerging threat actor believed to be operating from inside Europe earlier this month.

FusionCore has been described as a ‘one-stop shop’ for malware services, with a wide range of tools on offer, plus hacker-for-hire services too.

The malware on offer has been described as “cost-effective, yet customizable”, and its ransomware affiliate scheme provides both a ransomware payload and affiliate software to manage negotiations with victims.

“FusionCore typically provides sellers with a detailed set of instructions for any service or product being sold, enabling individuals with minimal experience to carry out complex attacks,” CYFIRMA said.

A number of indicators of compromise (IOCs) can be found on the researcher’s blog.

Chinese hackers targeting products with no EDR support

Mandiant’s blog in March highlighted a threat actor, which it tracks as UNC3886, targeting products that aren’t supported by endpoint detection and response (EDR) products.

These include firewalls, IoT devices, hypervisors, and VPNs from Fortinet, SonicWall, Pulse Secure, and others.

Dozens of attacks have been investigated by the security firm and have involved the exploitation of zero-day vulnerabilities and the use of custom malware to both steal credentials and maintain a lasting presence in a victim’s IT environment.

Full details of the attack scenarios, their methods, and the products being targeted can be found in Mandiant’s detailed blog.

The takeaway for admins here is that they should be communicating regularly with vendors to ensure any potential threats can be mitigated.

Developers beware of W4SP copycats

Sonatype said that one of the key malware trends for March this year was a continuation of malicious packages being uploaded to the PyPI registry - a destination for developers to download and use software built by the Python community.

It noticed a number of packages mimicking the W4SP stealer - a popular information stealer since the middle of 2022 used to carry out software supply chain attacks.

“These types of packages are a cause for concern as they pose a serious threat to developers who may inadvertently download and install them,” it said.

The packages have since been taken down, but with the ongoing attempts to poison the software supply chain, and the damage such attacks can cause - think 3CX as a recent example, then developers need to be especially vigilant when downloading open-source software, ensuring that it’s safe to use.

Every security leader understands the challenges that cloud migration and distributed workforces pose to their corporate network and endpoints, and the importance of moving to a Zero Trust architecture. But the journey to Zero Trust can seem complex and difficult.

This recorded session shares how Cloudflare offers one uniform, composable platform to make this journey extremely simple and effective for organisations of all sizes.

Watch now to discover how joint customers of Cloudflare and CrowdStrike use both platforms to achieve end-to-end protection across endpoints, networks, and applications.

Provided by

Attack surface management (ASM) might sound like something the SAS might get involved in, but this most definitely refers to the world of networks and cyber security.

The attack surface is the sum of all possible entry points that a cyber criminal might use to gain unauthorised access to systems, networks or data. For a typical business, this might include devices, websites, servers, software platforms and even people. Every time the enterprise adds a server, deploys a new application, sets up a virtual private network (VPN) or enrols more users, the surface grows.

That’s where ASM can come in handy. Taking the perspective of the hacker into account, this process involves discovering, analysing and mitigating the vulnerabilities and potential vectors that altogether comprise the attack surface. Proper attack surface management highlights the targets and understands the level of risk associated with the attack vectors in question.

What does attack surface management involve?

Attack vectors are methods that attackers use to gain access, such as phishing, malware, API exploits or zero-day vulnerabilities. The attack surface is the target against which those methods can be deployed. So social engineering is an attack vector; an individual whose trust is exploited is part of the attack surface.

Figuratively speaking, your attack surface generally has three sides. One is the digital attack surface: that’s everything connected to your network, from apps to websites and the ports they connect through. Then there’s the physical attack surface – servers, mobile devices, routers and even printers. Finally, the social attack surface comprises staff, contractors and so forth. You can of course further break down these divisions with greater levels of granularity, but the digital, physical and social aspects broadly cover everything.

What steps can my business take to shrink its attack surface?

This is very much the hard part. Because the attack surface is always changing and evolving, managing it can seem like a Sisyphean task.

1. Minimise complexity

As a business expands, its IT environment tends to accumulate legacy endpoints and applications – prime targets for attackers. Security processes grow in complexity too, creating more potential for exploitable mistakes. Cut out legacy assets wherever you can, and segment your network to limit the potential for intrusions.

2. Know your vulnerabilities

Static vulnerability scanning is valuable, but real attackers are more cunning and resourceful than any automated test. Schedule regular penetration testing, and include “red team” exercises to obtain a realistic, adversary’s-eye view of your vulnerabilities.

3. Raise awareness

Many compromises start at the social attack surface. Promote awareness of threats, from the shop floor to the boardroom – and support it with upstream security controls. Don’t play the blame game, but embrace zero trust principles to make it as hard as possible for anyone, whether inside the organisation or outside of it, to breach security.

4. Seek out an ASM solution

There are numerous ASM platforms out there, including ASM as a service. Most of these solutions address ASM from four perspectives: asset discovery, classification, risk prioritisation and ongoing monitoring. If you’re familiar with the security mindset you might wonder why there’s no risk remediation step – but that’s the sum of the other parts.

What do ASM services offer, in practical terms?

The asset discovery part is all about making sure you know what you’re working with. You can’t begin to manage the risks to your IT systems unless you’re fully apprised of exactly what and where those systems are. Creating a map of potential entry points can immediately highlight which are the most attractive to a threat actor.

This leads onto classification, where assets are analysed with regard to what they connect to, the attack routes they could enable, and the vulnerabilities they may contain. Once the process is complete, it’s time to prioritise, so that issues that represent the highest risk to the business can be dealt with most urgently. Those classifications, those priorities, will likely be subject to constant change, of course; that’s where the ongoing monitoring comes in, to ensure your organisation remains on top of its ASM game.

What’s the best ASM solution for my company?

As always in cyber security, there’s no one-size-fits-all answer. The best solution for your business won’t be the same as for someone else’s, perhaps for reasons of scalability, integration or cost. We can, however, give you some names to look up: Coalfire, CyCognito, ImmuniWeb, Randori, SearchLight, SpectralOps and UpGuard are all good places to start your ASM research.

Passwords: they can be tricky at the best of times. Proper password hygiene is one of the most important factors in endpoint security, as it keeps sensitive data secure and prevents threat actors from getting into important systems.

But despite the risks, the use of weak or recycled passwords continues to be a problem even amongst IT professionals. While systems such as two factor authentication have been used as an extra layer of security, groups like the FIDO Alliance and World Wide Web Consortium have been working to make passwords a thing of the past, in favour of more secure methods.

This week, we spoke to Richard Meeus, EMEA director of security & technology strategy for Akamai Technologies, to explore the solutions driving secure sign ons, and how the sector can adapt to this change.

Highlights

“The criminals know that we are bad with passwords, and we just use something like our pet's name or something like that. And it's relatively easy for people to get the passwords or, as most commonly happens, an organisation will be breached and their password and username database will be leaked out onto the internet. And then, those usernames and passwords are reused against websites all over the planet.”

“The concept of security authentication has always been based around, sort of, one of three concepts. So there's something you know, which is a password, something you are, which is your biometric. So use your face print or your thumbprint, or something like that. Or something you have, which could be a USB token, or something that you can punch numbers into as a handheld device. So one of those three things, and we've relied upon the something you know, predominantly, which is the password.”

“Anything that we can do within security that actually makes lives easier for end users, and makes them more secure, is a good thing. And reducing passwords, reducing the use of passwords is a good thing, because nobody likes them.”

Read the full transcript here.

Footnotes

• Revealed: The top 200 most common passwords of 2022
• If not passwords then what?
• What are biometrics?
• What is two-factor authentication?
• What is multi-factor authentication (MFA) fatigue and how do you defend against attacks?
• How to implement passwordless authentication
• Best password managers
• Best free password managers
• The sooner the FIDO Alliance can shut down passwords, the better
• Will FIDO passwordless authentication save cyber security?
• The top 12 password-cracking techniques used by hackers

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

​​This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Going passwordless'. We apologise for any errors.

Rory Bathgate

Hi, I'm Rory Bathgate.

Jane McCallion

And I'm Jane McCallion

Rory

And you're listening to the IT Pro Podcast, where this week we're discussing passwordless security.

Jane

Good password hygiene is one of the most important factors in endpoint security. If passwords are managed improperly, threat actors can access critical systems, and the use of weak or recycled passwords continues to be a problem even amongst IT professionals.

Rory

In place of legacy systems such as one time passcodes sent via SMS, groups like the FIDO Alliance and World Wide Web Consortium are working to make passwords a thing of the past.

Jane

Today, we're speaking to Richard Meeus, EMEA director of security & technology strategy for Akamai Technologies, to discuss the solutions that can enable more secure sign ons, and how the sector is handling this change. Richard, thank you for joining us.

Richard Meeus

Thank you very much, delighted to be here.

Jane

So everyone's been using passwords on their computers for decades. How come now they're being called insecure?

Richard

Well, I don't think it's now that they're being thought of as being insecure, I think they've been insecure for a long time. I mean, passwords have been utilised as an authentication mechanism for centuries. And it's always been fairly trivial to find out what they were. What we've been doing recently is with a plethora of websites and services, especially after the pandemic that everybody went online. Everybody reused the same passwords. People, humans, users we're rubbish at passwords, we have a limited capacity to remember passwords. And therefore we tend to use the same one repeatedly. Or we just try and be very clever and add a ‘1’ to the end, to try and make it uncrackable. And because of this, the criminals know this, the criminals know that we are bad with passwords, and we just use something like our pet's name or something like that. And it's relatively easy for people to get the passwords or, as most commonly happens, an organisation will be breached and their password and username database will be leaked out onto the internet. And then, those usernames and passwords are reused against websites all over the planet. And if you look at some of the database repositories, the legitimate repositories which are used for you to see if you have had your username and password put out onto the internet, there's about 10 million — 10 billion sorry, username and password combinations in there. That's a lot more than the internet-connected population. In fact, it's about four times more than the internet connected population. So there's a good chance there's a criminal somewhere who has your username and your password, and is trying them on a number of websites. Right now. What we want to do is move to a situation where that risk is mitigated to a certain degree.

Rory

With this risk of reusing passwords, certainly, or generating weak passwords. I know that a lot of businesses rely on things like password managers, can those be continued to be relied upon by businesses?

Richard

I think password managers, as well as with organisations looking to protect their users, it's important that password managers are used properly. A password manager is a great tool, I use one for my home business use for creating complex passwords, complex unique passwords. So I don't know what my passwords are, because they are a random bunch of 25 alphanumeric and special characters. I have no idea what they are. And the password manager remembers that, so every single asset that I talk to has a unique password. Password managers, I think, are very useful especially in the short term and within enterprises. It's not so great for end users because the vulnerable people in society, and people who are not familiar with technology, may find them quite difficult to use. But in enterprises they're certainly very useful because it allows you to create complex, distinct, unique user passwords for every single application that you go to. My passwords are often 25 characters long and a stream of unrecognisable characters, and numbers, and estimation marks, and question marks, and special characters that will be impossible to guess or impossible to do a brute force hack upon. So I think they definitely have a position, especially in the enterprise.

Jane

I mean, Richard, once again, I also use password managers. Are there risks associated with those? Recently we have seen LastPass, breached. And every time I see something like that my heart goes in my mouth. And then you realise, actually, your passwords are typically safe. But is there any kind of real chance that either the database itself could be breached particularly say, if you're reusing password for them? Or something a bit more sophisticated than that?

Richard

Well, I think a lot of the time, there's always been that concern about “if I put all my eggs in one basket, is that creating more of a risk? I think that's been the typical response to people not wanting to use password managers. But I think when you actually look at the security that is around the actual passwords, and how they're stored and how they're utilised, I think that that overweighs any of that concern about the risk about having all your passwords in one basket, or eggs in one basket. So I don't think there's a chance that if you, people do use them, I think they are very good, they're very useful. It again, outweighs the risk of just having very simple passwords that you can try to remember.

Jane

Yeah.

Rory

So in response to this, to focus on passwordless security as an option. When someone says passwordless security, I mainly think of biometric security, fingerprints, facial recognition. Is this the most promising avenue for this technology? And what are some of the other methods that are in place?

Richard

Yeah, well I mean the concept of security authentication has always been based around sort of one of three concepts. So there's something you know, which is a password, something you are, which is your biometric. So use your face print or your thumbprint, or something like that. Or something you have, which could be a USB token, or something that you can punch numbers into as a handheld device. So one of those three things, and we've relied upon the something you know, predominantly, which is the password. And we tend to use the something you have, like the USB key, or the something you are like the biometrics as an additional level and commonly called this is like two factor or multi factor authentication. So that what the concept is of going passwordless, is actually shifting away from using passwords as the primary method of authentication. And say, why do we need to use passwords as a primary, when we can use one of the other two, such as having a hardware device or using biometrics to do that first part of authentication? Obviously, there are many benefits to using the hardware device, or your thumbprint, or your face print. Because they're not likely to have the same level of simplicity around them. You know, it's not going to be quite as simple as password 123, when you're talking about your thumbprint, so there's a lot of sort of intrinsic benefit to that already.

Jane

I mean, when we're talking about this, we've sort of talked to him a little bit. When we talk about passwords you're speaking about moving the second part of two factor authentication to the front, the something you have, the something you are. Are we talking about getting rid of passwords completely, or do they become the second part of this 2FA? Or is it going to be my face and my token?

Richard

Passwords can still be used, but I would suggest that they are taken away largely completely, because they prove that they can't really be utilised effectively or securely. Certainly, if you have a three factor authentication it’s often used when you're going into very secure facilities. Where you have to sort of take in your access card, do a thumbprint, and then you have to type a PIN code in there. And then the PIN code would be sort of synonymous with your normal password. So that sort of three factor authentication will still be relevant in a lot of cases. But I think the concept of using a password to log on to a website will eventually go away, because it's not an effective way to access that level and proportionate that level risk.

Rory

And when you're talking about, I guess, in some cases this is consumers would be able to use, say a passkey, a physical passkey to verify their identity on a multitude of different accounts. In an enterprise model, could this be hard to, this specific something you have, could that be hard to implement in that if you left the company, you'd have to return what you had. It would potentially be harder than do changing a password?

Richard

Absolutely, I think the same thing you have part is an interesting concept about what it can actually be. And something, because I think everybody's sort of familiar with the, the old dongles which have the sort of rotating password pass key on them, that have been around from people like RSA for many, many years. And if you look in your desk drawer, you'll probably find two or three of them where the batteries died that you've had from many years ago. And that's not an unusual situation. And so there is an overhead to managing all those additional keys, and people will forget them, people will lose them. So there is an additional overhead in terms of that. So ideally, you want to try and use something that you already have, and you're never likely to let go of. And that's probably something like a mobile phone. And you can use a mobile phone as the something you have component. And it also allows you to do the something you are component because it allows you to do, especially with the modern smartphones, the biometrics and things like facial recognition and fingerprint recognition.

Jane

And I suppose if you've got company provided phones, then it's as easy as just returning the phone or remotely wiping it or any of that kind of thing if somebody leaves the company but they are, for whatever reason, not returning the phone.

Richard

Yes, if you're provided a company phone you will normally have some sort of MDM, some mobile device management software on the phone. Whereas as soon as they leave the company or as soon as the employment is terminated, then it's a question of just hitting a button on the central console and it would remove any of those components.

Jane

Yeah, I've thought of all kinds of nefarious things for employees to do. I think most of us more inclined to sort of lose our phone, on a train or whatever as well.

Richard

Yeah,absolutely. But also remembering that without the knowledge of where you're going, and what you're going to, because you still have to get the thumbprint to actually authenticate because it's part of that you would have something you have, something you are. Smartphones make it very easy to do two factor authentication, by taking the biometrics and the something you have. So that gives you the two factor based on that. So if you do lose your phone, they may be able to guess the pin number or the swipe pattern you have to get into the phone. But it's unlikely then they'll have the biometrics to actually get through the next level, to get on to the corporate assets as required.

Jane

Sure.

Rory

Through things like FIDO, there's been talks — I know that some manufacturers at Google Apple, Microsoft, have been in talks — to standardise this kind of technology that you're talking about. So that regardless of the hardware you were using, like the standardised keys across either your business interactions, or on a consumer basis across all of your different accounts, do you think a unified approach like that will be necessary to avoid there being a different kind of tool sprawl for businesses and consumers in the future where they're having to oh, you know, “which passkey am I going to be doing through my phone?”

Richard

I think there's going to be an argument for that. Not quite sure what things are going to happen in the short term, but it remains to be seen. I do think the work that FIDO is doing to promote easier and more secure access online is something that will be followed by more and more organisations. The current iteration, which is FIDO2, so fast identity online version two, even goes so far as to provide solutions that allow you to do phish proof MFA, because that is also a problem with MFA. It's not 100%. It's a lot better than not having multi factor authentication. But MFA is not 100%, and with the next generation, which is FIDO2, it will be phish proof. Again, it's never going to be 100%, but it's going to be a lot closer to where we want it to be.

Jane

So Richard, you've mentioned, FIDO2 briefly there. Could you tell us a bit more sort of what that's about?

Richard

Yeah, so FIDO2 is a methodology to make MFA sort of even better, because surprisingly, MFA doesn't solve all problems. You know, we think that it's going to address all of our authentication issues, but it doesn't and there's been several organisations that have been breached fairly publicly. So a very well known video game manufacturer, a well known taxi company, a global taxi company has recently been breached by what's called an MFA bypass. And an MFA bypass technique basically means that the device is talking to the website or the application, and the device that is doing the multi factor authentication are not linked. So this means that if you have stolen credentials, you can put those into the asset, put those into the website, the website will respond with an MFA challenge. And the attackers realise that the MFA challenge is going to be sent to the user, and they will try and persuade them to actually accept the challenge. And it's surprisingly easy to do that, with things like push MFA challenges. If you start sending people that at 3am in the morning, it's remarkable how quickly people will just click on ‘accept’, rather than have to listen to the bing, bing, bing, bing, bing, bing, constantly being reminded in the middle of the night. And this is what's happened to many, many organisations, is that because the device that’s making the request to the asset and the device are not linked, you can get this what's called push MFA or MFA bypass. So what FIDO2 wants to do is to locally connect the devices making the request to the origin and your external device. Now, you can do this through a USB key, plug the USB key into your device, they're now locally linked. Or you can do it through NFC, or you can do it as we do with Akamai, you can link them together through cryptographic keys. So my phone and my laptop are cryptographically linked, which basically means that the MFA is not valid unless it comes from my laptop. So if my credentials are stolen, and somebody tries to log in in another part of the world, and then tries to do a push MFA exertion on me, it won't even happen because the request has to come from my laptop. And this is what FIDO2 is doing, it’s ensuring that local MFA connectivity before it actually goes on to the next stage. And by doing this, it gets round a lot of the big MFA bypasses that have happened this year.

Jane

So this all sounds really great. And as a consumer, I can see myself adopting it. I already have, I use my thumb on my phone, people use their faces on their phone. And, you know, really consumers can turn on a penny when it comes to adopting new technology, anything like that. For businesses, it can be a little bit more difficult, especially if there's some kind of integration that they need to do with legacy systems. So how quickly can that be done? I mean, is it a problem? Am I throwing up a problem where one doesn't exist? But if I'm not, how can this be managed, and how quickly can things change?

Richard

I think with enterprise, it'll be a lot easier than it will be for consumers. For two different reasons. The main reason for consumers is that there will be a long tail of users who, for want of a better word, maybe a sort of Luddite about adopting the new technology. There are many people who don't want to have a smartphone with biometric controls on them for whatever reason. So for a service, such as public services, public sector, where they have to provide a fully inclusive service, there's gonna be a long tail of people there who won't fit into the parameters where you can do that full technology, but for multi factor authentication using biometrics or smartphone, so there will have to be solutions there to cater for those people. But with the enterprise, you have a lot more control. And you can certainly start linking all of your assets to talk to a central identity provider, be it Active Directory or some other form. And once you have authenticated with your main IDP, your main identity provider that can provide authentication tokens to every single other device within your estate, meaning once you're logged in, you're logged in across your estate. And that identity is protected by authentication through multifactor.

Jane

So the other way around to what you find quite often then, is that for businesses actually, this is quite easy. I mean, are there any sort of key hurdles that might hold up passwordless security in businesses or is it really just as easy as kind of going, “right this is our, you know, the method that we do now internally, at least. And, and off we go”?

Richard

There's always going to be some legacy applications that don't have the ability to use authentication. So there's a functionalities like OAuth, which allows applications to be authenticated elsewhere. If they don't have the functionality to have that capability, then you're going to have to have another way of authenticating with those legacy applications. So it's not necessarily going to be applicable across the board. But most modern organisations will have the facility to deploy the majority of their applications through that one password, or one authentication process, and then being able to pass that assertion through to all the relevant applications.

Rory

Do you think that implementing a system like this might also help with oversight of who has access to which systems? Because currently, obviously with passwords, it's very easy within an organisation for someone to ping a password across on a Google chat to someone who maybe shouldn't have access to, to a back end system. So using authenticators might also improve observability across the system?

Richard

I think there's a potential for that, I think that where that particular area’s going is more into is looking at the authorisation component. So with identity, you’ve got the identification, which is the username, you've got the authorisation. Sorry, the authentication, which is the something you are, something you have, something you are. And then there's the authorisation component, and authorisation is something that's being looked at when you look at things like zero-trust network access, which is a way of giving users access just to applications that they need. So it's really sort of going down heavy on lease privilege. This is a really good way to ensure that only the users authorised to access an application, get that level of access. Which means that anybody else does not have that level of access. So, if you gave somebody else a password, you'd have to have the username and have the password, but they still wouldn't be authorised, they still wouldn't physically be able to get to that particular asset. And I think that's why a lot of organisations are looking into it. Because I know zero trust is a word that bandied around a lot with, with wanton carelessness, sometimes, but it fundamentally comes down to lease privilege, which is something that IT professionals have been familiar with for many, many years. And that's where it's trying to get to, if you don't have the right identity, authentication and authorisation, you can't actually get to that application.

Jane

So Richard, if the worst does happen, and a business is hit by a cyberattack, can using a passwordless solution help minimise the impact? Or does it just minimise the risk?

Richard

That's a really good question. I think initially, it minimises the risk. Because I think if you, there was a report I think in the Verizon data breach incident report last year, that credential vulnerabilities were responsible for 84% of all breaches. So if you can get to addressing that vulnerability, that reduces the risk significantly of having a breach. So I think that's the first aspect. Once somebody has got inside your organisation, then absolutely, having good identity controls is in place, but it's a little bit late at that point, you then need to be looking at other security elements to be able to protect your organisation. And that can be through things like zero trust, network access, or micro segmentation to throw another technology into the mix to prevent them moving laterally through your organisation. But I think this is where passwords can be used, especially within the enterprise as part of a layered security model of trying to reduce the risk at all levels, reduce the level at authentication time, reduce the risk at connection time, whether connecting via IP or just the application layer, and then reducing the risk of moving throughout an organisation when deployed as part of a managed strategy, then you're able to reduce the risk at all levels as best as possible.

Jane

Yeah, and I think you've kind of hit on something important there really, which is whether this is passwordless or really any other kind of security technology, or any technology, that it's not a panacea, it's not a cure-all, it has to be used as part of a wider security strategy. Whether that's training or like you say, other technologies that can help the progress or at least to slow the progress of anybody who's staging an attack. Is that a fair observation?

Richard

Absolutely. I think that there aren’t many things that as security professionals we can do, that actually makes things easier for end users. Normally, we are seen as the Department of No, the Fun Police. So I think that anything that we can do within security that actually makes lives easier for end users, and makes them more secure, is a good thing. And reducing passwords, reducing the use of passwords is a good thing, because nobody likes them. Nobody likes them, nobody likes trying to have to remember them. There's always a challenge, there’s always some times you forget, or whatever. It's a problem. It's a massive security risk. So getting rid of that pain point from users would be a boon I would say.

Rory

So you think that there's real potential for this to improve, maybe, productivity within the workforces? Or at least improve the use of access for vital systems within workforces?

Richard

Absolutely. I think when you look at most organisations where you have, you know, probably thousands of applications within an organisation, although most users will only have access or need to use 10 or 20 of them. The ability to reduce the access to just the applications you need, and the ability to have to worry about a password is fantastic. At Akamai we've been passwordless for many years now. So I don't use a password to log on. I don't use a password to access applications, it's just all done through passwordless technology. And that makes it a lot easier for me not having to worry about, “oh, I need to access that particular system. Where is it located? What password do I need?” All that, it's a lot easier to use? And yes, it's anything that gets rid of that, “oh, what's the password for that application that I haven't used for two months?” Anything gets around that problem, which everybody has, if you can get if you can solve it, it's bound to help all sorts of users.

Jane

So Richard, at Akamai you are ahead of the curve. But how far away do you think we are from universal adoption of this kind of security across businesses?

Richard

I think that's a very difficult question. Because there are many companies and many verticals that are on all sorts of that journey, all different areas of the passwordless adoption journey. I think people will want to go there because the benefits are manifold. But there is always going to be an issue with inclusivity. Because you have to make sure that everybody is catered for. And if you can't cater to everybody, then there's always going to be an issue. So in the consumer space, I think it's going to be utilised to enable users, I still think you're going to have to have passwords for inclusivity. But if you're using it in the consumer space, and you want to get access to all of your favourite music sites, or TV sites, or shopping sites without having to remember a password all the time, I think people are going to embrace that. And that it will be seen as a benefit not only for the consumers, but also the vendors as well. In the enterprise space, I think that organisations will want to go down this level to a certain degree, I think there's always going to be legacy applications that won't suit that. Or the infrastructure will not benefit it as a whole. But I think overall, it's certainly a methodology that will be broadly adapted. The big vendors, as you mentioned at the beginning, are doing this. Microsoft has things like Microsoft Hello, which allows you to do passwordless authentication. It's something that's being adopted through many different vectors, so it will increase. Am I going to put a date on it and say you have no more passwords in five years. That’s a crystal ball I would love to have, but I couldn't say that.

Jane

No fun, no fun.

Rory

Well, Richard, thank you so much for being on the show.

Richard

Thank you Rory, thank you Jane. It's been a pleasure. Thank you very much indeed for having me.

Jane

Thank you. As always, you can find links to all of the topics we've spoken about today in the show notes and even more on our website at itpro.co.uk

Rory

You can also follow us on social media, as well as subscribe to our daily newsletter. Don't forget to subscribe to the IT Pro podcast wherever you find podcasts. And if you're enjoying the show, leave us a rating and a review

Jane

I will be back next week with more from the world of it but until then goodbye.

Rory

Goodbye

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Surveying today’s threat landscape'. We apologise for any errors.

Rory Bathgate

Hi, I’m Rory Bathgate. And you’re listening to the IT Pro Podcast, where this week we’re assessing the current threat landscape. Cyber security is at the forefront of company strategy — if you go into a boardroom, you’re likely to find it ranks at the very top of C-suite concerns. In an ever-changing threat landscape, full of exploits, state-sponsored threat actors, and increasingly novel strains of malware, businesses must maintain oversight of endpoints and stay up to date with pressing risks. This week, we’re speaking to Bernard Montel, technical director EMEA at exposure management firm Tenable, to discuss how businesses can tackle their threat surface area, and the biggest risks. Bernard, thank you so much for being on the show.

Bernard Montel

Thank you very much for this invitation. I'm very proud to be part of your podcast today. We try to help our customers really to reduce the risk of the cyber attacks.

Rory

Well, I really appreciate you being here. I'd like to start with quite a broad question. But just as a kind of a roundup of 2022, what would you say are some of the key security takeaways from the past year in terms of the threat landscape?

Bernard

What I would say is that 2022, unfortunately, was in the train of 2021. We have a lot of new threats and, I mean that the pressure is there. It's, you know, it didn't really stop. We had much more context in 2022. But the top one is still you know, the cyber criminals, which are there and ransomware that we talked about for the past couple of years now is still, you know, very here and number one in the threat that organisations globally have today. That's one of the takeaways that, you know, there are still a lot of attacks every single day and still ransomware as is the top one.

Rory

Yeah, ransomware always comes up in these conversations. It seems to be something that has had a lot of focus recently. I saw a recent report that indicated that the UK government's National Emergency or Cobra meetings have centred around ransomware quite often recently. Would you say that this intense focus on ransomware is warranted, is it representative of the real scale of the threat?

Bernard

I mean, yeah, I mean, definitely, yes. But what we've seen as well, in 2022, is the emergence of, you know, attacks we had in the past, like, for example, the DDoS attack, which means denial of services. And also phishing attacks are also raising in 2022. So that's a kind of new way, because now we have also the three dimensions of the three kinds of attacks, we will also have seen some, you know, attacks using the three of them in the meantime. So we call it triple extortion, which means that not only a company or an organisation was hit by a ransomware attack, but in the meantime, they were hit by a denial of services attack, which means shutting down their their services. So we've seen that in 2022 DDoS attacks were quite old, but they are coming back in combination with ransomwares.

Rory

So it sounds like it's a lot of the same old threats, a lot of classics, you might call them, the classic threats, they're here to stay. But have there been any big surprises in the year as well, any I know that there's been some methodology change in ransomware, we've seen the programming languages and some strains change to languages like Rust, would you say that this is keeping threat management kind of on its toes?

Bernard

So one of the main changes we've seen two years ago was really the supply chain attacks, you know, for attackers, only targeting one software and then having that domino effect, or you're you're hitting one, but you are compromising many. That is something which is still very very new. For example, very recently, Python has been attacked and compromised. Now, if you are compromising that kind of technology, immediately a huge amount of developers are using Python and if you're using a compromised version of its, as you can imagine, you know, the drama around it worldwide because it has been spread everywhere. So that is really the supply chain attacks. We all remember SolarWinds, but we have many others coming out. And Log4Shell year ago, roughly, you know, I think it would be the anniversary of Log4Shell right now, a couple of couple of days, I think it came out roughly around the 2 December or 3 December. You will be surprised that a year after, we've done a study at Tenable, a lot of companies are still vulnerable to Log4Shell. It's not that they've been lazy. We've seen once one element, which is very important is called reinfection, they've fixed the vulnerabilities partially or completely, but they install new software, and new technology, and now suddenly, those new technologies unfortunately, were using a very old library of of Log4j. So those are the supply chain elements. But you asked me a question regarding what is new. And what really new in 2022, is the wipers. Now ransomware groups are really inspiring themselves by some nation states groups, which were deleting data, in some parts of the world, and some of the conflicts of the world. But now, you know, such kind of techniques has been reused by, you know, ransomware groups for not only just encrypting data, because it's quite long and difficult. They prefer breaching, putting the data out, and then completely deleting the data with what we call the wipers, which is wiping the data instead of encrypting it. And that is quite new. I mean, in 2022.

Rory

Yeah I mean, I mentioned it I think briefly in the intro, but this influx of state-sponsored groups, amidst or parallel to the rise of ransomware as a service groups and threat actors like that has seen a big increase in wiper activity. I mean, with Russia's invasion of Ukraine, obviously, we've seen a lot of attacks that aren't driven by profit, they're just driven with the intention of destroying systems, of causing chaos in systems, especially in critical national infrastructure. Would you say that this is kind of an accurate assessment that attacks on critical national infrastructure are increasing, are a growing threat, and these kinds of attacks that aren't so much driven by profit, that just are driven with chaos in mind, are maybe a growing concern?

Bernard

I would say that, you know, as I said, you know, those techniques are shared between those attackers groups, but the main motivation is still, you know, financial motivations. Top one is still very high on the fact that those attackers really want to get money. The fact that they are attacking critical infrastructures, and again, if you will linking the number of attacks against critical infrastructures using ransomware, this is very huge, which means that their main motivation is still financial motivations. So they are using techniques, which are very similar to what we've seen, as you said, in Ukraine. But I would say that the attacks against critical infrastructure are still very motivated by the money they can gain with that. But yes, I mean, we've seen anyway increases against critical infrastructures a lot. So, I leave you, you know, guessing if this is just, both together those nation state attacks and ransomware attacks together. But what is important for us is how they do operate, whatever the motivation, what is important if they, they do operate by using vulnerabilities, which are there sometimes for a while. You would be surprised if I would say to you that, some attacks, whatever their whatever their motivations are still using, for example, Log4Shell we discussed about it, but also ProxyShell, which is a very old one right now, you know, more than roughly a year and a half, even two years. So, the way they do operate, you know, it's more important to compare why they do that, because what is important for organisations is really to be able to identify any attack path that attack groups will use. But to go back to your question, yes, critical infrastructures are attacked dramatically today, and the government took that really seriously. We've seen for example, some governments shutting down some some attacker groups, we've seen government putting a lot of pressures against organisations. Like in Australia, one of the telcos has been attacked, not only have they lost a lot of customers, but they also have fines from the government, “hey guys, you know, we are there and we are forcing you to put some security policies”. And if you don't do that, and obviously you get fined by the government.

Rory

Yeah, I mean, Australia, there's been this terrible sequence of attacks in Australia, some links to SingTel, some not linked to SingTel whatsoever. But as you say, the government have stepped in, they've increased the, I think the fine increased from 2 million Australian dollars to 50 million Australian dollars for privacy breaches. And also, there's this open discussion around legislation banning companies from paying the demand, for paying threat actors in ransomware. Do you think this kind of action is effective? Is it warranted? Or does that need to be either more done by governments or more done really, in the private sector?

Bernard

I mean, this is the only way they have to force organisations to increase the level of security. If you go back, for example, to GDPR which came out from the EU. I mean, by applying GDPR everywhere, mechanically the level of security has increased. That doesn't mean that we have reduced the number of attacks, the number of attacks as well has increased, but if we all together try to upload the level or the greater level of security, then mechanically, you know, we are better prepared. But that's the only way they have; the government have two kinds of responsibility. Number one is really protecting the government agencies. So they have some security operation centres, they have national security agencies for looking after attacks that are targeting themselves directly. But for the private organisations, you know, they cannot control them. So they have to be able to force them by directives, regulations, local, or whatever they are EU or UK based, they are already looking after the set of rules they're putting together, and the fines in fact, is the only way for forcing them. You know, if you only put recommendations, soft recommendations, I wouldn't say that they will follow it. If you're already putting fines, okay they would take that seriously, because they will be between a rock and a hard place, because, in one hand they have the pressure from the attack groups, and in the other hand they have the pressure from the governments. So they do something. So there, that's for sure.

Rory

And on that point of companies doing something, just to circle back to what you were saying earlier about Log4Shell. I did see the Tenable research that was published, it's kind of a shocking statistic that 72% as of October of 2022, 72% of organisations remain vulnerable to Log4Shell. I know that you said earlier, this isn't necessarily negligence on the part of the companies and maybe to do with all the libraries that are difficult to strip out. But surely, there's got to be some sort of fire lit under the feet of these organisations to change this.

Bernard

Yeah, there is another study we've done last week, discovering external assets, which is, using very old protocols. This study has been done by Tenable against 22 major UK organisations, and we found that 100% of them were still using the old encryption protocols in some of the assets. But what is amazing with this very, very recent study is the number of assets, we found — external facing assets, which is huge. An organisation itself has more than 500,000 assets. How can you manage that? So, I would not blame them to not fix Log4Shell, that they didn't fix it in January or February. You know, we knew when Log4Shell came out how deep it was embedded into some of the technologies. So, a year after, yes, the number is quite high 72%. But that means that those organisations, they don't even know the asset they have. So that's the first takeaway. The second takeaway is, if they new such kind of assets, they are fixing it. But in the meantime, you know, the attacks surface is really growing and highly dynamic, that is the second takeaway. You cannot imagine if it was 15 years ago, when you had a set of assets, you knew what you needed to fix, you fixed it, and then for the next two years, you would be okay. Now, this is not the case anymore, developers are pushing codes or committing codes, once per week sometimes for making new features on some applications. So as you can imagine, it's super fast. So a lot of assets, they don't know a lot of assets, you know, that are moving and growing and changing roughly every week. So if you don't have a real time and continuous programme, then you are only doing screenshots, and then photographs, it doesn't give you any motion. So that's, I think, one of the takeaways, the third one if you want, which is if you don't do that all the time, or the continuous way then you are, you're late. And then that's what's happened after a year.

Rory

So as much as possible, you should really have real-time security response to these threats, really be plugged into not just vulnerabilities, but oversight over your own footprint.

Bernard

Yeah, and another element, which is quite important is, you know, the majority of the organisation's invested a lot in real time security event detection: “I want to be aware if there are any alerts or any incident right now”. But then they didn't really think about, hey, what about if you're aware, in real time, on any vulnerability? Because then in this case, it will put you in a much more preventive, predictive approach. Some CISO that I talked with a couple of years ago, they said, “I would dream to predict what will happen”. In this case, you have to change your mind, you know, spend more time in prevention, rather than only putting all your effort in detection, because if you do that it's like our health; if you don't do any sport, you are eating fat and sugar, and then you will get some stuff, that's for sure. But if you are making a lot of prevention, your life is… we used to use the term cyber hygiene. And I like this one, because it really reminds me of our daily hygiene, you know, as a human. So, if you really are looking to understand in real time what's happened in your attack surface, immediately, you can identify a door that was closed, and that certainly is open. And if you don't do that, believe me, you know, the hackers would do that, because they are trying to scan and identify those vulnerabilities every single day. I mentioned the attack paths, and we organisations, global organisations are working in silos, we have people in charge of it, we have people in charge of security, we have innovation within the security space, we have, you know, a specialist on the cloud, specialist on identity and so on. Attackers don't do that, they have a small group of people, they try to find a way, they find one way and they — I'm used to using the spaghetti, you know, they are putting it and they find, “oh, yeah, well, I've got a meat now, you know, I'm very hungry, but I have everything I want, because I just pulled back at and then I found a way to get much more”. So that's one stuff, we need to understand the way they are behaving is smart and agile, so we have to change our mind and not work in silos with different people that never communicated before and together. So that's one stuff, I think we need to change if we really want to help our organisations to be more proactive.

Rory

So would you say that that should prompt maybe more of a unification of companies? I know that this is a topic that we've discussed recently, as well, but this push for hybrid cloud, as well as, as you've pointed out, lead to this kind of silo structure, where you can you can expand and expand and expand and just tack on more silos, but that's not necessarily conducive to having a full understanding of your surface attack surface.

Bernard

Yeah, I mean if you look at what the SOC has done, the threat detection and response. They've done that journey already, you know, they collected a lot of data with logs, for example, rail, or EDR, or with what we call a SOAR, which is an orchestration for incidents. They have tried to have that view around those security events. If we do exactly the same on the prevention part, then we have the full picture. Then, we can ensure that aggregating the data, the prevention data, the static data or the state data that we can have. I just want to go back to the the analogy that I've done with doors open. Now that we have the attack surface, which is partially in the cloud, partially on-prem, IT, network identity, and some organisations have also industrial system OT, we don't have a cloud specialist to understand what's happening and address your system, we still will have those people in charge of their own domain, that's for sure. But what we need to have to aggregate the data together, we need to have a governance where we see in a nutshell, at a glance, all those indicators, I'm calling that the key risk indicators for companies. A company needs to understand if for their business critical applications, they have all the lights, you know, green, orange, yellow, red, they know immediately, whatever the technology behind it, a business critical application could be hosted in the cloud, and partially also having some on-prem data, on-prem identity. What is important is to have that risk-based governance, on the preventing part. Which is, every morning I open my dashboard, and I say, “I'm good today, I'm fine today, I know that my business critical application doesn't have any doors open today”. Tomorrow could be another day.

Rory

It's interesting, because that does seem to be a point of contention within the industry. I've definitely spoken to some people who say, “Yeah, prevention is good, but you can't prevent everything, so, you know, occasionally, you've just got to, you've got to respond. It's all about the response when anything does happen”. But it sounds like just to link it back to Log4Shell. Correct me if I'm wrong, but it sounds like what you're saying is, we really have to prevent the next big vulnerability from taking place, because I guess, otherwise, you know, that could be catastrophic for our business, if you're not focused on prevention,

Bernard

When you are leaving your house, do you close the door?

Rory

Well, that's right, exactly.

Bernard

That's, you know, we have closing and locking the door, okay, and putting an alarm system. If you leave the door open, and you put just the alarm system, believe me, it will ring, that's for sure. Because someone who's out will say “that door is open, what's going on here and what's wrong?” you know, and then suddenly, you will get a notification because your alarm system has detected a movement or whatever. So, I think we need to apply the same analogy. People need to identify if, before leaving your door, or your window is open. You know, I'm living in a second floor here. So I'm very sensitive, in my flat, that I'm not leaving the windows open, because people can climb and enter into my apartment. So before leaving, and looking after the windows, if those windows are closed, I'm safer. That doesn't mean 100% safe, it could be that someone will, you know, find another way, but I'm doing what I need to do. My duty is closing the windows, closing and locking the door, then having an alarm system, it’s not the other way back. People are looking at their detection, saying, as you said, you know, “I cannot prevent, so I will detect”. Okay, now, if you want to detect an encryption for a ransomware attack it’s just too late, you know, you have to be able to prevent any way. So focus on prevention, at least equally than the detection. Even in systems sometimes, if you are investing 80% on your prevention, then your detection complexity will reduce anyway, mechanically, it's easy to understand, I think,

Rory

On a strategic level that makes perfect sense. On a technical level, something I'm wondering is, you're talking about maintaining prevention hygiene, and bringing together teams that were siloed. So on a more specific technical level, what kind of systems can be implemented by businesses to achieve this, this increase in prevention.

Bernard

As I said, you know, a cloud security specialist won't be, will never be an OT security specialist. These are different worlds. We don't want that, we don't want to do everything, we want to do something. So they will still have their own tools and what we call sensors, they will need to collect the data. So for example, if you're collecting the data, regarding your cloud misconfiguration, you know, someone has just deployed an application in the cloud and they've left misconfiguration somewhere leaving then again, the door open. Now, we need to collect that data and attach that to a platform where we can see that data linked to the business application. And if we do that for identity data, if we do that for vulnerability, classical vulnerability on-prem data, if we do that for web application, OT, and cloud all together, then we have in one place, what I'm calling again, the key risk indicators coming from those tools, coming from those solutions. And even if we go further, we can even collect data from non Tenable technology. Nothing is stopping us, you know, we need to be able to have those sensors covering those scopes. The scopes are technical, the scopes and the technology is what it is. Okay, so cloud technology is one, which is very different than active directory, which is very different than network or devices or OT, we won't change that. We will apply sensors on those different places within the attack surface. But if we stay there, and stop only there, each and single team will have their tools, or no one will be able to understand globally what's happened in the attack surface. So that is the answer. The answer is aggregating all those data into one place. That's exactly what we've done at Tenable. We have created a platform, which is aggregating the data, correlating the data, the same correlation, we've seen in the you know, in the security event detection part we apply the same correlation of preventing data is something that never existed before. And we really wanted to be able to call that, you know, subject as well.

Rory

On this task of aggregating data, obviously, there's huge potential for automated systems. I know that there's a lot of, kind of naturally, a buzz around terms like artificial intelligence and machine learning. Obviously, it's not a silver bullet, you can't just plug in an AI and everything improves. But do you think that there's, there's scope for maybe more intelligent aggregation, and contact providing context to security teams for this?

Bernard

So in this platform, called Tenable One, we have a group of people called the data scientists and they have developed such a kind of algorithm, when you calculate the risk, you are collecting data, you are collecting the assets, and we need to understand the posture of the assets. By doing that, you know, for doing that, we need to calculate the risk. And so that's exactly what we've done. Again, within this platform, the value is the data. But if we stay there it’s just just the data, we need to be able to calculate some exposure score. And that we've done, for example, with some data scientists, and obviously some kind of artificial intelligence that they've developed to be able to understand the trends, understand the posture, understand the reason why, and the key risk indicators as has been put together.

Rory

While we’ve got you here, I would be remiss not to ask if you have any burning predictions for 2023, or beyond, for the threat landscape: what you think is likely to be a key concern going forward.

Bernard

So in the beginning of the year, we've seen attacks against remote workers, and critical infrastructures. And also cloud because the cloud and remote workers are, you know, very linked together, we need it, we need to work from home. So we need to have much more cloud applications. Very recently, as I said, you know, we've seen ransomware attacks are very there, plus nation state attacks. Now using the tools, we see combinations of both. So again, I want to go back to the wipers, I want to go back to the supply chain. So my prediction, unfortunately, would be that we will see more and more attacks, you know, using not only double extortion, but now triple extortions — if you really want to target an organisation, you know, those attackers are now using one, two, three kinds of attacks in the meantime. So that is a trend that we've seen, and I think we will see that in 2023. The second part that will never, I think, stop is attacks against critical infrastructures. We've seen a rise of that. We've seen a lot of attacks against critical infrastructures. And again, the main motivation is most of the time, financial motivation, but we know we tend to deny as well that there have been nation state attackers as well. If you combine both together, the number of attacks against critical infrastructure has been very important. And the last one is obviously very related to the cloud. You mentioned hybrid cloud, and cloud will never stop, you know, some organisations will be slower than others. But definitely the cloud is here, and you know, we will see clearly attacks against cloud more and more.

Rory

Well, on that note, thank you so much for your time. It's been a pleasure speaking to you, and I'd love to check back in with you at some point in the future to discuss the threats, what's come true and the state of the threat landscape going forward again.

Bernard

Thank you very much.

Rory

As always, You can find links to all of the topics we've spoken about today in the show notes and even more on our website at itpro.co.uk. You can also follow us on social media, as well as subscribe to our daily newsletter. Don't forget to subscribe to the IT Pro Podcast wherever you find podcasts. And if you're enjoying the show, leave us a rating and a review. We'll be back next week with a special festive edition of the podcast but until then, goodbye

In a sector of changing priorities, cyber security remains at the top of the list in any boardroom. With the threat landscape presenting challenges old and new, and the increasing risk of entities such as state-sponsored hacking, it is essential that businesses carefully craft their cyber security strategy to keep ahead of the next big attack.

The speed that threats evolve now demands real-time action from companies, who must maintain oversight of their attack surface and maintain as many assets as possible against vulnerabilities such as Log4Shell.

This week, we spoke to Bernard Montel, technical director EMEA at exposure management firm Tenable, to discuss how businesses can tackle their threat surface area, and the biggest risks.

Highlights

“You will be surprised that a year after, we've done a study at Tenable, a lot of companies are still vulnerable to Log4Shell. It's not that they've been lazy. We've seen once one element, which is very important is called reinfection, they've fixed the vulnerabilities partially or completely, but they install new software, and new technology, and now suddenly, those new technologies unfortunately, were using a very old library of of Log4j.”

“I mean, this is the only way they have to force organisations to increase the level of security. If you go back, for example, to GDPR which came out from the EU. I mean, by applying GDPR everywhere, mechanically the level of security has increased. That doesn't mean that we have reduced the number of attacks, the number of attacks as well has increased, but if we all together try to upload the level or the greater level of security, then mechanically, you know, we are better prepared.”

“An organisation itself has more than 500,000 assets. How can you manage that? So, I would not blame them to not fix Log4Shell, that they didn't fix it in January or February. You know, we knew when Log4Shell came out how deep it was embedded into some of the technologies.”

Read the full transcript here

Footnotes

• The new wave of cyber security threats facing critical national infrastructure (CNI)
• Tenable Research Finds 72% of Organizations Remain Vulnerable to “Nightmare” Log4j Vulnerability
• Businesses urged to remain vigilant as Log4Shell issues persist one year on
• Microsoft says “it’s just too difficult” to effectively disrupt ransomware
• 'Systemic ID problems for 10 million Australians’ after Optus breach, warns minister
• Australia to increase maximum data breach penalty to $50 million
• MoD launches callout for tech to plug cyber security holes
• What is an SOC audit?
• What is GDPR? Everything you need to know, from requirements to fines
• Mastering endpoint security implementation
• What is big data analytics?
• What good AI cyber security software looks like in 2022
• How to use machine learning and AI in cyber security

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Cyber security company Sophos has issued a warning over antivirus-nullifying malware it discovered bearing legitimate digital certificates, including signatures from Microsoft’s own digital verification service.

The drivers, found paired with a ‘loader’ executable that was used to install the driver, carried the digital signature of Windows Hardware Compatibility Program (WHCP), and appeared to be specially designed to limit the functions of endpoint detection and response (EDR) security programs.

Code signatures are cryptographic certificates that indicate a program has not been altered since its release by its manufacturer. WHCP signatures are only intended to be given to software that Microsoft has checked over and given its personal seal of approval, and therefore seen as trustworthy files to run by Windows systems.

Researchers say that the find shows that threat actors are working harder to move up the 'trust chain', employing increasingly sophisticated methods to sign malware with legitimate cryptographic signatures so that it can be installed on systems without detection.

Sophos made the discovery while responding to a ransomware attack, which revealed the driver and executable. Because it prevented the attack from occurring, it has not been able to definitively identify the ransomware variant that the driver sought to enable and deploy.

However, in a blog post researchers noted that the loader used is likely a variant known as BURNTCIGAR. Use of this variant is characteristic of the Cuba ransomware group, and a search of public repositories for similar drivers revealed an archive that contained both the driver and loader, along with a list of 186 files that are commonly-used in endpoint security and EDR software. Researchers surmised that these were processes intended to be killed by the malware once activated, to allow the ransomware to run without resistance.

In a subsequent search for similar variants on the malicious driver, security researchers found as many as ten, having emerged in the middle of the year and grown in number since then. The earliest of such drivers found by Sophos was uploaded to antivirus aggregation website VirusTotal in July, and carried the signature of Chinese software developer Zhuhai liancheng Technology Co., Ltd.

This company’s signature is flagged by Sophos as a potential unwanted application (PUA), and the threat actors appear to have moved away from this to less suspicious certificates in subsequent iterations. Indeed, other malicious drivers were signed by Nvidia, in addition to those that carried the WHCP signatures.

Following the discovery, Sophos Rapid Response collaborated with Microsoft to quell the threat, and to release a security update that revokes the affected certificates as well as improving detection for legitimate drivers that have been involved in malicious activity. This was released as a part of Microsoft’s December Patch Tuesday.

“In 2022, we’ve seen ransomware attackers increasingly attempt to bypass EDR products of many, if not most, major vendors,” said Christopher Budd, senior manager of Threat Research at Sophos.

“The most common technique is known as ‘bring your own driver,’ which BlackByte recently used, and it involves attackers exploiting an existing vulnerability in a legitimate driver. Creating a malicious driver from scratch and getting it signed by a legitimate authority is far more difficult. However, should they succeed, it’s incredibly effective because the driver can essentially carry out any processes without question.

“In the case of this particular driver, virtually all EDR software is vulnerable; fortunately, Sophos’ additional anti-tampering protections were able to halt the ransomware attack. The security community needs to be aware of this threat so that they can implement additional security measures, such as eyes on glass, where necessary; what’s more, we may see other attackers attempt to emulate this type of attack.”

Earlier in 2022, a similar technique was employed by threat actors who masked malware using Nvidia certificates, following a breach of Nvidia systems by the LAPSU$ hacking group. However, certificates are generally revoked by companies after they have been found to have been stolen, and Sophos’ discovery represents a step up in the methodology of attackers, as the drivers in use were, for all intents and purposes, seen as legitimate.

The Cuba ransomware group has previously claimed an attack on Montenegro’s government, and has been linked to a number of attacks by security researchers. The group’s exact origins are unknown, but some have suggested it could be Russia-backed due to observations of Russian on the group’s dark web site.

Finnish company F-Secure offers separate consumer and business security solutions and has relaunched its enterprise endpoint protection portfolio under the new WithSecure brand. The underlying product family remains largely the same, with the Elements Security Center cloud portal providing a central point to manage them all.

The Elements Endpoint Protection (EPP) module on review can look after Windows and macOS workstations, Windows, Linux and Citrix servers, plus Exchange and SharePoint hosts. Along with malware protection, EPP applies web content security and removable device controls, and the price includes patch management for Windows OSes as standard.

EPP's DeepGuard feature exposes zero-day attacks and unknown malicious programs by analysing file contents, system change attempts and program behaviour. An EPP Premium subscription increases yearly device costs to £34 and adds application controls plus WithSecure's DataGuard, which uses behavioural rules to detect potential ransomware activity.

The Elements portal home page provides an overview of licensed products, their status and the devices under protection. The EPP module is accessed from the same console, and its dashboard presents graphs showing the number of protected devices and the status of software updates with a list highlighting vital security events.

Deployment is simple: you can email a link to users or download the agent directly and place it in a central distribution point. Either way, the agent takes five minutes to install, connect to the portal and acquire updates. We deployed the iOS protection app by sending email invites from the portal and, when the app had loaded, it created a VPN link to the nearest WithSecure concentrator and applied reputation-based web filtering. The Elements home page is being updated and currently can't show mobile devices, but the EPP dashboard displayed them without any problems.

A preconfigured read-only profile is assigned to devices on first contact. This enables full protection and allows users to access the local interface, run manual scans and turn off features.

Another default profile is provided that stops users from accessing the agent settings, and we cloned these and used them as a basis for our own profiles. Profiles offer full control and are used to manage real-time scanning, permit users to run manual scans, determine when automatic updates occur and schedule regular system scans.

Web protection includes reputation-based web page scanning, safe search enforcement, browser plug-ins to show link reputations in searches and content control, with a list of 32 URL categories you can block. The infection reports from the older portal have been replaced with a more informative security events view, where you can also enable email alerts.

We were impressed with EPP's lightning-fast reactions: after introducing malware to our test clients, the security events page listed them in 15 seconds with email warnings issued within five minutes.

EPP can be augmented with the optional Endpoint Detection and Response (EDR) module, which provides a proactive stance on attacks that can automatically isolate compromised systems before they affect others. You can also extend your security umbrella over Microsoft 365, as the Collaboration Protection module keeps threats at bay for Exchange and SharePoint Online, and both this and EDR are accessed from the same cloud portal as EPP.

WithSecure's Elements Endpoint Protection is a good-value choice. It's simple to deploy, supports a wide range of client platforms and is easily managed from the Elements cloud portal.

Security researchers have discovered a vulnerability affecting Hyundai and Genesis cars, which would have allowed hackers to remotely control functions such as the door locks and engine.

The exploit impacts cars by Hyundai and Genesis released since 2012 and targets a weakness in the use of insecure vehicle data in mobile apps intended for use by the owners of the vehicles.

The API calls used to control the locks, horn, engine, headlights, and boot controls of cars were easily exploitable, and could be backwards engineered to give hackers full remote access to the car's functions, the researchers said.

In a thread on Twitter, bug bounty hunter Sam Curry explained the process in full. Within the affected apps, functionality like locking and unlocking the user’s car was secured behind an access token, a JSON web token generated from an authenticated email account, checked against the HTTP request made in the app and the car’s vehicle identification number (VIN).

However, the regular expression (regex) used to accept email strings as valid allowed for the inclusion of special characters. Curry and fellow researchers quickly discovered that by appending a carriage return line feed (CRLF) character at the end of an email address that already existed on the system, they could send an HTTP request to a secure endpoint. This contained a list of vehicles registered to the given address, allowing for the VINs of any chosen customer to be harvested.

Using the faked JWT, the researchers sent an unlock vehicle request to a car owned by a collaborator, and received “200 OK” back at the same time as the car's locks responded to the request.

Once the manual process had been figured out, the researchers were able to massively reduce the steps a threat actor would have to take, using a simple script written in Python. Using this, all that was required was the victim’s email address to gain access to their car, and commands could be run entirely within the program.

"Hyundai worked diligently with third-party consultants to investigate the purported vulnerability as soon as the researchers brought it to our attention," a Hyundai spokesperson told IT Pro.

"Importantly, other than the Hyundai vehicles and accounts belonging to the researchers themselves, our investigation indicated that no customer vehicles or accounts were accessed by others as a result of the issues raised by the researchers.

"We also note that in order to employ the purported vulnerability, the e-mail address associated with the specific Hyundai account and vehicle as well as the specific web-script employed by the researchers were required to be known. Nevertheless, Hyundai implemented countermeasures within days of notification to further enhance the safety and security of our systems. We value our collaboration with security researchers and appreciate this team’s assistance."

Earlier in the year, Curry and other researchers stress-tested a number of similar telematics apps, with the common link of developer SiriusXM Connected Vehicle Services (SiriusXM), as outlined in a subsequent Twitter thread.

“We take the security of our customers’ accounts seriously and participate in a bug bounty program to help identify and correct potential security flaws impacting our platforms," a Sirius XM Connected Vehicle Services spokesperson told IT Pro.

"As part of this work, a security researcher submitted a report to Sirius XM's Connected Vehicle Services on an authorization flaw impacting a specific telematics program. The issue was resolved within 24 hours after the report was submitted. At no point was any subscriber or other data compromised nor was any unauthorised account modified using this method.”

SiriusXM provides connected vehicles systems for cars from a number of household automotive brands. Researchers discovered that through the use of only the VIN of a customer’s car, it was possible to not only remotely activate vehicle features, but to also fetch a customer’s user profile within the NissanConnect app. This contained details including the victim’s name, phone number, and address. Similar vulnerabilities were replicated in the apps of Honda, Infiniti, FCA, and Acura.

Derek Abdine, CEO at artificial intelligence (AI) company furl, responded to Curry with the claim that VINs are widely available on dealership websites.

All vulnerabilities were reported to the relevant companies, which have patched the vulnerabilities.

Concerns around the vulnerability of cars that connect to apps have been around for years. In 2016, the FBI warned connected cars can be hacked, and particularly stressed the risk posed by cars that connect to mobile devices. The same year, Chinese hackers remote targeted a Tesla, with security researchers as Tencent’s Keen Labs passing the details of the successful attack onto the EV firm to patch.

This article originally stated that Hyundai cars could be accessed without the need for a victim's email address. This was inaccurate, and the article has now been updated to reflect this.

SMBs that want endpoint protection with an emphasis on simplicity will find Avast's cloud-managed business security solutions could fit the bill nicely. It's easy to control costs, too, with Avast offering a range of versions covering home and small offices with up to ten users, plus Essential, Premium and Ultimate versions which can all protect up to 100 devices.

We reviewed Premium Business Security (PBS), which takes all the protection services from the Essential version and adds removable device controls plus Avast's built-in VPN service for securing workstation internet connections. The Ultimate version includes Windows patch management and increases yearly costs for 25 devices to £1,023.

Installation choices are plentiful. You can download the Windows and macOS agents and place them in a central distribution point or email a downlink to staff and remote workers. LAN deployment can be sped up by promoting one system to scanning agent status, viewing the list of discovered devices and pushing the agent to them directly from the cloud portal.

Protection starts immediately: unless otherwise requested, endpoints are assigned a default policy that has all the main security services enabled. Policies are a powerful tool and allow you to enable Avast's CyberCapture Windows service for blocking unknown files and new threats, real-time anti-malware scanning, app behaviour, mail and web activity shields, a client firewall, a security browser extension, anti-spam and a sandbox for running untrusted or unknown apps in a safe environment.

If permitted, users can load the agent interface, view their protection status, run on-demand scans, access the sandbox and use the webcam shield to block snoopers by only permitting their camera to be used by specific apps. Supporting Windows and macOS clients, the ransomware shield protects nominated files and folders from encryption attempts by untrusted apps.

Mobile support includes Android and iOS devices, but although the apps are included free with every device seat in your subscription, Android users get the lion's share of security services and neither can be cloud-managed. All we could do with the iOS Security & Privacy app on an iPad was enter our subscription key, create an instant connection to Avast's VPN service for secure web browsing and see if the app considered our Wi-Fi connection safe.

The Avast cloud management portal sees a substantial redesign, making it even easier to use, and its simplified dashboard tells you everything you need to know about your security posture. A top table shows all threats broken down into unresolved, quarantined and resolved status, with each providing hot links for viewing detected threats and compromised endpoints.

A pie chart alongside provides an overview of all protected systems, while below is a real-time graph showing all activity for the past two weeks. Reporting doesn't see many improvements, with the portal offering a set of canned reports for executive summaries, threats, devices, audit logs, tasks and USB device usage, with no options to create custom ones.

Avast responds quickly to threats. After introducing genuine malware to our test Windows 10 clients, the agent blocked every one and warnings were posted in the dashboard in as little as 30 seconds. We also set up email notifications from the portal, and alerts for all of our tests were received in no more than five minutes.

Mobile device management would round out Avast's endpoint security offering nicely, but we can't fault it for the sheer depth of protection features on offer. SMBs will find it simple to deploy and easily managed, while its subscription plans are good value.

APM and observability tools have become powerful analytics platforms that ingest multiple telemetry feeds, providing critical insight into application performance. The significant differences amongst the vendors mean infrastructure and operations leaders need to consider strategic monitoring choices.

This Gartner report looks at the capabilities of APM and observability tools, including security functionality, application monitoring on mobile, support for VDIs, and integrations with service management tools, amongst others.

Read now to gain insights into the current vendor landscape and how IBM Instana has been recognised as a leader in this field.

Provided by

Malwarebytes has announced a new managed detection and response (MDR) service, which has been designed to help organisations bridge their cyber security staff and knowledge gaps.

Combined with the firm’s endpoint detection and response (EDR) technology, the MDR offering provides threat prevention and remediation services through a team of cyber security experts, including both automated and human-led protection.

The service includes dedicated analysts assigned to remotely monitor an organisation’s network 24/7 to detect, analyse, and prioritise new threats.

In an announcement, the company said its new offering can function as an extension of existing teams, or as a complete solution for organisations that lack dedicated security staff.

"We've recruited an incredible team of dedicated experts across the globe and empowered them with our award-winning tools and AI-based threat modelling to be a powerful force multiplier for SMBs and MSPs," said Bob Shaker, VP of managed services at Malwarebytes.

Malwarebytes’ EDR technology provides lightweight, integrated endpoint security that bundles together real-time continuous monitoring and endpoint data collection, with automated response and analysis, it said.

For SMBs and managed service providers (MSPs) swamped with security alerts, the combination of EDR with human threat intelligence has been designed to help prioritise, detect advanced malware attacks, analyse past indicators of compromise, as well as reinforce resiliency.

Additionally, the vendor says it will also help reduce security costs and provide rapid time-to-value, thanks to automated onboarding that provides a speedy route from purchase to service operation.

Malwarebytes MDR arrives as many organisations are struggling to recruit staff with the required digital skills. Back in April, research conducted by the Open University found that more than three quarters (77%) of surveyed IT decision-makers said they were currently facing a digital skills gap in their organisation.

Back in 2020, a UK government report also discovered that 27% of businesses have a skills gap when it comes to incident response, and that 48% of surveyed companies were hiring individuals without confidence in their abilities to perform basic tasks.

With its new MDR service, Malwarebytes said it is now taking steps to help bridge this gap and ensure businesses have adequate protection.

“This is just the beginning as we continue to accelerate product innovation and deliver new services to secure chronically underserved SMBs and empower MSPs to be their heroes," said Shaker.

As organisations continue to emerge and evolve with new technologies in the wake of the pandemic, it’s the time for great business opportunities: moving operations to the cloud and adopting automation for improved workflows. However, alongside this, cyber criminals are taking advantage of the lack of innovation in security measures to protect these digital transformations.

This whitepaper explores the importance of improving security measures in parallel with your business innovations, to protect against advancing cyber threats, and leverage the benefits from your digital advancements.

Download now to learn more about:

• The business areas that require the most protection
• Which security measures to prioritise
• How to achieve robust end-to-end safeguarding

Provided by

Acronis’ Cyber Protect puts a different spin on data protection to most rivals, as it combines hybrid backup with AI-driven cybersecurity measures and endpoint management. This will appeal to SMBs that want to avoid the expense of separate solutions, since it means they can pay a single subscription fee for all their data backup and workstation protection services.

Platform support is impressive and includes Windows, macOS and Linux systems, all popular business apps and almost any virtualisation host you care to name. You can choose from on-premises or cloud-managed versions; we’ve reviewed the latter as this extends protection to home workers and mobile devices.

Acronis offers Essentials, Standard, Advanced and Backup Advanced editions. We tested the Advanced version, which activates features such as deduplication, backup malware scans and security posture reports. All security services are enabled and include malware protection, web content filtering, patch management, remote desktop services and vulnerability assessment reports.

Subscriptions are based on the type and number of protected systems, with workstations priced at £79 each per year and one VMware or Hyper-V host and unlimited VMs costing £729. This includes 250GB of cloud storage, with further 1TB chunks costing £379 per year, while the optional cloud disaster recovery service starts at £389 for an extra-small cloud VM.

The web portal presents detailed overviews on protected systems, backup repository status, alerts, detected malware, blocked URLs and patch status. It can get very busy but each chart and graph is widget-based so you can easily customise it to your own requirements.

Protection plans combine backup requirements, encryption passwords, schedules and security settings. Primary and secondary storage locations can be assigned to a plan, and we used local Synology NAS shares for fast local backups and the Acronis cloud repository for our secondary, off-site store.

Within workstation plans, you can enable real-time malware scanning, apply URL filtering using up to 44 categories, schedule vulnerability assessments and run patch management remediation tasks. A data-protection map reports on unprotected files, while device controls can be used to block access to USB ports, removable storage, printers and screenshot activities.

No email invitation options are provided so agents must be copied to each workstation, installed manually and logged in to the cloud console. This can get tedious but, once registered, they can be assigned to a plan that automates all further backup and protection.

A separate agent is provided for Hyper-V systems while for VMware, we downloaded the agent VM, installed it on a vCenter host and configured it with our cloud credentials. Once the host agents were deployed, the portal listed all their VMs, and using a plan to protect them at the host level ensured newly created VMs would be included.

Along with swift file and folder recovery services for remote workstations, the portal provides excellent restore functions for Hyper-V and VMware. We were able to recover entire VMs to their original location, as a new VM on the same host or another location while for even faster recovery, it can create a temporary VM on the host from a local backup.

An Advanced Backup subscription adds Microsoft 365 protection with facilities for Exchange Online, OneDrive for Business, SharePoint Online and Teams. It’s included in the free 30-day trial, and we had no problems authenticating it with our live Microsoft 365 account and creating protection plans for cloud-to-cloud backups of all four components.

Acronis Cyber Protect takes data protection to another level with its clever partnership of hybrid backup and endpoint security. Agent deployment could be further improved, but the whole package is easily managed from one cloud portal and it provides extensive platform support.

Avira Free Security looks smart, with its dark colour scheme and tasteful splashes of colour. It also looks quite substantial for a free security suite: distributed across the Security, Privacy and Performance pages you’ll find a total of 16 big buttons for various promising-sounding functions.

Unfortunately, once you start clicking around, you discover that many of the apparent features are dummies. Try to enable web, email or ransomware protection and you’re merely greeted with an advert inviting you to upgrade to the commercial Avira Prime suite.

Other buttons do half a job, then invite you to pay for the rest of it. For example, the software updater scans your system and warns you about apps that might be obsolete, but when you click “Update” it reveals that automatic updates require – you guessed it – an Avira Prime subscription. It’s not unreasonable to ask people to pay for security services, but this isn’t a respectful way to do it. It doesn’t help that the full suite is pretty pricey, costing £52 for five devices in the first year, rising to £86 after that.

Although it’s disappointingly light on features, Avira Free Security delivers quite creditable virus protection. In the latest tests by independent security lab AV-Comparatives.org it managed a 99.96% malware protection rate while connected to the internet – matching Microsoft Defender – with an impressive false positive rate of just one wrong detection in over 10,000 items. That’s better than any other free security solution we’ve tried.

Perhaps because so little is actually included in the free package, it’s also very lightweight. In performance tests carried out by AV-Test.org, Avira slowed down web browsing on a standard PC by just 8% – just a whisker above Defender’s 5%. Apps launched quickly too, with an 8% slowdown that was once again barely any different to the 6% impact of using Windows’ built-in protections.

Alongside the main application, the Avira installer sets up the company’s Phantom VPN service. Like Avast’s VPN, this allows limited use for free, but it’s much more restrictive, allowing just 500MB of protected traffic per month. There’s a link to the web-based Avira password manager service too, which can store and auto-fill any number of passwords for free. The optional Avira Safe Shopping browser extension warns you away from fake sites and blocks trackers – though it also inserts coupon deals into web pages, which feels a little sleazy for a security product.

The component we’re most uneasy about is Avira System SpeedUp – a completely separate app which installs without asking for permission, and pops up when you click various buttons on the Performance page, including Battery saver and Advanced tools. It’s effectively another limited demo: unlocking its features requires a separate SpeedUp Pro licence, which starts at £4 a year, then rockets up to £22.

To be fair, it’s easy to ignore Avira’s upsell attempts. You can leave the antivirus running in the background and enjoy very good malware protection, with minimal impact on performance. If you do want additional features, though, Avast One Essential gives you much more for free, while those seeking a minimal experience might as well stick with Microsoft Defender.

Kaspersky Lab makes no secret of its Russian origins, and in the current climate you might be wary of trusting it with your security. In the past few years though the company has taken steps to put its operations beyond reach of the Kremlin: data storage and processing are now handled in Switzerland, while additional “transparency centres” in Brazil, Canada, Malaysia and Spain allow governments and other institutions to review the company’s code and practices.

There’s no question about Kaspersky’s malware-blocking credentials, though. In the latest independent tests by AV-Comparatives.org the Kaspersky engine achieved a superb online protection score of 99.98% – slightly better than Microsoft Defender on 99.96%. It racked up fewer false positives too: against a set of more than 10,000 items, Kaspersky wrongly raised the alarm just twice, while Defender missed the mark five times. AV-Test.org confirms the engine’s effectiveness: in its tests for January and February 2022, Kaspersky provided impeccable 100% protection against both new “zero-day” and widespread threats.

The user experience is delightfully clean. Although Kaspersky’s main business is commercial security products, the Kaspersky Free Windows client has no adverts or non-functional buttons – a real breath of fresh air.

Instead there are just a few buttons for the major functions. From the Home page you can quickly scan your computer for malware and check online to see whether your personal credentials have been compromised; on the Security page you’ll also find buttons to download emergency boot media, and to scan your Windows configuration for suspicious or corrupted settings.

That may sound a bit minimal, but there’s more going on behind the scenes. Kaspersky Free also quietly takes care of web and email scanning, while the System Watcher component keeps an eye out for ransomware-like behaviour and automatically offers to undo potentially harmful activity. If anything, these components are perhaps a bit too unobtrusive: unless you delve into the program settings you might never realise that they’re enabled. Still, that’s better than AVG’s approach, which puts big fake buttons in its interface purely to tell you that these features aren’t available in the free suite.

A few other tools are hidden away under Settings. A Privacy Cleaner scans your system for records of recently accessed files, cookies, caches and so forth, while an optional on-screen keyboard helps defeat keyloggers. The resource consumption options let you tweak things like automatic scans, to help minimise battery drain or avoid possible interference with games.

That’s not a huge issue, as Kaspersky Free is fairly lightweight. In AV-Test.org’s performance tests, it slowed down web browsing on a standard PC by 14% – that’s some way behind Defender’s 5% impact, but better than Avast One Essential on 17% and well ahead of AVG AntiVirus Free’s 28%. Similarly, Kaspersky had a 10% impact on application launch speed, versus 6% from Defender and 12% from Avast and AVG.

One thing that Kaspersky Free lacks is centralised administration; you can connect up to three installations under an individual email address, but it’s not designed to be managed across businesses. Even if you can live with that, it’s understandable if you’re still uncomfortable rolling out a Russian security solution. But with its excellent protection, generous feature set and unobtrusive design, Kaspersky Free has enough going for it to deserve serious consideration.

This popular security suite has recently received a new name and a new look, but the price hasn’t changed: Avast One Essential is free forever, across Windows, Android, macOS, and iOS devices.

Naturally, there’s a paid option too. The full Avast One package costs £40 a year for up to five devices, or £55 for up to 30 devices. This is sold as a family licence, however, and doesn’t include corporate-friendly management options. Note too that these prices only cover the first year of service, after which the cost doubles.

Still, the free edition is useful enough. Job one, of course, is virus protection, and here Avast One is hard to criticise. In the most recent tests by independent security lab AV-Comparatives.org, the Avast engine provided excellent 99.8% protection when connected to the internet – a fraction above Microsoft Defender’s 99.6%. AV-Test.org achieved even better results, reporting a 100% score for Avast against both unknown zero-day threats and prevalent malware during the first two months of 2022.

The Windows edition of Avast One also includes a nifty custom firewall, and a ransomware protection feature that blocks untrusted processes from writing to your personal folders. While similar capabilities are already built into Windows, Avast’s implementations have a friendlier interface, making it less of a chore to check and configure these security settings.

Something Windows definitely can’t match is a free VPN. Avast One can protect your privacy by routing all your internet traffic through a private server, with a pretty generous transfer limit of up to 5GB a week. The catch is that you don’t get to pick your server location – Avast selects the fastest one for you. If you want a free choice of all available servers, across 37 countries, you’ll need a paid subscription.

Other free features include password protection, which checks whether your credentials have leaked online, and a speedup module that identifies potentially unwanted programs running in the background. A secure custom browser is included too, to help protect you against snoopers.

We do have some reservations about Avast. The interface feels a bit overloaded, with a proliferation of panes, scrollable lists and buttons – some of them acting as advertisements for features that aren’t actually included in the free edition. Most perplexingly, the shortcut buttons to launch a quick scan or activate the VPN are hidden off the bottom of the home page, so you have to scroll down to find them.

Then again, the number of controls reflects the breadth of features on offer, and how configurable they all are, while premium-only features are all clearly marked as such – an example we wish more free software would follow.

Another possible point of concern is false positives: AV-Comparatives noted that, during its tests, Avast One incorrectly gave warnings about 10 legitimate files. Still, that’s out of more than 10,000 test cases, and it’s a lot better than Panda’s free solution, which wrongly intercepted a shocking 96 items.

In all, Avast One Essential is an effective and likeable option for those seeking a free antivirus solution. It’s not as manageable as Microsoft Defender, but it has a good spread of features that add some worthwhile extra layers of protection.

Get five steps to adopting the Dell Technologies Unified Workspace and start modernising PC lifecycle management today.

This end-to-end approach to deploying, securing, and managing Dell devices saves up to nearly a week of IT time per 1000 devices deployed, provides 11 times faster support, and configures your entire endpoint fleet from a single console.

Download this whitepaper to find out how this solution improves the employee experience and ramps up productivity to end up paying for itself.

Provided by

Microsoft has announced a range of endpoint management features to take the administrative burden away from IT teams, including automated updates, a premium tier of Endpoint Manager and targeted messaging across an organisation.

The first of the new automated services is 'Windows Autopatch', which is designed to free up IT teams by making the management of Windows and Microsoft 365 updates easier. The aim its to minimise the burden of updates for Windows, Edge, and Office and have an automatic process for all company endpoints. The service keeps all devices protected and compliant so that IT teams can focus on other areas of the business.

Autopatch works via a gradual deployment that's meant to prevent overloading on machines. If there are any issues during deployment the service can be stopped and even reversed if it causes significant disruption.

Autopatch will be available from July this year at no additional cost to Windows Enterprise E3 subscribers.

Elsewhere, there are also a number of updates for endpoint management, including 'application management for Microsoft Edge'. This is a BYOD-type feature that aims to help IT teams manage access to corporate resources. It allows managers to configure how data flows in and out of their organisation and also define the treat level on any device.

This seems to be primarily aimed that those workers logging into company Edge accounts on their own devices, for temporary reasons, such as checking unfinished work or sending last-minute emails, but without creating a security risk.

There will also be a premium version of Microsoft Endpoint Manager, which is aimed at companies that want a zero-trust security model. The first feature for the premium tier is Endpoint Manager Remote, which deals with helpdesk and users connections for hybrid environments.

Company wide messages direct to your device

Finally, IT teams will also have a new communication tool that allows for businesses to send messages to every user device simultaneously through Windows 11. These can be sent directly to users across "various surfaces", according to Microsoft. That includes desktops, lock screens, or even right above a user's taskbar.

The idea is that critical company announcements can be sent as device notifications instead of becoming lost in an email folder. Messages can be sent with customised links and URLs directly from the Endpoint Manager admin centre. A defined target of users is set via an integration with the Azure Active Directory.

The rise of hybrid working means that many businesses now have to manage a workforce that is remote for part or all of the working week. In this climate, organisations are increasingly turning to unified endpoint management (UEM) solutions to keep their employees and their devices secure.

Companies seeking to adopt more modern management practices are driving growth in the UEM market, and these solutions are now considered a vital piece of the broader enterprise IT infrastructure puzzle.

Read the report to understand Omdia's analysis of the UEM landscape, as well as why IBM was named one of the leaders for unified endpoint management.

Provided by

The most productive security teams are going beyond the use of tactical tools for investigation and reporting of security incidents. Instead, they are taking a more strategic, proactive, platform-oriented approach to identifying and assessing security-related risks, proving compliance, and maturing the flexibility and resilience of ongoing operations.

Read this report to learn about the evolution of security monitoring capabilities and discover what comprehensive security technologies companies are investing in to support their work from anywhere (WFA) / hybrid work model.

Provided by

The shift to hybrid working models has transformed the role of endpoint security in the modern enterprise. As a recent report from Gartner makes clear, remote work is now just work. 64% of employees are now able to work from home and two-fifths of them are actively doing so. "The movement to hybrid (or remote work) is a durable trend with more than 75% of knowledge workers expecting future hybrid work environments," the report concludes. "From a security perspective, this requires a total reboot of policies and tools to better mitigate risks."

This is a big deal for resellers and MSPs. IT teams charged with managing and securing a dispersed workforce face countless new points of vulnerability. Those who relied on their traditional network and perimeter-based security models are likely to find – perhaps painfully – that they no longer deliver the protection needed. That’s why channel partners need to step in to help their customers protect their endpoints, making the most of new capabilities like AI and automation to give them more oversight and control.

1. Start with Zero-Trust

Once you’re securing endpoints both inside and outside the corporate network, the classic network security architecture of perimeters and firewalls breaks down and you need a new model to replace it. Zero-trust security isn’t a technology or a set of features, but an approach that makes no assumptions about which endpoints, infrastructure, programs or processes can be trusted, and instead uses intelligence and automation to monitor and hunt for threats. When every action is checked and classified and anomalous behaviour found and blocked, you close down the chances of a compromised endpoint resulting in a serious breach.

With the right technology and services in place, MSPs and businesses can build zero-trust into their endpoint security solutions and start delivering threat detection and remediation capabilities that protect their customers from attack.

2. Layer up and get smart about security

Antivirus products and network firewalls are no longer enough. Endpoint protection involves multiple layers of security, both on the endpoint itself, in the network and running from the cloud. Endpoint protection platforms combine real-time protection and reporting with advanced detection aided by security analytics and real-time intelligence feeds. Endpoint detection and response systems monitor continually for behaviour linked to new exploits, advanced persistent threats and fileless attacks, with everything rooted in zero-trust.

The most effective of these solutions make extensive use of automation and AI, incorporating machine learning and deep learning for continuous monitoring, detection and protection in a way that neither adds to the workload of the IT team nor slows end-users down at work. They also work perfectly within managed services and solutions, giving providers the chance to offload work from their enterprise customers at the same time as strengthening their endpoint protection. What’s more, the more data MSPs can capture and analyse from a range of customers, the better equipped those automated, intelligent systems will be at detecting and warding off incoming threats.

3. Centralise through the cloud

Managing security through a central, cloud-based platform just makes sense. You can monitor endpoints whether they’re on premises or remote. You can apply policies and monitor security from one location using one set of tools. Not only can you manage security, but updates, vulnerabilities, encryption, licensing, privacy and more.

From a reseller or MSP perspective, centralising through the cloud is even more beneficial. As well as the operational efficiencies in handling everything remotely, it becomes easier to protect and manage multiple customers in less time and without hiring new staff. It also helps ensure visibility across more complex or fragmented network architectures. When threats emerge or customers have concerns, you’re in a better position to have all the relevant answers.

4. Simplify and consolidate

While a layered approach is a necessity, that doesn’t mean you want to manage a wide range of security solutions and tools from an equally wide range of providers. This makes it difficult to build up in-depth knowledge, and often results in having solutions in place that overlap, waste time and effort or potentially conflict. You also don’t want solutions that require new IT infrastructure on the premises, or add new tools and processes to learn, adopt and update.

That’s why it pays for MSPs and channel partners to work with a small set of solutions using a minimal set of tools and make the most of built-in automation and integration with existing platforms. Simplify and consolidate, and it’s easier to scale-up, optimise and deliver effective, cost-efficient solutions.

5. Partner with a specialist

MSPs need more from a security vendor. They need specialist expertise, a depth of knowledge and continuous training to help maintain a view across what can be a fast-moving threat landscape. They need solutions and services they can tailor to their customers’ needs, and technologies that evolve to match new security demands. And if that vendor can also provide integrated solutions, automation, consolidation and simplicity, it becomes easier to drive new business and deliver a great service to customers new and old.

WatchGuard EPDR brings together Endpoint Protection (EPP) and Endpoint Detection and Response (EDR) capabilities into one easy-to-buy product for maximum security against sophisticated endpoint threats. It protects users from advanced threats, APTs, zero day malware, ransomware, phishing, rootkits, in-memory exploits and malware-less attacks, and also provides IDS, firewall, device control, and URL and content filtering capabilities. EPDR uniquely automates the prevention, detection, containment, and response actions for ultimate security that is easy to manage and deploy.

WatchGuard EPDR is managed in WatchGuard Cloud, providing a single pane of glass view into the entire WatchGuard Unified Security Platform. Offering a single, centralized interface for delivering and managing network security, advanced threat detection, MFA and endpoint security, WatchGuard Cloud delivers efficient management flows and the utmost in security visibility.

To find out more about WatchGuard and how it’s transforming security for resellers and MSPs, please visit https://www.watchguard.com/wgrd-partners/security-of-one-partner

Google Cloud has launched a new threat detection solution for Google Cloud Platform (GCP) specifically designed to tackle the mounting cases of cryptomining malware operating through compromised cloud instances.

Google Cloud said the Virtual Machine Threat Detection (VMTD) is a first-to-market solution from a major cloud provider, now available in public preview as an added security layer within Security Command Center (SCC) Premium.

Virtual machine-based computing accounts for a significant portion of businesses' operations running in the cloud and according to a November 2021 threat intelligence report from Google Cloud, cryptomining activity was observed in 86% of all compromised GCP instances, making it the leading issue affecting Google Cloud customers.

The time it took for attackers to install this financially-motivated malware was quick, too, with more than half of cases (58%) seeing malware installed within just 22 seconds of compromising the platform.

Google Cloud said in most cases, this was due to exploitation of poor customer security practices or vulnerable third-party software. Leveraging the power of cloud computing can improve the efficiency of cryptomining malware due to its scalable nature, potentially raising monthly cloud bills for businesses by a large sum.

"The economy of scale enabled by the cloud can help fundamentally change the way security is executed for any business operating in today’s threat landscape," said Timothy Peacock, product manager at Google Cloud. "As more companies adopt cloud technologies, security solutions built into cloud platforms help address emerging threats for more and more organisations.

"VMTD is one of the ways we protect our Google Cloud Platform customers against growing attacks like coin mining, data exfiltration, and ransomware," he added.

Now available in public preview, VMTD detects cryptomining attacks but as it moves closer towards general availability, Google Cloud said customers can expect to see a steady release of new detective capabilities that will integrate with other parts of GCP.

Google Cloud said VMTD complements the existing threat detection capabilities supplied by the existing Event Threat Detection and Container Threat Detection products, providing cover for compute while the others services areas like Kubernetes, identity, managed services, networking, and API.

Agentless approach

Google Cloud's VMTD provides memory scanning for customers on an agentless basis, which means GCP users can expect a smaller performance impact, lowered operational burden, and a less-exposed attack surface.

This is unlike a traditional endpoint security model which involves running additional software inside virtual machines to gather signals and telemetry. Instead, Google Cloud said it 'instruments the hypervisor' - the underlying software that "orchestrates" its virtual machines - to include threat detection that's difficult to tamper with.

Today, enterprises of all sizes are up against unprecedented security challenges. The growth of remote and hybrid working practices has left IT teams struggling to secure a wider range of endpoints that aren’t always under their direct control. According to figures from YouGov, 37% of UK workers spent some of their week working from home before the COVID-19 pandemic. By September 2021 that had risen to 50%, with 60% saying they would prefer to work remotely at least some of the time.

At the same time, the security landscape grows more threatening, with cyber criminals becoming more sophisticated in how they target their attacks. Last year the UK government’s Cyber Security Breaches survey found that four in ten businesses had experienced a breach or attack in the last 12 months, with that rising to 64% to 65% for medium-sized and larger enterprises. What’s more, the report concluded, a lack of monitoring tools and user monitoring raised the possibility that some attacks were slipping through unrecognised and unreported.

New working practices have opened up new vulnerabilities, and cyber criminals have been quick to exploit them. A 2021 study conducted for HP Wolf Security found that 75% of IT teams surveyed had seen a rise in employees opening phishing links, while 40% of office workers surveyed reported clicking on a malicious email. Almost half (49%) had done so more often since working from home, and 70% of those that had clicked or nearly clicked on a link hadn’t reported it to IT.

To compound the crisis, IT teams have never been under so much pressure. HP’s research shows that the shift to home working has resulted in IT teams spending more time and effort patching endpoint devices, provisioning and securing new devices or triaging threats. The complexity of securing remote and hybrid workforces can be overwhelming. 77% of those HP surveyed said that homeworking was making their job much harder and that burn-out was a serious concern.

In this landscape, traditional software-based endpoint security is no longer up to task. It can provide a decent base level of resilience but can’t safeguard against the full spectrum of malicious email attachments, file downloads, browser exploits, credential theft and phishing links. Software alone can’t detect attacks below the OS level designed to compromise the firmware, or control attacks based on browser-level exploits. Applications designed around recognising malware signatures are powerless to act against script-based fileless threats or zero-day attacks. This is crucial. Google patched out 16 different zero-day vulnerabilities, some critical, from its Chrome browser during 2021. That same browser has a 70% market share.

Hardware-based security meets zero trust

Meeting these challenges requires a new approach. To be more specific, businesses need to consolidate their endpoint security and adopt new security principles anchored in a zero-trust approach, where nothing from device integrity to user identity is taken for granted, and constant behind-the-scenes verification becomes the norm. This starts at the hardware level and extends upwards to cover software and services, minimising vulnerabilities across all endpoints to protect the enterprise as a whole.

The key to this approach is that it’s not just about recognising and blocking attacks but isolating and containing threats and providing automated recovery and remediation. For example, malware that attacks the PC’s BIOS can be difficult to detect, highly persistent and challenging to remove, giving the attacker scope to install ransomware, steal data or infect more applications and devices. HP Wolf Security meets these threats through HP Sure Start, a hardware-based technology that detects when the BIOS has been compromised and automatically restores it.

HP’s Endpoint Security Controller, built into HP’s business and enterprise-grade laptops and PCs, also powers HP Sure Run, which prevents crucial security processes from being disabled by a malware attack by monitoring security-critical processes and repairing and restarting them at any sign of failure. The same controller also enables HP Sure Recover, which allows remote workers or IT teams to securely reimage their devices if the OS is critically damaged or compromised. These hardware-level features add layers of protection you could never get from software alone.

The same applies to HP Sure Click Enterprise, which provides hardware-enforced application isolation and containment. HP Sure Click Enterprise runs each task in a non-persistent micro-virtual machine (micro-VM), which isolates and contains attacks, minimising the attack surface for malicious email attachments, phishing links, file downloads, browser exploits and credential theft attempts without bombarding users or IT teams with unnecessary alerts.

As for emerging fileless or zero-day attacks, HP Wolf Security finds the answer in HP Sure Sense: an AI-based threat prediction technology that uses deep learning to recognise the tell-tale signs of malicious behaviour and malware threats. It can then apply that training to identify new threats before they execute and stop them in their tracks. HP Sure Sense doesn’t replace existing tools but augments and improves them, adding an extra layer of endpoint protection to cover their blind spots. What’s more, because it’s AI-based and designed to work autonomously, it doesn’t need constant updates to remain effective.

Adopting this approach will involve a change of mindset, not to mention new investments in hardware and support, but when there’s an endpoint security crisis brewing, standing still is not an option. HP Wolf Security offers a layered solution that can help your organisation boost its resilience to cyber attacks by detecting and protecting against threats, and prepare you for breaches by boosting your recovery capabilities. With the threat of cyber attacks ever growing and changing, these are the tools you need to be ready for them.

To find out more about streamlining your security stack – and how HP Wolf Security can help – watch our webinar here

Google Cloud has announced the acquisition of Siemplify, an Israeli-based cyber security company that specialises in end-to-end security for enterprises.

The exact terms of the deal were not announced, though Reuters reports it is worth around $500 million.

Acquisition rumours were reported in the Israeli press just before Google Cloud made an official announcement on Tuesday. The CEO and co-founder of Siemplify, Amos Stern, also noted that his company is to be integrated into Google Cloud's Chronicle platform.

Founded in 2015, Siemplify is another example of the growing tech prowess of Israel, which has become a hotbed for new startups and data-centric businesses. Much like digital footprint tracking service Mine, Siemplify is another Israeli company founded by former members of the country's military intelligence agencies.

The company is typically referred to as a security orchestration, automation and response (SOAR) service, which is "the missing piece" for Google's Chronicle platform, according to Forrester analyst Allie Mellen.

"Other security analytics platforms began incorporating SOAR as early as 2017," Mellen said. "This acquisition is an important step in providing a unified offering to practitioners and in being able to compete more directly in the security analytics platform space. Enabling the orchestration of response across multiple tools is an integral part of security operations and has become an integral part of a security analytics platform. This acquisition continues to demonstrate that."

Chronicle is one of Google's original moonshots founded within its "X" programme that was migrated to Google Cloud in 2019. It was designed for cyber security telemetry, specifically to track the movement of data across all devices and networks in a bid to prevent breaches. SOAR platforms act as the customer interface for that operation.

"Siemplify was one of the few remaining standalone SOAR offerings, as many others have been picked up by SIEM vendors over the years," Mellen added.

"Most other standalone SOAR vendors have been acquired or built out their portfolio with other products like threat intelligence platforms. In some ways, that makes this a heady acquisition and signals the end of the standalone SOAR or, frankly, SIEM. We predicted early on that the SOAR market could not stand on its own, and now it has truly come to fruition."

I’m about to so do something I’m sure won’t shock regular readers: pick an argument with the powers that be. The organisation in question, being the National Cyber Security Centre (NCSC) which, by and large, does a splendid job in both public and private sectors in matters of security advice and support. By and large, but not on one occasion recently when it decided the time was right to remind us of some password construction advice it first offered five years ago. It was wrong then and remains so to this day.

Using the perfectly reasonable hashtag of #thinkrandom, that advice was to use three random words as your password. That’s three words, not four, so you can forget about the XKCD comic suggestion of “correct, horse, battery, staple” that’s wedged itself into cyber security folklore. Not that you should use it anyway, as password reuse is obviously verboten if you want to maintain any semblance of a strong security posture.

While admitting the use of three random words is “not a password panacea”, the latest NCSC posting serves to press home the message that it’s better than using traditional password complexity advice, because the latter relies upon us memorising lots of long and complex strings. Using three random words, we are advised, creates passwords that are “strong enough for many purposes”, and helps get around the reuse problem that it says traditional complex passwords creates.

Random access memories

Let’s deal with the last of these first: password reuse. There is absolutely no bloody difference between trying to remember 97 unique complex and random password strings and doing so with 97 three random word passphrases. You will fail unless you are a memory savant. That is a fact. It’s a fact because as humans we are simply not wired to remember random things.

This brings me to the second problem I have with the advice: the reality of randomness. Most people, most of the time, will choose three words that are far from random when constructing a whole bunch of passphrases. What people will do is, totally subconsciously, adopt patterns in the phrases they come up with. Patterns in both the connections between the words used to make recall easier and patterns between the passphrases themselves to make multiple ones easier to recall.

Humans just don’t do randomness well; that’s why there are computer-me-bobs for creating truly random stuff, and more on that later. There’s a really interesting piece of research from the University of Cambridge Computer Laboratory, admittedly now almost a decade old but still relevant, that explains this very well. Its evidence on multi-word passphrases was pretty damning: “By our metrics, even five-word phrases would be highly insecure against offline attacks,” the researchers found, because people naturally sway towards speech rather than randomness. “Phrases like young man which come up often in speech are proportionately more likely to be chosen than rare phrases like young table” the research concluded. Which is exactly what I would expect.

There’s an app for that

Look, I perfectly understand plenty of security professionals disagree with me here. Their argument generally being along the same lines as the NCSC, that adopting a three random words approach will create stronger passwords than those we often see being used and reused today. This is true, and I’m not suggesting that Password, or P@ssw0rd, or even P@ssw0rd1 is a super-duper credential to be using. What I am suggesting is that, rather than getting people to use three supposedly random words, it would be far better to advise them to use some form of secure password manager instead.

Skip the whole three words thing, don’t mention it at all, go straight for the “use a password manager dammit” jugular. That way you can create truly random and complex and extremely long passwords, or the application can, and have a unique one for every login.

Of course, the perennial problem of master password creation rears its very ugly head once more. Rather than go over old ground involving muscle memory, encrypted USB sticks (which need yet another password) or a biometric device (JEMpass) and even dice with multiple patterns rolled randomly into a locked box (DiceKeys), let’s approach this from the three random words angle. Or, rather, let’s not. Just three words, no matter how random, would make a spectacularly poor master password if you ask me. Instead, go for five or six, or more if your memory will allow.

These would, of course, need to be random rather than your idea of random. Which is where one password manager, in fact 1Password, comes in. Did you see what I did there? Anyway, it has a password generator that anyone can use – which has the option of generating a passphrase using random words. Just select the “memorable password” dropdown, set the number of words to something you are comfortable with, and you’re away. Other services, of course, are also available, such as Kaspersky's own password generator.

As I say, don’t go for anything too short as this is the key that unlocks all your other passwords. I’d also avoid unchecking the “full words” box as this produces gibberish words that aren’t really easier than a long password to memorise. Practise typing the result over and over to get that muscle memory working, and if you are a 1Password user, be sure to save the “emergency kit” that can be printed out and stored somewhere secure. The reality is that for 99% of use cases a threat actor isn’t going to ransack your house searching for a master password, nor your office for that matter. If you do fall into the 1% then the chances are high that you’ll already be using some kind of security protocol that makes the entire three random words argument moot anyway.

Talking of passwords in the workplace, I can’t wrap up this conversation without mentioning some more research, this time from Beyond Identity. This found that not only did nearly a quarter of employees questioned still have access to accounts from a previous job, but 41% admitted to sharing passwords in the office, and 20% used the same passwords at home as they did for work-related accounts. Just in case you wondered why I bang on about the importance of password hygiene, month after month.

Trend Micro offers an endpoint protection choice for every business: firms that want to keep it all in house can install Worry-Free Business Security Standard on their own server, while those that prefer a hosted solution can use this fully cloud-based option.

It’s aimed at companies with up to 250 devices to protect, and the price is SMB-friendly. Yearly pricing starts at £58 for two devices, rising to £520 for 25, with each licence covering one Windows or Mac workstation, one Windows server or one mobile device.

All the key security features are present. Along with anti-malware scanning you get protection against web threats, web content filtering, a client firewall, removable device controls and mobile device security. A standout feature of both the standard and cloud-hosted versions is an advanced data-loss prevention module, which comes preconfigured to recognise (and optionally block) 244 different types of sensitive data, including British financial and healthcare information.

Ransomware is very much on Trend Micro’s radar, too. The software subjects suspicious processes to a range of tests including predictive machine learning, behaviour monitoring and new program detection – and if the malware isn’t immediately stopped, the program can also directly detect malicious encryption attempts and undo any suspicious changes made by untrusted programs.

As the name implies, another focus of the Worry-Free suite is keeping deployment and administration simple. The cloud portal is easy to use, with a dashboard that keeps you posted on all client activity, detected security risks and policy violations. Clicking on any of the threat categories takes you straight to the portal’s log page, where you can quickly identify the threat type and which clients are affected.

The one place you might hit a hiccup is with initial client setup, as the email invitation process requires a standalone mail client running on your local system. This isn’t a huge obstacle, though: after logging on from a computer with Outlook installed, we were easily able to email invitations to our Windows 10 users. The messages pointed them to a tiny 7MB executable, and after launching the installer, they had the agent running and connected to the portal in less than five minutes, with settings applied from the portal’s default groups for instant protection.

Agents can then be manually moved into specific groups in the portal, each with custom policies. These define real-time and manual scan behaviour, apply predictive machine learning and use one of three web reputation levels to classify and block suspect web pages. Optional global settings can be applied for malware scanning, approved and blocked websites (which override URL-filtering policies) and password protection to stop users disabling the agent.

Data-loss prevention can be set up here too. We created a policy to block all sensitive data, then tried to use Gmail on a client PC to send an email containing a credit card number. The attempt was instantly blocked and logged, leaving Gmail complaining about a lack of network access.

Mobile protection is a mixed bag. Android devices get malware scanning, plus access to the web reputation service and password controls; if you’re using a Chromebook, you get web threat prevention too. As usual, however, iOS options are far more limited. All you can do is enforce complex unlock passcodes, set expiration limits and apply device lock timeouts.

Even so, Trend Micro’s Worry-Free Business Security Services provides great desktop security, plus exceptional DLP and ransomware protection. For small numbers of users it’s good value, and SMBs will find the cloud portal very easy to work with.

There's a saying that the best antivirus product is the one you actually have installed. That's the approach Microsoft has taken: its Defender security system is integrated into every installation of Windows 10 and 11, ensuring a baseline level of protection across the whole operating system.

Defender isn't just widespread - it's effective. Every Windows computer with an internet connection automatically downloads the latest signatures and recognition algorithms on a daily basis, meaning newly identified threats can be very quickly shut down.

And we can't argue with the results. In the most recent tests by AV-Comparatives.org, Defender successfully blocked 99.96% of malware samples; AV-Test.org reported that, during January and February 2022, the software scored a perfect 100% against both known threats and brand-new zero-day attacks.

Defender doesn't operate in a vacuum, however. It's one part of the wider Windows Security app, which includes ransomware protection, reputation-based assessment, firewall management and even parental controls, to prevent kids from inadvertently accessing dangerous or inappropriate content.

Perhaps because all of this is plumbed into Windows at a low level, it has very little effect on system performance. AV-Test.org found that Windows Security slowed down web performance by a mere 5% on a standard PC, compared to browsing with protection disabled. For comparison, Avast One Essential had a 17% impact, while AVG had a massive 28% penalty.

Windows Security also had a minimal impact on application launch speed, incurring a 6% slowdown while Avast and AVG both hit 12%. Defender does seem to scan applications more rigorously when they're first installed: here Windows Security was 14% slower, compared to 9% for Avast and 16% for Avira Free. That's a smart way of doing things, though, since you might launch an application every day, but you're only going to install it once.

Our biggest issue with Microsoft Defender is to do with usability. The whole Windows Security app is a mess, with nine different pages of buttons and links to hunt through. Everyday functions rub shoulders with obscure technical features such as CPU extensions, and ransomware protection is bafflingly turned off by default. That might be to protect users from its impenetrable interface though, which requires you to dig deep into the advanced security settings to approve applications.

Then again, that might not matter - because one of the biggest benefits of Windows Security is that business users don't need to manage it for themselves. Using either group policies or Windows Intune, organisations can control every aspect of user security, ensuring protections are enabled, current and appropriate for the needs of the business and the individual.

That might not appeal to small businesses wanting to minimise their management commitment. In some scenarios, it will make more sense for staff to use a free consumer-grade antivirus solution. In a larger organisation, however, the benefits of central administration will surely outweigh any individual security features: for them, the best antivirus really is the one that's already installed.

Sophos offers an impressive portfolio of security services and, as an early adopter of cloud management, it's ensured everything can be accessed from its Central administrative portal. Along with the Intercept X Advanced workstation and server endpoint protection on review, you can use Central to look after Sophos' Mobile threat defense package along with its XGS firewalls, Wi-Fi 6/6E access points, 100 and 200 series network switches, and zero trust network access service.

That's a lot to pack into one management portal, but Sophos has done a fine job of keeping it simple. The main dashboard provides an overview of your company's security posture, and all endpoint protection services are neatly separated into three sidebar menu categories for workstations, servers, and mobiles.

Along with essential malware and threat protection services, Intercept X Advanced supports multiple security policies plus application and device controls. It employs AI-based deep learning to defend against unknown malware, blocks ransomware attacks using behavioral analysis and enables a threat analysis center.

An XDR (extended detection and response) license allows you to create your own custom threat cases. This provides deeper malware analysis and threat intelligence, on-demand endpoint isolation, and suspicious event detection and prioritization to identify targeted attacks.

Sophos Intercept X Advanced: Setup

Deployment is swift. You place the Windows and macOS installers in a central distribution point or create users in the portal and email a link to them. A different agent is used for Windows servers but, in both cases, they only take ten minutes to install, connect to your portal account and retrieve a base security policy.

The base threat protection policy has all recommended security settings enabled and is always applied to users and devices if no other policy has been assigned. Other policies are provided for web, application, Windows firewall and device controls, and data loss prevention, although these are deactivated and require configuration and assignment. Policies present an extensive range of security measures and include CryptoGuard ransomware protection.

When any file is opened for writing, it places a temporary clean copy in a proprietary cache on the local drive and, if it detects malicious encryption activity, it will automatically roll back the file to its original state.

Custom policies are easily created by cloning the preconfigured ones and tweaking their settings to suit. These can be assigned to device groups, and if you import users via the free Active Directory (AD) sync tool or Azure sync service, you can apply policies to users so they're always protected no matter what device they have signed in to.

Sophos cuts through alert smokescreens as only unresolved events that need your attention to appear in the Central dashboard and cause email notifications to be issued. We used our malware collection to create a virus outbreak condition on one PC which was highlighted immediately, whereas other events such as successful malware removals and website blocks were only posted in the logs and reports section.

The portal's threat analysis center provides a basic dashboard showing the most recent threats. Selecting one provides a full analysis of events and a one-click option to clean up all associated files and Registry entries and block them so other devices can't run it. Sophos has also added a new XDR threat analysis center dashboard that provides smarter widget-based graphical views of malware detection.

Sophos Intercept X Advanced delivers a huge range of endpoint protection measures for the price. It's simple to deploy, device and user policies add flexibility and seamless integration with the Central cloud portal makes management simple.

This content originally appeared on ITPro's sibling magazine PC Pro. For more information and to subscribe, please visit PC Pro's subscription site. 

Kaspersky’s Endpoint Security Cloud Plus (ESCP) offers some of the most flexible licensing terms in the business. While some vendors expect you to purchase separate licence packs for different types of devices, each Kaspersky user licence covers one workstation, laptop or server, plus two iOS or Android mobile devices.

The service is designed to protect up to 1,000 Windows and Mac workstations and Windows servers, and is managed entirely in the cloud. The extensive roster of security features includes anti-malware, threat and ransomware protection, a client firewall, network vulnerability scanning and an attack blocker.

On top of all this, the Plus subscription we tested adds endpoint device controls, URL-based web filtering, vulnerability assessments, patch management and encryption. It also adds the ability to block any email, file-sharing, messaging or social networking cloud services in use by your clients, while the standard licence only lets you monitor activity.

A final benefit of the Plus licence is the Security for Microsoft 365 component. This provides dedicated security services for Exchange Online, OneDrive, SharePoint Online and Teams, with its data discovery tool highlighting files identified as containing sensitive information.

Deployment starts with creating a Business Hub account and defining your company. You’re then taken to the ESCP web portal, where wizards guide you through adding users, enabling cloud discovery and scheduling updates and scans.

Then you just need to get the software onto clients – and this too is painless, as you can email invitations to users directly from the cloud portal. We found the client software took around five minutes to install, then a further 15 minutes to fully register itself with the portal and update its signature database.

A default security profile is applied to each new device so full protection starts immediately, but it’s easy enough to create custom ones. There’s a huge range of options on offer, with clearly distinguished settings for Windows, Mac, Android and iOS devices.

For example, file, web and network threat protection are available for Windows and Mac devices, while Android users get standard antivirus measures. Since iOS is so locked down, the only options available here are access controls, which let you choose what mobile features are accessible, set screen lock and password policies and specify which networks can be connected to.

It’s also worth noting that cloud discovery is only available for Windows devices. It works well, though: after you’ve given it a few hours to build up a picture of your network traffic, the portal shows a handy readout of the top five services and the devices using them.

Another Windows-centric feature is patch management. All available updates are displayed in the portal, and you can set a daily or weekly schedule to apply them all, or only those you’ve approved.

To make use of the Security for Microsoft 365 component you need to create a new workspace in your cloud account, which presents a separate portal. After granting access to our account, we were able to create profiles to protect our Exchange Online mailboxes from spam, phishing and malicious attachments, and apply anti-malware policies to our files in OneDrive and SharePoint Online.

The data discovery service, meanwhile, works with Exchange, OneDrive and SharePoint data, sending an alert to selected users if it finds confidential information. As with the ESCP portal, plenty of information is presented, with detection statistics for Exchange mailboxes, OneDrive files and SharePoint data.

Businesses seeking both device security and protection within Microsoft 365 will find Kaspersky Endpoint Security Cloud Plus has all the angles covered. You do need to use separate portals to manage everything, but there’s a huge range of security features on offer, and Kaspersky’s licensing scheme makes it very affordable.

It turns out that Sweden isn't the only Nordic nation with a talent for efficiently packing a lot of functionality into a small space. That's proven by Finnish cybersecurity vendor F-Secure: its web-based portal lets you manage not just the Endpoint Protection package but the company’s entire portfolio of business security products. So if you’re already using an F-Secure cloud service – or if you plan to in the future – it could help you simplify administration.

We found the cloud side of things easy to set up. Once we’d created a central management account, we simply had to enter our Elements Endpoint Protection (EEP) subscription details, after which the service immediately appeared in the console. Other F-Secure services are enabled in the same manner, and can be accessed from the portal’s upper right menu button.

EEP offers protection for a good spread of endpoint types. Windows and Mac workstations are covered, as well as Windows, Linux and Citrix servers, plus iOS and Android mobile devices. Malware protection is provided on all of these platforms, with F-Secure’s software analysing file contents, monitoring system change attempts and keeping an eye on program behaviour. EEP also offers patch management, web content security and removable device controls.

For the broadest possible security, you can move up to an EEP Premium subscription; this increases the per-device cost to £32 exc VAT, but adds application controls and dedicated ransomware protection.

The EEP console dashboard presents colour-coded charts for computers, patches and mobiles so you can instantly see your protection status. A table below lists any alerts and errors, with a link next to each that takes you to the relevant page for more detail. You can switch to the devices page for an overview of protected machines – and if one of your systems is infected, you can isolate it with a click, blocking all network access so it can’t do any harm. Once the system has been disinfected you can send an unblock command to remotely restore access.

This is also where you can invite users to install the EEP agent. Messages are sent by email, and include an agent download link for the appropriate platform; on Windows and macOS this takes around five minutes to install and connect to the EEP portal. On Android and iOS, users simply need to download the Android or iOS apps and log in using the pre-generated credentials in their email.

After installation, all client machines are set up with a default protection profile, which enables malware scanning, automatic quarantine actions and browsing protection. For tailor-made protection, you can create your own profiles, which define real-time scanning options, permit users to run manual scans, determine when automatic updates occur and schedule regular system scans. Web protection options include reputation-based web page scanning, content control with a list of 32 URL categories you can block or allow, and an optional browser plug-in that shows link reputations next to search results.

For mobile devices, profiles can also enable the F-Secure VPN service. There’s nothing users need to do to enable this: once the app is loaded, it creates a VPN connection to the nearest concentrator and applies the profile’s browsing controls. Protection against malicious websites and tracking cookies is included, too.

As for reporting, tabs in the portal show protection status, security events and infections. One-click menus at the top of each category send summary reports to administrators, and you can choose to issue email alerts to multiple users when infections are detected.

F-Secure Elements Endpoint Protection is a good choice for SMBs seeking easy protection: its cloud portal makes for simple management, and it’s easy to deploy a wide range of security services across all the device types you’re likely to be using.

Microsoft has announced a brand-new security suite designed specifically for the threats faced by small and medium-sized businesses (SMBs).

Microsoft Defender for Business was announced at Microsoft Ignite 2021 today and it will aim to bring what Microsoft is calling its "enterprise-grade endpoint security" to companies with 300 employees or fewer.

Entering public preview later this month, it will be available as a standalone product for businesses to purchase at a rate of $3 (£2.20) per user, or alternatively the new tools will be available as part of a Microsoft 365 Business Premium subscription.

Specifically designed to protect businesses against malware and ransomware across Windows, macOS, iOS, and Android devices, Defender for Business will have the following features:

• Threat and vulnerability management: allows customers to build a secure foundation by identifying and addressing software vulnerabilities and misconfigurations
• Attack surface reduction: Using capabilities such as ransomware mitigation, application control, web protection, network protection, network firewall, and attack surface reduction rules, SMBs' attack surface can shrink
• Endpoint detection and response (EDR): Behavioural-based detection and response alerts allowing SMBs to identify persistent threats and remove them from their environments
• Automated investigation and remediation: reduces alert volume and remediates threats. SMBs can automate Defender for Business to carry out tasks automatically, allowing them to prioritise the most important tasks
• APIs and integration: allows SMBs to automate workflows and integrate security data into their existing security platforms and reporting tools

IT managed service providers will also have the option to use Microsoft Defender for Business with Microsoft 365 Lighthouse, applying the product's endpoint security production for multiple customers as they monitor security events with a multi-customer view.

“Small and medium businesses will be empowered to elevate their security by moving from traditional antivirus to next-gen protection, endpoint detection and response, and threat and vulnerability management - all while taking advantage of simplified setup and management,” said Microsoft on the announcement.

According to Microsoft's own research, almost 60% of SMBs report not feeling adequately equipped to contend with today’s ever-widening cyber security threat landscape, citing insufficient resources and a lack of specialised security skills as the reason.

Microsoft said Defender for Business requires no specialist knowledge in order to install and manage effectively. It has a wizard-driven set-up and it will recommend security policies out of the box to expedite the process.

Among Microsoft's myriad Ignite 2021 announcements, on the security side of things Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) has added a new application governance capability which is generally available as of today. It aims to help identify and alert the customer to risky behaviour across data, users, and applications.

Defender for Cloud also received an update to multi-cloud environment control. Customers can now secure Azure and Amazon Web Services (AWS) environments from one place, giving users the same experience as they would find in AWS Security Hub.

McAfee’s an old hand at anti-malware, and it’s become a little less bloated in recent years. Despite the 2020 sell-off of the enterprise security site of the business, the consumer anti-malware division continues as a publicly traded company, with former owner Intel still holding a 49% stake.

You get a lot of features packed into McAfee Total Protection, but they’re not always the ones you’d expect. Although McAfee’s malware defence engine includes components designed to spot the telltale behaviour of ransomware attempting to encrypt your personal files, you don’t get any direct control over this as a user.

Unlike many rivals, you can’t designate specific directories for the software to monitor for and block unauthorised changes to. However, handling ransomware threats in-engine as zero-days when detected by McAfee’s behavioural analysis is a less obtrusive approach. Similarly, there’s no dedicated webcam protection module, although McAfee’s heuristic malware detection engine watches out for potential device hijacking.

Total Protection helpfully includes a dedicated firewall with a clean and pleasant interface, so you won’t have to use the Microsoft Defender Firewall’s creaky configuration UI. Also included are a vulnerability scanner to help you keep on top of required application updates, an “app boost” performance optimiser, a secure file shredder, an encrypted vault for your most sensitive data, and a “web boost” tool that prevents irritants such as auto-playing videos in chrome.

Silent detection is enabled by default to ensure that you’re not interrupted while gaming or watching videos at full screen, although the setting in question is buried in the settings menus, rather than being placed in the main interface.

You also get a copy of the McAfee True Key password manager thrown in for free, but you can do better with rivals such as Bitwarden. Family tier subscriptions include the Safe Family parental control and tracking toolkit.

In SE Labs’ latest home antivirus test, McAfee got a 100% total protection rating, meaning that it blocked all malicious software and didn’t falsely identify any benign programs as malicious or potentially unwanted.

In AV Comparatives’ most recent real-world protection test, it blocked 99.7% of malware, in common with most of its rivals, with 2 false positive identifications of legitimate software.

And it defended against 100% of malware in three of AV-Tests most recent four rounds of testing. McAfee's engine breezed through the reference malware sample set in two successive months, but only protected against all threats in August’s real-world test; in July, like a number of its rivals, it was caught out by a couple of malware exposures, but still blocked 99.3% of threats, with a single false positive. That’s only slightly less accurate than Microsoft Defender.

AV-Test’s performance data from the same period highlights a couple of minor impacts on system performance and responsiveness, however. There was a noticeable slowdown when loading websites compared to Microsoft Defender and while McAfee’s impact on software installation times was a little less pronounced than Defenders’, it was still significant compared to most rivals.

A one device, one year Total Protection account costs £29.99 for the first year and renews at £59.99 when bought from the McAfee website. The company was recently the subject of a CMA ruling finding its auto-renewal practices to be unfair, and it now more clearly highlights that its subscriptions auto-renew at a higher price and makes it easier to opt out. Renewals are still significantly more expensive than the first year’s subscription, though - more than double in the case of a ten device account.

However, as is often the case, the official price isn’t the same as the real price. A one-year, three-device key for McAfee Total Protection 2021 currently costs £11.99 from Amazon, just over a third as much as the standard introductory price for a single device, let alone the auto-renewing subscription fee.

McAfee provides some auto-renewal bonuses, notably access to the company’s Safe Connect VPN service and a money-back protection guarantee. However, even for fans of the product, this isn’t really enough added value to justify auto-renewal costs versus buying a much cheaper key elsewhere when it’s time to renew.

Total Protection does an adequate but not astonishing job. If you’re in the market for new malware protection, Kaspersky Internet Security is a better choice right now.

Finland’s F-Secure Safe has most of the features you’d want from an antivirus suite for home or home office use, with the addition of a particularly solid set of parental controls and content filtering tools to replace those that come built into Windows 10 and 11. These can be activated immediately at install time by specifying that you’re setting up an account for a child, and allow you to set up time limits, as well as web filtering, but don’t include app restrictions.

You get the expected - and vital - real-time malware protection as well as various on-demand and scheduled scan options. Although it doesn’t have as many dedicated options here as some rivals, a Full Scan covers everything you’ll need, including the boot sector.

Other features are pretty standard: Known-malicious websites are blocked by default, with the option of also blocking sites deemed to be suspicious. Additional security features are available via browser extensions for Firefox, Edge and Chrome, including a secure banking tool and a site reputation checker for search engine results on Google, Bing, Yahoo, and DuckDuckGo.

F-Secure doesn’t have all that many features that you can directly control or interact with. DeepGuard leans on the F-Secure cloud to only allow the installation of applications that it knows to be safe. This helps to keep malware from installing itself, but can throw up false positive identifications of legitimate software as potential threats. Fortunately, this is relatively rare and you can easily unblock anything you do want via the Tools page in the F-Secure client.

F-Secure doesn’t get as much regular attention from testing houses as some of its rivals. Consequently, this review is based on data from AV-Test and SE Labs only. Although F-Secure scored 100% in one real-world malware exposure test set and both reference set scanning tests from AV-Test, it - like many other malware detection engines - experienced a blip in July’s real-world tests, giving it a protection rate of 99.3%. It only threw up a single false positive, however.

SE Labs last tested F-Secure Safe in the first quarter of 2021, when it was solidly out-performed by Microsoft Defender. Kaspersky, McAfee and Avast also had better protection and total accuracy ratings. F-Secure had a protection rate of 96% and allowed the installation of 97% of legitimate software without false positive alerts, giving it an SE Labs total protection score of 96%.

AV-Test’s performance data shows us that F-Secure Safe has a low impact on system performance. It compares particularly well to Microsoft Defender when it comes to installation times for new software on low-performance PCs, and has less of an impact on website loading times than rival Kaspersky Internet Security.

Although F-Secure doesn’t always get perfect malware protection test scores, it’s nonetheless effective enough to provide solid defense against the kind of online threats you’ll encounter day-to-day. It has a decent range of features, but lacks dedicated webcam protection and has no firewall, so you’re still left wrangling the Microsoft Defender firewall’s rather dated interface.

While the product’s £59.99 (inc VAT) full price - the one you get on renewal - is fairly typical, its reduced first-year subscription fee of £39.99 is higher than that of many rivals, including those with more features. For that matter, Kaspersky Internet Security costs £34.99 after your first year. However, as with much antivirus software, Safe is available for much less if you buy a subscription key from either an online or bricks-and-mortar shop - a one year, one device subscription costs as little as £19.35 on Amazon. F-Secure also goes out of its way to highlight and make it easy to opt out of automatic renewal fees, which we welcomed.

Between protection and features, while Safe does what it needs to, it doesn’t stand out from the crowd, or even from your operating system’s integrated default option. If you’re looking for paid-for antivirus, Kaspersky Internet Security has more features and a lower introductory price.

Kaspersky Internet Security is a long-standing entry in our antivirus awards list, and its performance this time around hasn’t disappointed. We’ve reviewed the Windows version, running under Windows 10, but you can use your Kaspersky licenses to protect any combination of Windows, macOS, Android and iOS devices.

As well as the expected real-time malware detection and schedule scans, KIS provides a useful selection of features. There’s a browser protection module, ransomware defense that prevents unauthorized changes from being made to selected directories, private browsing and ad blocking, webcam protection, an interruption-free gaming mode, and online monitoring to check the protection status of all devices associated with your Kaserpersky account. Unusually for an antivirus suite in this price range, Kaspersky Internet Security also includes a fully-featured firewall.

You also get the free version of Kaspersky’s Secure Connection VPN, with a 300MB per day bandwidth cap, installed as a standalone utility. The other standalone components are an optional free subscription to Kaspersky Password Manager, and the free Safe Kids parental controls. None of these stand out against the market leaders in their sectors, however. As they aren’t really integrated into the KIS client, you won’t feel their absence if you do away with them.

When it comes to the protection afforded by its anti-malware engine, you can’t go wrong with Kaspersky’s products. KIS netted perfect protection scores without a single false positive in the most recent tests by AV-Test and SE Labs. AV Comparatives’ July/August 2021 data shows that it blocked an impressive 99.70% of malware in real-world exposure tests, once again without any false positives. Not quite perfect, but an impressive performance however you cut it, matching that of Microsoft’s impressive integrated Defender.

Where Kaspersky provides a real advantage is in its interface and performance. KIS has been a great choice for minimal impact on system resources for years, and currently out-performs built-in Microsoft Defender Antivirus on Windows 10 PCs, notably when it comes to how long it takes to install software, although Kaspersky had a greater impact on website opening times.

Perhaps the best feature of Kaspersky Internet Security is the fantastic interface it provides for actually controlling it. While in practice, most of the same things KIS does can be achieved using Windows’ integrated tools, it’s just easier to do with Kaspersky.

Its firewall in particular is designed to be lived with and used, making it easy to add and edit rules, while the Microsoft Defender firewall remains comparatively unfriendly to work with. Application controls are also a welcome addition, although they tend to block unsigned software by default, requiring an exception to run.

Kaspersky Internet Security is pretty cost-effective, starting at £14.58 exc VAT for a one year, one device subscription from Kaspersky’s website. Further discounts are sometimes available, and you can buy packaged codes at physical and online shops at prices as low as £11 inc VAT.

Watch out for renewals, though - that single-user subscription goes up to £29.16 exc VAT on the second year, and your auto-renewing subscription is set up automatically if you buy your license via the official Kaspersky site. That’s still a decent price for 12 months of malware protection, but you should make sure you’re aware of it and that you want to renew automatically rather than buying codes elsewhere.

It’s also worth noting that, since 2017, some US businesses and both UK and UK government departments won’t allow their colleagues or contractors to run Kaspersky software on devices used for work. Kaspersky subsequently moved significant parts of its operation from Russia to Switzerland.

We’d prefer it if KIS put a little less emphasis on promoting Kaspersky’s other products after we’d already paid for this one, but that’s a minor complaint about an otherwise outstanding antivirus suite.

Kaspersky Internet Security is our favourite paid-for anti-malware solution, providing a great user interface and outstanding protection against malware and minimal impact on performance, improving even on Windows’ very credible integrated malware defence.

Cellebrite has announced its new remote mobile data collection solution for handheld devices and computer systems.

Integrated into Cellebrite’s Endpoint Inspector, the new solution streamlines corporate investigations, e-discovery, and incident response. It can retrieve data from iOS and Android mobile devices and computers running Windows and macOS.

"We focused on simplifying the employee experience during data collection and deployed our domain expertise to engineer Endpoint Inspector to automate the complexity of the collection process and limit business interruption," said Ken Basore, general manager of enterprise solutions at Cellebrite.

Basore continued, "In Enterprises that deploy Endpoint Inspector, employees no longer need to hand over their device or spend hours with internal support personnel to follow complex procedures. We are pleased to be able to bring this value to our enterprise customers across life sciences, banking, insurance, and other industries.”

Commenting on scope, Cellebrite said its remote solution could gather evidence from devices inside or outside an organization's IT network. The capability adds to the firm’s Endpoint Intelligence solution that integrates data from disparate sources to provide a 360-degree view of employee communications.

Additionally, a Smart Collections feature within Cellebrite's remote data collection solution ensures only pertinent data is collected on any device. Data collection occurs with the explicit consent of employees, and an audit record is automatically generated upon confirmation.

Together, Cellebrite’s Endpoint Intelligence platform and remote data collection solution help businesses counter fraud, detect intellectual property theft, investigate claims of employee misconduct, and more.

“Corporate investigators are under serious pressure, now having to face the additional challenge of sourcing data to support cases from a geographically scattered hybrid workforce, who are using more devices and messaging services than ever before for professional communications. Today's announcement underscores the strategic importance of Cellebrite's cloud capabilities and our commitment to ensure enterprise investigators can adapt to a hybrid workforce, " added Basore.

Provided by

Enterprises are playing pandemic catch-up as they continue to adjust to the explosion of remote and hybrid workers.

The results from this Forrester survey of nearly 800 IT decision-makers highlight the need for improved, modern endpoint management.

See how IT priorities have shifted to increased predictive analytics, enhanced security, and automation for endpoint management tasks, and learn key recommendations from Forrester on steps organisations can take to update their endpoint management strategy.

Provided by

Endpoints have become a frequent target for cyber attacks and represent a weak link in many organisations’ overall security posture.

This guide explores the reasons why your endpoints could be at risk and highlights the opportunities to combat these threats.

Read on for guidance on security requirements that should be included in your next RFP and the questions you should ask to strengthen the security of your devices, data, and identity to protect your business against ever-evolving cyber threats.

2020 was an unprecedented year for security teams amid the global health crisis. The threat landscape continues to evolve as malicious actors quickly adapt to the changing environment and are finding new ways to exploit your vulnerabilities. It is now more critical than ever to protect your workforce at the endpoint no matter where you are.

Legacy endpoint security tools have proven to be ineffective at preventing these sophisticated threats. It is time to consider a modern endpoint security solution to gain advantage over highly innovative attackers.

Download this eBook to gain insights into:

• 8 common endpoint security challenges and how they are solved by modernisation
• Benefits of modernising your endpoint security
• Why VMware Carbon Black Cloud is the easy answer to security challenges

Provided by

Medigate and CrowdStrike have joined forces to provide integrated endpoint security for Internet of Things (IoT) medical devices.

With more and more medical devices entering hospital networks, health care delivery organizations (HDOs) face the difficult challenge of ensuring visibility into every connected device or terminal.

Medigate and CrowdStrike aim to solve this problem by offering HDOs a consolidated view of threat activity across connected devices.

As part of the partnership, CrowdStrike will integrate its Falcon software with Medigate’s device security platform, allowing HDOs to manage risk outcomes, detect anomalies, and enhance response capabilities.

Falcon by CrowdStrike monitors and safeguards functions and applications installed on all managed endpoint devices and workloads. Medigate device security platform (MDSP) offers critical insights into clinical protocols, communications, and workflows in a network.

The integration will allow MDSP to incorporate Falcon’s telemetry into its passive network monitoring. In addition to providing a 360-degree view of the environment, the combined solution will enable HDOs to monitor their managed and unmanaged endpoints for signs of intrusion and block them from becoming successful.

“We have seen a significant number of cyber attacks and ransomware against hospitals over the past year and this number will only increase in the future. A hospital should focus on patient care, rather than seeking to respond to external threats, ” said Matthew Polly, vice president of worldwide alliances, channels, and business development at CrowdStrike.

“Medigate's unique interest in the healthcare IoT industry is very effective in helping to reduce the fields of attack. With CrowdStrike and Medigate, HDOs can accurately see, detect, respond and prevent attacks across the IT and clinical landscape to safeguard their operations and data - including patient information. "

Provided by

IT threats are constantly changing and one of the greatest security challenges is protecting endpoints as cyber criminals have more ways to break in than ever. A great amount of resources is taken up monitoring endpoints and identifying risks, but with workforces now distributed - with countless distributed devices - traditional security processes and tools aren’t proving to be effective.

Now is the time to rethink your model and utilise cloud-based applications to strengthen your endpoint security and simplify your endpoint management.

Download this guide to learn how Google has changed its approach to endpoint security through cloud computing and multi-layered defences.

.

McAfee’s security software hasn’t always wowed us in the past but, since parting company with Intel in 2017, it’s become a persuasive contender.

That’s partly to do with value. Total Protection is McAfee’s top-of-the-line offering and one of the most feature-packed security suites we’ve seen, yet you can get a three-PC package on Amazon for just £15 a year. The slightly leaner Internet Security suite can also be had for two quid less.

McAfee Total Protection review: Features

McAfee Total Protection keeps an active watch over your system and blocks viruses and other malicious items on access. It monitors web content, too, and the free browser extension for Chrome, Edge, Firefox and Internet Explorer will steer you away from dodgy websites.

Additional features include a custom firewall and access to McAfee’s True Key password manager across five devices. There’s also an automatic software updater, a simple network scanner that lets you inspect nearby LAN clients, and tools for encrypting or shredding sensitive files.

The optional App Boost component isn’t really a security feature but it can make your system feel more responsive by allocating extra system resources to foreground applications.

Also included is McAfee’s Safe Family parental control platform. This works across Windows, Android and iOS to track and block specific apps and online content, keep tabs on device location and even send you alerts when your kids enter or leave defined areas.

Most unusually, your McAfee subscription also includes a complete VPN service, with selectable servers in 23 locations around the world and no data caps. You can even set it to kick in automatically whenever you connect to a new network too – a very nice touch. The catch is that to use it you have to keep the automatic licence renewal option turned on. This could prove costly if you forget to cancel at the right time, as the price goes up significantly in the second year.

McAfee Total Protection review: Protection

McAfee’s malware engine is regularly put through its paces by both AV-Comparatives.org and AV-Test.org and, in the most recent tests carried out in the first half of 2021, Total Protection achieved a flawless 100% protection rating.

There’s a catch, though. While McAfee successfully blocked every nasty sample it was exposed to, it also wrongly flagged seven innocent items. That’s more than we’d like to see. Once you get into the habit of manually unblocking safe items, it becomes far more likely that you’ll end up unblocking something dangerous. By contrast, in the same test, F-Secure SAFE and Eset Internet Security made no mistakes at all.

McAfee Total Protection review: User interface

In the past, some McAfee products were burdened with a sluggish, overcomplicated front-end; thankfully, that’s now been completely overhauled. The current release of Total Protection is nicely responsive and neatly organised, with tabs along the top and sensibly labelled controls in the main pane.

It’s also one of the nimblest security suites around. In a range of different usage scenarios, AV-Comparatives.org and AV-Test.org reported it slowed down their test PCs by an average of 6.3%. That’s an excellent score; of the packages we’ve seen, only F-Secure SAFE did better, nosing ahead with 6.1%. Windows Defender meanwhile weighed in at a ponderous 12.5%.

Scanning is quite quick, too. McAfee Total Protection fully scanned an external hard disk containing 55GB of assorted data in well under two minutes. Again, it didn’t quite keep up with F-Secure SAFE, which whizzed through the test in 27 seconds, but many other suites took longer and Windows’ own scanner left us waiting around nearly ten minutes.

McAfee Total Protection review: Verdict

McAfee Total Protection partners slick and effective malware protection with a tempting array of genuinely useful add-ons. The fact that it can be had for such a low price makes it almost irresistible.

However, a worse than average false positive rate means you might need to be prepared to fish the odd file out of quarantine and, if you��re going to enable the VPN, make sure you set a reminder to cancel your subscription before you’re stung with a hefty renewal fee.