Security agencies are warning that hackers are exploiting vulnerabilities in Cisco Adaptive Security Appliance (ASA) 5500-X Series devices to install malware, execute commands, and steal data.

The first vulnerability, tracked as CVE-2025-20333, allows authenticated attackers to execute arbitrary code on devices using ASA and Firewall Threat Defense (FTD) software.

Meanwhile, a second vulnerability (CVE-2025-20362) allows them to access restricted URL endpoints without authentication.

"In May 2025, Cisco was engaged by multiple government agencies that provide incident response services to government organizations to support the investigation of attacks that were targeting certain Cisco Adaptive Security Appliance (ASA) 5500-X Series devices that were running Cisco Secure Firewall ASA Software with VPN web services enabled," the networking giant said in a customer advisory.

"Attackers were observed to have exploited multiple zero-day vulnerabilities and employed advanced evasion techniques such as disabling logging, intercepting CLI commands, and intentionally crashing devices to prevent diagnostic analysis."

CISA, NCSC respond to Cisco ASA flaws

According to the US Cybersecurity and Infrastructure Security Agency (CISA), the campaign is 'widespread' and connected with “ArcaneDoor” activity identified early last year

This threat campaign targeted perimeter network devices from several vendors, including Cisco, to deliver malware strains such as Line Runner and Line Dancer.

"CISA is directing agencies to account for all Cisco ASA and Firepower devices, collect forensics and assess compromise via CISA-provided procedures and tools, disconnect end-of-support devices, and upgrade devices that will remain in service," the agency said.

The UK's National Cyber Security Centre (NCSC) has also issued guidance in the wake of the exploitation. The cybersecurity agency noted that some Cisco ASA 5500-X series models will be out of support from September 2025 and August 2026.

With this in mind, enterprises using these models should take immediate action to mitigate potential risks.

“It is critical for organizations to take note of the recommended actions highlighted by Cisco today, particularly on detection and remediation,” said NCSC chief technology officer Ollie Whitehouse.

“We strongly encourage network defenders to follow vendor best practices and engage with the NCSC’s malware analysis report to assist with their investigations.

“End-of-life technology presents a significant risk for organisations. Systems and devices should be promptly migrated to modern versions to address vulnerabilities and strengthen resilience.”

New malware strains are a potent threat

New RayInitiator and Line Viper malware strains believed to be used in attacks represent a “significant evolution” on Line Dancer and Line Runner, the NCSC warned, particularly in terms of sophistication and their ability to evade detection.

CISA has now issued a directive ordering federal agencies - which have already been targeted - to identify, analyze, and mitigate potential compromises immediately.

"CISA is directing agencies to account for all Cisco ASA and Firepower devices, collect forensics and assess compromise via CISA-provided procedures and tools, disconnect end-of-support devices, and upgrade devices that will remain in service," it said.

"These actions are directed to address the immediate risk, assess compromise, and inform analysis of the ongoing threat actor campaign.”

MORE FROM ITPRO

• Cisco polishes its platform but the network is still king
• 96% of businesses have low cyber-readiness, claims Cisco
• Cisco promises AI training for a million Americans

Russian government-linked hackers are exploiting unpatched Cisco networking devices to spy on critical infrastructure organizations.

The attackers are mainly targeting organizations in the telecommunications, higher education and manufacturing sectors, with known victims in a number of geographic regions, including North America, Asia, Africa and Europe.

The group carrying out the attacks is believed to be part of the Russian Federal Security Service's (FSB) Center 16, and has a number of names, including Static Tundra, Berserk Bear, Energetic Bear and Dragonfly.

It's exploiting Simple Network Management Protocol (SNMP) and end-of-life networking devices running a seven-year-old unpatched vulnerability in Cisco Smart Install (SMI).

"For years, Static Tundra has been compromising Cisco devices by exploiting a previously disclosed vulnerability in the Smart Install feature of Cisco IOS software and Cisco IOS XE software (CVE-2018-0171) that has been left unpatched, often after those devices are end-of-life," said Cisco Talos researchers Sara McBroom and Brandon White in an advisory.

"We assess that the purpose of this campaign is to compromise and extract device configuration information en masse, which can later be leveraged as needed based on then-current strategic goals and interests of the Russian government. This is demonstrated by Static Tundra’s adaptation and shifts in operational focus as Russia’s priorities have changed over time."

Over the last year, the group has been spotted collecting configuration files for thousands of networking devices associated with US organizations across critical infrastructure sectors.

On some vulnerable devices, it modified these configuration files to enable unauthorized access, through which they then carried out reconnaissance in their victims' networks - revealing their interest in protocols and applications commonly associated with industrial control systems.

The group has been compromising network devices for more than ten years, focusing particularly on devices accepting legacy unencrypted protocols like SMI and SNMP versions 1 and 2.

It's also made use of custom tools against certain Cisco devices, such as the malware known as SYNful Knock in 2015.

"Once they establish initial access to a network device, Static Tundra will pivot further into the target environment, compromising additional network devices and establishing channels for long-term persistence and information gathering," said McBroom and White.

"This is demonstrated by the group’s ability to maintain access in target environments for multiple years without being detected."

Cisco Talos is urging customers to apply the patch for CVE-2018-0171 or, if that's not an option, to disable Smart Install.

"The threat extends beyond Russia's operations — other state-sponsored actors are likely conducting similar network device compromise campaigns, making comprehensive patching and security hardening critical for all organizations," McBroom and White warn.

"Threat actors will continue to abuse devices which remain unpatched and have Smart Install enabled."

MORE FROM ITPRO

• The convergence of network and security – how it helps achieve business outcomes
• Russian hackers tried to lure diplomats with wine tasting
• ‘All US forces must now assume their networks are compromised’ after Salt Typhoon breach

Compromised network edge devices have rapidly emerged as one of the biggest attack points for small and medium businesses, prompting calls for firms to shore up defenses.

Statistics from Sophos’ Annual Threat Report show firewalls, routers, and VPNs accounted for initial compromise in nearly 30% of all incidents observed by the firm over the last year.

Virtual private networks (VPNs) were cited as the most frequently compromised, accounting for over 25% of all incidents and also 25% of ransomware attacks.

What’s more, these figures come from cases that could be confirmed by telemetry, Sophos said, so the actual number of cases could be much higher.

Sean Gallagher, principal threat researcher at Sophos, said the report highlights how attackers have aggressively targeted edge devices over the last several years.

“Compounding the issue is the increasing number of end-of-life (EOL) devices found in the wild – a problem Sophos calls digital detritus,” he commented.

“Because these devices are exposed to the internet and often low on the patching priority list, they are a highly effective method for infiltrating networks.”

Gallagher added the aggressive targeting of edge devices forms part of a larger shift in cyber criminal tactics. In its report, Sophos said this means attackers don’t have to deploy custom malware and can employ ‘living off the land’ techniques to maximize their impact on target organizations.

“They can exploit businesses’ own systems, increasing their agility and hiding in the places security leaders aren’t looking,” Gallagher said.

Other popular attack methods highlighted in the report were social engineering via Software as a Service platforms. These widely-adopted platforms have become heavily abused products commonly used for initial compromise.

Business email compromise is also a growing concern, according to the report, attributing to an alarming rate of initial compromises in security incidents.

In these instances, malware deployment, credential theft, and social engineering are being used extensively, the report warned.

Phishing of credentials via adversary-in-the-middle (AiTM) attacks and multi-factor authentication (MFA) token capture was cited as the main drivers of the increase.

AiTM attacks are a specific variant of the traditional 'man in the middle' attack method, whereby cyber criminals intercept communications between two parties to steal data.

This new type of attack differs greatly, however, enabling threat actors to actively interfere with and modify communications rather than simply intercepting them.

This particular method has been growing in popularity among threat groups in recent years, with state-backed threat actors in particular employing the technique.

In an advisory last year, Microsoft warned AiTM attacks have now become one of the 'go-to' methods for cyber criminals, with the tech giant's Digital Crimes Unit (DCU) observing a 146% increase across 2024.

MORE FROM ITPRO

• Six of the best malware removal services you can use today
• We ranked the best VPNs for businesses
• The best Wi-Fi and access points for your enterprise

HPE has announced a sweeping expansion of its Aruba Networking Central platform, offering users a raft of new features focused on driving security and data sovereignty.

As part of the move, users of the network management solution will be granted access to a virtual private cloud (VPC) environment aimed at shoring up data security and meeting regulatory requirements, the company said.

This will be complemented by an on-premises option capable of operating while disconnected from the cloud.

Phil Mottram, EVP and general manager for HPE Aruba Networking, said the expansion comes in direct response to evolving enterprise needs with regard to data sovereignty.

Enterprises operating on both sides of the Atlantic, particularly in the European Union (EU), face strict rules governing the use, storage, and sharing of customer data.

“Organizations are increasingly prioritizing data sovereignty, requiring regional and local presence for mission-critical IT solutions,” he said.

“With these innovations, HPE now uniquely addresses the most pressing enterprise challenges for corporate, nonprofit, and government entities with unprecedented network management deployment flexibility.”

HPE Aruba Networking Central changes

As part of the expansion, HPE Aruba Networking Central will gain four new deployment options. This means the solution can now be deployed in a cloud-delivered SaaS, VPC, on-prem, or NaaS format.

Similarly, integration of FIPS 140-2 certified hardware aims to help enterprises meet government security requirements and adhere to regulations including GDPR.

Described as a “comprehensive networking management solution”, HPE said this will boost efficiency for use-cases such as AI data capture, training, and inferencing - all of which typically require greater levels of control through air-gapped on-prem and cloud-based VPC options.

Underpinning this is the company’s GreenLake platform, which will provide enterprise users with local cloud options across a range of locations.

The firm is also keen to highlight gains made with regard to global points of presence (PoP), with dedicated instances now hosted in the US, Canada, EU, Middle East, Africa, Asia Pacific, and China.

AIOps tools look to drive network productivity

Elsewhere, other new features unveiled by HPE include the launch of automated network AIOps capabilities.

This will enable enterprises to continuously monitor critical wires and wireless network operations, optimize processes, and detect performance issues.

“A fabric of AI assistants acts as network architects, monitoring and gathering data, providing diagnostics and recommendations to extend existing capacity and performance, close security gaps, and identify configuration errors before they impact network operations,” the company said in an announcement.

“Combined with our continued innovation across AI, security and connectivity, HPE Aruba Networking Central continues to offer the most powerful and versatile network management application on the market, helping organizations meet their security, privacy and control requirements,” Mottram said.

MORE FROM ITPRO

• HPE unveils Mod Pod AI ‘data center-in-a-box’ at Nvidia GTC
• What HPE's results say about the direction of enterprise AI
• HPE’s ‘one-click AI solution’ for private cloud cuts project times from months to a ‘single moment’

With the number of IoT devices expected to skyrocket in the next four years, researchers have called on more robust cybersecurity protections to counter a wave of rising threats.

In a new study by Juniper Research, the number of devices is set to hit 28 billion globally by 2028. However, amidst this sharp growth, the increasing complexity of IoT networks means there's a greater need for effective frameworks that underpin security solutions.

A key factor in this call to action is the fact that industry has a fragmented approach to IoT security, researchers said.

"The IoT cybersecurity market is expected to reach $51 billion by 2028; partly driven by adoption from SMEs," said research author Michelle Joynson.

"To capitalize, vendors must simplify their solutions in a time when IoT architectures are becoming increasingly complex, and a greater number of connectivity technologies are used."

IDC advises enterprise IoT users to protect themselves against high-risk events such as data breaches, financial losses, and regulatory non-compliance by implementing zero trust architecture (ZTA) frameworks as a priority.

"ZTA frameworks operate on the principle that no device on a network is to be inherently trusted; requiring constant authentication," said IDC.

"These frameworks also offer greater visibility of IoT device activity through continuous authentication; enabling earlier threat detection and mitigation."

As for vendors, the scale of expected IoT growth and rapid pace of digitalization by SMBs means these frameworks will need to be deployed across IoT networks of various sizes.

As the number of networks grows, vendors should be leveraging the scalability of their ZTA frameworks to make sure that cybersecurity solutions can keep pace.

IoT remains a security blind spot for enterprises

IoT has become something of a wild west in terms of security, with connected devices representing the biggest targets in the UK last year.

Research from Beaming, for example, found there were at least 161 attacks on IoT devices per day, with threat actors increasingly targeting applications such as building control systems, network-enabled printers, remote monitoring tools, and industrial control systems.

According to the UK's National Cyber Security Centre (NCSC), many devices aren't secure by design or by default, aren't given regular firmware updates, or have weak authentication measures with limited logging, making it hard to detect suspicious activity.

Similarly, many may not be configured securely, lack proper network segmentation, or use unsupported or end-of-life (EOL) hardware.

Last year, analysis from WithSecure identified a steep rise in security incidents caused by the mass exploitation of IoT and edge devices, including MOVEit, CitrixBleed, Cisco XE, Fortinet’s FortiOS, Ivanti ConnectSecure, Palo Alto’s PAN-OS, Juniper’s Junos, and ConnectWise ScreenConnect.

Earlier this month, the Five Eyes cybersecurity agencies released guidance on how to secure edge devices, including IoT devices, recommending that they include and enable standard logging and forensic features that are robust and secure by default.

MORE FROM ITPRO

• New industry-backed IoT standards aim to bolster security
• Implementing zero trust with the Internet of Things
• What the Internet of Things (IoT) means for data security

Cisco’s ‘security everywhere’ mantra has just taken on new meaning with the launch of a series of smart network switches it says will redefine the way firewalls, the old stalwart of cybersecurity, work entirely.

Unveiled at Cisco Live in Amsterdam, Cisco said its N9300 Smart Switches will introduce new capabilities to help businesses defuse some of the lateral movement techniques used by the most sophisticated groups operating in today’s threat landscape.

The N9300 switches are equipped with data processing units (DPUs), that allow the for the deployment of advanced services such as Cisco Hypershield directly into the switching fabric.

Hypershield is a firewalling capability launched by Cisco in 2024 that enables the micro-segmentation of a network, but it required hardware with built-in DPUs, which did not exist at the time.

But now Cisco's souped-up N9300s don’t just switch traffic, they run services like Hypershield with high performance at high throughput rates.

The firm said that as customers upgrade their hardware the combination of its new switches and Hypershield will unlock unprecedented levels of protection at the data center and beyond.

Redefining the firewall

Speaking during a panel session on AI-ready data centers, Tom Gillis SVP and GM of the security, data center, internet, and cloud infrastructure group at Cisco, said the N9330 switches mean the firm is in a position to ‘redefine’ the way firewalls function in modern ICT infrastructure.

“A firewall used to live in a box at the edge of the network. So with Cisco Hypershield we’ve taken that concept and broken it into a million little pieces. So instead of a box you try to shield at the edge, you have the ability to put a micro perimeter at each one of those services that make up an application.”

Gillis explained that Cisco is leveraging its in-house switching ASIC, Silicon One, to enable the performance required to deliver advanced inspection at every connection across distributed applications with minimal orchestration.

“The net of this is that it lets folks like you put firewalls in places you couldn’t even imagine. You don’t have to cable up an appliance, you don’t have to write a bunch of rules, and here’s the best plus: it’s dynamic and upgrading itself.”

Cisco’s unified firewall management system, Secure Firewall, enables automated deployment of firewalls to the cloud that can be managed centrally, scaled up automatically, and are ‘self-healing’.

‘Self-healing’ refers to the fact that if the firewall detects any type of failure, Cisco Security Cloud will take that image down, redeploy a new image, and sync it back with the cluster.

Automating the deployment, scaling, and upkeep of these appliances will be increasingly important if firms are to rigorously segment their increasingly distributed and fine-grained application ecosystems, which are often made up of thousands of microservices running across multi-cloud services.

Neutralizing the Typhoon

Cisco emphasised that this is a significant step forward for the securing applications, and network security more broadly.

In recent years, state-sponsored threat actors have been found targeting complex vulnerabilities in network infrastructure and using that to establish persistence on sensitive enterprise and government networks.

The various groups tracked under the Typhoon moniker in Microsoft’s threat actor taxonomy - and thought to be based in China - have been responsible for a number of highly sophisticated attacks on critical national infrastructure and government institutions in the US.

In December, a senior White House security official confirmed that the Salt Typhoon group was able to record conversations of senior political operators in the US after hacking several major telecom providers in the region.

Last month, the Treasury imposed sanctions on several Chinese firms accused of having some role in recent cyber intrusions attributed to the Flax Typhoon group.

Speaking to ITPro, Martin Lee, technical lead of security research at Talos, Cisco’s threat intelligence arm, described this type of activity, noting that threat actors have been observed using complex techniques to compromise network devices and using these as ingress points on the network.

“If you can find your way in through the network infrastructure, you can then get inside of your environment and use that target device as a platform to launch attacks against the target systems,” he explained.

“This kind of threat actor and this kind of activity underlines why getting the network architecture and segmentation right is so important. If they’ve managed to compromise one environment, you’re forcing them to do work to compromise the other one and it’s that work that is the noise that you can detect.”

MORE FROM ITPRO

• Cisco is jailbreaking AI models so you don't have to worry about security
• Networking is still king as Cisco polishes its network capabilities
• Cisco's 'savvy' CoreWeave deal will supercharge its AI ambitions

A host of cybersecurity agencies have teamed up to offer guidance on how to secure edge devices from ever-increasing threats.

The advice covers network edge devices and appliances, such as firewalls, routers, virtual private networks (VPN) gateways, Internet of Things (IoT) devices, internet-facing servers and internet-facing operational technology (OT) systems.

Issued by the UK's National Cyber Security Centre (NCSC), CISA, and agencies in Australia, Canada, New Zealand, and the US, the guidelines encourage device manufacturers to include and enable standard logging and forensic features that are robust and secure by default.

This, the NCSC points out, should make it easier for network defenders to detect malicious activity and investigate following an intrusion.

The guidelines also set out a set of minimum standards for forensic visibility to help network defenders secure organizational networks, both proactively and when responding to a compromise.

"In the face of a relentless wave of intrusions involving network devices globally our new guidance sets what we collectively see as the standard required to meet the contemporary threat," said NCSC technical director Ollie Whitehouse.

"In doing so, we are giving manufacturers and their customers the tools to ensure products not only defend against cyber attacks but also provide investigative capabilities post-intrusion."

The NCSC said malicious actors are increasingly exploiting vulnerabilities and insecure design features to gain and maintain valuable accesses. Devices often aren't secure by design or by default, aren't given regular firmware updates, or have weak authentication measures with limited logging, making it hard to detect suspicious activity.

Similarly, many may not be configured securely, lack proper network segmentation, and use unsupported or end-of-life (EOL) hardware, thereby increasing their vulnerability to exploitation.

Last summer, a report from WithSecure identified the mass exploitation of edge services as the year's prevailing trend for attackers.

The year saw a sharp rise in security incidents caused by the mass exploitation of edge devices, including such as MOVEit, CitrixBleed, Cisco XE, Fortinet’s FortiOS, Ivanti ConnectSecure, Palo Alto’s PAN-OS, Juniper’s Junos, and ConnectWise ScreenConnect.

The number of edge service and infrastructure Common Vulnerabilities and Exposures (CVEs) added to the Known Exploited Vulnerability Catalogue (KEV) was 22% higher than in 2023.

Juliette Hudson, CTO of CybaVerse, said the new guidance is much needed given the scale of threats facing edge devices currently.

"These are guidelines that shouldn't be ignored, because when edge devices are insecure, the entire networks they run within are at heightened exposure to attack. Today, all businesses are digital businesses, where they rely on smart devices and the internet to deliver services, but this expands the enterprise attack surface," she said.

"Having good visibility across network assets and running proactive monitoring for threats are essential, but device manufacturers also have a key role to play, and it is essential they practice good security hygiene in the development process."

MORE FROM ITPRO

• Five Eyes raises alarm over 'living off the land' attacks
• How edge computing can benefit businesses
• Check out the best VPNs for enterprises

T-Mobile was able to protect sensitive customer information and prevent disruption to its services after detecting malicious attempts to infiltrate its systems, according to its security chief.

Jeff Simon, chief security officer at T-Mobile, published an update on a string of recent cyber attacks targeting wireless companies, believed to be orchestrated by the Salt Typhoon group.

The update states that the attacks originated from the network one of T-Mobile’s wireline providers it was connected to, but Simon said connectivity to the provider’s network, which may still be compromised, was quickly severed.

Simon noted that unlike other providers, and despite media reporting, T-Mobile’s customer information was not impacted.

“Many reports claim these bad actors have gained access to some providers’ customer information over an extended period of time – phone calls, text messages, and other sensitive information, particularly from government officials. This is not the case at T-Mobile,” he wrote.

“Our defenses protected our sensitive customer information, prevented any disruption of our services, and stopped the attack from advancing. Bad actors had no access to sensitive customer data (including calls, voicemails or texts).”

Speaking to Bloomberg, Simon said T-Mobile’s network engineers discovered the attack after noticing suspicious behavior on some of the company’s network devices.

The behavior wasn’t “inherently malicious” but may have been used to gain a clearer understanding of the company's corporate network, with threat actors probing for potential lateral movement opportunities.

Simon stated that T-Mobile’s layered network design, featuring network segmentation and robust monitoring, partnerships with third-party cyber experts, and its swift response all helped to prevent the attackers from causing further damage.

Salt Typhoon is on a rampage

Although T-Mobile were unable to “definitively identify” the attacker’s identity, the behavior is consistent with previous attacks leveraged by the Salt Typhoon group.

Trend Micro published a report on 25 November detailing previous activity of Salt Typhoon, also known as Earth Estries, Ghost Emperor, or UNC2286).

The report stated the group has primarily targeted critical sectors such as telecommunications and government entities across the US, Asia, Middle East, and South Africa since 2023 and potentially even earlier.

“The group employs advanced attack techniques and multiple backdoors, such as GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, affecting several Southeast Asian telecommunications companies and government entities,” Trend Micro outlined.

“Earth Estries exploits public-facing server vulnerabilities to establish initial access and uses living-off-the-land binaries for lateral movement within networks to deploy malware and conduct long-term espionage.”

According to the report, the group has compromised over 20 organizations in the telecommunications, technology, consulting, chemical, and transportation industries, as well as government agencies.

Reports of Salt Typhoon infiltrating internet service providers (ISPs) in the US came out in September 2024, with the Wall Street Journal confirming in October that major players Verizon Communications, AT&T, and Lumen Technologies were among a list of companies whose networks were breached.

Unnamed sources familiar with the matter told theWSJ that the access may have allowed the group to access information from systems the federal government uses for court-authorized wiretapping, describing the compromise as "potentially catastrophic”.

T-Mobile appears to have avoided the worst impacts of Salt Typhoon’s campaign, according to Simon, who added that he had recently attended a meeting of leaders at the White House to discuss how the industry can work together to mitigate the threats the group pose and avoid further damage.

Cyber security firm Check Point has announced the acquisition of network security firm Perimeter 81 for $490 million.

The acquisition comes as Check Point looks to widen its range of security service edge (SSE) and secure access service edge (SASE) offerings to serve a growing market of remote users, cloud, and data centers in need of secure access.

Check Point said it identified Perimeter 81 as a world leader in SASE solutions, with a market-leading approach to on-prem and cloud security. It aims to integrate the firm’s offerings within its wide range of products and services to offer the most secure

Perimeter 81’s approach to zero trust access and mesh connectivity was specifically noted by Check Point in its post on the acquisition, with both linked to the secure and seamless remote browsing that Check Point aims to provide for its customers.

The acquisition is expected to close in Q3 2023, subject to normal close proceedings. It will be completed in cash and debt-free.

Gartner has predicted that by 2025, 65% of enterprises will group their SASE components such as SD-WAN under dedicated SASE vendors, compared to 15% in 2021.

“With the advent of hybrid work and the rise of cloud transformation, the demand for security services that expand beyond the network perimeter is increasing,” said Gil Shwed, CEO at Check Point Software Technologies. 

"By leveraging Perimeter 81´s capabilities and integrating them into the Check Point Infinity platform we continue with our vision to deliver the best security through comprehensive, collaborative and consolidated solutions.”

Perimeter 81 currently has more than 200 employees worldwide, in comparison to Check Point’s 6,000. It is based in Tel Aviv, the site of Check Point’s international headquarters.

It currently offers a unified security stack through which it states customers can use to easily deploy and scale their secure corporate network.

“This strategic move marks an exciting period for our company, partners, and customers. By joining Check Point, a global leader in cyber security for over 30 years, we aim to deliver the premier SASE platform in the market,” said Amit Bareket, CEO at Perimeter 81. 

"Our interconnection represents a significant step towards a comprehensive and scalable security for the modern era. We look forward to the positive impact we will jointly create."

Security researchers have uncovered a vulnerability, tracked as CVE-2023-38408, in the secure networking suite OpenSSH which would allow hackers to remotely execute code using simple commands.

Exploitation of the vulnerability makes use of a commonly-used helper program in OpenSSH called ssh-agent, which holds a user’s private keys for use in frequent, often automated, SSH public key authentication.

Administrators managing remote servers often enable ‘ssh-agent forwarding’, which enables the ssh-agent to be accessed from a chosen server so that local SSH keys to be used without storing keys on the server itself.

Qualys researchers discovered that when a forwarded agent is set up using default settings, with PKCS11 enabled, it’s possible for a threat actor with a connection to the same remote server to load and unload shared libraries on a victim’s machine with malicious side effects.

Security researchers used this technique to achieve one-shot, remote code execution (RCE) by combining just four side effects of loading and unloading common shared libraries.

Once an attacker has achieved RCE, a host of malicious actions can be undertaken including the installation of malware, carrying out a data breach, or total system takeover.

“This newly uncovered ssh-agent vulnerability underlines the continuous need for rigorous security measures and immediate response,” wrote Saeed Abbasi, manager, Vulnerability Signatures at Qualys.

“Even robust systems can harbor hidden vulnerabilities, as demonstrated by the shortcomings of the ssh-agent. Proactively rectifying such vulnerabilities through actions such as implementing patches is critical to maintaining the integrity of digital assets.”

OpenSSH is a widely-used solution for encrypted data transfer and remote logins, particularly by administrators seeking to easily manage SSH keys. It is used worldwide for secure connections.

Researchers found the default installations of Ubuntu Desktop 22.04 and 21.10 to be vulnerable and warned that other Linux distributions or operating systems could also be exploited if left unpatched.

Vulnerable OpenSSH releases include:

• 1:7.9p1-10+deb10u2
• 1:7.9p1-10+deb10u1
• 1:8.4p1-5+deb11u1
• 1:9.2p1-2
• 1:9.3p1-1

The issue has been fixed as of version 1:9.3p2-1.

OpenSSH noted that the flaw can only be exploited if specific libraries are present in the victim’s system, and that if agents are not forwarded to a hacker-compromised network, attacks cannot be achieved remotely.

ASUS has announced a raft of firmware updates to fix critical vulnerabilities found in a number of router devices. 

The firm revealed that nine security vulnerabilities were discovered in networking appliances - two of which were rated as ‘critical’ with six designated as ‘high’ risk. 

Tracked as CVE-2018-1160 and CVE-2022-26376, the two critical vulnerabilities were given a 9.8 severity rating out of a possible 10, the company said. 

Analysis shows that the former of these pertains to an out of bounds write bug found in Netatalk prior to version 3.1.12. This near-five-year-old vulnerability could enable an unauthorised party to achieve arbitrary code execution. 

Meanwhile, CVE-2022-26376 is a memory corruption vulnerability found in Asuswrt and Asuswrt-Merlin New Gen firmware. This flaw could allow an attacker to trigger this vulnerability by leveraging a “specially-crafted HTTP” request, which would cause memory corruption. 

Nearly 20 router models have been affected by disclosed vulnerabilities, ASUS revealed. 

These include:

• GT6
• GT-AXE16000
• GT-AX11000 PRO
• GT-AXE11000
• GT-AX6000
• GT-AX11000
• GS-AX5400
• GS-AX3000
• XT9
• XT8
• XT8 V2
• RT-AX86U PRO
• RT-AX86U
• RT-AX86S
• RT-AX82U
• RT-AX58U
• RT-AX3000
• TUF-AX6000
• TUF-AX5400.

In its security advisory on 19 June, ASUS urged customers to patch affected routers as soon as possible to avoid risk of exposure.  

The firm warned that customers choosing not to install new firmware updates should disable services accessible from via WAN to “avoid potential unwanted intrusions”. 

“These services include remote access from WAN, port forwarding, DDNS, VPN server, DMZ, port trigger,” ASUS said. 

The company also recommended frequent auditing of equipment to ensure firmware is up to date and to mitigate risk.

“We strongly encourage you to periodically audit both your equipment and your security procedures, as this will ensure that you will be better protected,” the firm said.

Cyber security provider Dragos has announced the launch of its new Dragos Global Partner Program, which will enable partners to act as industrial controls systems (ICS) and operational technology (OT) experts and advisors.

Dragos specializes in cyber security for ICS and OT environments, providing visibility into ICS/OT assets, vulnerabilities, threats, and response actions. 

The firm’s solutions protect organizations across industries such as energy, manufacturing, building automation systems, water, government, food, and more. 

Partners will have access to the Dragos platform for visibility into customer assets, Dragos Professional Services, as well as threat intelligence via the Dragos WorldView offering. Dragos OT Watch also enables managed ICS/OT threat hunts and notification triage, while Neighborhood Keeper provides collective defense.

Positioned as the only channel program that spans OT, services, and threat intelligence, the initiative provides training to help partners position themselves as specialist advisors able to offer their customers assessment services, resell the Dragos security platform, as well as manage deployment.

In an announcement, Dragos said partners will be able to offer the full range of ICS/OT cyber security technology and services to increase revenue opportunities and deliver positive results for customers.

“Market demand for OT cyber security is accelerating as evolving threats, geopolitical dynamics, and regulations shine a spotlight on the need to protect industrial infrastructure,” said Christophe Culine, VP of global sales and CRO at Dragos. 

“With the new Dragos Global Partner Program, we will transfer our knowledge and experience as the industry’s ICS/OT cyber security leader to our channel partners, enabling them to fully manage their customers’ deployments with the industry’s most comprehensive and complete ICS/OT security solution.”

Partners can access the program’s training via a self-service portal that pulls together automated deal registration, marketing materials, and access to self-paced ICS cyber security skills training through Dragos Academy training modules.

There are also market development funds (MDF), including proposal-based MDFs for demand and lead generation, as well as cumulative volume discounts and deal registration with increased margin for identifying opportunities.

Sean Tufts, practice director of ICS and IoT security at Dragos partner Optiv, said the partner program enables both businesses to achieve joint commercial success.

“The comprehensive, unparalleled training we get from Dragos and the highly differentiated product offerings allow us to triage and investigate potential incidents for our customers, enabling quicker response and visibility into the breadth and depth of attacks as well as affected devices,” he said. 

“All this allows us to give our customers the confidence that their operational technology and industrial infrastructure are secure, resilient, and compliant.”

A critical vulnerability in Barracuda Networks’ email security gateway (ESG) devices now means all devices must now be replaced.

The order came directly from the security company this week which said devices should be replaced regardless of whether the zero-day vulnerability was patched.

Barracuda updated its security advisory and also communicated the instruction to customers via the user interface of their ESG devices.

“Barracuda’s remediation recommendation at this time is full replacement of the impacted ESG,” the company said. “Impacted ESG appliances must be immediately replaced regardless of patch version level.”

Barracuda has not offered any further description as to why the devices must be fully replaced, but it may be due to the malware installed after exploiting the vulnerability allowing for persistent backdoor access for attackers.

The firm, which has more than 200,000 customers globally, has been engaging affected clients since news of the vulnerability emerged in late May. 

Barracuda ESG vulnerability - what happened?

Last month, Barracuda said it detected “anomalous traffic” originating from its email security gateway appliances. A subsequent investigation identified a critical vulnerability exploit, tracked as CVE-2023-28681, in the appliance. 

Initially, the company issued a patch to remediate the vulnerability for all ESG appliances globally. A script was deployed to contain the incident and prevent unauthorized access methods, Barracuda said. 

However, last week the company revealed that further analysis of the incident found the vulnerability had been actively exploited for several months before it was discovered and patched. 

Barracuda said the “earliest identified evidence of exploitation of CVE-2023-2868 is currently October 2022”.

The vulnerability enabled threat actors to obtain “unauthorized access to a subset of ESG appliances”, it added. The company said that malware was identified on a subset of appliances, offering would-be attackers persistent backdoor access. 

Two particular malware strains were uncovered by Barracuda during its post-mortem analysis of the incident. 

The first was SALTWATER, a “trojanized module for the Barracuda SMTP daemon that contains backdoor functionality”. 

The second malware strain, known as SEASPY, was also identified. SEASPY also offered attackers backdoor functionality with persistence, while disguising itself as a legitimate Barracuda Networks service. 

No other Barracuda products, including its SaaS email security services, were affected by the vulnerability, Barracuda said. 

ITPro approached Barracuda Networks for comment on the latest update. 

Security researchers at two companies have issued warnings over ‘widespread’ exploitation of Zyxel network devices. 

Researchers at Rapid7 raised the alarm over the ongoing exploitation of a critical authenticated command injection vulnerability, tracked as CVE-2023-28771, that was found to affect multiple Zyxel devices. 

The flaw was present in the default confirmation of vulnerable devices, Rapid7 found, and exploitable via Zyxel’s Wide Area Network (WAN) interface. 

Zyxel researchers explained this is “intended to be exposed to the internet”, and that a VPN would not need to be configured on a targeted device for it to be at risk. 

Successful exploitation of the vulnerability would allow an attacker to remotely execute code on a target system by sending a “specially crafted IKEv2 packet” to UDP port 500 on the device, researchers said. 

Zyxel released an advisory for CVE-2023-28771 on 25 April. The US Cybersecurity and Infrastructure Agency (CISA) has since added the flaw to its known exploited vulnerabilities list and warned organizations to remain vigilant.  

Technical analysis from Rapid7 found that it was being “widely exploited and that compromised Zyxel devices were being leveraged to conduct downstream attacks as part of a Mirai-based botnet”.

“As of May 19, there were at least 42,000 instances of Zyxel devices on the public internet. However, this number only includes devices that expose their web interfaces on the WAN, which is not a default setting,” researchers noted. 

“Since the vulnerability is in the VPN service, which is enabled by default on the WAN, we expect the actual number of exposed and vulnerable devices to be much higher.”

Additional Zyxel vulnerabilities disclosed

Zyxel has also issued a patch for a security vulnerability affecting owners of its Linux-operated NAS326, NAS540, and NAS542 storage devices running the latest firmware.

These Zyxel NAS appliances allow for the storage of user data in a single location, including cloud data, photos, videos, or USB data, according to researchers at Sternum. 

In an advisory, the firm said researchers were “in the process of scanning one of the Zyxel NAS units” and uncovered the flaw when a “Dangerous String Format” alert was triggered.

“In this situation, there was a problem with a ntpdate_date process, which, as the name suggests, is responsible for periodically synchronizing the device’s internal clock via NTP pings,” researchers explained. 

“Knowing that it was passed as a string to ntpdate_date, Sternum researchers investigated further to see if it could be used to manipulate the device.”

Analysis revealed the flaw that could be used by an unauthenticated user to "execute an arbitrary system command with root privileges on the system”. 

This could be used for more malicious purposes, Sternum added, such as remote malware injection. 

Zyxel acknowledged the vulnerability and issued a patch and CVE notice on 30 May. 

A critical vulnerability discovered in Barracuda Networks devices may have been actively exploited for seven months, the company has revealed. 

The security firm said the flaw, which was first discovered in May, affected its Email Security Gateway (ESG) appliance and was patched after an initial investigation. 

This week, however,  analysis of the vulnerability revealed it had been actively exploited for several months before the patch was issued. 

Barracuda Networks said the “earliest identified evidence of exploitation of CVE-2023-2868 is currently October 2022”.

In its advisory, the firm said the vulnerability stemmed from “incomplete input validation” of user-supplied .tar files. 

The flaw meant that a remote attacker could format file names in a deliberate manner to remotely execute a system command through Perl’s gx operator. 

The investigation also revealed that a third party exploited this to gain unauthorized access to a subset of ESG appliances. 

“Barracuda's investigation to date has determined that a third party utilized the technique described above to gain unauthorized access to a subset of ESG appliances,” the firm said in its advisory. 

Malware was identified on this subset of appliances, Barracuda revealed, which would allow for persistent backdoor access. In addition, the company said it uncovered evidence of data exfiltration on impacted appliances.  

Two specific malware strains were highlighted by Barracuda during a post-mortem analysis of the incident. This included SALTWATER, a trojanized module for the Barracuda SMTP daemon that contains backdoor functionality.

SALTWATER enables threat actors to upload or download arbitrary files and execute commands, as well as proxy and tunneling capabilities, Barracuda said. 

Another type of malware, known as SEASPY, was also identified during the probe led by Barracuda and Mandiant. SEASPY contains backdoor functionality that is activated by a ‘magic pocket’, according to researchers.

“SEASPY is an x64 ELF persistence backdoor that poses as a legitimate Barracuda Networks service and establishes itself as a PCAP filter, specifically monitoring traffic on port 25 (SMTP),” the firm said. 

Barracuda engaging with affected customers

Barracuda insisted that no other products were affected by the vulnerability, including its SaaS email security services. 

The company added that customers potentially impacted by the incident have been notified via the ESG user interface, and the company has reached out to specific customers directly. 

Barracuda has around 200,000 customers globally. However, the exact number of those affected by the vulnerability has yet to be determined. 

ITPro approached Barracuda for comment on the matter, but hadn’t received a response at the time of publication. 

Organizations globally have been urged to remain vigilant amid an ongoing hacking campaign that leverages office networking devices to target critical national infrastructure (CNI) assets. 

Research from Microsoft this week revealed that attacks carried out by Volt Typhoon, a Chinese state-sponsored group that commonly focuses on espionage and intelligence gathering, are specifically targeting CNI organizations. 

Microsoft said Volt Typhoon relies “almost exclusively” on living-off-the-land (LOTL) techniques and hands-on-keyboard activity. 

LOTL attacks typically see attackers compromise a victim’s system and use the systems and tools that are already installed to achieve their goals, rather than executing their own code or malware payloads, for example.

“To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign,” said Microsoft, which assisted the Five Eyes investigation. 

“They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence.”

As part of the campaign, Volt Typhoon has been observed blending into normal network activity by routing traffic through compromised small office and home office (SOHO) network equipment. This includes routers, firewalls, and VPN hardware.

Microsoft confirmed that a number of devices, including those manufactured by ASUS, Cisco, D-Link, Netgear, and Zyxel are at risk and urged owners of these devices to ensure interfaces are not exposed to the public internet to mitigate threats. 

“Owners of network edge devices should ensure that management interfaces are not exposed to the public internet in order to reduce their attack surface,” the firm said in a blog post. 

“By proxying through these devices, Volt Typhoon enhances the stealth of their operations and lowers overhead costs for acquiring infrastructure.”

Marc Burnard, senior consultant for information security research at Secureworks, said that targeting network devices is a common tactic employed by threat actors such as Volt Typhoon, which is also tracked as ‘Bronze Silhouette’.

This enables the group to ‘blend in’ to network traffic and operate behind the scenes with impunity, thereby gaining a stronger foothold and compromising additional assets. 

“From our first-hand observations, we determine the group to have a consistent focus on operational security including a minimal intrusion footprint, defense evasion techniques, and use of compromised infrastructure,” he said. 

“Think of a spy going undercover, their goal is to blend in and go unnoticed. This is exactly what Bronze Silhouette does by mimicking usual network activity.”

Burnard added that these tactics highlight the group’s “operational maturity and adherence to a modus operandi” that focuses specifically on reducing the likelihood of detection. 

Five Eyes response to Chinese hacking threat

The campaign by Volt Typhoon has prompted Five Eyes security agencies to issue an urgent warning to critical infrastructure organizations. 

The UK’s National Cyber Security Centre (NCSC) issued a joint statement with the equivalent authorities from the US, Canada, Australia, and New Zealand calling for heightened vigilance amid the ongoing attacks. 

“It is vital that operators of critical national infrastructure take action to prevent attackers hiding on their systems, as described in this joint advisory with our international partners,” said Paul Chichester, director of operations at the NCSC. 

“We strongly encourage UK essential service providers to follow our guidance to help detect this malicious activity and prevent persistent compromise.”

According to Microsoft, the purpose of the campaign by Volt Typhoon appears to have broader geopolitical goals amid rising tensions between the US and China. 

The group has been active since mid-2021, the firm revealed, and has already targeted critical infrastructure organizations in the United States and Guam, a key site for US military activities in the Pacific. 

“Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.”

Identity-based cyber attacks are an increasing weapon of choice the more we work in a world increasingly reliant on identity-based authorization. This means, in essence, stealing or faking our passwords or other login credentials. 

In response, organizations are adding new layers of authentication, which, inevitably, cyber criminals work to find ways through or around. In this cat-and-mouse game, identity-based attacks are on the rise, and organizations must implement several measures to defend themselves from these.

Identity-based cyber attacks are a growing threat

Hacking into computer systems is as old an activity as computer systems themselves. But the attack surface is wider than ever before; there are more systems around, storing more data about individuals and organizations, offering more potential for exploitation. 

“With so much more personal information now online, companies, institutions, infrastructure, and even democracies are being maliciously targeted by actors wishing to exploit it,” Del Heppenstall, partner and head of cyber at KPMG in the UK tells ITPro.

It’s people that are most often the source of a data breach. The 2022 Verizon Data Breach Investigations Report found 82% of data breaches involve the “human element”. That human element can be through sheer malevolence, such as social engineering attacks, of course. But more often than not, it’s a simple incident of human error, such as people falling prey to fake SMS messages, succumbing to a phishing exercise, or reusing common passwords across personal and professional logins. Mistakes are inevitable – after all, we are only human – which is why zero trust strategies are important. 

“Adversaries can easily launch high-volume password spraying where they only need to be right once out of millions of attempts,” former BP CISO, Simon Hodgkinson, says. “Similarly, with high-volume phishing attacks, all it takes is one person to click on the link and provide their credentials. The defenders on the other hand need to be right 100% of the time.”

Guarding against the inevitable

Not only do the attackers really know their business, they’re pushing hard and faster. The Microsoft Digital Defense Report 2022 notes the volume of password attacks has risen to an estimated 921 attacks every second. That’s a 74% increase in just one year.

So what is an organization to do? Hodgkinson tells ITPro: “One must be pragmatic. Cyber risk cannot be eradicated. Organizations can only put in place mitigations aligned to their risk appetite and have robust response plans in place. Every organization should assume that they will be compromised at some point.”

In this context, organizations must put security front and center. For Heppenstall, the security-first approach that most organizations now take can be strengthened by moving to an identity-focused approach. 

He mentions features like least privilege, enhanced monitoring, threat analytics and controls, the establishment of communications guidelines both internally and with external entities and individuals, and continuous validation of end-users including internal, contractors, and third parties. He also suggests “keeping proactive and reactive risk management capabilities around identity and access management, then integrating it with business and security needs will be key to handling threats”.

Taking a nuanced approach to tightening the net

For Kevin Curran, IEEE senior member and professor of cyber security at Ulster University, organizations can fall short if they don’t understand the difference between identity management and authentication. 

It’s crucial to “establish how roles are identified in a system and how they are assigned to individuals”, he tells ITPro. This means “security teams need to pay attention when removing, adding, and updating individuals alongside their roles in a system”. 

“There needs to be a sensible allocation of levels of access to individuals or groups of individuals,” he continues. “Only then can security teams assume that they have established a ‘foundation’ of protecting the sensitive data within the system and securing the organization itself.”

Best practice isn’t only about technology: there are cultural and process factors to take into account too. Hodgkinson gives ITPro a strong example of how cultural shift has helped other industry sectors with different issues.

“The airline and oil and gas industries dramatically improved safety by embracing a culture of ‘speak up’,” he explains. “When there was an accident or a near miss, people were encouraged to share. This led to a culture of continuous improvement in safety. A similar approach is required in cyber – let’s encourage people to report and share their learnings.” 

What would this look like in practice? “If one user clicked on a phishing link, they should share why so others learn from it,” he adds. “This will require organizations to positively support employees who have made a mistake.”

All in all, it would seem that organizations must accept the inevitable and assume attacks will happen. They must also understand that their best mitigation is not solely a matter of best technology practice. It’s also about organizational culture, accepting that people are fallible, and providing a culture of support and learning in that context.

Alerts for new malware strains and active ransomware groups were spread widely across the security industry throughout March and the first half of April.

New strains of malware targeting organizations of all kinds were discovered, harnessing infection vectors that may not already be in their threat models.

It’s highly important that organizations stay on top of emerging threats and patch their systems against the most prevalent types of attacks. 

Patching isn’t always an easy task to do, especially in large organizations, but as a bare minimum, it’s advised that active threats are protected against if a more comprehensive patch operation isn’t feasible.

Knowing what cyber security vulnerabilities and zero days to patch is one thing, but it’s equally important to pay close attention to the ways malware is evolving to bypass security detections so the workforce can be aware of what suspicious activity to look out for.

Here you’ll find a complete list of the most dangerous malware and ransomware threats of April 2023.

OneNote exploited to bypass macro attacks

Ever since Microsoft made the long-awaited decision to disable VBA macros in Office documents by default last year, cyber attackers have been experimenting with inventive ways to deliver malware in a trusted way.

Microsoft OneNote is installed on Windows by default, unlike Word, Excel, and PowerPoint, and can therefore allow all Windows users to open email attachments in the OneNote format regardless of whether they have a Microsoft 365 subscription.

The combination of using a malware-laden OneNote file to seem more legitimate and the weaker detection measures the application provides against embedded malware, now makes OneNote a more reliable threat vector than Office documents.

Zscaler’s ThreatLabz researchers found that a variety of scripts and malware have been observed running after successful phishing attacks led victims to download and open the files.

Remote access trojans (RATs) and information stealers have been installed following successful attacks. 

Researchers also said that MSHTA, WSCRIPT, and CSCRIPT can be executed from within OneNote, using multi-layered obfuscation techniques to evade detection. 

CHM, HTA, JS, WSF, and VBS scripts are also supported via OneNote documents.

Organizations should inform their staff about the dangers of OneNote attachments in emails. If an email seems suspicious, it should be checked by the organization’s security team before downloading any attachments.

Emotet returns again with new tricks

Trend Micro announced in March that the Emotet botnet has returned once again after another of its trademark periods of downtime.

Emotet was observed mimicking replies in existing email chains, increasing the perceived legitimacy of responses rather than it being a cold email from an unrecognized sender.

While OneNote is being exploited to bypass Microsoft’s VBA macro defenses, Emotet instead deploys social engineering tactics to trick victims into manually re-enabling macros, allowing malicious Office documents to execute commands, like downloading DLLs, and install malware.

The new version of Emotet also uses binary padding - crafting large files, such as 500MB Word documents, to bypass security scans.

The prevailing advice is that workers should remain mindful that attempts to re-enable VBA macros will likely lead to malicious activity and should be flagged to the security team as soon as possible.

Cl0p overtakes LockBit in ransomware rankings

Cl0p’s exploitation of the vulnerability in GoAnywhere MFT propelled it to the top of Malwarebytes’ ransomware rankings for April, overtaking LockBit by a small margin.

The group claimed to have breached more than 130 organizations in a month including Proctor and Gamble, Virgin Red, Saks Fith Avenue, and the UK’s Pension Protection Fund (PPF).

Although Cl0p operates its own namesake ransomware program, many of the GoAnywhere-related breaches are thought not to have involved ransomware.

Regardless, it overtook LockBit this month after it dominated in March with 126 attacks. For context, the second-place gang from last month, ALPHV, only registered 32 attacks.

The reliability of LockBit was questioned earlier this month by DarkTracer International, accusing it of running an inefficient website on the dark web.

LockBit responded by attempting another of its ‘pranks’, like it has done in the past with the likes of Mandiant and Thales, but it ultimately backfired when its team, which doe snot speak English natively, confused DarkTracer with Cambridge, UK-based Darktrace. 

This forced Darktrace to publicly deny that it had been attacked by LockBit, and the vent prompted many in the community to mock the ransomware gang’s mistake.

A patch for the GoAnywhere MFT vulnerability has been available since February and should be applied as a priority if it hasn’t been already to prevent further attacks from Cl0p.

Microsoft signals new ransomware gang on the block in Patch Tuesday

In yet another error-strewn Patch Tuesday from Microsoft, it highlighted an actively exploited zero-day vulnerability.

Researchers identified the new ransomware gang, known as Nokoyama, exploiting the vulnerability since February.

Trend Micro’s report on the group linked the operation to the recently taken down Hive group, which claimed attacks on the likes of New York Racing Association, Tata Power, and Altice.

The researchers said the two groups share a number of similarities in their attack chain such as the use of Cobalt Strike and phishing emails, but noted Hive’s double extortion technique hasn’t been used by Nokoyama yet.

FusionCore malware as a service operation

Researchers at CYFIRMA detailed an emerging threat actor believed to be operating from inside Europe earlier this month.

FusionCore has been described as a ‘one-stop shop’ for malware services, with a wide range of tools on offer, plus hacker-for-hire services too.

The malware on offer has been described as “cost-effective, yet customizable”, and its ransomware affiliate scheme provides both a ransomware payload and affiliate software to manage negotiations with victims.

“FusionCore typically provides sellers with a detailed set of instructions for any service or product being sold, enabling individuals with minimal experience to carry out complex attacks,” CYFIRMA said.

A number of indicators of compromise (IOCs) can be found on the researcher’s blog.

Chinese hackers targeting products with no EDR support

Mandiant’s blog in March highlighted a threat actor, which it tracks as UNC3886, targeting products that aren’t supported by endpoint detection and response (EDR) products.

These include firewalls, IoT devices, hypervisors, and VPNs from Fortinet, SonicWall, Pulse Secure, and others.

Dozens of attacks have been investigated by the security firm and have involved the exploitation of zero-day vulnerabilities and the use of custom malware to both steal credentials and maintain a lasting presence in a victim’s IT environment.

Full details of the attack scenarios, their methods, and the products being targeted can be found in Mandiant’s detailed blog.

The takeaway for admins here is that they should be communicating regularly with vendors to ensure any potential threats can be mitigated.

Developers beware of W4SP copycats

Sonatype said that one of the key malware trends for March this year was a continuation of malicious packages being uploaded to the PyPI registry - a destination for developers to download and use software built by the Python community.

It noticed a number of packages mimicking the W4SP stealer - a popular information stealer since the middle of 2022 used to carry out software supply chain attacks.

“These types of packages are a cause for concern as they pose a serious threat to developers who may inadvertently download and install them,” it said.

The packages have since been taken down, but with the ongoing attempts to poison the software supply chain, and the damage such attacks can cause - think 3CX as a recent example, then developers need to be especially vigilant when downloading open-source software, ensuring that it’s safe to use.

To address the ongoing threat of cyber attacks, the European Union (EU) has put in place an updated Network and Information Systems Directive (NIS2). This is a comprehensive legal framework intended to bolster cyber security by imposing obligations on organizations to manage cyber risks, report incidents, and cooperate with authorities to smoothen incident response.

The directive applies to certain critical sectors such as energy, transportation, and health and requires companies to proactively protect their systems from threats like malware and ransomware, as well as report certain types of incidents to relevant authorities.

The twin directives of NIS2 and the Critical Entities Resilience (CER), which replaced the European Critical Infrastructure Directive of 2008, came into force in January 2023. Member states were given until 17 October 2024 to comply, with all of the law’s measures now applying to business operations.

Both aim to improve the cybersecurity of businesses throughout the region, by setting strict standards for network and IT security. While CER is centered on critical entities, NIS2 compels organizations to adopt risk management strategies that encompass the widest possible range of cyberattacks.

In 2022, the UK updated its own NIS regulations as the EU’s updated law does not apply within the region.

Its NIS regulations carry stringent requirements for managed service providers (MSPs), particularly around supply chain security, remote access, incident response planning, and staff training. MSPs must also report any incidents to the National Cyber Security Centre (NCSC).

What are the key provisions in the NIS2 Directive?

The NIS2 Directive is a set of regulations that aims to raise cyber security standards of network and information systems throughout the EU. It requires companies operating in essential sectors, such as energy, transport, banking, financial services, healthcare, drinking water supply, digital infrastructure, public administration, chemicals, food supply and distribution, and space, to bolster network security, incident management, business continuity, and compliance.

NIS2 sets out clear standards for companies in all of these sectors, requiring leaders to conduct plans for cyber risk assessments, draw up plans for incident response strategies, report major cybersecurity incidents within 24 hours, and ensure staff are adequately trained to respond to cyber incidents.

It also draws up plans for the Cooperation Group, which will work with the EU Commission and European Union Agency for Cybersecurity (ENISA) and regional cybersecurity agencies to share information on cyber incidents and best practices. This will be established on 17 January 2025.

There are also requirements for incident reporting, voluntary certification schemes, and supervision and enforcement by national authorities. The directive, finally, includes risk management through regular risk assessments and implementation of appropriate security measures to mitigate identified threats. These measures may include incident management processes, business continuity plans, and compliance with relevant regulations. Companies must also monitor and evaluate the effectiveness of these measures on an ongoing basis.

To which organizations does NIS2 apply?

NIS2 applies to all medium or large-sized important entities and operators of essential services (OES) and digital service providers (DSPs) operating within the EU. These are defined as those organizations with 250 employees or more, an annual turnover of €50 million ($54 million) or more, or alternatively a balance sheet of €43 million ($46 million) or more.

An OES is a company or organization that provides a service essential for maintaining public life or economic and societal activities. Organizations in sectors such as electricity, water, health, transport, and digital infrastructure fall under this definition.

In the previous iteration of NIS, EU member states could individually identify OES according to their own definitions. NIS2’s size-based approach standardizes this approach to prevent inconsistencies across different member states. Governments and entities operating in defense, judiciary, and law enforcement are exempt from NIS2, though the law does apply to central and regional administrations due to growing cyberattacks on the public sector.

NIS2 vs UK NIS: What’s the difference?

Although both NIS2 and UK NIS intend to improve the cybersecurity posture of businesses in their respective regions, they differ in several crucial aspects.

For a start, the regulations set out deviating reporting processes, fines, oversight, and certification.

There are also specific requirements for MSPs in the UK legislation. UK-based CIOs and IT managers must also understand the requirements and implications of both sets of regulations, and ensure overall compliance if they fall under the jurisdiction of both.

NIS2 vs UK NIS: Incident reporting

Both the UK's NIS regulations and NIS2 require OES and DSPs to report certain types of incidents to the relevant authorities.

The EU directive does encourage member states to establish mechanisms for the exchange of information between OES and DSPs, including the exchange of information on specific incidents. This information exchange can be done on a voluntary basis, and it's up to each member state to decide how to implement it.

The UK regulations define a cybersecurity incident as an event that has a significant impact on the continuity of the essential services they provide, the security of the network and information systems they use to provide those services, or the personal data they process.

NIS2 vs UK NIS: Certification

NIS2 allows member states to adopt voluntary certification schemes for OES and DSPs. This means that the certification process is not mandatory, and companies may choose to be certified under the voluntary scheme to demonstrate their credentials.

The UK NIS regulations require OES and DSPs to be certified by a relevant certifying body, while the EU NIS directive allows member states to adopt voluntary certification schemes for OES and DSPs.

Certification requirements under the UK NIS regulations mean that OES and DSPs must be certified by a relevant certifying body to demonstrate that they have taken appropriate steps to manage risks. This certification process is mandatory and ensures that companies operating in these sectors are held to a high standard of cybersecurity.

NIS2 vs UK NIS: Supervision and enforcement

The UK NIS regulations have designated the NCSC as the organization with the power to supervise and enforce compliance, while the EU’s directive grants member states the remit to delegate supervision and enforcement to regulators within each country, depending on their preference.

The level of fines also differs. NIS2 sets out varying fines according to whether an entity is classed as important or essential – noncompliance on the part of the former can be met with a fine of €7 million ($7.59 million) or 1.4% of global annual turnover, while the latter can face fines of €10 million ($10.84 million) or 2% of global annual turnover. Precedence is given to whichever monetary amount is higher.

The UK’s NIs regulation, meanwhile, can impose a fine of up to £17 million, or 4% of global turnover, for non-compliance, while the EU’s version allows member states to impose non-specific administrative fines. The penalties are expected to be much higher in the UK than across the continent.

NIS2 vs UK NIS: Demands for MSPs

There are stricter rules and requirements for MSPs under UK NIS than NIS2, which means UK MSPs will have to comply with stricter security measures.

Examples include implementing strong access controls, such as multi-factor authentication (MFA), to prevent unauthorised access to systems and networks; regularly testing and assessing the effectiveness of security measures to identify vulnerabilities and address them promptly; and maintaining comprehensive records of security incidents, including details of the incident and the steps taken to address it

SMBs that want a network monitoring solution that does all the hard work for them will love AdRem's NetCrunch. We found it can be deployed in as little as 15 minutes, and once we'd added all our device credentials to the discovery wizard, it scanned our lab network and presented its findings in a very informative central console.

The amount of detail gathered by network monitoring software can be overwhelming, but NetCrunch is able to organise this into easily digestible console views. It succeeds admirably, with the Atlas overview page using colour-coded icons for all monitored devices and services so you can see at a glance which ones have problems.

The Top Charts tab presents graphical views of nodes with the most alerts and those with the highest CPU, memory and storage usage. Move to the Nodes page and you can see them all or use one-click filters to change it to show systems that are down, those with critical alerts or those in a warning state.

More tabs are provided for quickly pulling up views of VMware and Hyper-V virtualisation hosts. Once our ESXi 7 host had been discovered, another tab was added to the Atlas page so we could see all its active VMs, their status, the datastores in use and host CPU utilisation.

Smart Pages go further as the Atlas automatically provides a range of views based on the device categories selected in the left pane. These can be anything from a list of workstation and server nodes to networking devices such as switches, and you can create your own custom views.

NetCrunch 13 adds a new Active Alerts console page that provides real-time views of the latest network issues, which can be filtered by severity. We tested this by shutting down one of our Windows servers: within four minutes, a new critical alert took centre stage at the top of this screen.

The Active Alerts analytics page shows graphs of all alerts over the last day, week or month, and you can drill down to selected items for more detailed information. A summary view provides a canned report of all alerts, while the history page allows you to browse the NetCrunch event log over any time period and create custom views using its integral query builder.

Another smart feature is NetCrunch's Monitoring Packs, which group together performance data and alerts for specific devices or services and are automatically assigned during the discovery process. NetCrunch Essentials provides 110 packs, which the Professional version extends to over 270, with the Enterprise edition adding sensors for cloud services such as Amazon Web Services, Microsoft Azure and 365, Google and Zoom.

We tested this by adding the OneDrive sensor, which ran a swift two-step authorisation process for our Microsoft 365 account. We could then see total cloud storage allocated to the account along with free, trash and used space, and load daily, weekly and monthly performance trend graphs.

Along with great monitoring features, NetCrunch looks good value as its flexible pricing schemes are based on a combination of nodes and interfaces. We've shown the yearly cost of NetCrunch Essentials for 100 nodes and interfaces, but if you have lots of network switches to monitor, increasing the interface count to 350 only pushes the yearly price up to $1,330 (£1,065).

AdRem's NetCrunch 13 is a great network monitoring choice for time-poor SMBs as deployment is a breeze and it does most of the legwork for you. Even though it requires a dedicated Windows Server host, value still looks good and its smart consoles ensure support staff are never out of the loop.

For IT managers it never ends. In the morning it’s endless tickets about individual desktop issues, then a database isn’t responding, a server goes down, or for some unknown reason backups are failing. Even the most diligent administrator gets hit with a pile of issues, and as always they tend to cluster around the worst times of day like early morning or quitting time.

That’s why many IT managers look to simplify their systems as much as possible. Not only does it make life easier, but it also increases the chance that you won’t be staying late to fix some obscure server issue. Some things just can’t be pared down, of course, but what if we told you edge networking wasn’t one of those things?

Download now to learn more about how Zero Trust Network Access, a dependable Firewall-as-a-Service, and a Secure Web Gateway wrapped up in a single, secure, networking package can get you home in time for dinner.

Provided by

In this webinar you will:

• Learn how Zero Trust can help your organisations' network security
• Understand how Zero Trust solves challenges of modern security deployment
• Discover just how new (or not) the Zero Trust concept is
• Determine the difference between Zero Trust and legacy business VPNs

Provided by

Between the rise in social-engineering attacks and the Biden Administration’s executive order for mandating zero-trust initiatives across government agency networks, demand for zero trust is at an all-time high.

In this webinar, experts discuss the growing importance of zero trust models to the future of cybersecurity. The panel of speakers follow their discussion with a real time demonstration of Perimeter 81’s zero trust offering.

Watch the full webcast to learn more about zero trust initiatives and see how partnering with Perimeter 81 could accelerate your zero-trust journey.

Provided by

Many businesses today are rethinking their network security solutions since the adoption of remote and hybrid work, and considering the multiple cyber security options now available. For the majority, the best solution would be to introduce new elements - like Zero Trust - that can be implemented alongside legacy infrastructure.

This study shares how converged network security - Security Services Edge (SSE) - could be the solution to achieve this, offering integrated cloud-based abilities without compromising existing environments.

Download now for the full results of this study, discover the main challenges in managing network security, including remote access, and realise the numerous drivers for adopting SSE.

Provided by

IT leaders today are tasked with finding innovative ways to secure their remote workforce, with legacy hardware firewall VPNs no longer able to meet today’s security needs. One solution is enterprise level network security with Zero Trust, that enables network access for users to only what they need to perform their roles.

This guide further explains the benefits of a Zero Trust Network Access (ZTNA) security model and how organisations can significantly reduce the level of exposure to cyber attacks and limit unwanted access to their data.

Download now to see how ZTNA compares to On-premise Firewall VPNs, and how it can offer a safer hybrid work environment.

Provided by

Since the global pandemic, the modern workforce has become largely remote in a bid to continue business operations. With more remote devices now accessing the company network from multiple locations, and the adoption of cloud-based collaborative tools, cyber criminals have revelled in exploiting vulnerabilities following this shift.

With employees today determining how they work - the majority opting for remote/hybrid opportunities - this resource can help organisations ensure the security of their remote employees with ten clear cyber security checks.

Download now to learn how to radically simplify your cyber security and discover the tools that can meet the needs of both your remote workforce, and deliver the robust protection your IT teams require.

Provided by

According to a recent study by Perimeter 81, two thirds of the 500 IT professionals they surveyed had experienced a ransomware attack during the course of their career, highlighting just how encompassing ransomware has become. As malicious actors continue to take advantage of zero-day vulnerabilities, the time has come for businesses to ensure they have the tools to counter attacks.

This eBook focuses on practical data to help organisations understand the full implications of a ransomware attack, from the risks associated with hardware VPNs, to how to protect your remote workforce, and shares how to select the best approach to prevent malware, both now and in the future.

Download now to learn the six principles of Zero Trust Network Access (ZTNA), and discover how this key component of Security Services Edge (SSE) can offer your business complete cloud security.

Provided by

There are multiple benefits when it comes to using a cloud-based network security solution. As there’s no need for hardware, it’s cost effective, faster to deploy, and as it’s built for purpose, it has the ability to evolve as your business grows.

This resource shares the seven security musts of cloud-based network security, including firewall defence and Zero Trust, and explains how to assess your own infrastructure first to establish your security needs.

Download now to discover the right solution for your organisation, and discover the full-featured cloud-based network security solution that ticks all boxes.

Provided by

It’s very easy to assume that as a small business owner, once you opt for a renowned cloud service such as Microsoft 365 for email and collaboration tools, your data and business is secure - this isn’t the case.

This eBook shares the importance of establishing your business security needs - particularly when it comes to data laws and compliance - and why you need to keep on top of your security settings in Microsoft 365 with the ever evolving threat landscape.

Download this checklist - aimed at SMBs and MSPs - as it goes through each security setting for Microsoft 365, explaining why you might need them, what the implications are, and recommended configurations.

Provided by

Many hybrid working environments have been adopted industry-wide since the global pandemic, with employees using collaboration tools when working from home. IT managers are therefore tasked with, not only the security of internal infrastructure, but also those collaboration solutions on the edge.

This study delves into how employees use collaboration channels, as well as how sensitive information and data is shared via these solutions, and discusses the risks and challenges when it comes to using them.

Download now to learn the risk factors when it comes to collaboration solutions, and why back ups are critical to success.

Provided by

HPE has confirmed the acquisition of Israel-based cloud security provider, Axis Security.

The exact terms of the deal are yet to be detailed by HPE, however, the acquisition is expected to close in its second fiscal quarter.

In an announcement yesterday, HPE said the acquisition will enable the firm to expand its edge-to-cloud security capabilities by offering a unified Secure Access Service Edge (SASE) solution.

This, the company revealed, will help meet “increasing demand” for integrated networking and security solutions in a rapidly expanding and increasingly competitive global marketplace.

Axis, based in Tel Aviv, provides a cloud-native SSE platform called Atmos, which delivers “authenticated user access to private applications at the network edge”, a secure web gateway, and a cloud access security broker that provides in-line access to SaaS apps.

HPE said it will integrate Axis Security technology within its existing Aruba secure networking services in a bid to bolster its SASE offering, which delivers WAN and cloud security controls directly to the application network edge as opposed to routing data through a data centre.

This will help customers flexibly deliver provider networking components as a service through one dedicated point of control instead of acquiring, maintaining, and licencing separate components individually.

“Our SSE platform is a natural complement to Aruba’s SD-WAN, network firewall, and dynamic segmentation offerings,” said Dor Knafo, CEO of Axis Security.

“Together, we create a unified SASE platform, designed to extend connectivity to edge, and do so through a combination of modern access services – all working together in harmony.”

In addition, HPE revealed its GreenLake edge-to-cloud platform will also integrate Axis Security’s cloud-native SSE platform.

“As we transition from a post-pandemic world, and a hybrid work environment has become the new normal, a new approach is needed for network edge security to protect critical SaaS applications,” said Phil Mottram, executive vice president and general manager at HPE Aruba Networking.

“The convergence of Aruba and Axis Security solutions will transform edge-to-cloud connectivity with a comprehensive SASE solution that provides enterprises with the highest levels of security for both IoT devices and all users’ access across geographically distributed locations.”

Mottram said the acquisition builds on a recent acquisition of private cellular technology provider Athonet, as the company accelerates plans to expand SASE and private 5G solutions for customers.

Following the acquisition last month, HPE said the combination of its Aruba intelligent edge platform with Athonet will deliver the “most complete private 5G and Wi-Fi portfolio” currently available on the market.

“Combined with the HPE telco and Aruba networking portfolios, Athonet will put HPE at the forefront of a growing market that is predicted by IDC to increase to more than $1.6 trillion by 2026,” the company said.

SolarWinds offers one of the most extensive ranges of network management products and its Network Performance Monitor (NPM) has always taken pride of place. This is no surprise: it offers a wealth of network troubleshooting and monitoring features all easily accessed from the same Orion web console that's used by all its stablemates.

You need to be careful with licensing, though, as it's based on monitored elements, which can be nodes, interfaces and volumes. We've shown the price for an SL250 yearly subscription licence, which allows you to monitor up to 250 of each type, but if any single element goes over this limit, you'll need to upgrade to an SL500 licence, which pushes yearly costs to £4,594.

New features in NPM 2022.4 aren't very exciting. Along with visibility into VeloCloud SD-WAN services, the interface status views have been improved to show their assigned alert thresholds. NPM can monitor and report on Microsoft Azure cloud services, but for Amazon Web Services, you'll need the optional SolarWinds Hybrid Cloud Observability or Server and Application Monitor products.

It took 90 minutes on a Windows Server 2019 host for the routine to download and install all the required components. When evaluating NPM you can use the included SQL Server Express, which has a 10GB database limit, but this isn't supported for production environments so you'll need to source a full version of SQL Server 2016 or later.

Our first network discovery took ten minutes, and NPM reported back with a detailed list of all our lab systems. Discovery tasks can be scheduled to run at regular intervals and will alert you when changes have occurred or new devices are detected.

The Orion web console presents an avalanche of information that can be refined with customised views. New dashboards are produced by adding extra columns, choosing resource views and placing them in the desired order and, if you run out of room, the network operations centre rotates through multiple dashboard views at predefined intervals.

Coloured icons highlight device issues, with the console's Alerts & Activity tab providing a detailed overview where you can drill down into each entry to see what the problem is. The Message Center adds full search facilities and alerts can be linked to actions such as sending SMS messages and emails.

NPM provides only basic availability monitoring of virtualisation hosts so you may need to consider the Virtualization Manager, which offers much more but costs £1,337 for an 8-socket licence. Snapping into the Orion web console, it presented plenty of details about our VMware and Hyper-V hosts, including CPU, memory and datastore use, along with VM resource usage.

Businesses that need to quickly identify the root cause of problems will find the NPM Performance Monitor a boon as it compares data collected from multiple monitors in one dashboard. You can also stay on top of cloud service performance issues with NPM's NetPath, which probes external web locations and provides hop-by-hop maps with latency and packet loss details.

NPM's Quality of Experience (QoE) service is another winner. This uses sensors linked to switch mirror ports to identify, categorise and analyse traffic for over 1,500 apps. The QoE dashboard is ideal for keeping an eye on app usage: it displays transactions, traffic volumes and response times, and separates them into business, social and potentially risky categories.

The quirky licensing needs to be kept under control, but NPM offers a remarkable range of network monitoring and troubleshooting tools. The Orion web console is well-designed and easily customised, ensuring support staff always stay one step ahead of network problems.

Paessler's PRTG network monitor is probably one of the most versatile network monitoring products on the market thanks to its simple sensor-based licensing. Just choose the sensor pack you require and it can be assigned to anything on the network you want PRTG to keep a close eye on. And when we say anything, we mean it. The PRTG network monitor 22.4 on review currently offers 284 different types of sensor covering almost every type of network device, server, workstation, hardware component, service and business application.

Value looks even better, since the price includes sensors for monitoring VMware, Hyper-V, Citrix XenServer and Nutanix virtualisation hosts – features some competing vendors charge extra for. Even better, higher-level functions such as NetFlow, sFlow and jFlow monitoring are included as well.

With a perpetual 1,000-sensor licence costing €2,499, PRTG is good value, but if you don't want to incur the extra cost of a host system, Paessler can run it in the cloud for you. A yearly hosted 1,000-sensor licence costs €2,399 and you can monitor your local networks by installing remote probes in them.

Either way, you'll need to keep a close eye on sensor usage. During its first discovery, PRTG assigns the most appropriate ones to each device and they can get used up very quickly. For example, a 24-port TP-Link gigabit switch was awarded 47, our VMware ESXi 7 host received 31 and a Windows Server 2019 Hyper-V host slurped up 48 more.

Fortunately, the PRTG web console home page provides a complete summary showing the total number of sensors in use. If you have devices no longer on the network or components you don't want to monitor, you can delete them and return unused ones to the sensor pool for use elsewhere.

PRTG's main device view is capable of presenting a huge amount of information that can be neatly organised into hierarchical groupings. You can use these to represent things such as network locations, sets of application servers, cloud services, virtualisation hosts and so on. When devices are moved to other groups they inherit settings such as discovery schedules and login credentials from the parent group, or they can have their own settings.

Network pain points are easy to spot as each sensor is assigned a colour showing if they are up, down, paused or in a warning state. Plus, PRTG provides plenty of alerting methods including email, SMS, Syslog, Slack and Microsoft Teams. Clicking on any device pulls up a complete overview and activity graphs of all its associated sensors.

You can drill down deeper into selected sensors and see activity summaries, live views and details of what's occurred over the past 48 hours, week, month or year. It's easy to spot the busiest devices from the Top 10 sensor page and you can use PRTG's libraries to load groups of sensor data for comparison.

Paessler provides pre-configured libraries for views such as CPU, memory and network interfaces, and you can easily create custom libraries for more specific activities. PRTG can be remotely monitored from a web browser or you can use Paessler's slick Windows and macOS desktop apps, which provide the same features and just as much information. Mobile support is simply the best as the free Android and iOS apps can remotely access the PRTG server, display all sensor data and receive alerts.

PRTG Network Monitor is a great choice for SMBs and the ability to assign sensors to any device you want makes it extremely versatile. It provides lots of informative consoles and everything is included in the price so you don't need to concern yourself with optional modules.

Paessler PRTG Network Monitor 22.4 requirements: Core Server and Probe: Windows 10 Server 2012 R2 upwards

Metaverse technology: although it still hasn’t found its feet, it’s the headline-grabbing area of development that has seen massive investment in just the past few years. Meta has spent over $15 billion on the tech through its Reality Labs division, and Microsoft, Apple, Nvidia, and more have all begun development using variations on metaverse tech.

But like any new technology, metaverse tech will also usher in new security risks, from innovative threat actors and existing vulnerabilities inherited by building this new frontier on legacy architecture.

This week, we spoke to Rick McElroy, Principal Cyber Security Strategist at VMware, about the opportunities and challenges metaverse tech, and what we can do while it’s still in its infancy.

Highlights

“The cool part of all of it is, we actually get to design it. Right? Like, we're humans, we're now working on some in the future. And so we do get to look at the past, have those design considerations? And then really move forward with like, how can we start to fundamentally get rid of some of these things from the beginning, because we know that they're going to happen, right? And so I hope the opportunity is exciting for folks that are working on those projects.”

“I can tell you, I've talked to no CISOs over the last 18 months where it's at the top of their project list. Generally speaking, ransomware is still at the top of that list. Again, the security fundamentals of being able to patch as quickly as possible, and then of course, recover from some types of these attacks.”

“We're not writing a new internet protocol for the metaverse, it's going to be IPv6 and IPv4. Generally speaking, it'll be IPv6, because it's a lot of new companies that are adopting it. Manipulation of that TCP/IP stack is still real, those threats exist all the time, adversaries take advantage.”

Read the full transcript here.

Footnotes

• What is Web3 and will it revolutionise the internet again?
• Microsoft signs $22bn deal to supply US Army with HoloLens devices
• Apple's mixed reality headset could debut in 2022
• Why AR, not VR, is the next big thing in business
• Meta's earnings are 'cause for concern' and 2023 looks even bleaker
• The future of virtual assistants might lie in the metaverse
• Did the Pentagon really ban Furbys?
• What is metaverse security?
• How to protect your endpoints
• If not passwords then what?
• What is TCP/IP?
• Whatever happened to IPv6?
• What is zero trust?
• What is GDPR? Everything you need to know, from requirements to fines
• What is the California Consumer Privacy Act (CCPA)?
• Understanding PCI compliance: The role of the channel
• What is Wi-Fi 7?
• US unveils next-gen encryption tools to withstand quantum computing attacks
• Seven steps to keeping metaverse meetings safe and secure
• Meta deepens metaverse partnership with Microsoft and Accenture, still lacks compelling business case
• Immersive tech can be more than just a gimmick
• Siemens and Nvidia partner on industrial metaverse concept
• Into the metaverse: Everything we learned from our virtual tour
• The metaverse is a waste of time, effort and processing power

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘How secure is metaverse tech?’ We apologise for any errors.

Rory Bathgate

Hi, I’m Rory Bathgate. And you’re listening to the IT Pro Podcast, where this week we’re considering the risks and rewards of metaverse technology. In just the past few years alone, metaverse technology has seen massive growth and investment. Facebook retooled itself as Meta last year, and the company has subsequently spent over $15 billion on the tech through its Reality Labs division. Meanwhile, other big names in tech such as Microsoft and Nvidia have announced forays into metaverse tech themselves, and McKinsey says that in all, over $120bn was spent on metaverse tech in the first five months of 2022. But like with all innovations in the tech industry, metaverse tech carries the potential to bring many vulnerabilities along with its proposed benefits, with existing vulnerabilities carried across to this new frontier along with the potential for novel threats that make use of metaverse technology also becoming an issue. This week, we’re speaking to Rick McElroy, Principal Cyber Security Strategist at VMware, about the challenges posed by metaverse tech, and what can be done to address these while it’s still in its infancy. Rick, thanks so much for being on the show.

Rick McElroy

Hey, thanks for having me.

Rory

So just to start off with, what do you see as the main business use cases for Metaverse technology?

Rick

Oh, that's interesting. I personally, think about the cost savings of sending humans like myself all over the globe, to whether that's facilitation of a meeting, audit, controls some sort of incident response engagement, there is a huge cost to transporting humans all over the globe to do their job, right. There's a huge cost to educate those humans. You just got back from VMware Explorer. And I think certainly organisations have explored something like virtualized conferences during the pandemic. And then I would say, as that starts to mature, as it starts to become more real, I do expect organisations to, to achieve some cost savings by being able to bring together people remotely in these types of areas. I certainly think I'm in the education space. This is a huge area where you can have virtualized universities where there's better connection than we do from an online university perspective. And so I do think, you know, some of those verticals are exploring those areas today.

Rory

Fantastic. So you mainly see it as one of many tools to bring into the workplace, not necessarily radically changing how offices work in any way, potentially, but maybe for specific use cases, such as in education and in conferencing?

Rick

I think potentially, in the end. But if you look at what happened over the pandemic, so the realism of having to send employees home caused a lot of organisations to have to change technologies change process, do all of these things. Well, we're back on the other side. And some companies have decided to start to bring people back to offices. And so it is a long tail, especially inside of organisations to adopt technology. When you look at certain verticals, certainly the federal vertical, the state and local verticals and municipalities and governments, they're just a little slower to bring that tech in, right? And so I know, meta, and all the good folks are instantly gonna see some consumer adoption. But I think in organisations, there'll be a vetting period.

Rory

That's interesting that there might be a public private, delayed adoption. I mean, of course, that's something that we see across the tech sector. But it's interesting that you mentioned that. So assuming that metaverse technology does really take off in a big way, and certainly a lot of really large tech firms like Microsoft, Apple, of course, Meta. They all seem to think it will. What are some of the immediate cyber security concerns that it will raise?

Rick

Well, I think the first one for me is we're building a bunch of new tech on top of old technology. So if you look at the back end of what's being built, it's still sitting on top of Linux servers with containers, which we fundamentally know are insecure based on lots of threat analysis, and lots of consulting with companies. And then of course, watching what the attackers are doing, right? So my first concern is, with any new technology, not building that with the misuse cases in mind, as a rush to market generally becomes, I think, concerning from a security and risk perspective. And so, I think having some thoughtfulness as we start to deliver some of this new technology specific areas that I think about: we haven't quite nailed identity yet, and misuse of identity. So those are key areas that I think if we dragged relying on passwords into the metaverse, that's probably a path that we know. It's a recipe towards breaches and towards some of that disastrous results. But I think if we're thoughtful about things like identities, if we're thoughtful about controls that we put in place to help identify folks, so that they can't run scams or report some of the misinformation that we see from other platforms, those types of things, great. But I think we're moving a little faster than then I think the security and privacy community's comfortable with.

Rory

Yeah, I mean, you know, you're a cybersecurity expert yourself. I think there are a lot of cybersecurity experts right now who are shaking their heads going. No, we've, you know, we want to move away from the whole password headache and towards something more more secure something, you know, this is a software error. This is a technology in its infancy, maybe we can design something from the ground up, you know, is properly secured by design. On that note, there's been talk I know around continuous digital authentication, and the role that that can play in the metaverse or in metaverse tech, I should say. So, could you talk a bit about that? For those who don't know, could you lay out what it is in brief and how it could help in this role?

Rick

Yeah, absolutely. The idea of a continual, you know, authentication strategy. Most people are familiar with a one time authentication, I go to a website, I need a service, it has a login, I use a username and password, good to go, right? Continual auth moves towards using factors to continually authenticate the device, the identity of the human that's on the device. And then of course, other factors, one of which will probably be biometrics as we start to look towards that future with Meta. But I think the intrinsic risk is really, you know, this idea of to actually get to a place where you can use continual auth on an identification, it butts up against privacy. Right, so for nations that are concerning, and certainly citizens that are concerned about privacy, as we start to gather this data, it clearly butts up against the line of privacy. And I think for some of the organisations that are involved in the build out of the metaverse, or whatever we wind up adopting as that nomenclature in the future, hey've shown that they haven't been good shepherds of privacy today. And so I think them having some transparency and addressing their current issues would help alleviate some of the concerns in the future.

Rory

That's interesting. And on that point of the nomenclature, I think, certainly right now there is a tendency to talk about the metaverse, which is often I guess, just by name association, and by the amount of money that they've poured into it already associated with Reality Labs, other researchers at Meta, and with Meta itself. Do you think that we need to be having conversations right now around maybe broadening the term out and not letting it fall into the hands of a very choice few players and maybe broadening the technology out in its infancy?

Rick

Well, I mean, I certainly think it's brilliant. I will credit that. I mean, it's pretty brilliant, what they did. Um, that being said look Apple is, you know, currently developing their technology and platforms. So I have a feeling their ecosystem is going to do what Apple's ecosystem does right. And so I do see them as a major player in this market moving forward, but that's all going to look different. Look, I think Apple has taken a different stand on privacy and security than some of the other vendors, I appreciate what they've done. They've certainly helped to secure these devices, I think they've enabled a world, or are starting to enable the world where we're not just ad tracks, and all of this private data is floating around for those purposes. And so I think, having a vision towards that, as we start to deliver that it's going to benefit all of the consumers of that technology, right? And so I do think we have to broaden this out, because they think if we continually say "one organisation is going to own the future of a virtual reality world," that's probably going to be incorrect. There'll be a number of technology players, Nvidia is doing some really cool things with this digital clone of Earth and being able to, you know, look at storm patterns, and all of this really cool stuff. We know, the military is embracing AR and VR for training purposes, to drive down the cost of, you know, sending munitions down range, and again, being able to do that stuff. And so I do, but I think fundamentally, we have to ask ourselves the question, what do we want in this future? And I think everybody needs a voice at that table. Certainly security should be at the table, but there needs to be other consumer voices there as well, to advocate for things like what happens when we have cyber stalking and bullying, how are we going to do this? What are we going to do when you have completely made up personas in a in a virtualized reality? That look like me that talk like me, how am I as a consumer going to be able to vet Rory on the other end of this call in a virtualized world, to know that that's actually who it is that I'm talking to, and then take action based on that. And you can imagine, in a corporation where a CEO can tell a CFO to wire transfer hundreds of thousands of dollars outside of a company, that's going to become a problem. We were already seeing that in the current version of the digital world that we have. And we will certainly see massive amounts of scam and fraud inside of you know, the metaverse virtual reality, whatever we call that,

Rory

Right I mean, I know that there are already, you do see reports around deep fakes being used for job interviews. And some of that might be at the moment, again, still in its early stages. But certainly, I can see the potential for identity fraud and phishing to kind of take on a whole new, a whole new identity in this new realm. I guess on that note, what do you what do you think, like a metaverse threat actor will look like?

Rick

It's very interesting. So what I think about is how cybercriminals always look at technology, right? And so again, because I got to wear this adversarial hat for a long time, and still do, and we think about the misuse cases, right? So it's pretty typical developer wants to get the thing working. How do we do this at scale? How do we make sure we're not burning people's eyeballs out or engaging the brain? These are all considerations as we're strapping things to our faces, right? From our perspective, we look at misuse cases. So how can I start to deny service to that thing, so that I can make the consumer or the organisation pay me some sort of extortion? Right? How can I start to — and you've seen some of this in attempts of virtualized worlds. How can I do something like digital mods that fill up a space that's supposed to be a safe space that's created for something right, so I'm interfering, you know, on those fronts, and then, of course, I'm how can I get to the money, right? So if the answer is, well, it's easier for me to go into the metaverse and scam a nother human than it is for me to create a bunch of malware that I then have to test, send out, figure out who QAs it, get somebody to click on a link, like I know we purport that it's fairly easy to trick humans. But that being said, we've got a bunch of technology to do that. That won't exist in the metaverse, right. So you can expect a number of security companies to start to address the risks as well. And then certainly, as companies start to adopt it, I mean, I think back to something simplistic, like when, when Furbies came out, right? And then the DoD banned them from the Pentagon because they recorded conversations, or Google Glass was banned from Google campuses when it came out because it recorded right. And so how does the other person know that the conversations report being recorded? Did they consent? All of those things, those are all considerations from a legal perspective and a risk perspective, we're gonna have to build into this new world. And I think, look, the cool part of all of it is, we actually get to design it. Right? Like, we're humans, we're now working on some in the future. And so we do get to look at the past, have those design considerations? And then really move forward with like, how can we start to fundamentally get rid of some of these things from the beginning, because we know that they're going to happen, right? And so I hope the opportunity is exciting for folks that are working on those projects.

Rory

I had never heard about that Furby ban. That's, that's incredible. It does raise kind of an interesting point, though, which is that certain dichotomies that currently exist in the sector are going to, I guess, necessarily have to be carried over into metal as tech, such as public and private sector. If you're talking about educational bodies, but also government entities, perhaps even like you're saying the Department of Defence wanting to use metaverse tech versus versus private companies, are the necessary discussions around that happening right now? Or do you think there's there's too much focus on the maybe the private sector applications, the business applications of this tech right now?

Rick

I think governments across the globe are struggling with the tech that they have, and so they're hesitant to start to adopt it. Certainly, you know, folks like DARPA, and some of the research agencies have, that's what they do. But I think more broadly, as you look at governments, they're really struggling with patching. They're, they're struggling with endpoint detection and response and being able to report that they've had a breach. Right? So you see, new executive orders new legislation across the globe, to try to get them to a place where it's reasonable security to build on top of, and so I do expect for the next few years, they have some fundamental projects and some heavy lifts that they're going through. Great, we encourage it, we're helping them as much as possible along with, I think, a lot of other vendors, but then they'll start to build upon that right. And so getting something like continual authentication over the technology they have, they they they're going to have to figure that process out, they're gonna have to figure the tech out, and then they can build on it, right? And so my expectation in the future is the work they're doing now, from a security fundamentals perspective, will benefit them in the future.

Rory

That's fantastic. So you mentioned you made a reference there to some of the work that VMware has been doing in this space. And in, in general, across the across the industry. Seeing, or given that this is something that is likely to create massive waves in the tech sector, however, it turns out, what is VMware specifically currently doing in anticipation of this sort of big shift?

Rick

Well, look, I mean, I think we have to work on this idea that things are born secure. So so you'll hear us say this a lot. You'll hear us talk about this a lot. What does that mean? It means that the design considerations for security and misused or thought about upfront, and then technology enables developers to be able to deliver that in a way that covers the full lifecycle. Now look, that's a whole mouthful, all of the security professionals that are listening in the IT professionals will understand parts and pieces of that, maybe that is a big piece is your secure software design lifecycle. A big piece is going to be the ability to contextualise all of the data and telemetry to be able to do you know, behavioural analysis to find the bad guys. That being said, what we're really working on, is this idea that applications and infrastructure are born secure, maintained throughout the entire lifecycle of that workload, that application, that server in a secure fashion, and then eventually turned off securely, right? So whether that's an encryption of data and deletion, whether that's ensuring that your data is backed up to an air gapped environment, that then is restored clean, all of those things is really, I think, what VMware is working on, because we understand, we're the fundamental virtualization technology that lives underneath all of this, right? And so, when we look at it, it's a stack, we have to provide, I think, strong prevention and detection controls there that other people can rely on build the top up, and that's what we're focused on.

Rory

And in your discussions with customers, is this coming up more and more as a concern, or maybe something that they're excited about that you're having to then discuss with them about the actual reality of it?

Rick

I'm very lucky, I live on the West Coast of America, and I work with West Coast companies. So we have a tendency to move a little faster than I think a whole lot of other places. So yes, I would say Northern California is already in some cases adopting, you see a lot of companies that are being built around it right to do those things. That being said, the rest of the globe, intentionally is a little slower, right? I mean, after all, these are the pioneers that are proving the tech and all of that stuff, right. So I get to see a little preview, I get to see some of the folks that are working on it. And then I think I have a pretty strong idea, as I talk to people about it. I can tell you, I've talked to no CISOs over the last 18 months where it's at the top of their project list. Generally speaking, ransomware is still at the top of that list. Again, the security fundamentals of being able to patch as quickly as possible, and then of course, recover from some types of these attacks. And then what they're really concerned about is the fewest number of tools to do the security job. So they're retooling. They're rebuilding their processes in an automated fashion, to again, with this eye towards being able to deliver quickly these other solutions coming down the road. And so fundamentally, we're fixing a bunch of stuff and architectures, to allow for the future and rapid delivery of these solutions.

Rory

That raises an interesting question about kind of, fixing the environment we have now before moving into this new space. Do you think that, whereas people are currently kind of talking around the metaverse technology as this, this whole new realm to exist in but in its current form, it's going to have to be entrenched in a lot of the systems that we already have. Do you think that there's a potential for some of the worst problems that we're currently experiencing to currently be carried over into into Metaverse technology?

Rick

Yes. And I'll give you one brief example. We're not writing a new internet protocol for the metaverse, it's going to be IPv6 and IPv4. Generally speaking, it'll be IPv6, because it's a lot of new companies that are adopting it. Manipulation of that TCP/IP stack is still real, those threats exist all the time, adversaries take advantage. And so again, we're using insecure protocols today that a bunch of technology had to be built on top of, to allow for things like transport layer security, session layer security, cryptography, the data at rest, all of those things, right. And so here's the good news. The good news is, we've proven a bunch of this technology over the last 25 years. I would certainly hope that again, as organisations are implementing this technology and organisations are building this technology, that we take those lessons and build them in. And crypto, in my humble opinion, it's a must like, like the fact that we are even telling consumers to consider using a VPN, like, no, your application should have good strong encryption built into it. And the consumer should not have to be concerned about the transport layer security. Now it's great that they are, I encourage everybody today to be, but that's just one small example of how the underlying, you know, internet protocols if at all are, you know, easily subverted and built on top of. And then of course, you know, Linux operating systems are still going to be in play, right? You know, things like software defined radio attacks for the chips in the motherboards, the firmware that sits underneath of all of that those are all part of the supply chain of the metaverse, and will need good security controls.

Rory

Is there a risk that we're moving too quick with Metaverse tech right now, and we risk sort of building it on top of all of these systems and reaching a point maybe in five to ten years where it's too late, we can't pull those systems out from underneath metaverse tech?

Rick

It's a good question. I think I have a futurist hat that I wear, and a technology hat. And I do love the future of technology. But then I have a very realist, a little bit pessimistic brain as well, which keeps me in security. So I think the pure security professionals, and if you asked any hacker, we would say yes, we're entirely moving too fast. But I think we would have said that of almost any technology. So that being said, I think there is a speed market and a balance here. Look, you've got to create a market, you got to sell into a market so that you can prove a market, go secure the market, right? And so those pieces don't exist in vacuums. And so I do think we have to move fast in certain areas. Certainly, I think I have some caution about just moving super fast when it comes to like, video game markets and stuff. Which is, fine and probably going to be where we see the largest spread of the technology first. So no, look, security is never going to get our way because if we did, it would take another 10-15 years of development. So we have to be realistic as well and say, look, I think there are amazing use cases in the future, you know, this idea that I can perform surgeries or consult for, you know, in a third world country where maybe they don't have access to surgeons. This is amazing, you know that what we're talking about here, I think, being able to bring humans together in a way, that's not a zoom box. I know the last two and a half years zoom boxes have been killing me, right? So at some point, I do think like it's going to be fun, it'll be really cool,some of the stuff we see from an AR perspective or, you know, walking into office buildings, those types. But yes, the the adversaries are going to take advantage. And they're going to look for us to make some mistakes along this development path. And they'll take advantage of it.

Rory

So with that in mind, is this something that security teams and individual companies, on a customer by customer basis, should be worrying about yet, in anticipation of implementing this? Or is this more of a, like you were saying, a kind of secure by design concern for those architects that are leading the way in the sector.

Rick

I think if you're bleeding edge companies, certainly you're going to look to move as fast as possible, especially if you're diversifying your business portfolio as well, where you have an existing, you know, social or web company that I think could benefit from that adoption, you're gonna move a little faster. So it is probably a design consideration over the next three years for those types of organisations. Generally speaking, again, the design consideration the architecture, discussions that we're having, fundamentally revolve around things like continual authentication, zero trust, enabling, you know, again, born secure applications, where we understand vulnerabilities that exist, and then we're able to rapidly do those. Because we ran really fast to get to this point. And so there's a little bit of reworking we have to do in architectures, and most of it has to do with cloud, right? So if you think about how we used to do security versus how we're doing it now a lot of people are reworking it. Metaverse will be a consideration as part of this strategy, only because we know the metaverse will be powered by the cloud. And generally speaking, if you're accounting for some of the cloud security components, you'll be accounting for things that you need in the metaverse as well.

Rory

So with those security concerns to one side for a second. On a regulatory basis, how is the metaverse — this is a very broad question — but how is the metaverse going to be regulated?

Rick

This is a great question. I generally think regulation will follow all other regulations for tech, which means it'll be late to the table. Now, I don't say that to knock legislators or regulators. Generally, it's just the way that it goes, they have to figure it out. You know, clear considerations we're going to have to think about upfront: what do we do on education especially for, you know, children? Right? And who, you know, how is that going to work? And I have a whole lot of questions, right, I got a lot of nieces and nephews, that'll probably wind up strapping a headset on at some point. But as you can imagine, if you're a parent, you have major concerns over how that works in a non-physical way today. Now, I would also say, from a safety perspective, at least in America, there's probably some benefit to moving towards these models as well, right. So I think it'll be per-vertical. I think some of the, again, some of the some of the industries will move a little bit faster than the other ones. And then what we'll see is iterations through regulations over time, right. So we know GDPR didn't get it exactly right the first time and there's the you know, we know the California Privacy Act had to change. So we'll put something out there, it'll iterate, but it probably won't be fast enough to satisfy anybody's needs. Because generally speaking again, when it comes to things like cybercrime and theft, we have to observe the behaviour, laws across the globe have to be created, they have to be voted on democracies, take a little take a little while to get that done right. And then we see some benefit from it. So I do think, particular to regulations in the industry that are helpful, something like PCI DSS, I think, is has been more meaningful for credit card encryptions and to disrupt credit card theft. So adoptions of models like that, instead of adopting, you know, models that add a bunch of overhead for no particular reason than to add the overhead right. I think there's an effective way to do that.

Rory

It's interesting, you mentioned GDPR. But considering these issues across different continents across different countries, do you think also that this focus currently on the metaverse as if it's going to be one unified entity as opposed to a series of different metaverses used by different organisations, different entities will run into issues like data sovereignty as well, that maybe could stymie this unified vision that people are currently talking about?

Rick

I think the metaverse will follow the real world Internet, and we thought that the internet was gonna wind up 'The Internet'. It's not actually true. There's a lot of different internets, and a lot of different rules, especially depending on how you're governed, right? So no, I don't expect that say the CCP's version of the metaverse is going to be the exact same as the UK's, or the exact same as the US's. Certainly I think, the local citizen, and the consumers are going to have a big say, because they're voting with dollars, right? But I think each government has had to, again, based on risk, based on breaches, based on privacy, has had to sort of draw that line. And so what we've ended up with is a lot of different internets, and a lot of different piles of data around. I think the metaverse is is certainly going to find that, and I can't imagine that authoritarian governments across the globe are going to want to facilitate open access to information and not having a big say in how that's developed.

Rory

On that point of having a say, do you think that some sort of framework that companies could agree to that that governments could agree to around metaverse tech is necessary? Or or will it just naturally fall into, like you're saying, a geographic perspective?

Rick

No, I think generally technology happens to follow that right? So whether it's IEEE standards, ISO standards that you know, NIST standards, will certainly account for it as well. And so I would assume NIST is probably already looking at some guidance around metaverse. I'm probably not in the room for like the draft discussion, but at some point, it'll come out for a draft form. We as security professionals, with the way on it will iterate through the changes make some recommendations. But yeah, I would expect there'll be specific, you know, standards for metaverse for things like communications, interoperability, all of those things. And if, if you're going to win in that space, you're going to have to be open. Like, I think it's gonna be really hard to go down the path of a closed technology unless you're someone like Apple who already has a massive consumer base

Rory

To kind of round off the discussion: to turn one of the earliest questions I asked on its head, we've talked about a lot of the security drawbacks of metaverse tech. But given that we have an opportunity to, as you say, kind of author our own future with this technology, what are some of the real benefits or potential benefits that to security specifically, that that could be be achieved through metaverse technology?

Rick

Well, I'll tell you one that I think about all the time. And you hear this from security professionals: I have a team of people that help me, that team might be called the manage detection and response team, it could be called managed security provider, you know, we have all kinds of names for our third parties. But one of the hardest things to achieve is the context of what's happening in the environment, right, the familiarity of each one of these humans, or these groups of humans working together to drive a singular outcome. So, when it comes to upfront consulting, when it comes to architecture design, when it comes to incident response, when it comes to facilitating incident response across the globe, being able to do briefings, man, again, I think have disparate teams sit in a room like we're with each other on a virtualized whiteboard. It's one of the hardest things that I have a problem with today, with the technology that we have in place for remote work. And yes, I know there's tonnes of companies. Yes, we've used all the tech, it is not the same as sitting down real time with six people, when someone has their hands on a whiteboard, eraser. And we're just iterating through stuff, it's just not right. So I think I'm hopeful from that perspective. And then I certainly think from, you know, from my own home life, look, again, I have to get on planes all the time, my friends all have to get on planes, we are trading off that work life balance. And I think, for us, and our experience of burnout and fatigue, and the hours, I do think particular to cybersecurity, there will be an impact to that. And then I hope, if we actually do our jobs right, with continual identity authentication, maybe we can get to a place where we start to eliminate some of this fraud, and the scams, that one human purports to another human, because all they're doing is lying and tricking the other human. So maybe we can think about those use cases in the metaverse and drive some of them down, right? And I don't know how we do that yet. Some people would say we're gonna adopt MRI technology, other people you know, it gets a little dystopian, too, right. That being said, we do have a chance to design it, we do have a chance to consider it. And so what I'm looking for, for these organisations that are building this technology, and the developers, and the architects is like proof, prove that is trustworthy. Give me the transparency that we need to adopt it. Because I think we want to, we love the future, we love it. But it's just a little risky, and so you got to give us what we need to lead the organisations to this change.

Rory

Well it certainly sounds like if we play our cards, right, there's, there's lots to look forward to.

Rick

Absolutely, I think it's, it's just, it's really cool, right? I mean, we're at a point where we can, we can play with our own reality in a way that's safe, we can move significant chunks of pieces, like, you know, this idea that Nvidia did with this digital Earth. And being able to use actual weather models, and what happens if we, you know, move that, like putting all those pieces together that has a huge value to humanity. And that's the exciting future that I want to make sure, you know, we safeguard and shepherd this technology through.

Rory

Fantastic. Well, Rick, thank you so much for being on the show.

Rick

Thanks for having me.

Rory

As always, You can find links to all of the topics we've spoken about today in the show notes and even more on our website at itpro.co.uk. You can also follow us on social media, as well as subscribe to our daily newsletter. Don't forget to subscribe to the IT Pro Podcast wherever you find podcasts. And if you're enjoying the show, leave us a rating and a review. We'll be back next week with more insight from the world of IT but until then, goodbye.

VMware has revealed an addition to its network detection and visibility solutions in the form of Carbon Black XDR, seeking to address the very significant threat posed by lateral attacks and empower companies to combat threat actors that have already breached their networks.

Whereas endpoint detection and response (EDR) reacts to endpoint data, extended detection and response attempts to provide environment-wide, comprehensive visibility on threats. In this way, VMware Carbon Black XDR adds to and extends the capabilities of VMware Carbon Black Enterprise, the threat hunting and response solution already available for VMware customers.

VMware identifies this as crucial in drawing attention to the danger of threat actors performing lateral attacks once gaining access to a system, with historical focus having been placed almost exclusively on endpoint tools to prevent malicious access altogether.

The service leverages data within VMware Contexa, the firm’s threat intelligence solution that provides observability across VMware’s network, as well as endpoint and user technologies. The company claims it processes over 1.5 trillion endpoint events daily, using machine learning (ML) to contextualise this information in parallel with the input of more than 500 VMware Threat Analysis Unit partners and researchers. VMware Carbon Black XDR can then use this data to prompt action by security teams, and inform policy changes.

In August, VMware research suggested cyber attacks were on the rise following Russia's invasion of Ukraine, with 25% of attacks seeing lateral movement by attackers once systems had been compromised.

"Lateral security is the new battleground," said Tom Gillis, SVP and general manager, networking and advanced security business group at VMware.

“By bringing VMware Carbon Black XDR to market, we’re improving threat detection and prevention across endpoints and networks to address the need from our customers to limit the lateral movement of attackers inside their environment.

"Our XDR solution is not replacing SIEM, rather it’s helping to paint a broader picture of the threat landscape for customers. We are correlating high-fidelity, process-level data from the endpoint with packet-level data on the network to create super high-fidelity and actionable alerts that can also be fed into a larger SIEM. That data is pulled from VMware Contexa, our threat intelligence cloud that combines the telemetry of Carbon Black and NSX."

VMware has been quick to note the uptake in demand for XDR solutions within the current threat environment, citing a Forrester study it commissioned which indicated that although 75% of responding organisations have not implemented XDR, 27% are planning to in the next 12 months. Data from the same study suggested that ROI increased following early adoption of the technology, bringing the boons of automation and adding another feather to the cap of existing security stacks.

Carbon Black was acquired by VMware in 2019, in the interest of boosting security oversight across VMware’s cloud offerings. Since then, its offerings have been expanded and are now part of VMware’s array of network and endpoint security options. These include Contexa and the upcoming Project Northstar, a SaaS-based tool for network security for applying multi-cloud security policies through a central cloud console, which is currently in tech preview.

Joe Baguely, VP & CTO EMEA at VMware, spoke to IT Pro about how VMware Carbon Black XDR expands upon past efforts by VMware:

"We've actually been talking about these threats for over 10 years. When we first acquired Nicira, which became NSX, we talked about east to west security and what we're talking about now with natural security is pretty much the same thing. But what we're doing in that space is when we talk about it back in the past, we were literally introducing the concept of having micro firewalls per workload. But it was pretty basic, pretty manual.

"What we're doing with Carbon Black and the XDR technologies and EDR, is we're making that much more intelligent. We're bringing artificial intelligence (AI) and ML to that. And we're bringing all the intelligence we've got around threat analysis to what's going on in the data centre, to make it much more responsive."

VMware’s NSX security solutions aim to provide consistent, zero trust, multi-cloud security policies alongside granular protection such as network segmentation. The firm also states that NSX is uniquely able to combat lateral attacks, as it sits alongside a hypervisor to protect individual virtual machines within a VMware vSphere environment, and alongside Kubernetes to protect native clouds.

VMware Carbon Black XDR is available for certain customers in early access, with the security specialist team handling sign up requests.

Carbon Black in action

"Carbon black is an absolute godsend for us," said Ed Higgs, group director of IT Shared Services at Rentokil Initial, speaking to IT Pro.

"We're very acquisitive. We acquire just over one company a week and we've just done one for $6.1 billion - we just acquired Terminix in the US. It’s massive for us, and obviously all those acquisitions bring relative complexities, but whenever we've got an acquisition, the first thing they do is install Carbon Black, because that gives us visibility from day one."

Referring to the threat posed by lateral security, Higgs praised Carbon Black for the security insight it provides:

"We've been pretty good over years in managing the perimeter," added Higgs. "We pay companies, like everyone else, to hack us and see where they get and, of course, they're still finding things. When they first started doing it, there were massive gaping holes, and over the years we’ve matured and matured.

"Carbon Black and NSX have significantly reduced [a threat actor's] capability to do anything - because as soon as anyone elevates a role, on any of our systems, we immediately get a notification and they can go on and delete the account, segregate the environment, whatever they need to do. The last time we paid someone to hack into our systems, we had to tell the [Carbon Black team] to ignore the test, because we don't want them to stop the testers straight away, otherwise they wouldn't get to anything else that they might find."

Cyber attacks have become par for the course for enterprises and small and medium-sized businesses (SMBs) over the last couple of decades. 

The prospect of a cyber security incident – which may range from a minor malware infection to a major ransomware attack, with the likes of phishing and social engineering in between – is close to certain for many organizations. This is why maintaining and iterating on a strong security posture is essential across modern businesses. 

But security isn’t straightforward and there are different pillars that all come together to form an organization’s outlook. Indeed, information security, cyber security, and network security are all different pillars businesses need to pay attention to, which ensures there aren’t any holes that cyber criminals can exploit. There are different aspects of your business that you need to protect, and slightly different schools of thought around each one – including which particular cyber security skills are required. 

It can be easy to conflate these categories of security, which may come to complicate matters when devising a comprehensive business security strategy – so it’s important to know what each school refers to and what each entails. That’s why we’ve put together a quick guide on the differences between information security, cyber security and network security, so you know exactly what your business needs when keeping the hackers out.

What is information security?

Information security, also known as InfoSec, largely centers around preventing unauthorized access to critical data or personal information your organization stores. It is the “protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability,” according to the US Computer Science Resource Center (CSRC). Information security also involves three categories: confidentiality, integrity, and availability. 

• Confidentiality: Ensuring sensitive information isn’t disclosed to unauthorized users while making sure that authorized users have access to it
• Integrity: Making sure that the data is accurate and complete. Here, the information shouldn’t be edited by anyone who isn’t authorized to access it
• Availability: Data needs to be available when it’s needed. For example, a denial of service attack (DoS) could prevent this from happening

There are also several industry standards organizations must adhere to if following this triad, including maintaining password strength, using antivirus software, deploying access controls, security awareness training, and more.

Organizations can meet their information security standards by implementing a strict risk management process. It should identify information, related assets, and the threats and impact of unauthorized access. It should also monitor activities and make adjustments to address any new issues or improvements that have emerged, as well as evaluate any risks to the organization.

What is cyber security?

This is the process your organization must follow to be aware of the latest and emerging cyber security threats and trends – and to protect itself in light of the changing cyber security landscape. Having a healthy cyber security posture involves adopting policies such as zero trust, and using new tools and technologies to fight prospective threats where appropriate, as well as maintain compliance. Additionally, all staff within the organization must stick to these policies to make sure the business is fully protected.

As threats evolve, security policies need to be continuously evaluated and updated if need be. Your hardware and software – including endpoints and operating systems – for example, should be functional and secure to the best of your knowledge, but should also be periodically updated and refreshed. Software that you need to continuously assess includes security services, endpoint management tools, or even cloud services.

It’s also key to ensure staff follow any policies and procedures you put in place. Your business could have the best security tools out there, but it makes no difference if employees continue to use their own devices without IT’s knowledge to access data. You might also have an extensive antivirus product in force, but you must still ensure employees are aware of the dangers of phishing emails.

What is network security?

Network security spans how an organization protects the usability and integrity of its network and data. This field includes both hardware and software involved in a network and aims to prevent a variety of threats from entering the business’ networks or spreading through it.

It works by combining a number of defensive layers at the edge, and within the network perimeter. As you may assume, different policies and controls are available in each security layer. For example, authorized users must be able to access network resources, where it’s required for their specific roles, such as in a least privilege access regime, while bad actors must be blocked from carrying out any nefarious actions.

Network security is essential for all organizations as it directly affects their ability to safely deliver services or products to employees and customers. It doesn’t matter if it’s enterprise applications or accessing a remote desktop, ensuring the protection of data and apps on your network is vital for your business, as well as securing your reputation.

What is the difference between information security and cyber security?

These two terms are sometimes used interchangeably, so it’s important to understand the differences between them. While information security is the protection of your data from any unauthorized access, cyber security is protecting it from unauthorized access specifically in the online realm.

For example, cyber security centers around preventing ransomware attacks, spyware, or compromised social media accounts, for example. An example of information security is implementing controls for intrusion detection systems or making sure hard-copy files are locked down. Chief information security officers (CISOs) need to understand and identify whether any information is confidential or critical to the organization and whether it might be targeted by hackers.

Some people might ask which is more important but these two areas go hand-in-hand. Your organization must have clear policies and procedures around how to deploy both forms of defense – not just one. Both are continuously evolving too. Ultimately, your business must understand, first, what and where the most sensitive data lies, and secondly, which specific measures it’s putting in place to protect that data.

Information security vs network security: What’s the difference?

Information security protects information from unauthorized users, data modification, and access. Network security, on the other hand, must protect data flowing over a particular network. While network security focuses purely on the network, information security is concerned with information overall, irrespective of where it’s located.

For example, when it comes to attacks, network security involves protecting your network from specific threats like DDoS attacks, trojans, zero-day attacks, and spyware. Information security, meanwhile, involves protecting the data from leakage or access without permission, no matter the type of threat or the data’s location.

Cyber security vs networking security: What’s the difference?

It isn’t always clear where one begins and ends, but network security is broadly a subset of cyber security which, itself, is a subset of information security. While cyber security centers around how to protect the organization from different types of cyber attack, network security specifically focuses on defending against anything that may compromise the integrity of the corporate network.  

Network security aims to protect data as it travels through the network between users and endpoints and normally involves protecting against DoS attacks, viruses, or worms, as well as preventing unauthorized access. This may also involve taking measures to prevent, say, social engineering attacks in which hackers aim to seize employees’ credentials – alongside other methods normally deployed to breach the network. Cyber security, meanwhile, protects the data living inside endpoints as well as corporate servers, and protects everything within the digital realm. As such, cyber security covers all the devices that an organization owns, and cyber security practitioners will normally aim to negate the threat from malware, phishing, SQL injection, and zero-day exploits, among other forms of attack.

Why your business needs all three working in harmony

It feels as if the scale of cyber security threats is expanding, but what’s also clear is the variety of attack vectors and opportunities for hackers to strike is increasing. Having effective information security policies in place is crucial to this, with the volume of data expanding. But so too is adopting cyber security principles to stay abreast of the latest threats. Strong network security policies, meanwhile, ensure the organization’s corporate network is airtight, and all data transmitted across it is safe from exploitation. 

ITPro created this content as part of a paid partnership with Jamf. The contents of this article are entirely independent and solely reflect the editorial opinion of ITPro. 

IT security leaders and hackers are consistently head-to-head in trying to ensure, and circumvent, password security. Security professionals know that weak credentials are a key aspect of cyber attacks, so it’s vital to have a layered defence strategy to not only protect your business, but also your channel partners.

This whitepaper discusses the current state of today’s password security, shares things to consider and avoid in developing your organisation’s password strategy, and looks at the latest tools and techniques coming to an ever evolving cyber security landscape.

Download now to learn:

• The biggest threats affecting password security
• Best practices for ensuring strong credentials
• and How password management tools can support security improvements

Provided by

A new report shows there’s been a reduction in overall malware detections from the peaks seen in the first half of 2021, although there’s been an ongoing Emotet botnet resurgence.

Microsoft Office exploits continue to spread more than any other category of malware, according to WatchGuard Threat Lab’s Q2 Internet Security Report. The quarter’s top incident was the Follina Office exploit, first reported in April but not patched until late May. Delivered via a malicious document, Follina was able to circumvent Windows Protected View and Windows Defender and has been actively exploited by threat actors, including nation states, stated the report.

Researchers also found that the endpoint detections of malware were down overall, but not equally. Despite a 20% decrease in total endpoint malware detections, malware exploiting browsers collectively increased by 23%, with Chrome seeing a 50% surge. WatchGuard found that one potential reason for the increase in Chrome detections is the persistence of various zero-day exploits. Scripts continued to account for the lion’s share of endpoint detections (87%) in Q2. Additionally, network-based malware detections dropped 15.7% quarter over quarter. This includes drops in both basic malware and evasive or zero-day malware.

The network security company also warned of a resurgent Emotet. Although the volume has declined since last quarter, Emotet remains one of network security’s biggest threats. One of the quarter’s top 10 overall and top 5 encrypted malware detections, XLM.Trojan.abracadabra – a Win Code injector that spreads the Emotet botnet – was widely seen in Japan.

“While overall malware attacks in Q2 fell off from the all-time highs seen in previous quarters, over 81% of detections came via TLS encrypted connections, continuing a worrisome upward trend,” said Corey Nachreiner, chief security officer at WatchGuard. “This could reflect threat actors shifting their tactics to rely on more elusive malware.”

The report also found that the top 10 code signatures accounted for over 75% of network attack detections. The quarter saw increased targeting of industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems that control industrial equipment and processes, as well as new signatures like WEB Directory Traversal -7 and WEB Directory Traversal -8. The two new signatures are similar, the first exploits a vulnerability first uncovered in 2012 in a specific SCADA interface software while the second is most widely detected in Germany.

WatchGuard also shared that in Q2 it blocked a total of more than 18.1 million malware variants and more than 4.2 million network threats. Europe, the Middle East, and Africa (MENA) was also the most targeted region, receiving 52% of malware hits. The remainder was split between the Americas and the Asia Pacific, with APAC receiving slightly more.

DrayTek’s Vigor 2866ax looks like an ordinary wireless router – and for a small office it can fulfil that role perfectly well. It offers a solid set of Wi-Fi 6 services, with speeds of up to 574Mbits/sec on its 2.4GHz radio and 2.4Gbits/sec on the 5GHz band. It’s also one of the very few SMB routers we’ve seen that supports wide 160MHz channels for maximum bandwidth. Round the back, six Gigabit Ethernet ports allow for the direct connection of wired clients, or the sixth can alternatively be configured as a WAN socket, as we’ll discuss below.

Installation is a cinch. The router’s web console provides quick-start wizards for configuring internet access, presenting secure wireless services and setting up VPNs. The price includes support for 32 IPsec tunnels plus 16 SSL VPNs, with optional hardware acceleration for increased performance. The firewall is also enabled out of the box, and preconfigured with a strict security policy; this can be customised with rules and filters, which are also used to enforce application controls and web content filtering. Cloud management is available via the optional VigorACS 3 web portal.

DrayTek’s URL keyword filtering service is basic, but you can beef it up with the optional Cyren GlobalView service, which divides the web up into 81 site categories that can be blocked or allowed using up to eight profiles. A free 30-day trial can be activated from your MyVigor account, after which it costs around £35 per year.

Application controls are also free on registration, and provide a list of 160 apps and protocols that can be controlled. Services including Facebook, WhatsApp and LinkedIn can be instantly blocked using profiles enabled within your firewall rules, although we did notice that Twitter is oddly not covered.

One area where the Vigor 2866ax really stands out is WAN redundancy. Alongside the built-in G.Fast/VDSL2 modem, one of the Ethernet sockets can be set as an internet connection, and the two front-facing USB 2 ports will each take a 3G or 4G modem. Each WAN connection can be configured as an active or backup link, with the latter automatically brought online when the primary link fails or its traffic exceeds specific thresholds. Alternatively, you can set mutiple links as simultaneously active, and enable the load balancing service to distribute traffic across them all.

Wireless services are also good for the price. Up to four SSIDs can be defined on the 2.4GHz and 5GHz bands, each with its own security scheme, and you can present hotspot services for guest users with custom web portals and a range of authentication methods.

Performance is helped along by a clever hardware acceleration option that allows traffic that’s already been through the firewall and content filters to bypass the CPU. This can yield huge performance benefits: with acceleration disabled, close-range file copies between a server (connected via Ethernet) and a Windows workstation connected over Wi-Fi 6 averaged 65MB/sec, with router CPU usage peaking at 80%. Enabling acceleration saw speeds leap up to 105MB/sec, while CPU usage dropped to barely 5%. We were also able to gain a small performance increase by enabling the 160MHz channel width, which saw copy speed increase slightly to 107MB/sec.

The Vigor 2866ax offers a lot for a low price; it’s a great choice for small businesses that want reliable internet and security services in one unit. It lacks some advanced features such as gateway malware protection and anti-spam, but all the essential security measures are present, and thanks to DrayTek’s powerful hardware acceleration it’s faster than you might expect.

DrayTek Vigor 2866ax specifications

Ofcom will have the power to fine telecom providers £100,000 per day for poor network security under new government regulations.

New elements of the Telecommunications Security Act, which became law in November 2021, will be laid as secondary legislation in Parliament today, in a bid to force providers to increase the security of the UK's broadband and mobile networks. These will be presented alongside a draft code of practice that will provide a guide for how vendors can comply.

The new regulations and code of practice have been developed jointly by the National Cyber Security Centre and Ofcom and they set out the specific actions that public telecom providers must fulfil as legally binding duties. The aim is to improve cyber resilience in the UK by forcing providers to embed strong security practices within all their long-term investment decisions and also their general day-to-day operations.

As the relevant industry regulator, Ofcom will have powers to enforce new legal duties and carry out inspections of a provider's premises and systems to assess whether it has met the new obligations. The regulator will also be able to issue fines of up to 10% of turnover or £100,000 per day if it is a continuing contravention.

A final draft of the regulation has been confirmed by the Department of Culture, Media and Sport (DCMS) and follows a public consultation. The regulations will force providers to protect data processed by their networks and services and secure the critical functions which allow them to be operated and managed. It will also require them to protect software and equipment which monitor and analyse their networks and services. Providers will also need to take account of supply chain risks and understand and control who can access and make changes to the operation of their networks and services to enhance security.

The new rules will come into force in October with providers expected to have achieved all the necessary outcomes by March 2024. The code of practice will set out further time frames for the completion of other measures and will be updated periodically, according to the government, to ensure it keeps pace with any evolving cyber threats.

NEC Corporation and Fortinet have joined forces to offer secure 5G networks for communication service providers (CSPs).

Under their global agreement, NEC and Fortinet will set their focus on a series of key network security use cases and services, including radio access network (RAN), mobile roaming, and Gi-LAN/N6, to help service providers gain a comprehensive view into users, applications, and threats.

Fortinet’s high-performance security solutions, featuring automation and AI-driven threat intelligence, will add to NEC’s carrier-grade services spanning over 150 nations, as part of the deal.

"5G success and growth depends on service providers' ability to deliver innovative enterprise-facing use cases while meeting their security requirements," said John Maddison, EVP of products and CMO, Fortinet.

“We’re pleased to partner with NEC to deliver the required solutions and expertise to facilitate enterprises' 5G adoption and CSPs' success," added Maddison.

NEC Centers of Excellence (CoEs) and NEC Open Networks will also be leveraged to meet the unique and often dynamic requirements of CSPs.

“The global partnership with Fortinet is a perfect fit for NEC Open Networks’ ecosystem to enable our services to meet the customer’s urgent and diverse needs for network security in the 5G era,” said Hideyuki Ogata, general manager, service provider solutions department, NEC Corporation.

“NEC CoEs already have rich experience in network security, including the recent success with Fortinet for CETIN and others. This partnership promises to further enrich our service portfolio facing customers as a global network integrator.”

Earlier this month, Fortinet launched the “fastest” compact firewall for hyperscale data centers and 5G networks.

Over 200,000 routers made by DrayTek are subject to a serious vulnerability, which could open companies up to network breaches.

The DrayTek Vigor 3910 is currently vulnerable to complete compromise by threat actors and is particularly at risk if it has an internet-facing management interface.

Researchers from cybersecurity firm Trellix identified the vulnerability within the model in a blog post, as well as within 28 other devices from DrayTek that share the same code base. They stressed that at present, there are no examples of threat actors in the wild using the vulnerability.

The researchers have warned companies that once routers are compromised, they leave a network open to malicious action such as intellectual property theft, stolen passwords, data breaches, or a ransomware attack.

DrayTek is a Taiwanese manufacturer of routers that cater to so-called ‘SoHo’ small and medium businesses (SMBs), with their products often used to provide remote-working employees with virtual private network (VPN) access.

Because of a logic bug in its code, threat actors can exploit the management interface of the affected routers by inputting a base64 encoded string as username and password when prompted. This causes a buffer overflow on its login page, allowing a takeover of the router’s ‘DrayOS’.

The attack can be undertaken over the router’s local area network (LAN). If the management interface of the router is configured to be internet facing, the attack can be carried out remotely over the internet.

Researchers have issued several recommendations, including keeping firmware up-to-date, preventing the management interface from being exposed to the internet if possible, and changing the password to any affected devices.

The vulnerability has been filed under CVE-2022-32548 and Trelix was quick to praise DrayTek for releasing a firmware patch within 30 days of being made aware of the issue.

“A firewall or other piecemeal cybersecurity tool is not a cybersecurity strategy. Small businesses must not underestimate their value to an attacker and adopt a mindset and strategy centred on when they will be targeted versus if," commented Philippe Laulheret, senior security researcher at Trellix.

"SMBs can't underestimate the value of their data and IP, or the potential for their edge devices to be leveraged in botnet attack, or even the risk of becoming a steppingstone for attackers to compromise SMBs' customer networks.”

Cloudflare has revealed details of its new One Partner Program, which it says presents a new way for the channel to integrate and extend its Cloudflare One platform.

The initiative builds on the solution’s comprehensive zero trust, network as a service, and cloud email security services, providing architecture designed to help customers to stay secure and efficient.

Cloudflare said the new programme bundles together the tools and services that partners need to ensure swift deployment, fast performance, as well as robust security across endpoints, networks, and email.

“In order to keep today’s business environment protected and productive, organisations need a unified solution to secure their distributed workforces and at the same time accelerate employee systems,” explained Matthew Prince, co-founder and CEO of Cloudflare. “But another key piece is broad adoption, and that’s why we’ve been working to seamlessly layer this into organisations without interruptions.

“Critical architectures like Zero Trust shouldn’t be complex, yet we hear every day from businesses that don’t know where to start. That’s why we have modernised how partners can fully implement and deliver what organisations of all sizes need most today.”

One of the most interconnected networks on the market, Cloudflare One spans 270 cities in over 100 countries. Over the last twelve months, the number of customers using the platform has grown by 100%, while daily average traffic has increased sixfold.

The platform boasts a number of integrated products such as ZTNA, Secure Web Gateway, CASB, DLP, Browser Isolation, IoT Security, and now Cloud Email Security.

With its new partner programme, Cloudflare says partners will now be able to better guide customers, deliver comprehensive solutions, protect users from phishing attacks, as well as secure every connection with zero trust controls.

“With this new Cloudflare One Partner Program for Zero Trust, Cloudflare has launched a first-of-its-kind set of integrated product suites and partner services packages that will give our Trusted Advisors a compelling set of solutions to take to market,” commented Shane McNamara, EVP of Engineering and Operations at AVANT Communications.

The news comes just days after a Cloudflare outage resulted in a number of major websites being knocked offline for around two hours, including those operated by Shopify, NordVPN, and gaming platform Steam.

The worldwide network detection and response (NDR) market is slated to reach $5370.4 million by 2028, according to a recently published report by Industry Research.

The market research firm also estimates a growth worth $2485.7 million in 2022, attributable to the COVID-19 pandemic. Additionally, a compound annual growth rate (CAGR) of 13.7% is anticipated for the NDR market between 2022 and 2028.

Commenting on NDR’s significance, Industry Research stated, “NDR solutions primarily use non-signature-based techniques (for example, machine learning or other analytical techniques) to detect suspicious traffic on enterprise networks.

“NDR tools continuously analyze raw traffic and/or flow records (for example, NetFlow) to build models that reflect normal network behavior.”

“When the NDR tools detect suspicious traffic patterns, they raise alerts. In addition to monitoring north/south traffic that crosses the enterprise perimeter, NDR solutions can also monitor east/west communications by analyzing traffic from strategically placed network sensors.”

Gigamon, FireEye, Darktrace, and Cisco are among the major vendors influencing the NDR market.

By region, North America holds the largest market share (70%), followed by Europe (20%) and Asia-Pacific (20%).

A joint advisory issued by members of the Five Eyes international alliance has set out the latest practical cyber security recommendations for managed service providers (MSPs) to ensure supply chains remain secure.

Citing the high-profile supply chain attack on SolarWinds in 2020, leaders from the UK’s National Cyber Security Centre (NCSC) and equivalent organisations from the US, Australia, Canada, and New Zealand said the advice applies to MSPs especially now Russia has invaded Ukraine.

The advisory’s release coincides with the second and final day of the NCSC’s annual CYBERUK conference during which on Tuesday, the alliance officially attributed cyber attacks on Ukraine earlier this year to Russia.

Microsoft previously claimed the Russian-linked attack on SolarWinds was the most sophisticated cyber attack in history, executed by more than 1,000 engineers.

The message from Five Eyes’ cyber security officials is that the attack complexity shouldn’t be the focal point. Instead, MSPs should consider the overall impact of the attack which targeted up to 18,000 corporate and governmental networks, although SolarWinds said the number of impacted organisations was closer to 100.

“Our joint advisory with international partners is aimed at raising organisations’ awareness of the growing threat of supply chain attacks and the steps they can take to reduce their risk,” said Lindy Cameron, CEO, NCSC.

“Supply chain vulnerabilities are amongst the most significant cyber threats facing organisations today,” said Lisa Fong, director at New Zealand’s NCSC.

“Organisations need to ensure they are implementing effective controls to mitigate the risk of cyber security vulnerabilities being introduced to their systems via technology suppliers such as managed service providers. They also need to be prepared to effectively respond to when issues arise.”

Security leaders’ recommendations

Prevent initial compromise

Securing against common cyber attacks is an important first step in preventing supply chain attacks and the alliance pointed to resources on how to secure against some of the most common and dangerous.

• Improve vulnerable device security
• Secure internet-facing devices
• Defend against brute force attacks and password spraying
• Prevent phishing

Enable or improve existing logging capabilities

Cyber security professionals have espoused the benefits of keeping comprehensive logs for years and the same advice applies today. The five security agencies said it can be months before a cyber attack or intrusion is detected so the recommendation is to store their most important logs for at least six months.

MSPs are advised to log the delivery infrastructure activities used to provide services to their customers and also log both internal and customer network activity, as contractually agreed upon.

Customers are also encouraged to enable monitoring and logging and should ensure their contract with their MSP mandates it to implement a logging plan and provide visibility into the customer’s network.

Mandatory MFA

Multi-factor authentication (MFA) is considered one of the measures organisations can easily take to drastically improve their cyber security posture and secure remote access to critical systems or infrastructure.

MSPs are advised to recommend the adoption of MFA across all customer services and products, while customers should ensure their MSP contracts mandate MFA across all products and services they receive.

Manage internal architecture risks and segregate internal networks

Where possible, MSPs should ensure they have critical business systems isolated on their networks and verify all connections between internal systems, customer systems, and other networks to limit the impact of a single-vector attack, the advisory said.

Customers are also advised to review and verify network connections, making sure to use a dedicated VPN to connect to MSP’s infrastructure. They should also ensure networks used for trust relationships between them and the MSP are segregated and that the contractual agreement forbids MSPs’ reuse of credentials.

Assign the lowest level of privileges possible

Organisations should ensure that internal and external users receive the correct user privileges and not allow undue access to users who do not need it - the alliance calls this applying the principle of least privilege.

Proactively manage obsolete accounts and infrastructure

MSPs and customers should periodically review their registered user accounts and network infrastructure to remove or deprecate any unused user accounts or disable any unused network systems and services.

Apply updates

Another cyber security rule that is repeatedly re-iterated to organisations is to stay on top of their patch and vulnerability management strategies, ensuring all software is secure against the latest attack methods.

Customers are advised to enquire about their MSP’s patching policies and request updates are applied promptly.

Effective backup strategies

Ransomware victims are often criticised for not having comprehensive backup plans which then lead to the likelihood of paying a ransom, against industry advice.

These backups should be updated regularly and isolated away from the network connections that could be used to spread ransomware throughout an organisation.

Develop incident response and recovery plans

Every individual in an organisation that could feasibly be required to assist in disaster recovery after a cyber attack should be fully aware of their role and responsibilities should an attack strike.

These plans should have both digital and physical copies should staff lose access to systems, and ideally keep the digital versions isolated so potential attackers can’t study them to inform their attacks.

These plans should also be exercised regularly, ensuring all the people involved in the recovery strategy are fully trained in how to respond appropriately.

Understand and manage the supply chain risk

MSPs are advised to be fully aware of their own supply chain risk, and use risk assessments across security, legal, and procurement to prioritise the allocation of resources. Customers should also be aware of their MSP’s risk including with third-party vendors and subcontractors.

Transparent contracts

During the contract negotiation phase, MSPs need to be clear about what service they will be providing to the customer. The customer should also be fully aware of the service they are expected to receive and clarify any misunderstandings or queries before signing.

Account authentication and authorisation

The level of access an MSP is afforded should be clearly defined and restricted where appropriate. Customers should ensure MSP accounts are not added to any company administrator groups and restrict their accounts only to services managed by the MSP. MSPs should ensure that the customer has made these checks.

Vector Capital has made a fresh equity investment in WatchGuard to become the company’s majority shareholder, snapping up shares previously owned by Francisco Partners and other co-investors.

The private equity firm has held joint ownership of WatchGuard for more than a decade, overseeing the business transform from a network security vendor to a fully-fledged cyber security platform provider.

The company’s Unified Security Platform is now, in fact, used by more than 17,000 managed service providers (MSPs) to protect the environments, users and networks of more than 250,000 businesses worldwide.

WatchGuard CEO Prakash Panjwani said the move was a sign of Vector’s belief in the company’s portfolio, partners, employees and vision.

“This transaction is a testament to WatchGuard’s current success and the opportunity ahead,” he said. “We believe Vector is well-positioned to further accelerate WatchGuard’s growth strategy while preserving our company culture and commitment to security delivery through the MSP community.”

Looking forward, WatchGuard said it’ll continue to invest in critical areas, including cloud transformation, secure access service edge (SASE), extended detection and response (XDR), managed detection and response (MDR), as well as further innovation in security automation and simplification.

Sandy Gill, managing director of Vector Capital, highlighted the importance of a bespoke platform that’s built to suit MSP needs.

“MSPs represent the future of security delivery, but to be successful, they need a bespoke platform built for their needs,” he said. “WatchGuard is uniquely positioned to lead the market in enabling those MSPs with its Unified Security Platform.

“We are excited to further invest both organically and via acquisitions in the company’s mission to deliver security-focused MSPs one vendor, one platform and one vision to build their business upon.”

Alex Slusky, founder, managing director and chief investment officer of Vector Capital, added: “We are proud of the foundation of success we’ve built with WatchGuard’s management team and look forward to fuelling the next phase of growth and transformation for the company.”

The transaction is expected to close by the end of the third quarter of 2022, subject to customary closing conditions. Financial terms were not disclosed.

There are plenty of cloud-hosted network-monitoring options to choose from, but Auvik can claim to be one of the fastest to deploy. Two versions are available: the Essentials edition provides network mapping, monitoring, alerting and device configuration management, while the Performance edition adds features such as Syslog collection and flow data analysis for detailed application visibility.

To use it you simply need to install a collector agent in each site – and this is painless as it’s a lightweight service that will run on any version of Windows. The back-end, meanwhile, is hosted in AWS data centres, and protected by both single sign-on and 2FA procedures. All collector data is encrypted, and outbound communications are only permitted with its cloud servers.

Onboarding is a piece of cake. After creating our cloud account we used Microsoft’s Authenticator app to confirm secure administrative access, created our first site and downloaded the agent installer. After running this on a Windows Server 2019 host, we were prompted to provide a unique API key, and then a secure connection to our cloud account was created.

Auvik kicks off its discovery process immediately, and while it’s scanning you can enter credentials for SNMP, WMI, SSH, telnet, and VMware. We were impressed to see that it took only around 16 minutes to build a fully populated network map for a complete subnet.

From now on the network is continuously scanned – you can set an interval in seconds – while the map shows your network layout. Coloured link lines between devices distinguish between Layer 1, Layer 3, and VPN connections, while dotted lines denote wireless links. We found the map quickly updated itself to reflect network or device state changes, and each device icon is active, so you can hover over a node to see a pop-up status window, or click to load its details in the panel below.

The home dashboard panel provides a handy activity overview with tables of the busiest devices, open alerts, SSL VPN status and the condition of VMware host hardware components. The software offered full visibility into our Hyper-V host, showing details such as CPU, memory, storage and virtual switch utilisation, traffic throughput, and individual VM status.

To help you keep on top of any emergent issues, Auvik provides 58 preconfigured alerts, ranging from a down device or service to high storage usage, as well as the option to set your own. Notifications can be sent by email or via various messaging platforms, including Teams, Slack, and FreshDesk.

While Auvik’s main focus is clearly on network, service, and device availability, it can also keep critical infrastructure devices safe with automated configuration backups, restores and comparisons. The Performance edition adds a TrafficInsights dashboard where NetFlow, sFlow, and J-Flow data is ingested, analysed, and presented as informative graphs.

Auvik’s per-device licensing initially looks expensive, but it’s not hard to customise the configuration so that only your important devices are monitored, and you save by not having to provide a dedicated on-premises host. Since it’s so versatile, so easy to deploy, and so simple to manage, it’s a good choice for SMBs that want a clear picture of their network.

Companies accepting credit card payments online have a new set of standards to abide by as of today.

The Payment Card Industry Security Standards Council has issued version 4.0 of its PCI Data Security Standard (PCI DSS), a standard defining security measures to protect payment card information.

Anyone holding this data, such as online retailers or service providers, must comply with the standard.

The new version of PCI DSS features several changes. It expands its access control requirements to make multi-factor authentication (MFA) mandatory for all access into the cardholder data environment, and also updates password requirements.

Companies following the standard will also have to implement new protections against phishing attacks.

The latest document also introduces more flexibility for organizations to demonstrate their compliance. Whereas the previous version focused on firewall protection, version 4.0 has broadened its terminology to address other network security controls.

The Council has also added support for targeted risk analyses. These let companies define how frequently they perform some security-related activities, it said.

The PCI will translate the new version of PCI DSS into different languages over the next few months. Assessors - the companies that verify compliance with the standard - also have to train in the new version.

The current version, 3.2.1, will remain active until 31 March 2024, the Council said. After that, version 4.0 will be the only active version of the standard. Some requirements in the new version are defined as best practices, but will become mandatory. Organizations will have an extra year - until March 31 2025 - to phase those in.

Vodafone and Ericsson have completed a successful lab trial of 5G network slicing – a first for the UK telecoms and technology industry.

Enabled by Standalone 5G, network slicing is a new service aimed at businesses and app developers that involves carving out a ‘slice’ of the network to in order to cater it to specific use cases. This can be based on geographical location, download and upload speeds, latency, capacity, and even specific cyber security needs.

For instance, the trial successfully conducted by Vodafone and Ericsson involved creating and configuring an on-demand 5G network slice for a retail store that would have the enough bandwidth to support virtual reality (VR).

The slice, which took 30 minutes to complete, was able to deliver a guaranteed download speed of 260Mbps and latency of 12.4 milliseconds.

5G network slicing has the potential to enable a number of different 5G use case scenarios, ranging from automotive and healthcare to mobile gaming and smart cities.

In the case of the latter, 5G network slicing could be combined with IoT technology to deploy smart electricity sensors that can be adjusted by demand, or in order to track and manage emergency services in real-time. Due to the sensitive nature of the data, network slicing would enable a separate, more secure ‘slice’ of the network separate from the public internet.

Businesses could benefit from 5G network slicing by creating slices that would be tailored to individual teams based on their specific network demands, without sacrificing the quality of connectivity of one team in favour of another.

According to Ericsson UK & Ireland VP of digital services, Andrea Spaccapietra, the technology will play a crucial role in enabling new and innovative 5G services for consumers and enterprises alike.

“With the tools to efficiently manage network resources and provide differentiated services with dedicated performance, leading network operators like Vodafone can enable new business model innovation and use cases across different sectors and unlock new revenue opportunities to realise the full potential of 5G,” he said.

According to tech, media & telco analyst Paolo Pescatore, network slicing is "best-suited for enterprises and specific verticals" and "provides telcos with a significant means to help recoup the investment in 5G".

"For now, it seems unlikely that consumers will pay a premium for a superior experience," he told IT Pro.

The news comes less than two years after Vodafone delivered the UK’s first Standalone 5G network, with Coventry University becoming the first to use the new network as part of a new VR learning option for student nurses and allied health professionals.