Category Archives: Internet Security
How did Iran’s government pull the plug on the Internet? – Euronews
One of Iran's biggest internet blackouts means details about the impact of recent protests over fuel price hikes remains sketchy.
NetBlocks corroborated reports in Iranian media on Thursday that internet had been partly reinstated, "some connectivity is being restored, although only partially, national connectivity has risen further to 10%".
On Tuesday, Amnesty International said 100 protesters have been killed in 21 cities since last week's protests.
There has been no official confirmation and Tehran has called the figures "fabricated".
Experts say the lack of detail emerging about the protests is because the internet has been shut off in much of Iran as authorities attempt to stop people mobilising.
Irans judiciary spokesman, Gholamhossein Esmaili, said calm had been restored but some social media videos posted in defiance of an internet block showed protests continued in several cities on Monday night and a heavy presence of security forces in streets.
UN human rights spokesman Rupert Colville has called on authorities in Iran to restore the internet service cut off since Saturday, and uphold the demonstrators rights to freedom of expression and peaceful assembly.
The struggle of ordinary Iranians to make ends meet has become harder since last year when President Donald Trump withdrew the United States from Tehrans nuclear deal with world powers and reimposed sanctions on the country.
Combined with the rising inflation, growing unemployment, a slump in the rial and state corruption, Washingtons maximum pressure has caused Irans economy to deteriorate.
The government said the gasoline price rises of as much as 50% aim to raise around $2.55 billion (2.30 bn) a year for extra subsidies to 18 million families struggling on low incomes. The monthly cash payments are set at just 550,000 rials (4.01) per person.
Doug Madory, director of internet analysis at Oracle's Internet Intelligence team, noted on Twitter: "Unlike previous efforts at censorship and throttling, Iran is experiencing a multi-day wholesale disconnect for much of its population arguably the largest such event ever for Iran."
Whilst NetBlocks similarly affirmed reports on Tuesday: the last remaining networks are now being cut and connectivity to the outside world has fallen further to 4% of normal levels".
The international community and Iranians abroad have condemned the shutdown, with the UNs David Kaye asking on Twitter: "Whats being hidden from Iranians and the world?"
With reports of violence on the street increasing, a further concern is shouldered by those with families in Iran.
Sina Toossi, a research associate at the National Iranian American Council (NIA Council), told Euronews: "Unfortunately for us Iranian Americans, and the Iranian community abroad, its been immensely difficult to contact our loved ones back home. Usually, I use WhatsApp / Skype / Viber, all of these apps we cant access right now. Its very disconcerting that we have lost communication with our loved ones in the past few days
Many are questioning why this internet outage has been so widespread and devastating.
Amir Rashidi, an Iran internet security and digital rights researcher, who also works for the Center for Human Rights Iran, told Euronews the reasons are twofold.
"The Iranian government has realised they need to have control over the Internet, otherwise people can mobilise themselves, they have invested a lot in creating a local network National Information Network (NIN)," he said.
"Iran encouraged users and businesses to move services and servers inside Iran and use its national infrastructure."
The internet is the main platform and communication tool for Iranians to share their thoughts with each other and the world. With more platforms migrating to NIN, Iranians turned to circumvention tools and VPNs to access information, read about the protests, and communicate with one another.
Rashidi said: Since the US started their maximum pressure campaign, they imposed more pressures on Iran, Iranians werent able to use international platforms such as Amazon Cloud Web Services, Google Cloud, Github."
"US sanctions are further enabling the Iranian governments internet blackout," Toossi said.
"Weve seen an overcompliance with US sanctions by US tech companies. Google Cloud Services, Amazon Web Services, platforms that many Iranians use to access private virtual networks to circumvent filtering in Iran, in recent months, these companies have banned Iranians from their services directly citing US sanctions."
Nat Friedman, CEO of GitHub, wrote on Twitter in July: "It is painful for me to hear how trade restrictions have hurt people... to comply with US sanctions, we, unfortunately, had to implement new restrictions on private and paid accounts in Iran, Syria, and Crimea.
Amongst many others like Slack, these platforms have been forced to migrate off of these services onto Irans NIN, Toossi told Euronews: "This has allowed the Iranian government to be remarkably successful" in restricting internet access to a lot of ordinary users."
Rashidi concludes: "These sanctions were the biggest gift anyone could give the Iranian government."
It has long been levelled that Iranian civilians bear the brunt of western-imposed sanctions in terms of medicine and food shortages and money problems.
The US Department of the Treasury says sanctions target the "Iranian regime", not ordinary individuals.
In July, the US Department of State addressed these accusations in a video featuring US Special Representative for Iran, Brian Hook.
"The United States does not sanction hardware, software or services related to personal communications," Hook said, "Unlike your regime, we believe strongly in the free flow of communication and information."
However, Toossi notes: "The general license in US law, aimed at protecting ordinary Iranians and allowing them to circumvent government censors ... is five year-olds and its out of date".
Amongst others, the National Iranian American Council is calling for a revamp of General License D-1, which was issued in 2014.
Toossi says, If the Trump administration is sincere about helping Iranian people, they need to issue a new rule to this license, that expands the scope, and makes the necessary revisions."
At this point, many companies, out of a fear being fined and pressured by the US government for violating sanctions - are over complying with the license".
President of NIA Council, Jamal Abdi wrote on Twitter, Iranians are vulnerable to blackouts & abuse by Iran's government.
On the one hand, the Trump administration's aggressive hostile policies and maximum pressure campaign is impoverishing Iranian people and setting the two countries up for war Toossi tells Euronews.
"On the other hand, the repressive state, empowered hardliners in Iran who are cracking down, in light of gas price hike and suppression, is leading to more destructive situation internally.
When we talk about ingredients for peaceful democratic change and empowering Iranian people, these collectively punishing sanctions and scenario that has been created - this isnt the path to democratic change.
With #internet4iran trending, a petition has now been launched asking the White House to help reinstate internet to the Iranian people.
Rashidi noted: "The internet is so important, its the only place people can express themselves, without fear of being arrested, of course, some have been arrested for online activity, but you can be anonymous, if you know how to protect yourself, you can express your opinion and no one can find you."
Twitter has also become a platform on which ordinary Iranians can voice their concerns to people of authority.
Officials, ministers, Supreme Leaders, politicians, low-level city councillors are all on Twitter, Iranian people on Twitter try to keep them accountable and responsible, these are the tools people can use to pursue their request for more freedom and democracy for Iran.
See the rest here:
How did Iran's government pull the plug on the Internet? - Euronews
Putin: ‘Thank God’ election interference accusations have stopped amid US ‘political battles’ | TheHill – The Hill
Russian President Vladimir PutinVladimir Vladimirovich PutinPutin: 'Thank God' election interference accusations have stopped amid US 'political battles' Live coverage: Impeachment spotlight shifts to Fiona Hill, David Holmes As Buttigieg rises, Biden is still the target MORE said Wednesday that he was thankful "internal political battles" in the United States were putting an end to accusations that Moscow interfered in the 2016 presidential election.
"We see what is going on there in the U.S. now," Putin said while speaking during an economic forum in the Russian capital, according to an English translation of his comments. "Thank God nobody is accusing us anymore of interfering in the U.S. elections. Now theyre accusing Ukraine."
Here's how Putin feels about the impeachment hearings: "Thank God nobody is accusing us any more of interfering in the U.S. elections."
"Now they're accusing Ukraine" pic.twitter.com/zQ14uRgWKG
Putin's comments appeared to reference allegations at the center of the House impeachment inquiry into President TrumpDonald John TrumpWatergate prosecutor says that Sondland testimony was 'tipping point' for Trump In private moment with Trump, Justice Kennedy pushed for Kavanaugh Supreme Court nomination: book Obama: 'Everybody needs to chill out' about differences between 2020 candidates MORE's dealings with Ukraine. During a July 25 phone call, Trumpurged Ukrainian President Volodymyr Zelensky toinvestigate former Vice President Joe BidenJoe BidenKamala Harris receives new Iowa endorsements after debate performance Watergate prosecutor says that Sondland testimony was 'tipping point' for Trump Overnight Defense Presented by Boeing Deal on defense bill proves elusive | Hill, Holmes offer damaging testimony | Trump vows to block Navy from ousting officer from SEALs MORE, who is running for president, and a conspiracy theory related to the 2016 election.
Trump called on the Ukrainian leader tolook into matters related to CrowdStrike, a U.S.-based internet security company that initiallyexaminedthe breach of the Democratic National Committee (DNC) servers in 2016. The request was an apparent reference to a conspiracy theory that casts doubt on the assessment that Russians were responsible for hacking the DNC.
There is no evidence to suggest that Ukraine was involved in any 2016 election interference. The U.S. intelligence community has also concluded that Russia sought to interfere in the election to harm Democratic nominee Hillary ClintonHillary Diane Rodham ClintonDemocratic strategist laments 'low bar' for Biden debate performance Wasserman Schultz makes bid for House Appropriations Committee gavel Trump to hold campaign rally in Pennsylvania next month MORE's candidacy and help Trump.
Trump's promotion of the theory has gained attention amid the House impeachment inquiry, with some Republicans defending the president's motives.
Once you understand that Ukrainian officials were cooperating directly with President Trump's political opponents to undermine his candidacy, it's easy to understand why the president would want to learn the full truth about these operations and why he would be skeptical of Ukraine," Rep. Devin NunesDevin Gerald NunesHill, Holmes offer damaging impeachment testimony: Five takeaways Putin: 'Thank God' election interference accusations have stopped amid US 'political battles' The Hill's 12:30 Report Presented by Johnson & Johnson Witness dismisses 'fictional' GOP claims of Ukraine meddling MORE (R-Calif.), the ranking member of the House Intelligence Committee, said during the fifth day of public impeachment hearings.
Nunes's comments came afterFiona Hill, a former top Russia analyst for the White House, strongly disputed the narrative that Ukraine interfered in the 2016 election.
Based on questions and statements I have heard, some of you on this committee appear to believe that Russia and its security services did not conduct a campaign against our country, and that perhaps, somehow, for some reason, Ukraine did, Hillsaid in heropening statementThursday.
This is a fictional narrative that has been perpetrated and propagated by the Russian security services themselves," she continued.
Hill isn't the first former administration official to dismiss the theory that Ukraine interfered in the 2016 election; Tom Bossert, a former White House homeland security adviser, said in late Septemberthat the allegation was a "completely debunked" conspiracy theory.
He added that he communicated that to Trump during his time working in the administration.
The internet as we know it is off in Iran. Heres why this shutdown is different – WGNO New Orleans
(CNN) Iranians are still offline, three days after the government pulled the plug on the internet amid nationwide anti-government protests.
Experts say the shutdown is an attempt by the government to stop the flow of information and quash the demonstrations. David Kaye, the UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, told CNN that the blackout makes it harder for people to organize, harder for people to protest.
The impact is extraordinarily disproportionate because (it makes) it almost impossible for people to communicate with one another on the ground (and) with friends and family overseas and impossible for people to get information, Kaye said.
Irans minister of telecommunications Mohammad Javad Azari Jahromi said that the government had ordered the cutoff on Saturday and promised that it would return soon, state broadcaster Press TV reported Monday.
Internet will return to the life of the Iranian people soon and the government [will] continue to develop it, Mohammad Javad Azari Jahromi said, according to Press TV. He added that some essential online services had been switched to Irans National Information Network (NIN), a centralized national intranet.
But on Tuesday, connectivity in Iran was down to just 4% of normal levels, according to Netblocks, a non-governmental organization that monitors internet governance.
Despite authorities attempts to make some internal services available to a limited number of users, the shutdown continues and the internet as we know it is not available in Iran, NetBlocks executive director Alp Toker told CNN.
This is not the first time that Tehran has shuttered online access to stop information from spreading. After the 2009 presidential election, the Iranian government realized that the internet is key for communication between people not just inside the country, but also outside the country, Amir Rashidi, an internet security and digital rights researcher at the Center for Human Rights in Iran, told CNN. The center is a civil society non-profit organization based in New York.
When the mass protests were going on in Iran in December 2017 and January 2018, as soon as they shut down Telegram, basically the protest was finished because people were not connected to each other and they couldnt communicate, he added.
This time though, the shutdown appears different.
Toker described the blackout as the most severe disconnection tracked by NetBlocks in any country in terms of its technical complexity and breadth. According to NetBlocks data, the switch off itself was so complex that it took 24 hours to complete.
And Doug Madory, the director of internet analysis at Oracle, said the latest incident is unusual in its scale. In the past, he said, Iran would either intentionally slow down the internet through bandwidth throttling, or block individual websites such as Facebook and Twitter.
This current blackout is way more advanced. Were seeing a variety of different actions take place some networks have withdrawn their routes while others continue to announce routes but block traffic, Madory wrote in a blog on Oracles website.
Kaye added that while Iran has been blocking websites for many years, it has not previously cracked down on the use of VPNs, private networks that allow users to bypass bans. He said the move suggests that the concern isnt merely that Iranians might communicate with one another, but also that they might communicate with the outside world and tell people whats happening.
Madory added that while the internet has grown bigger and more complex in Iran in recent years, the basic structur remains the same: Connectivity between Iran and the rest of the world flows only through state-controlled entities, which serve as bottlenecks between Iran and the global internet.
These chokepoints suggest the Iranian government has architected, and will likely retain, the ability to control (and in recent days block) internet access of its people, he said.
The drastic measure taken by Iran is not unique. Myanmar, China, India, Zimbabwe, Venezuela and other nations have also previously blocked the internet.
Theres a kind of epidemic of internet shutdowns around the world. And they all seem to have the same kind of impact and motivation, Kaye said. Its a real effort to deprive people of their basic human rights to access information worldwide.
Apart from blocking people from talking to each other, the blackouts are also radically limiting the amount of information that gets out of the country.
That has been the case in Indian-controlled Kashmir, where authorities imposed an almost complete communications blackout in August.
We dont know whats happening in the country except through kind of intermittent information that might get out of the country, Kaye said. The design is clearly to make it harder for people to tell their story outside of the country.
Here is the original post:
The internet as we know it is off in Iran. Heres why this shutdown is different - WGNO New Orleans
Expert: Education industry ranks one of the worst when it comes to cyber security – FOX 59 Indianapolis
INDIANAPOLIS, Ind. The education industry is a target for cyber security attacks. Indiana school districts and universities are constantly detecting attackers trying to get your personal information.
Last week, a school district in northern Indiana had to restore its servers. Thats after a ransomware attack knocked out all of their internal systems district wide. The hackers wanted money to restore their service.
Thousands of students, staff and faculty make up a district or university. In moments, personal information can be compromised.
Our job is to stay one step ahead of that, said Andrew Korty, the Chief Information Security Officer at IUPUI, These groups are sophisticated groups, the attack groups that were talking about. Its organized crime.
He says hes dealt with his share of challenges.
Theres money that can be made out of identity theft, extortion, ransomware. So, theyre going to try and pick off the easiest targets, said Korty.
The education industry is one of those easy targets.
Weve always been faced with a fairly substantial level of attack attempts against us, said Korty.
Korty says personal information that school districts and universities require has value on the black market. IUPUI has had to add multiple safe guards to block hackers.
We have what we call two-step login, Korty explained, Which you may have seen with your bank, Facebook and things.
Maya Levine, a Security Engineer with Check Point Software says its more challenging for school districts because of funding.
I think a big portion of that is funding. Schools dont have money for textbooks, for overcrowded classrooms, not enough money to pay for teachers, things like that. That same concept is going to apply to technology and security, said Levine.
Other than adding two-step logins, Levine says everyone needs to learn the tricks hackers try to pull.
Really educate your users because humans are going to be the weakest point in anybodys cybersecurity defense posture. Thats just the way it goes, said Levine.
Staying a step ahead to protect our schools online.
Something bad could happen in the next 10 minutes and we just have to be ready for that, said Korty.
IUPUI has partnered with four other universities to form a security operations center. That way if an attack is detected at one of the institutions, IUPUI can know about it, before it hits.
There are some ways you can protect yourself against cyber crimes.
First, use a full-service internet security site to protect against hackers.
Then, youll want to create strong passwords. Experts recommend a combination of 10 letters, numbers and symbols.
Finally, keep your software updated, doing so can prevent hackers from exploiting known flaws.
Visit link:
Expert: Education industry ranks one of the worst when it comes to cyber security - FOX 59 Indianapolis
The eyes have it – Telegraph India
Social media is a boon as long as it can be used as a propaganda tool by the State. It is a bane when people use it to criticize the government. Asian countries, including Bangladesh, Singapore, Vietnam and China, which launched the digital revolution in the past few years, are giving the impression that they are allowing people to be a part of the global cyberspace. In reality, they are curtailing cyber freedom in the name of national security. India will join the bandwagon soon. After all, the ruling Bharatiya Janata Party doesnt like dissenters.
In Bangladesh, the government has used the Digital Security Act, 2018 to target people who called for reforms in government service recruitment and for better road safety measures through social media campaigns. The police invoked the law against demonstrators for allegedly spreading false propaganda online. The law also came down heavily on press freedom and was used to arrest journalists and confiscate their equipment without a court order. This year itself, at least four journalists have been arrested for publishing false information online about the government and posting provocative status on social media.
Vietnam enacted its cybersecurity law this year to stave off cyberattacks and weed out hostile forces. The ruling communist government stated that Facebook violated this law, allowing Vietnamese users to post anti-government content, and delayed removing such content even after being requested to do so. Interestingly, in Vietnam, it is the governments prerogative to decide what is illegal.
Similarly, Singapores Protection from Online Falsehoods and Manipulation Act, which has come into effect, gives the government the power to order social media sites to put warnings next to posts that the authorities label false and damaging to Singapores interests. People fear that this would stifle free speech online and empower the ruling Peoples Action Party to curb dissent. According to the law, individuals who post false statements that threaten public interest on social media would risk up to five years in prison or a fine of 37,000 US dollars. In a country where the rhetoric of nationalism is shrill, there isnt a clear indication of what is considered to be public interest.
China, characteristically, has gone a step ahead by blocking access to non-China based online communications platforms. As per the China Internet Security Law in 2016, network operators need to cooperate with Chinese security agencies and allow them full access to data on request. Again, this is being done in the name of national security and to safeguard public interest.
Picking up a cue from its adversary, India has proposed the personal data protection bill, which would allow the government to access encrypted messages on apps. The BJP, which used online platforms extensively to run campaigns such as #MainBhiChowkidar and #ModiHaiTohMumkinHai, has now turned against it. Once the law is enacted, the government would have the right to ask online platforms to remove content that it considers to be false and against national interest. Such a legislation would give sweeping powers to the government to access personal data, thereby posing a threat to the peoples constitutional right to privacy. This could leave no place safe for people to speak freely in the worlds largest democracy.
Last year, the government had authorized 10 of its agencies to intercept and monitor information from any computer. This April, an Israeli firm reportedly hacked into WhatsApp messages to spy on activists, journalists and political dissidents. Even though the Indian State claimed its innocence, the Israeli firm clarified that it only works with government agencies. This is illuminating, given the BJPs approach towards peoples freedoms and constitutional rights.
The question is this: is the new data protection bill the final nail in the coffin before India turns into a surveillance State?
The internet loved Fiona Hill blasting sexism in impeachment testimony – INSIDER
At a Thursday hearing in the impeachment inquiry into President Donald Trump, Fiona Hill, a former National Security Council senior director, won an outpouring of support for her powerful testimony slamming sexist double standards.
Hill, one of the nation's leading experts on Russian and Eastern European issues, left the White House earlier this year and testified about the efforts of certain members of the Trump administration to leverage the release of a nearly $400 million military-aid package to Ukraine in exchange for the Ukrainian government announcing investigations that would be favorable to Trump.
In particular, Hill testified that officials including Gordon Sondland, the US ambassador to the European Union, circumvented the interagency processes for conducting diplomacy with Ukraine and got in the way of the NSC's efforts, sidestepping the council and leaving its staff in the dark.
Hill holds multiple degrees in foreign affairs and history from Harvard University and has worked on Russian and Eastern European issues for decades. Sondland is a wealthy hotel executive who had no significant diplomatic experience when he was appointed in 2018 after donating $1 million to Trump's inaugural committee.
Hill recounted that in a July 10 meeting at the White House, she had to intercept Sondland and make clear to him that there should be no discussion of investigations with Ukrainian officials without first going through the proper diplomatic channels.
"I was actually, to be honest, angry with him," Hill said. "And I hate to say it, but often when women show anger it's not fully appreciated it's often pushed onto emotional issues, perhaps, or deflected onto other people."
Hill's measured, confident demeanor before the committee and her powerful testimony of being pushed aside and outflanked by a far less qualified male diplomat resonated with people across the internet. Many tweeted their support for Hill and made her name a trending topic.
Hill and David Holmes, a US diplomat in Ukraine, are sworn in to testify before the House Intelligence Committee on Thursday. Andrew Harnik/AP
Later in her testimony, Hill said that she believed the smear campaign and eventual ousting of Marie Yovanovitch, the former US ambassador to Ukraine, were also motivated by sexism and that Yovanovitch's gender made her a target for attacks.
Go here to see the original:
The internet loved Fiona Hill blasting sexism in impeachment testimony - INSIDER
What is Google Authenticator?: How to set up Googles two-step verification software to secure all of your Google apps – Business Insider
captionGoogle Authenticator is an extra step you can take to secure your Google apps.sourceShutterstock
As technology has continued to advance, so has the ability of hackers to access our personal accounts and information, potentially putting us at risk of becoming victims of identity fraud or worse. Because of this, internet security has become increasingly important, and many services like Google now take extra steps to help protect consumers private data.
Google Authenticator is an app that uses two-step verification software to keep your information safe by requiring an added layer of identification before allowing anyone to gain access to your accounts. Instead of simply entering a password when logging into Google apps via mobile, Google Authenticator generates a random six-digit code, which youre required to enter in order to log in if you have two-factor verification active.
If youd like to use Google Authenticator to help secure your Google apps, heres how to do it.
1. Download the Google Authenticator app from the Google Play store on your Android device or the App Store on iPhone.
2. While signed into your Google account on your PC or Mac, click on the small icon with your photo in it in the upper right-hand corner of your screen and click Manage your Google account.
3. Click Security from the menu on the left side of your screen, then scroll down to the Signing in to Google header.
4. Click 2-Step Verification to turn the option on. You will then be asked to re-enter your Google account password to proceed.
5. Under Set up alternative second step, click Set Up in the Authenticator app option.
6. Choose whether you have an Android or iPhone, then click Next.
7. Open the Authenticator app on your mobile device and tap Begin setup.
8. Tap Scan barcode, on your phone, then scan the code displayed on your computer screen.
9. After scanning the code, your Authenticator app will automatically begin to display a randomized six-digit code. Click Next on your computer screen, then enter the six-digit code displayed in the Authenticator app on your phone.
10. Click Done to confirm verification.
You will now be set up with Google Authenticator and can use the app to log into your Google account moving forward.
Cybersecurity perils: What CISOs must bear in mind – Elets
Share
Share
Share
In a world where cyberattacks have become the norm, organisations have no other option but to make cybersecurity a top priority. Cyberattacks can affect the very ability of an organisation to fulfill its mandate.Many cybersecurity leaders and teams voice concern around lack of funding and minimal executive support at all levels of the organisation (including the CISOs). However, this is just a reality and not the root cause. Therefore it is critical to understand and introspect the root causes, which organisations can easily miss out, as a result of which the companys true security risk reduction suffers. While many companies have understood the implications of cyberattacks but they are still lagging behind implementing the security measures.
Here are the top five cybersecurity pitfalls organisations face and what they should do to overcome them:
Today a number of cybersecurity programs are attempting to boil the ocean instead of focusing on whatsmostimportant for the business.Enterprises must know which business process and information are of the utmost importance and make efforts to protect them.
Some organisations which have made attempts to identify the most critical data and assets to protect, though it often tends to leave integrity and availability concerns and focus solely on data theft (confidentiality). Business continuity and IT disaster recovery programs and plans traditionally work to ensure that they are able to react to availability issues from any type of outage.In many cases, these efforts are disjointed and data integrity risks are largely left to be managed by the quality or compliance department.
Chief Information Security Officers(CISOs) can helptheir companies connect deeply with their business. They can understand worst-case scenarios for information theft, manipulation, which is not limiting thinking to IT systems. Once the company plans to focus on the most critical elements of business, they can easily build speed and depth to protect them. For example: If acompany has 1,000 IT systems and 10 different functional areas, comprising 500 business processes, then where does the company start to protect its system?Is everything critical? We have seencompanies fail to answer this question and significantly slow their efforts on a critical control or focus only on one risk dimension (e.g. compliance, or data theft).
One can easily identify the most critical to business elements by just imagining what a CEO would be most concerned about if a cyberattack hit at 3 a.m. The CEO wont be concerned about the technical details but he would rather focus on business riskandoperational impact. When you keep this in mind you would be able to focus on your information security program.
Today, themedia plays a key role in educating people about cybersecurity breaches. At the same time, the media distracts the enterprise. This is mainly due to privacy-driven data breach reporting laws,and media attentiontends to focus more on customer breaches and exposed personal information rather than the pitfalls or reasons for such an event.
This reporting bias doesnt account for all of the internal and external attack types and the companies true risk impact profile. Employees might end up reading media stories on security breaches, they may get into a reactive mindset or start exhibitingconfirmation biasthat may or may not be applicable to the particular situation of your company. This kind of thinking can distract you from your organisations biggest risks.
One cannot control the kind of articles your employees read but thereis a strategy to avoid knee-jerk reactions to specific vulnerability and breach-related news. The company can leverage news media in a way that provides isolated value instead of creating a distraction by getting deeply involved in threat intelligence and sharing with other companies. One can evaluate the inputs from the media so that you can rationalise what you should react too and act upon.
Judging from the social media backlash about the vendor circus at major security conferences and events, there is some recognition and reflection about the cyber tool sprawl. When it comes to technologies like AI, machine learning and blockchain, we are often promised silver bullets and told that these tools would be implemented as soon as possible. This creates a sense that, if these are not deployed, then they would face an imminent failure in protecting the company.
We recently learned about a smaller organisations security leader who was proud to have acquired seven marquee threat detection tools. When we asked him about howhe had the ability to leverage them all effectively, his reply was that he focused on one thing which gave him the most actionable data. He was using only one threat detection tool at a time. The other six were still running and producing logs and alerts, but no one was looking at them.
It is a known fact that the companys strategic architecture practices may not yield full potential at the beginning. But bybringing adeeply experienced, big-picture security architect on board to develop an ecosystem of cybersecurity tools will help it scale appropriately. CISOs need to look past the initial funding for cool tools towards the more comprehensive total cost of ownership (for both internal and external resources), linkages to business scope, ability to drive down risk and plans for appropriate scale.
One should know the basics as these matters the most to any organisation. According to theCenter for Internet Security Critical Security Controls(CIS CSC), there are the top four basic controls, which include inventory and control of hardware, inventory, and control of software, continuous vulnerability management and controlled use of administrative privileges. However, many organisations report ineffective or incomplete efforts in all four of these fundamental efforts. Meanwhile, investments may be focused more on toolsand controlsthat are popular in the market.
The solution is to prioritize some core efforts and basics in order to ensure that your team isnt spread so thin working on shiny new tools that it obstructs progress on critical building blocks.
The CIS CSC provides a robust and periodically updated playbook that includeshardware and software inventory, vulnerability management, controlling admin privileges, secure configuration (hardware/software) and maintenance and monitoring of logs.While they all seem essential for any security program, not many companies have solid progress and maturity towards these.
While connecting the dots betweenprioritizing business riskandsolidifying the basics,companies should leverage business risk to drive privileged access security programs.
Many a time it happens that a company buys a tool but does not implement it fully and then moves on to the next new thing or realises that they dont have the resources to execute, scale up or support after the initial investment money runs out. This does not help in reducing risk in the organisation.
Getting to theappropriatescale with these efforts is the only way to fully achieve the risk reduction efforts that your money, time and effort would have costed you. Scaling is hard but it is where the magic happens with risk reduction. The appropriate scale connects directly back to the business risks where you plan to reduce.
Companies that achieve appropriate scale leverage solid and consistent project management and measurement methodologies. They think proactively about the total cost to achieve the desired risk reduction. They dont run after new tools when they see their peers implementing in their companies. Since many CISOs have a maximum of two years of tenure in the role, they may not be focusing on long-haul solutions at scale.
(Views expressed above are the personal opinion of Rohan Vaidya, Regional Director of Sales India, CyberArk)
Visit link:
Cybersecurity perils: What CISOs must bear in mind - Elets
Perimeter 81 Announces $10 Million Funding Round to Expand its Network as a Service Platform; Partners with SonicWall to Add Unified Security Services…
The companies will integrate SonicWall's advanced security solutions and Perimeter 81's matured and innovative Zero Trust Network as a Service solution. Both company's platforms will offer an easy-to-use "Secure Network as a Service" solution that provides Zero Trust access to internal resources, user and branch internet security, branch interconnectivity and endpoint security in one place.
With cloud and mobility solutions changing the way we work, we are seeing an increasing number of employees working on the go. This is driving a need to shift from a dated site-centric security model to a more cloud user-friendly, service-based platform.Perimeter 81 is one of the only vendors offering a comprehensive set of converged secure network capabilities, delivered and managed from its multi-tenant cloud.
This funding round is the latest move in a year of exponential growth for Perimeter 81. Launched in February 2018, the company has already seen 400% year over year revenue growth, expanding from 180 businesses using Perimeter 81 to 500 in the past eleven months alone. More than 81% of Perimeter 81's customers use it as their secure corporate network and not only as Zero Trust Access, replacing the need for a VPN.
"As we see greater numbers of companies, from SMBs to enterprises and governments, making the move to a perimeter-less organization largely supported by cloud services, Perimeter 81 has seen tremendous growth," said Amit Bareket, Co-Founder and CEO of Perimeter 81. "When we created our Network as a Service solution, we made it possible to easily offer security solutions on top of our existing platform. We are excited to partner with SonicWall in order to provide the most advanced Secure Network as a Service available today."
"We are excited to partner with Perimeter 81. This relationship will allow us to provide a wide range of businesses, from SMBs to Fortune 500s and governments, with our award-winning Capture Cloud Platform and real-time breach detection and prevention solutions, while allowing them to adopt a Zero Trust Security architecture that delivers tremendous efficacy in securing the modern organization," said SonicWall President and CEO Bill Conner. "Going forward, our customers and partners have choices between on-premise, cloud, and now, Secure Network as a Service all with integrated management within Capture Security Services. We believe this will ensure that our customers continue to fearless."
About Perimeter 81
Perimeter 81 is a Zero Trust Secure Network as a Service that is simplifying network security for the modern and distributed workforce. Based in Tel Aviv, the heart of the startup nation and a global hub for innovative technology development, Perimeter 81 was founded by two IDF elite intelligence unit alumni, CEO Amit Bareket and CPO Sagi Gidali. The team of security as a service experts comes together every day to deliver a truly innovative, world-class network security service. Perimeter 81's clients range from SMB to include Fortune 500 businesses and industry leaders across a wide range of sectors, and its partners are among the world's foremost integrators, managed service providers and channel resellers. Earlier this year, Gartner selected Perimeter 81 as a "Cool Vendor in Network and Cyber-Physical Systems Security. For more information, visit http://www.perimeter81.com
About SonicWall
SonicWall has been fighting the cybercriminal industry for over 28 years defending small and medium businesses, enterprises and government agencies worldwide. Backed by research from SonicWall Capture Labs, our award-winning, real-time breach detection and prevention solutions secure more than a million networks, and their emails, applications and data, in over 215 countries and territories. These organizations run more effectively and fear less about security. For more information, visit http://www.sonicwall.com or follow us on Twitter, LinkedIn, Facebookand Instagram.
SOURCE Perimeter 81
Read this article:
Perimeter 81 Announces $10 Million Funding Round to Expand its Network as a Service Platform; Partners with SonicWall to Add Unified Security Services...
Evaluating Internet Isolation Clouds: Must-Have Features – Security Boulevard
Not all Internet isolation solutions are created equal. Just ask our customers. One of them learned the hard way.
With millions of customers worldwide and trillions of dollars in assets, a leading global investment firm was a high-profile target for cybercriminals. A layered defense protected the organization against a broad variety of threats, but email phishing attacks were becoming an increasingly serious threat. Something had to be done.
To combat email threats, the organization deployed multiple layers of security. The architecture included cloud and on-premises versions of anti-spam, anti-virus, data security, encryption, and sandboxing solutions, but spearphishing attacks and drive-by malware exploits were still a significant risk. It would take only one successful attack to cause billions of dollars worth of damage.
Knowing that this was an unacceptable risk, the organization worked with Menlo Security to implement a Zero Trust Internet cybersecurity strategy. Today, all of the organizations web sessions pass through the Menlo Security Internet Isolation Cloud, isolating all web traffic. When users do click on malicious links, all sites are already safely isolated and have input-field restrictions. By isolating all email links and attachments, Menlo Security Email Isolation protects the firm against credential theft, while eliminating 100 percent of drive-by malware exploits.
Here are 5 out of 10 must-have features to look for when evaluating an Internet isolation cloud, you will need to download the ebook to see the others:
Web Isolation Technology
Protection Against Phishing
Should include and integrate email security, including automatically isolating the links and attachments from email
Prevents users from filling out suspicious web form
Native-Like User Experience
Advanced Threat Protection
Should assume that all content originating from the Internet is risky, including content that was previously benign
Provides 100 percent protection against all web- and document-borne threats, including zero-day malware
Additional Cybersecurity Features
Should go beyond just isolation to provide AV, URL filtering, DLP, reporting, policy and authentication, encrypted traffic management, cloud access security broker, and email link and attachment protection
Dont wait until your organization suffers a devastating breach or until you reach the tipping point when cybersecurity becomes cost prohibitive as a result of inefficiencies. Look for an Internet isolation cloud that has these 10 features. You wont be sorry.
Go here to see the original:
Evaluating Internet Isolation Clouds: Must-Have Features - Security Boulevard