Cloud Hosting

AV-Comparatives' study, which ran from 13 January to 28 January 2022, tested all browser and antivirus products in parallel, exposing each to 250 valid and independently-selected phishing URLs, and 250 clean URLs for false alarm detection. The phishing protection provided by the AV products was tested on Windows 10 using Google Chrome 97.0 with Google Safebrowsing disabled. The browser extensions of the AVs were installed and enabled, and the competing browsers were tested without an antivirus program running. At the time of testing, all products were updated to their latest software versions.

"For many years, Avast's threat detection engine has been a standout performer achieving excellent results in the Malware Protection, Advanced Threat Protection and Real-World Protection Tests," said Andreas Clementi, Founder and CEO of AV-Comparatives. "Recently, Avast has excelled in the anti-phishing category, which is bad news for opportunistic cybercriminals who often depend on the high success rates of phishing attacks as a means of generating greater return on investment."

In 2021, our threat detection engine has identified and blocked nearly four million unique phishing URLs each month on average," said Siggi Stefnisson, Head of Threat Labs, at Avast. "Phishing is one of the most common threats for both businesses and consumers, often because it's easier to exploit the human condition through urgency, fear or pressure than it is to hack a system. Phishing attacks, particularly those which are targeted and personalized, and phishing URLs have become so widespread, hard to identify as malicious and successful in achieving their goals of theft, fraud and corporate espionage, that it's of paramount importance we maintain an industry-leading detection rate to apply to our products and services so our customers remain safe and secure online."

*This report was commissioned by Avast, however, AV-Comparatives' anti-phishing test of all products was carried out impartially and under identical conditions. The phishing sites were selected independently by AV-Comparatives without instruction, influence, dispute or review from Avast or any of the tested parties.

A complete breakdown of the antivirus and browsers products tested are listed below:

Antivirus Products:Avast Free Antivirus 21.11, Avast One Essential 21.11, Avira Free Antivirus 15.0, Bitdefender Internet Security 26.0, ESET Internet Security 21.3, Malwarebytes Premium 4.5, McAfee Total Protection 16.0, Microsoft Defender 4.18 (with Defender browser plugin for Chrome), NortonLifeLock Norton 360 22.21.

Browsers:Avast Secure Browser 97.0, Google Chrome 97.0 (with Safebrowsing), Microsoft Edge 97.0, Mozilla Firefox 96.0, Opera 82.0.

About Avast:Avast (LSE:AVST), a FTSE 100 company, is a global leader in digital security and privacy, headquartered in Prague, Czech Republic. With over 435 million users online, Avast offers products under the Avast and AVG brands that protect people from threats on the internet and the evolving IoT threat landscape. The company's threat detection network is among the most advanced in the world, using machine learning and artificial intelligence technologies to detect and stop threats in real time. Avast digital security products for Mobile, PC or Mac are top-ranked and certified by VB100, AV-Comparatives, AV-Test, SE Labs and others. Avast is a member of Coalition Against Stalkerware, No More Ransom, and the Internet Watch Foundation. Visit:www.avast.com.

Keep in touch with Avast:

Media Contact:[emailprotected]

SOURCE Avast Software, Inc.

See more here:
Avast's Online Protection and Secure Browser Products Win Latest Anti-Phishing Comparison Test - PRNewswire

Industry implementation of the industrial Internet of Things (IIoT) for oil and gas operations will result in a significant alteration of the existing operations technology/information technology (OT/IT) digital architecture, causing a change in cyber-physical security because of new and additional cybersecurity vulnerabilities.

The conventional defense strategies for cybersecurity are based primarily on traditional IT network security designs and practices, such as assuring data integrity and protecting the confidentiality of data and intellectual property. The primary threat to oil and gas operations, however, comes from the growth in attacks designed and directed at OT systems, which can result in significant negative operational events. In recent years, this has spurred the development of expanded OT defense strategies and the technical hardening of industrial control systems.

The U.S. Department of Homeland Security has recorded the annual cyber incidents relating to different sectors (Fig. 1). The results indicate that the energy sector (including petroleum) is one of the primary potential attack targets.

Source: U.S. Department of Homeland Security

Changes in digital technologies and architectures arising from the implementation of the IIoT in oil and gas operations have brought intrinsic changes in the security landscape. The goal of this paper is to aid oilfield security planning and design processes through improved recognition of the cyber-physical security effects arising from the implementation of IIoT architectures and technologies into field OT domains.

The paper identifies and compares the current oilfield OT logical structures with the designs emerging through the IIoT implementations. The analysis includes extensive review of developing standards, such as those proposed by Industrial Internet Consortium, and ongoing published experiences to find the primary points of transition.

The security risks stemming from IIoT implementation appear to raise significant concerns with regard to potentially severe cybersecurity outcomes, which could materially affect the integrity and safety of oilfield operations. The study concentrated on the cybersecurity threats that could pose negative physical and operational conditions resulting from loss of visibility or loss of control of the operational processes in field facilities.

Extensive literature reviews were the basis for identifying the implications of cybersecurity risks in the ongoing stages of integrating the IIoT into the field. The reviews identified the modified strategies for cyber-physical systems, including potential threats and countermeasurements for the field IIoT model. These proposed strategies, however, still miss a fundamental denominator: The assessments generally ignore that it is the fundamental nature of IIoT structure itself that creates cyber-security vulnerabilities.

To investigate further, the authors performed a contrasting analysis based on specific case studies of field IIoT devices such as the pumpoff controller and OT architectures. The following three foundational threat implications emerged on the transformation of IIoT architecture into the oil field:

The cornerstone of the distinctive IIoT attributes illustrated in the paper contributes to the potential loss of control, leading to the potential for serious damages to operational outcomes in the field.

Download the complete paper from SPEs Health, Safety, Environment, and Sustainability Technical Discipline page for free until 23 February.

Find paper SPE 200858 on OnePetro here.

See the article here:
Industrial Internet of Things Raises New Security Implications - Journal of Petroleum Technology

by Joe Panettieri Feb 10, 2022

Andrew Morgan, founder, Cyber Nation & CyberCall

The Right of Boom security conference for MSPs is under way in Tampa, Florida. Both MSSP Alert and ChannelE2E are on-hand to cover the event. Keep checking this blog for ongoing updates from the event, which is hosted by Andrew Morgan founder of The Cyber Nation and host of The CyberCall.

Heres what weve heard from the event so far:

1. Can Your MSP Really Survive a Cyberattack? We raised and explored that topic ahead of the event. Among our areas of concern: What percentage of MSPs are really qualified to offer MDR (Managed Detection and Response), and how many of those MDR-focused service providers actually offer credible response capabilities? Well be seeking answers at the event.

Beau Bullock, Black Hills Information Security

2. Top 10 Cloud Security Risks MSPs and MSSPs Need to Mitigate: This topic surfaced during a pre-conference workshop led by Beau Bullock of Black Hills Information Security.

3. MSP Ecosystem Embraces Physical and Virtual CISOs: Full-time chief information security officers, virtual CISOs and associated technology startups are popping up across the MSP software industry leading a multi-year journey that is starting to deliver improved MSP industry security and enhanced risk mitigation. Its a safe bet the vCISO trend as well as actual CISOs including Dattos Ryan Weeks will be on hand at the conference.

Wes Spencer

4. Laggards In This Journey Get Left Behind: Thats the key takeaway from Wes Spencer, who called on the MSP sector to move together, continue to shift right and make sure no MSP gets left behind in the cyber journey especially as MSPs begin to master detection and extend their focus to effective right.

5. Wes Spencer Joins Rewst: Details about Spencer joining Rewst are here from ChannelE2E. Rewst is a Robotic Process Automation (RPA) software startup focused on MSPs.

Jon Murchison, CEO, Blackpoint Cyber

6. MSP Security Progress: In the past three years, the MSP industry has made 10 years of progress, Morgan asserted. I agree.

7. Blackpoint Cyber CEO Jon Murchison: Most of the initial targeting involves RDP being open to the Internet, an unpatched firewall or phishing. Youd be surprised how many Exchange Servers remain unpatched. Also, be careful of rogue RMM (remote monitoring and management) installs and related free trials that may not be secure, he noted.

Phyllis Lee, Center for Internet Security

8. DMZs Are Dead: Move to the Zero Trust Model for a proper path forward, Murchison said.

9. Get to Know the Center for Internet Security: A key name to know is Phyllis Lee, senior director for controls at the Center for Internet Security. Lee pointed out that MSPs need to really understand effective cyber hygiene to maintain a proper posture, and be aware of where you data is going, records you care about and the fact that your network ends at your employees and partners fingertips. Also, read up on the Microsoft 365 security guidance from CIS, Murchison said.

John Hammond, Huntress

Jennifer VanderWier, F1 Solutions

10. The Year of Supply Chain Vulnerabilities and Mass Exploitation: Here, guest speakers John Hammond of Huntress and Jennifer VanderWier of F1 Solutions emphasized that MSPs have to look beyond their RMM to really analyze the security of every toolset the test/adopt. In F1 Solutions case, the MSP created a standardized list of security questions that team members ask their tool vendors. And in many cases, F1 Solutions will ask multiple sources at a software company about their cyber posture to see if all the statements match.

11. Ten Security Vendors MSPs Should Ask Their Software Suppliers: Thank you to VanderWier and Hammond for the list.

Sounil Yu

12. The Irony of Automation: A great paper, recommended by keynote speaker Sounil Yu, CISO & head of research at JupiterOne.

13. Resources from Sounil Yu: Thank you to Kyle Jackson, senior program manager at ConnectWise, for that high-value link.

14. The Cyber Defense Matrix: The grid is below. For more info, check out Sounil Yus website. The site is required reading for MSPs and MSSPs. The grid is all about helping organizations to map and improve their security controls.

14. The Cyber Defense Matrix Where MSPs and MSSPs fit:Whats the difference between an MSP and an MSSP? Generally speaking, I often say that MSPs are in the shallow-end of the security pool and also offer general purpose IT support. MSSPs are in the deep-end of the security pool and focus purely on security. Thats my spin. But Yu gets even more granular by mapping out MSP and MSSP capabilities in the Cyber Defense Matrix. Note: Yus mapping is meant to be a general perspective rather than any type of official, firm guide for the services that MSPs and MSSPs generally offer. Heres the mapping:

15. Additional News Updates: Keep checking this blog for more updates. And if youd like to meet or say hi at the conference, then send me an email ([emailprotected]).

Read more:
Right of Boom Live Blog: MSP Security Conference Takeaways - MSSP Alert

The term zero trust is rapidly gaining attention as agencies move away from the more traditional castle and moat models of cybersecurity.

Zero trust refers to a cybersecurity strategy or set of principles based in the understanding that just because an account or device is associated with the organization or has seemed trustworthy in the past doesnt mean they should be assumed to be trustworthy in the future. The mindset assumes an attacker could be in the network already and emphasizes limiting a bad actors ability to access data and other resources.

Organizations adopting zero-trust principles require users and devices to continually prove they are who they claim to be, whenever they want to access data or services. This stands in contrast to older thinking in which users may have only had to authenticate themselves once to enter the organizations network, such as by logging in, and then were granted access to a wide swathe of internal resources.

Core zero-trust principles also involve restricting users access privileges to the minimum amount they need to do their jobs, something known as the principle of least privilege (POLP).

But many of todays organizations rely on workforces that are no longer on premise and on assets stored in the cloud meaning theres no longer a castle to wrap the moat around. Remote employees connect to the network from a variety of locations, through personal Internet networks and, sometimes, on personal devices outside of an organizations control. Cloud-based data also remains outside of the defense of the organizations perimeter firewalls.

Malicious actors can attempt to pass themselves off as employees using new devices or may seize control of employees accounts or devices that are already familiar to the organization, then move within the network.

Organizations need to avoid locking out legitimate employees, but enabling the wrong device or allowing the wrong level of access privileges creates significant cyber risks.

To thread the needle, organizations that adopt the zero-trust approach require devices and users to verify themselves repeatedly and monitor continually. Reducing each accounts privileges to only what is essential also minimizes the damage that a bad actor or malicious insider would be able to achieve.

The federal government has thrown its support behind the idea, with Bidens executive order asking federal agencies to transition to zero trust.

The National Institute of Standards and Technology (NIST) outlines seven tenets in a 2021 draft white paper and 2020 publication:

1. Network identity governance: Organizations need policies and tools to ensure that only authorized users who have gone through a sufficient level of authentication are granted access to enterprise data and services, and that they are only able to perform authorized actions.

2. Secure end devices: Zero-trust plans need to address end devices such as mobile devices, remote sensors and compute resources.

3. Monitor, defend and defend against owned and associated assets: Organizations should attend closely to their data and services defenses including understanding how they are configured and maintained as well as continually monitor for signs of compromise and respond quickly to events like new patches or indicators of vulnerabilities. They may also need to block connections or restrict access to those devices over which they have less control.

4. Secure all communication: Organizations must safeguard the integrity and privacy of all data in transit even for communications within the network. Otherwise, an attacker hiding on the network could view or tamper with the communications.

5. Users should only be given access to individual enterprise resources on a per-session basis: Organizations should try to tightly control access to data, services and devices. To the extent possible, organizations should require users to clear authentication and authorization checks each time they seek to perform unique operation[s]. Users also should only be given the minimum access privileges required to complete their objectives. Adopting logging, backups and versioning tools can also help recovery if unauthorized activity does occur.

6. Thoroughly and dynamically vet access requests: Limit access to enterprise resources only to members of an allow-list who also both prove their identities and their genuine need to access the particular asset in question. Identities should be verified in robust ways. Organizations may continually monitor accounts and devices for suspicious behaviors and characteristics as well as require MFA to access some systems or data and require reauthentication at various points.

7. Gather information to understand and improve security posture: Organizations should collect and analyze as much data as they can about the status of their assets, network infrastructure and communications to help them identify ways to improve policies.

More here:
What Is Zero Trust? A Guide to the Cybersecurity Approach - Government Technology