2^nd article: Facing to invasion of more and more sophisticated data security threats business leaders push IT to deploy new technologies and services.

Continuing presentation of the IDC IT Security Roadshow organised in April 14th in Bucharest, will try to review the most important security issues discussed during keynote presentations and panel sessions.

Expose the Unknown – most important driver of data prevention for Check Point

One of the hottest subjects in the industry now is zero-day attacks prevention. According to Check Point a “zero-day” exploit is any vulnerability that’s exploited immediately after its discovery. We speak here about rapid attacks that take place before the security community or the vendor knows about the vulnerability, or has been able to repair it. Such kind of exploits are a Holy Grail for hackers because they take advantage of the vendor’s lack of awareness and the lack of a patch, enabling the hacker to wreak maximum havoc. Zero-day exploits are often discovered by hackers who find a vulnerability in a specific product or protocol. Once discovered, zero-day exploits are disseminated rapidly, typically via Internet Relay Chat channels or underground Web sites. From practice, detailed information about zero-day exploits are available only after the exploit is identified.

“Increasing your enterprise security often means increasing your complexity and management challenges in kind. Check Point delivers a multi-layered line of defence to help you maximize your security while minimizing challenges and closing gaps”, said Cezar Varlan – Security Engineer, Check Point Software Technologies

Trying to cover multiple-layers potential vulnerabilities, many organizations are investing in a disparate mix of new security technologies from a variety of vendors. All these tools provide punctual advantage but each must be managed individually, including reporting, provisioning, configuration and testing tasks.

Check Point offers a comprehensive solution, with a full range of interoperable threat prevention blades, common policy management and monitoring, and maximum protection from emerging threats. Attackers have become more creative, reaching corporate resources with modern and complex malware attacks. Check Point SandBlast Zero-Day Protection combines innovative technologies to proactively protect against even the most dangerous targeted attacks and unknown malware, while ensuring quick delivery of safe content.

Staying ahead of the threat with Fortinet

Today’s threats are increasingly sophisticated and often bypass traditional malware security by masking their maliciousness. As these attacks become more advanced, organizations must similarly improve their security posture. Why do these breaches continue? “Extreme focus on compliance, reacting only to known threats, and existing of to many point solution are between main reasons”, said Adrian Danciu – Regional Director, South Eastern Europe, Fortinet. “More that, the lack of a defined perimeter offers a borderless attack surface.”

Fortinet solutions are based on a deep segmentation for protection against outside and inside threats, proactive Mitigation, Advanced Threat Visibility, and Flexible Deployment Fortinet Advanced Threat Protection relies on multiple types of security technologies, products, and research applied from the network edge through to endpoint devices. To deliver the most effective protection, they are integrated to work together automatically, continuously handing off data from one to the next to identify, evaluate and respond to attacks.

Fortinet Advanced Threat Protection Framework delivers end-to end protection across the attack chain, based on three elements which work hand-in-hand:

• Prevent – Act on known threats and information
• Detect – Identify previously unknown threats
• Mitigate – Respond to potential incidents

Fortinet was recognised as major player in fastest growing market segment – network security and WLAN market (IDC, 2015), largest network security appliance vendor (units) and quickly growing (IDC – Worldwide Security Products), and second largest provider for Data Center Firewall (Infonetics research).

Applying probabilistic mathematics and machine learning to cyber threat discovery

Very interesting point of view opened by Darktrace and Safetech, based on major role machine learning could have in probabilistic identification of cyber threats.

Machine learning can be thought of as the third and most recent machine revolution. The first was the replacement of muscle by machine in the industrial revolution. The second involved computers taking over repetitive tasks that had originally been done by people. Machine learning represents computers being able to undertake complex thoughtful tasks.

Darktrace’s technology is powered by advanced machine learning, allowing it to learn what is normal for a company’s network environment, so that it can then determine if any behaviour is abnormal. This allows it to detect cyber-attacks of a nature that may not have been observed before, the unknown unknowns. The ability to self-learn and adapt to a changing environment in real-time allows organizations to reconcile the need for an interconnected workforce, customer base and supply chain, whilst ensuring that they protect against serious, existential threats to their businesses in the most effective and pragmatic way possible.

Legacy approaches to cyber security embody the second revolution: people describe what an attack looks for, and then ask the computer to look for a match to that description. Darktrace turns this paradigm on its head, embodying the third machine revolution: the computer analyses the data and finds areas that merit human interrogation. It is this capability that allows Darktrace to abandon the legacy approach of rules and signatures, and analyse even fast-moving, sophisticated and unknown threats in real time.

“Our vision is to apply human intelligence to cyber defence through revolutionary technology. Deep expertise in cyber defence operations and ground-breaking, self-learning technology allows organizations to keep up with the speed and sophistication of today’s attackers, “said Mateusz Flak – Cyber Security Regional Manager, Darktrace. “The age of surrounding your information with higher and higher walls is over. Legacy approaches permanently leave you a step behind. Darktrace moves at the same speed as the threat, automatically learning from an organization’s ongoing activity in real time to detect threat behaviours as they emerge.”

New approach for modern threat prevention coming from Palo Alto Networks

Most important is everybody should understand the prevention is no negotiable. The Palo Alto Networks’ strategy for modern threat prevention is based on five simple processes every organization should implement, each of them having a well-established actions:

• Everything must go in the funnel
• Reduce the attack surface
• Block known threats
• Test and adapt to unknowns
• Investigate and respond
• Investigate indicators

One of most frequent cyberattacks are ransomware messages. Attackers have traditionally profited by stealing identities or credit card numbers, and then selling them on underground markets. According to the Verizon Data Breach Investigations Report, the

price for stolen records has fallen, so cyber attackers are on the hunt for new ways to make a profit. Due to technology advances in attack distribution, anonymous payments, and the ability to reliably encrypt and decrypt data, ransomware effect is decreasing.

According Palo Alto Networks, the three key steps to protect against ransomware are based on:

• Preparation – Having a solid backup and recovery strategy in place is the key to recovery if the worst were to happen.
• Prevention – Segment your network, control access, stop known malware, and quickly detect and prevent unknown malware as it arises.
• Response – Understand the latest ransomware families and campaigns. Have a plan in place for engaging law enforcement agencies.

To better deserve the threat and attacks research Palo Alto Networks opened Unit42, with clear mission to analyse the data available to Palo Alto Networks to identify adversaries, their motivations and resources to better understand the threats our customers face.

Other valuable principle developed by Palo Alto is based on comprehensive concept of Threat Intelligence. What is Threat Intelligence? “Evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard, “ explained Peter Lechman – Regional Sales Manager – Eastern Europe, Palo Alto Networks, during his keynote in IDC Roadshow from Bucharest.

A new approach to security from Symantec

Knowing how cyber-criminals are threatening security is the first step to securing information—and any company’s goals. From data breaches to digital extortion, the 2016 Symantec Internet Security Threat Report leverages an unparalleled amount of data and is the resource you need to quickly uncover digital threats.

Here are the main key finding pf the last edition of ISTR, presented by Christos Trizoglou – Regional Manager of MiTech Systems, Symantec in his keynote from Bucharest:

• A large business attacked once in 2015 was likely to be attacked 3 more times

  

• 50% of all targeted attacks were against small businesses
• 55% increase in the number of spear-phishing campaigns attacks in 2015
• 3out of 4legitimate websites found to have unpatched vulnerabilities
• 125% increase in the number of zero-day vulnerabilities discovered
• 100 Million Technical Support scams blocked
• 35% increase in crypto-ransomware as it spread beyond end-users to holding businesses hostage
• A record 9 mega breaches occurred in 2015
• 430 Million new pieces of unique malware discovered

Symantec is ready to deliver a unified security intelligence platform that leverages the combined visibility and intelligence of all of his offerings (augmented by 3rd-party data) to block, detect, and remediate attacks, protect information, and reduce risk. Best Practices provided by Symantec are based on following advices:

• Don’t get caught unprepared – Use advanced threat intelligence solutions to find indicators of compromise and respond faster to incidents;
• Employ a strong security posture – Implement multi-layered endpoint security, network security, encryption, strong authentication &reputation-based technologies. Partner with a managed security service provider to extend your IT team;
• Prepare for the worst – Incident management ensures your security framework is optimized, measureable and repeatable, and that lessons learned improve your security posture. Consider adding a retainer with a third-party expert to help manage crises;
• Provide ongoing education and training – Establish guidelines & company policies and procedures for protecting sensitive data on personal and corporate devices. Regularly assess internal investigation teams—and run practice drills—to ensure you have the skills necessary to effectively combat cyber threats.

 Internet Identifiers – Your Most Undervalued and Under Risk Assets?

Very interesting subject proposed by ICANN which considers Internet Identifiers for both vulnerability place and security asset. ICANN (Internet Corporation for Assigned Names and Numbers) is a not-for-profit public-benefit corporation with participants from all over the world dedicated to keeping the Internet secure, stable and interoperable. ICANN mission is to preserve the security, stability and resiliency of the Domain Name System and domain name registration services, to promote user confidence and trust in these systems.

Obviously identifiers are common targets for loss, misuse or abuse. Domain Name are subject of various attacks, having as consequence loss of Web services, public defacement, eMail or eCommerce functions disruptions. IP addresses damages conduct to network disruption and data exfiltration. Autonomous System Numbers breaks can generate disruption of global communications systems and largescale loss of commercial hosting.

From Risk Mitigation perspective Internet Identifiers could be considered as assets. The best practice is based on quick adoption of standard risk management practices: regular evaluation of organization’s identifier assets, correct appreciation of the threat landscape and the vulnerabilities status, managing risks by priorities, and correctly positioning of mitigation techniques against protection costs. Periodic analysis is a strong defense.

Resource and relationship management could play critical roles in Risk Mitigation. “Organizations should know their allies, keeping points of contact for mitigation providers, upstream ISPs, hosting providers, registries, registrars, vendors and security service technical support,” said Andrea Beccalli – Stakeholder Engagement Manager – Europe, at ICANN

A new data protection regulation is born… during IDC conference in Bucharest

A happy coincidence was the final approval of the new EU General Data Protection Regulation has successfully passed through the European Parliament in the same day with IDC conference from Bucharest. Essential regulation and the critical importance for European Commission efforts toward a future Digital Single Market were presented by Bogdan Manolea – Legal Advisor, Legi-internet.ro

European Union (EU) member states will now had two years to pass the new regulations – which were proposed by former EU justice commissioner Viviane Reding four years ago – into law. The data protection reform package includes both the GDPR and the Data Protection Directive for Police and Criminal Justice Authorities. It replaces current rules based on directives laid down in 1995 and 2008.

Concluding, IDC IT Security Roadshow is a professional marathon inviting industry specialists and business managers to think, to learn and to act against digital security threats. This year IT security conference series investigates the threats to key systems, data, and networks, and the main actions that organizations need to take to secure them. IDC is advising security professionals not only to look at investing in security solutions, but also at people and processes, employees and business partners, helping individuals and organizations to develop a strategic thinking.