Home Podcasts Videos Guest Posts Q&A My Take Bio Contact
 

My Take

 

MY TAKE: How SASE has begun disrupting IT — by shifting cybersecurity to the ‘services edge’

By Byron V. Acohido

One of the hottest topics at RSA Conference 2021 taking place virtually this week is the Secure Access Services Edge (SASE) security framework.

Related: Cybersecurity experts react to Biden’s EO

SASE (pronounced sassy) essentially is a roadmap for infusing privacy and security deeply into the software coding that gives life to our smartphones, IoT devices and cloud infrastructure, i.e. at the “services edge,” where all the action is taking place.

Coined by Gartner in late 2018, SASE is gaining momentum as a generational disruptive force. It calls for organizations to start proactively managing the myriad new attack vectors they’ve opened up in the pursuit of digital agility — by embracing a bold new IT architecture that extends network security far beyond the traditional perimeter

However, disruption doesn’t happen without displacement. And at this early stage, things are a bit chaotic. As established and newer cybersecurity vendors scramble to catch the SASE wave, marketing messages have sometimes been less than clear.

From the customer’s point of view, some early-adopter enterprises have experienced buyer’s remorse trying out SASE services that don’t really make the grade, says Mike Spanbauer, security evangelist at Juniper Networks, a Sunnyvale, Calif.-based supplier of networking technology.

“What we’ve heard from out in the marketplace is that a number of SASE solutions that supposedly could deliver everything as promised, were found to be lacking in many capacities,” Spanbauer says.

ROUNDTABLE: Experts react to President Biden’s exec order in the aftermath of Colonial Pipeline hack

By Byron V. Acohido

As wake up calls go, the Colonial Pipeline ransomware hack was piercing.

Related: DHS embarks on 60-day cybersecurity sprints

The attackers shut down the largest fuel pipeline in the U.S., compelling Colonial to pay them 75 bitcoins, worth a cool $5 million.

This very high-profile caper is part of an extended surge of ransomware attacks, which  quintupled globally between the first quarter of 2018 and the fourth quarter of 2020, and is expected to rise 20 percent to 40 percent this year,  according to insurance giant Aon.

Ransomware is surging at at time when the global supply chain is being corrupted from inside out, as so vividly illustrated by the SolarWinds supply chain debacle.

In response, President Biden last week issued an executive order requiring more rigorous cybersecurity practices for federal agencies and contractors that develop software for the federal government. Last Watchdog asked a roundtable of cybersecurity industry experts for their reaction. Here’s what they said, responses edited for clarity and length:

Chenxi Wang, founder & general partner, Rain Capital

The new executive order is a swift response from the administration. It’s refreshing to see a government executive order that understands technology trends such as “zero trust”, is able to delineate “Operational Technology (OT)” from “information technology (IT,)” and can talk intelligently about supply chain risks.

While some of the measures stipulated in the order are considered table stakes like multi-factor authentication, the fact that the order exists will help to raise the collective security posture of products and services. It will not be sufficient to defend against sophisticated adversaries, but it will help organizations on the lower end of the capability spectrum to improve their cyber posture and defense.

Keatron Evans, principal security researcher, Infosec Institute

President Biden’s order was drafted with heavy involvement from actual cybersecurity experts, and this is encouraging. Requiring federal agencies to produce an actionable plan to implement Zero Trust Architecture is … more

RSAC insights: Introducing ‘CWPP’ and ‘CSPM,’ new frameworks to secure cloud infrastructure

By Byron V. Acohido

A greater good has come from Capital One’s public pillaging over losing credit application records for 100 million bank customers.

Related: How credential stuffing fuels account takeovers

In pulling off that milestone hack, Paige Thompson took advantage of CapOne’s lack of focus on cloud security as the banking giant rushed headlong into leveraging Amazon Web Services. Luckily, Thompson left an easy trail for the FBI to follow and affect her arrest in August 2019.

The lone wolf hacker’s lasting legacy may be that she gave the cybersecurity industry an impetus to double down on its efforts to help enterprises get a grip on cloud security.

A slew of new cloud-security frameworks have gained traction since the Capital One hack. I recently had the chance to sit down with Kevin Simzer, chief operating officer of Trend Micro, to discuss two of them: Cloud Workload Protection Platform (CWPP) and Cloud Security Posture Management (CSPM.) For a full drill down on our conversation please give the accompanying podcast a listen. Here are the key takeaways:

Cloud migration risks

The summer of 2019 was a heady time for the financial services industry. Capital One’s valuation hit record highs at a time when its senior executives bragged on Wall Street about how the bank’s aggressive adoption of AWS-supplied infrastructure would boost both profits and security. In reality, the bank wasn’t paying close enough attention to its shared responsibility for keeping its cloud-stored assets secure.

RSAC insights: Deploying SOAR, XDR along with better threat intel stiffens network defense

By Byron V. Acohido

Much attention has been paid to the widespread failure to detect the insidious Sunburst malware that the SolarWinds hackers managed to slip deep inside the best-defended networks on the planet.

Related: The undermining of the global supply chain

But there’s also an encouraging ‘response’ lesson SolarWinds teaches us, as well.

Reacting to the disclosure of this momentous supply-chain hack, many of the breached organizations were able to deploy advanced tools and tactics to swiftly root out Sunburst and get better prepared to repel any copycat attacks. It was an opportunity to put their security orchestration and automation and response (SOAR) solutions, as well as endpoint detection and response (EDR) tools, to the test.

In that sense, SolarWinds validated the truckloads of investment that has been poured into developing and deploying SOAR and EDR innovations over the past five years. I had the chance recently to visit with Leon Ward, Vice President of Product Management, at ThreatQuotient, provider of a security operations platform with multiple use cases including serving as a threat intelligence platform (TIP). We discussed current developments that suggest SOAR and EDR will continue to improve and make a difference.

For a full drill down on our conversation, please give the accompanying podcast a listen. Here are my key takeaways:

Leveraging richer intel

It was by happenstance that analysts at FireEye, a leading supplier of intrusion detection systems, stumbled into a copy of the Sunburst Trojan ever-so-stealthily embedded in FireEye’s own copy of SolarWinds’ Orion network management software. That was on Dec. 13, 2020.

RSAC insights: ‘SASE’ disrupts networking by meshing security, connectivity at the services edge

By Byron V. Acohido

It’s accurate to say that security has been bolted onto modern business networks.

It also has become very clear that we won’t achieve the full potential of digital transformation without security somehow getting intricately woven into every layer of corporate IT systems.

We’re still a long way from achieving that, but a promising roadmap has emerged. It’s a new model for architecting enterprise IT systems, dubbed Secure Access Service Edge (SASE), a term coined by top security analysts at tech advisory firm Gartner.

I had the chance to visit with Kelly Ahuja, CEO of Versa Networks, a supplier of SASE systems. For a full drill down on our discussion on why SASE could be game changer, please give a listen to the accompanying podcast. Here are the key takeaways:

Connectivity vs. security

Corporate networks exist to connect users to applications. Traditionally this was done by setting up a datacenter at company headquarters, and having employees enter the building and access applications using company-managed equipment. Thus, local area networks, or LANs, were born.

Then along came wide area networks, or WANs, as a means to securely connect several LANs set up in geographically dispersed branch offices. Over time WANs proved to be expensive and inflexible, so they began to be replaced with software-defined wide area networks, or SD-WANs, which offered heightened data-transfer efficiencies.

However, the first-generation of SD-WAN solutions were notable for one key thing: they were solely focused on improving connectivity and did little to account for security.

RSAC insights: How the ‘CIEM’ framework is helping companies manage permissions glut

By Byron V. Acohido

A permissions glut is giving rise to an explosion of new exposures in modern business networks.

Related: Securing digital identities

Companies are adopting multi-cloud and hybrid cloud infrastructures and relying on wide-open app development like never before. In doing so, permissions to make myriad software connections are proliferating. Taken together these man-to-machine and machine-to-machine connections result in cool new digital services. But they’ve also dramatically expanded the attack surface and left it wide open to threat actors.

Now comes an emerging security discipline to help companies get a grip on all of these permissions. It’s called “cloud infrastructure entitlement management,” or CIEM, not to be confused with security information and event management, or SIEM, which is something else altogether.

Last Watchdog visited with Raj Mallempati, chief operating officer of CloudKnox Security, aSunnyvale, Calif.-based cybersecurity firm, to get a better understanding of emergent CIEM systems. For a full drill down on our discussion please give a listen to the accompanying podcast. Here are key takeaways:

The permissions glut

Managing permissions in a way that doesn’t unduly tax agility has become a Gordian Knot security challenge. To start, the raw volume of permissions continues to rise exponentially. Consider that global spending on cloud infrastructure services jumped 32 percent to nearly $40 billion in the last quarter of 2020. This reflects the rise in remote work and schooling, as well as spikes in online shopping, gaming and media streaming over the past 12 to 18 months.

RSAC insights: Sophos report dissects how improved tools, tactics stop ransomware attack

By Byron V. Acohido

A new report from Sophos dissects how hackers spent two weeks roaming far-and-wide through the modern network of a large enterprise getting into a prime position to carry out what could’ve been a devasting ransomware attack.

Related: DHS embarks on 60-day cybersecurity sprints

This detailed intelligence about a ProxyLogon-enabled attack highlights how criminal intruders are blending automation and human programming skills to great effect. However, in this case, at least, they were detected and purged before hitting paydirt, demonstrating something that doesn’t get discussed often enough.

Enterprises actually have access to plenty of robust security technology, as well as proven tactics and procedures, to detect and defuse even leading-edge, multi-layered attacks. It’s clear to me that cybersecurity technical innovation and supporting frameworks, which includes wider threat intelligence sharing, are taking hold and making a material difference, albeit incrementally.

I had a lively discussion with Dan Schiappa, Sophos’ chief product officer, about this. For a drill down, please give the accompanying podcast a listen. Here are the key takeaways:

Exploit surge

ProxyLogon refers to the critical vulnerability discovered in Microsoft Exchange mail servers early this year. Criminal hacking rings have been hammering away at this latest of a long line of zero-day flaws discovered in a globally distributed system. The pattern is all too familiar: they marshal their hacking infrastructure to take advantage of the window of time when there is a maximum number of vulnerable systems just begging to be hacked.