Home Podcasts Videos Guest Posts Q&A My Take Bio Contact



CyberArk shows how ‘shadow admins’ can be created in cloud environments

By Byron V. Acohido

There’s little doubt “digital transformation” is here to stay. And it is equally clear that just about all of the fundamental network vulnerabilities we already know about will escalate, in lockstep, with any benefits accrued.

It turns out that speeding up tech innovation cuts both ways.

Related article: How safeguarding privileged accounts can lower insurance

A vivid illustration of this  truism comes from the rising challenges businesses face locking down privileged accounts. I had the chance to visit with CyberArk security researchers Lavi Lazarovitz and Asaf Hecht just after they carried out a stunning demo at RSA Conference 2018.

The pair showed how threat actors can create all-powerful  “shadow admin” accounts within cloud platforms, such as Amazon Web Services, Microsoft Azure and Google Cloud, simply by manipulating the very design features meant to make cloud services nimble and agile.

For a full drill down on our discussion, please listen to the accompanying podcast. Here are key takeaways.

On-premise vs. cloud

Some context: When I interviewed CyberArk CEO Udi Mokady back in 2013, we discussed how most organizations had a lot to learn about privileged access security best practices. The vast majority of organizations at the time underestimated the number of privileged accounts that existed in their networks, allowed employees to widely share passwords, did not use two-factor authentication much, and changed passwords infrequently.

Since then companies have made substantial progress. Privileged access security technologies and best practices have been more widely adopted with respect to on-premises data centers. Companies are paying much closer attention to the use —  and abuse — of privileged accounts, credentials and secrets, especially those that provide root access to mission-critical systems. …more

Why antivirus has endured as a primary layer of defense — 30 years into the cat vs. mouse chase

By Byron V. Acohido

Antivirus software, also known as antimalware, has come a long, long way since it was born in the late 1980’s to combat then nascent computer viruses during a time when a minority of families had a home computer.

One notable company’s journey in the space started in 1987 when three young men, Peter Paško, Rudolf Hrubý, and Miroslav Trnka, built one of the earliest antivirus prototypes while working out of a house in the former Czechoslovakia. A few years later they formally launched ESET in the central European country of Slovakia in the city of Bratislava.

Related article: NSA super weapons fuel cyber attacks

ESET has endured as part of a select group of legacy antivirus companies that got started in that era. The list includes Avira, Avast, AVG, Bitdefender, F-Secure, G Data, Kaspersky, McAfee, Panda, Sophos, Symantec and Trend Micro.

It’s amazing that these companies all continue to thrive years later, long after pundits declared traditional antivirus too anachronistic to keep pace with the rise of ecommerce, cloud computing, mobile computing and now the Internet of Things. But they were wrong.

Today the “endpoint security” market, which includes antimalware, antispyware and firewalls, is as healthy as ever; research firm Marketsandmarkets estimates global spending on endpoint security will rise to $17.4 billion by 2020, up from $11.6 billion in 2015, a robust 8% per annum growth rate.

I had the chance to discuss ESET’s evolution from traditional antivirus to a full suite of security solutions (ransomware protection, threat intelligence, encryption and the like) with Tony Anscombe, ESET’s global security evangelist, at RSA Conference 2018. For a drill down on our conversation please give the accompanying podcast a listen. A few big takeaways: …more

MY TAKE: Why DDoS attacks continue to escalate — and how businesses need to respond

By Byron V. Acohido

Law enforcement’s big win last month dismantling ‘Webstresser,’ an online shopping plaza set up to cater to anyone wishing to purchase commoditized DDoS attack services, was a stark reminder of the ever present threat posed by Distributed Denial of Service attacks.

Related video: How DDoS attacks leverage the Internet’s DNA

The threat actors running Webstresser accepted all paying customers — no questions asked.  Anybody could use Webstresser’s online payment system to rent out stressers or booters, available for hire for as little as $18 per month — and most effective at flooding targeted servers with traffic, no technical skills required.

Webstresser had more than 136,000 registered users who patronized it to launch some 4 million DDoS attacks against government agencies, banks, police and gambling sites, according to Europol. Keep in mind, Webstresser is just one colorful example of how far DDoS attacks have come.

DDoS originated a decade or more before anyone ever thought up ransomware attacks; and DDoS has advanced and expanded, approximately on par with targeted phishing and leading-edge data breach tactics.

I recently had a chance to discuss the current state of DDoS threats with Lee Chen, CEO of A10 Networks, a leading supplier of advanced DDoS detection and mitigation systems. For a full drill down on our discussion please listen to the accompanying podcast. Here are a few takeaways: …more

MY TAKE: Why the unfolding SIEMs renaissance fits hand-in-glove with ‘digital transformation’

SIEM systems have been on the comeback trail for a few years now. And now SIEMs could be on the verge of a full-blown renaissance.

Related article: Freeing SOC analysts from tedious tasks

I spoke with several vendors who are contributing to this at RSA Conference 2018. One of them  was Securonix, a supplier advanced next-generation SIEM  (security and information management) technology. The Addison, Tex.-based company is also a leading innovator in UEBA (user and entity based analytics) systems.

For a full drill down of my conversation with Nitin Agale, Securonix’s SVP of products, please listen to the accompanying podcast. A few takeaways from our discussion:

SIEMs’ second wind

SIEMs, you may recall, first cropped up in 2005, and, at the time, got unfairly hyped as something of a silver bullet. SIEMs are designed as a tool to collect event log data from internet data as well as corporate hardware and software assets, and then cull meaningful security intelligence from a massive volume of potential security events.

For a number of reasons, SIEMs never quite lived up to their initial promise. Now, 13 years later, we’re in the midst of a “digital transformation” that has resulted in an exponential increase in the volume of business data, much of it circulating in the cloud. …more

NEW TECH: Acalvio weaponizes deception to help companies turn the tables on malicious hackers

By Byron V. Acohido

Differentiating itself in a forest of cybersecurity vendors has not been a problem for start-up Acalvio Technologies. While hundreds of other security companies tout endless types and styles of intrusion detection and prevention systems, Acalvio has staked out turf in a promising new sub-segment: deception-based security systems.

Related article: Hunting for exposed data

Launched in 2015 by a group of cybersecurity veterans, the Santa Clara, Calif.-based start-up has 50 employees and has raised $22 million in venture capital financing to date. It has achieved this by pioneering technology that lays in wait for intruders who manage to get inside a company’s firewall, and then leads them down a path rife with decoy systems and faux data.

I had the chance to visit with Acalvio marketing chief, Rick Moy, at RSA Conference 2018. For a drill down on our conversation please listen to the accompanying podcast. Here are a few high-level takeaways:

Changing tactics

Deception is an age-old stratagem. Animals and insects use it to survive in the wild. Warring nations use it to gain tactical advantage over each other. Cybercrime and cyber warfare, no surprise, largely revolve around deception. Phishers deceive to gain trust; hackers deceive to avoid detection. …more

How ‘identity governance’ addresses new attack vectors opened by ‘digital transformation’

By Byron V. Acohido

Mark McClain and Kevin Cunningham didn’t rest for very long on their laurels, back in late 2003, after they had completed the sale of Waveset Technologies to Sun Microsystems. Waveset at the time was an early innovator in the then-nascent identity and access management (IAM) field.

The longtime business partners immediately stepped up planning for their next venture, SailPoint Technologies, which they launched in 2005 to pioneer a sub segment of IAM, now referred to as identity governance. Today SailPoint has 800-plus employees and growing global sales.

Related article: What the Uber hack tells us about DevOps exposures

The company is coming off a successful initial public offering last November in which it raised $240 million. SailPoint’s share price has climbed from the mid-teens to the mid-twenties since its IPO.

I had the chance to visit with McClain, SailPoint’s CEO – Cunningham serves as chief strategy officer—at RSA Conference 2018. We had an invigorating discussion about how “digital transformation” has intensified the urgency for organizations to comprehensively address network security, and how identity governance is an important piece of that puzzle. For a full drill down, please listen to the accompanying podcast. Here are excerpts edited for clarity and space:

LW: Your focus is on helping companies do much better at a fundamental security best practice.

McClain: Exactly. Within the big realm of security, we’re within the realm of identity, which is getting a lot of airtime these days.  And within identity, our focus is on what’s called identity governance . . . The company has been around for a while now. We work in almost every industry vertical and focus on mid-sized enterprises with 2,000 to 3,000 employees all the way to the largest global enterprises in the world. …more

PODCAST: Netsparker advances penetration testing 2.0 – automated web app vulnerability scanning

By Byron V. Acohido

A dozen years ago, or so, Ferruh Mavituna was doing very well as a lead penetration tester at a prominent cybersecurity consultancy when his frustration level began to spike.

Mavituna had access to the best tools available to hunt down latent vulnerabilities in web applications. And yet, all too often for Mavituna’s tastes, the tools spat out “false positives” – false alerts to vulnerabilities that really did not exist. Or sometimes the tools would simply overlook security holes that would later surface.

Related article: Cross-site scripting attacks plague web apps.

Believing he could do much better, Mavituna spent a few years doing R&D and then in 2009 launched Netsparker to introduce a new type of automated web vulnerability scanner. Today Netsparker’s automated scanner is used by the likes of Samsung, NASA, Skype, ING and Ernst & Young.

I had a chance to visit with Mavituna at RSA Conference 2018 recently in San Francisco. The company, which is headquartered in the U.K., had just announced receipt of $40 million in financing from  Turn/River Capital, a San Francisco-based growth and private equity fund. The cash infusion will be used to accelerate marketing and expand into more geographical markets.

Just last week, Netsparker received the prestigious Queen’s Award for Enterprise. To qualify the company had to demonstrate steep year-on-year growth  in overseas sales three years running, or substantial year-on-year growth over six years. …more