Podcasts

Byron Acohido · The supplanting of VPNs by ZTNA

Black Hat Fireside Chat: Replacing VPNs with ZTNA that leverages WWII battlefield tactics

By Byron V. Acohido

The sunsetting of Virtual Private Networks is underway.

VPNs are on a fast track to becoming obsolete, at least when it comes to defending enterprise networks. VPNs are being replaced by zero trust network access, or ZTNA.

VPNs encrypt data streams and protect endpoints from unauthorized access, essentially by requiring all network communications to flow over a secured pipe. VPNs verify once and that’s it. This was an effective approach when on-premises data centers predominated.

By contrast, ZTNA never trusts and always verifies. A user gets continually vetted, per device and per software application — and behaviors get continually analyzed to sniff out suspicious patterns.

Guest expert: Rajiv Pimplaskar, CEO, Dispersive

This new approach is required — now that software-defined resources scattered across hybrid and public clouds have come to rule the day.

I had the chance at Black Hat 2022 to visit with Rajiv Pimplaskar, CEO at Dispersive, an Alpharetta, GA-based supplier of advanced cloud obfuscation technology. We discussed how ZTNA has emerged as a key component of new network security frameworks, such as secure access service edge (SASE) and security service edge (SSE)

We also spoke about how Dispersive is leveraging spread spectrum technology, which has its roots in World War II submarine warfare, to more effectively secure modern business networks. For a full drill down on our forward-looking discussion, please give the accompanying podcast a listen.

Byron Acohido · The going-forward role for full-service MSSPs

Black Hat Fireside Chat: MSSPs are well-positioned to help companies achieve cyber resiliency

By Byron V. Acohido

Network security is in dire straits. Security teams must defend an expanding attack surface, skilled IT professionals are scarce and threat actors are having a field day.

That said, Managed Security Services Providers – MSSPs — are in a position to gallop to the rescue.

MSSPs arrived on the scene 15 years ago to supply device security as a contracted service: antivirus, firewalls, email security and the like.

They’ve progressed to supplying EDR, SIEM, threat intel platforms and numerous other advanced network security services on an outsourced basis.

Guest expert: Chris Prewitt, CTO, Inversion6

Today, big IT services companies, as well as legacy cybersecurity vendors, are hustling to essentially give shape to the next-gen MSSP, if you will. The leading players are partnering and innovating to come up with the optimum portfolio of services.

I had the chance to visit at Black Hat 2022 with Christopher Prewitt, CTO at Inversion6, a Cleveland-based supplier of managed IT security services. We discussed how far MSSPs have come since the early 2000s, when the focus was on helping companies do check-the-box compliance. For a full drill down on our forward-looking discussion, please give the accompanying podcast a listen.

Going forward, MSSPs seemed destined to play a foundational role in enabling digital commerce. They could help enterprises and SMBs overcome the IT skills shortage, truly mitigate cyber risks and comply with audit requirements, to boot.

Byron Acohido · The intricacies of overlapping cyber attacks

Black Hat insights: Getting bombarded by multiple ransomware attacks has become commonplace

By Byron V. Acohido

The top ransomware gangs have become so relentless that it’s not unusual for two or more of them to attack the same company within a few days – or even a few hours.

Related: How ‘IABs’ foster ransomware

And if an enterprise is under an active ransomware attack, or a series of attacks, that’s a pretty good indication several other gangs of hacking specialists came through earlier and paved the way.

In short, overlapping cyber attacks have become the norm. This grim outlook is shared in a new white paper from Sophos. The report paints a picture of ransomware gangs arriving on the scene typically after crypto miners, botnet builders, malware embedders and initial access brokers may have already profited from earlier intrusions.

I had the chance to discuss these findings last week at Black Hat USA 2022, with John Shier, senior security advisor at Sophos, a next-generation cybersecurity leader with a broad portfolio of managed services, software and hardware offerings. For a drill down on our discussion, please give the accompanying podcast a listen. Here are the key takeaways:

Common infection paths

Security teams face a daunting challenge. They must detect and remediate multiple cyber attacks by numerous, determined hacking groups, sometimes coming at them simultaneously and quite often seeking different objectives.

Byron Acohido · A primer on the importance of 'attack surface management'

FIRESIDE CHAT: ‘Attack surface management’ has become the centerpiece of cybersecurity

By Byron V. Acohido

Post Covid 19, attack surface management has become the focal point of defending company networks.

As digital transformation continues to intensify, organizations are relying more and more on hosted cloud processing power and data storage, i.e. Platform as a Service (PaaS,) as well as business tools of every stripe, i.e. Software as a Service (SaaS.)

I had the chance to visit with Jess Burn, a Forrester senior analyst, about the cybersecurity ramifications.

Guest expert: Jess Burn, Senior Analyst, Forrester Research

We discussed how the challenge has become defending the cloud-edge perimeter. This entails embracing new security frameworks, like Zero Trust Network Access, as well as adopting new security tools and strategies.

This boils down to getting a comprehensive handle on all of the possible connections to sensitive cyber assets, proactively managing software vulnerabilities and detecting and responding to live attacks.

A new category of attack surface management tools and services is gaining traction and fast becoming a must-have capability. To learn more, please give the accompanying Last Watchdog Fireside Chat podcast a listen.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

Byron Acohido · Here's why ZTNA has begun to replace VPNs

FIRESIDE CHAT: The inevitable replacement of VPNs by ‘ZTNA’ — zero trust network access

By Byron V. Acohido

Virtual Private Networks – VPNs – remain widely used in enterprise settings. Don’t expect them to disappear anytime soon.

This is so, despite the fact that the fundamental design of a VPN runs diametrically opposed to zero trust security principles.

I had the chance to visit with David Holmes, network security analyst at Forrester, to learn more about how this dichotomy is playing out as companies accelerate their transition to cloud-centric networking.

Guest expert: David Holmes, Analyst for Zero Trust, Security and Risk, Forrester Research

VPNs encrypt data streams and protect endpoints from unauthorized access, essentially by requiring all network communications to flow over a secured pipe. VPNs verify once and that’s it.

Zero trust — and more specifically zero trust network access, or ZTNA — never trusts and always verifies. A user gets continually vetted, with only the necessary level of access granted, per device and per software application; and behaviors get continually analyzed to sniff out suspicious patterns.

Remote access is granted based on granular policies that take the least-privilege approach. For many reasons, and for most operating scenarios, ZTNA solutions makes more sense, going forward, than legacy VPN systems, Holmes told me. But that doesn’t mean VPN obsolescence is inevitable. To learn more, please give the accompanying Last Watchdog Fireside Chat podcast a listen.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

Byron Acohido · How a new SaaS ransomware protection leverages SASE platform

FIRESIDE CHAT: New ‘SASE’ weapon chokes off ransomware before attack spreads laterally

By Byron V. Acohido

It’s stunning that the ransomware plague persists.

Verizon’s Data Breach Incident Report shows a 13 percent spike in 2021, a jump greater than the past years combined; Sophos’ State of Ransomware survey shows victims routinely paying $1 million ransoms.

In response, Cato Networks today introduced network-based ransomware protection for the Cato SASE Cloud. This is an example of an advanced security capability meeting an urgent need – and it’s also more evidence that enterprises must inevitably transition to a new network security paradigm.

Guest expert: Etay Maor, Senior Director of Security Strategy, Cato Networks

I had the chance to visit with Etay Maor of Cato Networks. We discussed how Secure Access Services Edge – SASE – embodies this new paradigm. In essence, SASE moves the security stack from the on-premises perimeter far out to the edge, just before the cloud.

This gives security teams comprehensive visibility of all network activity, in real time, which makes many high-level security capabilities possible. For a full drill down on my conversation with Etay Maor, please give the accompanying podcast a listen.

Network security developments are progressing. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

Byron Acohido · How cybercriminal specialists aid and abet ransomware

RSAC insights: How IABs — initial access brokers — help sustain, accelerate the ransomware plague

By Byron V. Acohido

Specialization continues to advance apace in the cybercriminal ecosystem.

Initial access brokers, or IABs, are the latest specialists on the scene. IABs flashed to prominence on the heels of gaping vulnerabilities getting discovered and widely exploited in Windows servers deployed globally in enterprise networks.

I had the chance at RSA Conference 2022 to visit with John Shier, senior security advisor at Sophos, a security software and hardware company. We discussed how the ProxyLogon/Proxy Shell vulnerabilities that companies have been scrambling to patch for the past couple of years gave rise to threat actors who focus on a singular mission: locating and compromising cyber assets with known vulnerabilities.

For a drill down on IABs, please give the accompanying podcast a listen. Here are the key takeaways:

Sequential specialists

IABs today jump into action anytime a newly discovered bug gets publicized, especially operating system coding flaws that can be remotely exploited. IABs gain unauthorized network access and then they often will conduct exploratory movements to get a sense of what the compromised asset is, Shier told me.

This is all part triangulating how much value the breached asset might have in the Darknet marketplace. “IABs specialize in one specific area of the cybercrime ecosystem where the victims are accumulated and then sold off to the highest bidder,” he says.

To assure persistent access to, say, a compromised web server, an IAB will implant a web shell – coding that functions as a back door through which additional malicious

« Newer Articles

Older Articles »

The Last Watchdog

Podcasts

Black Hat Fireside Chat: Replacing VPNs with ZTNA that leverages WWII battlefield tactics

By Byron V. Acohido

Black Hat Fireside Chat: MSSPs are well-positioned to help companies achieve cyber resiliency

By Byron V. Acohido

Black Hat insights: Getting bombarded by multiple ransomware attacks has become commonplace

By Byron V. Acohido

FIRESIDE CHAT: ‘Attack surface management’ has become the centerpiece of cybersecurity

By Byron V. Acohido

FIRESIDE CHAT: The inevitable replacement of VPNs by ‘ZTNA’ — zero trust network access

By Byron V. Acohido

FIRESIDE CHAT: New ‘SASE’ weapon chokes off ransomware before attack spreads laterally

By Byron V. Acohido

RSAC insights: How IABs — initial access brokers — help sustain, accelerate the ransomware plague

By Byron V. Acohido