devopsy.kinsta.cloud

Tag: Cybersecurity

  • DevSecOps: Can JIT PAM Bring Relief?

    DevSecOps: Can JIT PAM Bring Relief?

    IT and cybersecurity leaders have come to agree that the purpose and intent of DevSecOps is to create a mindset that “everyone is responsible for security,” while also incorporating application and infrastructure security directly into the software development and delivery process. DevSecOps has proven to be a critical ideology for cybersecurity, yet is littered with false starts and failures. Many of those failures can be attributed to a basic misunderstanding, wherein IT management has come to use the terms DevSecOps and DevOps interchangeably, because of the false belief that security is already part of the DevOps process.

    A recent CyberArk DevOps Survey polled respondents to determine if DevOps and security teams were integrated, less than half of the respondents said yes. What’s more, almost three-quarters said they had no privileged account security strategy for DevOps and some 99% failed to identify all of the different places privileged accounts or secrets could exist in a DevOps environment. The survey demonstrates that common and well-established security practices have not been adopted by DevOps teams. Clearly, DevOps and DevSecOps are not synonymous.

    A clear vision of what DevSecOps should be about can lead to DevOps teams releasing vulnerable software and exposing enterprises to unnecessary risk—a problem that has been manifesting itself in the rush to embrace digital transformation and re-engineer legacy apps into cloud-based equivalents. Expediency combined with a lack of understanding increases risk, which should cause alarm.

    For the most part, breaches occur because of a lack of privilege management, In other words, proper security practices dictate the who, how and when of access, along with the permissions associated with that access. It is a concept that has given birth to platforms that manage privileges, also known as privileged access management (PAM) solutions. For DevSecOps to succeed, the concept of privilege must be embraced. However there is more to security than just privilege management; namely, the context of privilege must be incorporated, such as the “why,” “when,” and “where” of access.

    Simply put, administrators and managers often forget to revoke the rights of temporary workers, contractors and other non-employees when a project is complete. It’s an issue that plagues many DevOps teams that rely on freelancers to help move the processes forward. The lesson here is one of instituting better controls and policies, which ultimately can be adopted throughout the enterprise to bring better cybersecurity to fruition.

    JIT PAM to the DevSecOps Rescue?

    Better control over privileges has created a new acronym, JIT (just in time), that takes residence in front of the PAM acronym. The concept of JIT PAM, which is being promoted by security vendors such as Beyond Trust, is one of controlling access based upon a number of different policies that are further enhanced with behavioral data.

    At the recent Beyond Trust partner summit, cybersecurity expert Derek Smith noted, “Privileged credentials exist everywhere and 100% of all advanced attacks rely on exploits of privileged credentials.” That’s a sobering thought for those in charge of cybersecurity and those who are part of the DevSecOps process. Smith said some of the best practices around PAM include, “Track and secure, govern and control, and record and audit,” exemplifying the need for a platform approach. For Beyond Trust, that means creating a platform that defines a new paradigm of trust, one that builds policy around the who,what,why,where,when of access.

    The concept offers valuable lessons to DevSecOps team members, lessons that entail incorporating the proper security elements into the application and infrastructure layers of service delivery. For the short term, those capabilities may be beyond those in the DevOps arena, meaning that they may have to turn to third-party platforms to bring forth better security. On the plus side, JIT PAM can also be used to secure legacy applications, giving DevSecOps teams more breathing room to define and re-engineer those legacy applications as they transition to the cloud.

    — Frank Ohlhorst

  • The Challenge of Securing a Dynamic, Cloud-Based DevOps Environment

    The Challenge of Securing a Dynamic, Cloud-Based DevOps Environment

    The tech landscape has fundamentally changed over the last decade. The steady migration from local data centers to cloud computing combined with the advent of DevOps and the rise of containers have taken what was a more or less contained and relatively stable environment and transformed it into a dynamic, constantly shifting ecosystem. At the same time, the volume of exploits and threats has risen exponentially. The challenge today is how to effectively secure and protect servers, applications and data when your network is a moving target.

    It Starts and Ends With Visibility

    It’s difficult enough to protect something. Imagine that I give you a bag filled with money and tell you to keep it safe. There are risks involved and there will be criminals that want to steal the bag of money, but you have a fair idea of the threats you face. You know about the bag. It is in your possession. You can put it in a closet with only one entrance, make sure the door is locked and deadbolted, and monitor access with cameras. Now, consider how you would protect bags of money if hundreds of them could materialize at any point in time, anywhere in the house.

    If you don’t even know how many bags of money there are or where they’re located, how can you effectively protect them? The answer is simple: you can’t. That is essentially the situation IT teams face with dynamic, cloud-based DevOps environments.

    On a traditional, legacy network, it was relatively simple to keep track of how many servers were running in the data center and the applications running on them. One of the primary benefits of cloud computing, however, introduces one of the primary challenges of security in the cloud: The ability to scale capacity on demand adds elements of chaos and complexity that make it more difficult to know what exactly is on the network in real-time.

    As with the bags of money illustration above, though, comprehensive visibility is crucial for effective security. You can’t protect what you can’t see—or what you aren’t aware exists at all.

    Achieving Visibility in a Dynamic Environment

    Of course, getting comprehensive visibility is easier said than done. Many organizations have a hybrid and/or multi-cloud environment, with assets and data in local data centers and spread across different public and private cloud systems. You can install agents on some resources that will provide accurate information about the current state in real-time, but there are also many devices and services that can’t run an agent—requiring more diverse and creative approaches to gain visibility.

    The reality is that no single telemetry source will suffice. It takes a combination of active scanning, passive scanning, cloud-based accounts, agents running on devices and container-aware security to ensure that all of the various networks—and the servers, applications and services running on them—can be monitored and inventoried in real-time.

    Comprehensive Visibility Equals Consolidated Visibility

    Having broad visibility is not the same as having comprehensive visibility. Putting the tools and technologies in place to achieve and maintain comprehensive visibility is essential, but you also need to have the means to consolidate that information and manage it from a single console or pane of glass.

    You need all of the various sources of visibility data to be integrated into a single, comprehensive view so the entire ecosystem can be analyzed, monitored and maintained from one central view. Effective cybersecurity depends on visibility, and comprehensive, real-time visibility in a dynamic cloud environment requires a security platform with both the agility and scalability to keep pace and provide you with the information necessary to prioritize and address issues as they arise.

    — Tony Bradley

  • Insight IGNITE: DevOps, Cloud and Cyber From Iceland With Love

    Insight IGNITE: DevOps, Cloud and Cyber From Iceland With Love

    I had the pleasure recently of attending my first Insight IGNITE event, which was held at the ION Adventure Hotel in enchanting Iceland. It was also my first trip to Iceland. These two new experiences combined to deliver an excellent learning and networking experience, resulting in me realizing more than several new insights (pun intended) around DevOps, cloud and cybersecurity, as well as mindfulness and contentment.

    The agenda for this particular IGNITE event featured some great examples and discussion around DevOps, cloud migration and infrastructure and cybersecurity, among several others. All three of these were right in my wheelhouse, so I really enjoyed the presentations and discussions. I couldn’t type fast enough to keep up with all of the insights I was soaking in. Of course, I was also trying to contribute to the conversations, which are held in a very open, communal manner under Chatham House Rules.

    You may not be familiar with the Insight IGNITE Innovation Roundtable Series. They are the brainchild of Insight Partners’ Emmet B. Keeffe III. Emmet is beyond passionate about digital transformation (among several other passions including Formula One racing, world peace and now mindfulness/contentment). Utilizing his vast network (and it is vast), Emmet founded Insight IGNITE, an innovation program that delivers Innovation Briefings, the Innovation Roundtable Series and Growth Advisory Board opportunities to global IT leaders. I know that sounds like marketing speak, but let me explain.

    Basically, Emmet holds about one of these events a month at some of the most fascinating venues on earth. Each one has ~50 people. There is a mix of C-level executives from some of the 200+ Insight Partners portfolio companies, along with executives past and present from large global enterprises, sprinkled in with a mixture of technology experts and subject matter experts (I guess that is what got my ticket punched). The agenda is an exhilarating mixture of roundtable discussions and presentations on subjects touching on Digital Transformation, along with exciting activities that allow attendees to experience the local venue.

    The events are open to Global 2000 executives and other business and technology experts who think they could both benefit from this type of experience as well as have something to offer.  You can reach out to Emmet’s team if you are interested in attending one of these events.  Most attendees have to cover their own airfare/hotel. While not cheap, it is well worth the money, and the IGNITE team, who are extraordinary, do an amazing job of keeping it fresh, fun and challenging.

    The real special sauce of the IGNITE Roundtable Series, though, is the passion, caring and love that they receive from Emmet’s team. It is infectious and spreads to the attendees as well. I have attended hundreds of conferences over the years and don’t remember one where I made as many connections, had as many great side conversations and really felt part of a group. I am sure many of the people I met at this event I will be in touch with and doing business with in the months and years ahead.

    I met Emmet about three or four years ago in London (where he lives with his family now) and was invited to a previous event or two but was unable to make it. Since then, it seems Insight Partners is investing in so many of the companies that we work with here at MediaOps in DevOps, containers and cybersecurity—including Tricentis, JFrog, Aqua Security, Firemon and others. If you can’t beat ’em join ’em, as they say, so I decided to take Emmet up on his kind invite and check it out.

    The IGNITE event in Iceland had several great presentations about disrupting your own company product by spinning up the disruptor internally. We heard from “a queen of transformation” who has led transformations at several large multinational and government agencies. Another presentation focused on how an energy company keeps transforming as it stays ahead in today’s ever-shifting market and sets the bar for what the energy company of tomorrow looks like. In addition, there were some great panel discussions on the current state of DevOps and Agile, another on the state of cloud migrations, hybrid cloud and next-generation infrastructure. Also on the agenda was a great discussion regarding what is happening in cybersecurity and how critical it has become as part of any transformation. All of these were great, but what made them better was the great discussions they sparked among the attendees.

    That was not the full roundtable agenda, though. We also had a private briefing with the first lady of Iceland, discussions on some new fintech companies and technologies, AI/ML and more.

    But perhaps some of my favorite presentation and discussions were on a new passion of Emmet’s called the Contentment Foundation. This is a breakthrough effort to bring a new take on making education better for the world of today and tomorrow. Led by Dr. Daniel Cordaro, it recognizes that children are truly our future. How can we make them more content and mindful, better equipped to handle the world of tomorrow and the challenges they will face? The Contentment Foundation has developed a curriculum that is available to just about any school in the world. If you know a school that you think could benefit from this, I encourage you to reach out to them.

    All work and no play would make for a boring event, though. My trip to Iceland at the Insight IGNITE Roundtable was far from boring. We visited the famous Perlan Planetarium (which, unfortunately, was as close as I got to seeing the Northern Lights on this trip); ate in a Viking-themed restaurant; and rode ATF vehicles through the rugged, lava rock-strewn, stream-filled Icelandic countryside. We explored a lava tube cave and more. Unfortunately, the weather didn’t cooperate, so we had to cancel snowmobiling, whale watching and dinner on an island off the Iceland coast. I stopped off before heading to the airport to explore a bit in the capital of Reykjavík, which is a great little city with great cafés, shopping and sights.

    Even the social activities provided some great bonding and networking opportunities. It is rare for me that I not only make business acquaintances, but also form friendships at events like this. To me, this was yet another unique feature of the IGNITE Roundtable: People were there genuinely to share their experiences and discuss the burning topics at hand.

    All in all, one of the best events I have attended in a long time. I highly recommend attending at least one of these IGNITE Roundtables, if this sounds like something you may be interested in. As for me, I am already looking at what is the next one I will be able to attend. Once I have had a chance to digest and percolate on some of the insights I experienced, I will share a follow-up article to share them with you.

    Thanks, Emmet and IGNITE team, for a great experience.

    — Alan Shimel

  • Tech, Legislative Changes Impacting Developers in 2019

    Tech, Legislative Changes Impacting Developers in 2019

    In 2018, software development saw exponential growth in areas including blockchain technology and artificial intelligence, and the New Year has the potential to bring even more change through recent developments in automation, cybersecurity and legislation.

    Software development professionals have a unique opportunity to leverage these new developments this year, and the first step in doing so is learning how their industry has been impacted.

    Automation is undeniably looked at as an integral part of a software developer’s workflow. From using it to avoid repeat coding to stress-testing for systems, automation holds an incredibly valuable place in a developer’s world. In fact, recent data has shown that the percentage of development teams not automating has dropped by more than 50 percent in the last two years, and teams that fully apply continuous integration (CI) now outnumber those that don’t.

    One key development that will carry forward into the New Year is the integration of DevOps with the cloud. Cloud-integrated DevOps “can create a bug report, generate script, perform calculations and test code,” according to an article by CIO Applications.

    Effectively Automating Results

    The last year in automation also brought forth innovative artificial intelligence (AI) programming tools that use machine-learning algorithms to generate code using codebases developed by humans, as well as robotic process automation being used as a development platform for AI-driven apps.

    Automation isn’t the only area that software developers should focus on in 2019. Businesses around the world are falling victim to cyberattacks of all shapes and sizes. With advancements in technologies, these attacks are being more sophisticated and leading to breaches that at the most can cripple companies to the point of extinction and at the least create a serious scarring of consumer trust. According to the Poneman Institute’s 2018 “Cost of a Data Breach” study for IBM, the average cost of a data breach for a U.S. company stands at a whopping $7.91 million.

    With the advent of the internet of things (IoT), and the United States now being the No. 1 target globally for cyberattacks, software developers have the ability to help combat these devastating crimes. And, although developers can be the ones to lead the charge to help businesses utilize more effective cybersecurity mechanisms, the world of software development has its own vulnerabilities that cybercriminals have taken advantage of.

    Making Safety the Priority

    The truth is that nobody is safe from a cyberattack. Even behemoth companies that deal with tech and software development,  such as Facebook, have fallen victim to attack because of a lack of prioritizing cybersecurity. Effective security protocols can include using the cloud during the development process, along with having an awareness of the level of sensitivity of the data you’re handling and protecting that data accordingly.

    Furthermore, companies are now strengthening their cybersecurity efforts during the software development process by making a space for both the development and security teams to work together.

    “These organizations are able to innovate faster, save costs and become more agile in dealing with news risks,” said Chris Wysopal, chief technology officer at Veracode and Forbes contributor. “It all starts with recognition from business leaders that integrating security into their development processes is important.”

    Policies for the Benefit of Tech

    Not only can software developers benefit from creating avenues to work in automation and cybersecurity, but taking advantage of policies coming out of Capitol Hill can also prove to help improve performance and business opportunities.

    The Tax Cut and Jobs Act of 2017, which impacts tax years after Dec. 31, 2017, offers benefits for tech organizations that ultimately can create what agile companies need most: extra funds to put back into their business. Besides the enormous benefit for tech giants of overseas cash being taxed at only 15.5 percent, small- to midsize companies involved with tech can take advantage of the R&D Tax Credit.

    This government incentive is particularly noteworthy for those in software development who are either building out and testing new software or improving existing software, as the IRS has viewed these activities as qualifying for the credit.

    Whether developers are breaking new ground using automation or AI, the credit is an invaluable tool for a businesses looking for more money to put toward new technologies.

    The realm of software development, with increasing competition and constantly advancing technologies, isn’t the easiest field to thrive in. However, taking into account these developments and how they have impacted the industry can be the first step in seeing stronger performance in 2019.

    This article was co-authored by Rizwan Virani, Senior Vice President in alliantgroup’s Houston national office. He oversees alliantgroup’s Energy Incentives practice. Rizwan is an experienced electrical engineer with prior experience in the semiconductor industry. He brings several years of experience and expertise in manufacturing technology, semiconductor process, electrical and mechanical hardware development and fundamental engineering principals. Prior to joining alliantgroup, Rizwan was a project engineer and consultant for one of the largest semiconductor capital equipment makers.

    — Rick Lazio

  • Digital Defense Announces Frontline Active Threat Sweep™

    Fast, Easy to Deploy, Cost-Effective Alternative to Threat Hunting Platforms

    San Antonio, TX – November 15, 2018 – Digital Defense, Inc., a leading security technology and services provider, today announced the availability of their next generation Threat Detection technology, Frontline Active Threat Sweep™ (Frontline ATS™), an optional addition to Frontline.Cloud.

    Frontline ATS – underpinned by Digital Defense’s patented security assessment technology – operationalizes threat intelligence.  The solution fills a unique need in the threat arena by offering an agentless malware detection solution that quickly and reliably analyzes assets across the enterprise for threat activity and indicators of compromise that may have bypassed traditional security defenses.

    Time is of the essence when protecting digital assets from cybercriminals.  Changing out existing endpoint protection programs in favor of Next Generation Anti-Virus (NGAV) or Endpoint Detection and Response (EDR) offerings requires significant time and investment.  Frontline ATS immediately shores-up existing defenses and provides visibility as to where organizations need to selectively deploy tools on endpoints when greater levels of forensic analysis is needed.  With Frontline ATS, organizations:

    • benefit from highly-targeted rapid response to possible malware infections
    • minimize operational disruption and capital expenses
    • optimize resources with minimal to no training requirements

    “Whether you need to sweep millions of nodes or just a few, Frontline ATS quickly determines if malware has evaded cybersecurity defenses deployed to protect your information assets,” said Mike Cotton, SVP of Engineering at Digital Defense, Inc.  “And as with all Digital Defense solutions, Frontline ATS is a cloud-based offering hosted in Amazon Web Services (AWS).  Frontline ATS provides clients with the most powerful and configurable threat sweeping solution in the marketplace.”

    Any organization looking to bolster existing endpoint protection, NGAV, or EDR investments will find Frontline ATS provides a compelling alternative to expensive, difficult to deploy threat hunting platforms.

    Learn more about Frontline ATS

    Contact sales@digitaldefense.com

    About Digital Defense

    Serving clients across numerous industries, Digital Defense’s innovative and leading-edge technology helps organizations safeguard sensitive data and eases the burdens associated with information security. Frontline.Cloud, the original Security SaaS platform, delivers unparalleled accuracy and efficiencies through multiple systems including Frontline Active Threat Sweep™ (Frontline ATS™), Frontline Vulnerability Manager (Frontline VM™), Frontline Web Application Scanning (Frontline WAS™) and Frontline Pen Test™, while SecurED®, the company’s security awareness training, promotes employees’ security-minded behavior. The Digital Defense Frontline suite of products, underpinned by patented technology and complemented with superior service and support, are highly-regarded by industry experts, as illustrated by the company’s designation as 2018 Global Vulnerability Management Customer Value Leadership Award, #10 ranking in Black Book Market Research’s list of Compliance & Risk Management Solutions, five-star review in SC Magazine, and inclusion in CRN’s MSP 500.

     

    Contact Digital Defense at 888-273-1412; visit www.digitaldefense.com, our blog, LinkedIn, or follow @Digital_Defense on Twitter.

  • XM Cyber Closes $22 Million in Series A Funding

    Cybersecurity Disruptor will Use New Investment to Fuel Continuous Growth and Innovation

    HERZLIYA, Israel, Nov. 13, 2018 /PRNewswire/ —  XM Cyber, multi-award winning provider of the first fully automated APT simulation and remediation platform, today announced that it has closed a $22 million Series A funding round with the participation of Macquarie Capital, Nasdaq Ventures, Our Innovation Fund, LP and UST Global, among others. The company has now raised a total of $32 million, following a previous seed round of $10 million from Swarth Group.

    XM Cyber will use the funding to accelerate its strong growth through expanded sales, marketing and engineering programs. The company, a leader in the “Breach and Attack Simulation” category, has already received 16 industry awards this year on the strength of its HaXM platform, including being recognized as a “Technology Pioneer” by the World Economic Forum. XM Cyber’s customers include leading financial institutions and critical infrastructure organizations across North America, Europe, Israel and Australia.

    “In this era of hyper-sophisticated cybercrime, our solution demonstrates that organizations should be asking themselves ‘Are my critical assets really secure?’ as there is a plethora of ways hackers can compromise them,” said XM Cyber CEO and Co-Founder Noam Erez. “2018 has been an incredible year for XM Cyber, and this funding round will help us expand our footprint in 2019. We are grateful to our investors for this vote of confidence and look forward to their continued strong support.”

    Even when an organization has deployed and configured modern security controls, hackers can infiltrate the network in a wide variety of ways to compromise critical assets. They capitalize on human errors such as misconfigurations, shadow IT and faulty security practices, and use attack techniques and methods that circumvent cyber defenses — often by employing legitimate tools and leveraging real user behavior. HaXM continuously leverages a multitude of offensive methods to rapidly expose the most critical blind spots and uncover hidden attack vectors. It then provides data-driven remediation focused on the organization’s critical assets, thus reducing the company’s IT risk and enabling it to optimize its cyber resources. In effect, HaXM operates as an automated purple team that fluidly combines red and blue teams’ processes.

    “As cyber-threats continue to evolve, we believe XM Cyber is addressing an important need, particularly for financial services and market infrastructure companies,” said Gary Offner, Head of Nasdaq Ventures. “We believe our investment in XM Cyber will help continue new developments in advancing breach simulation and detection technology and processes. This is an important, developing area of cyber security innovation and we’re pleased to be supporting its growth and expansion.”

    “We are proud to be part of this round of funding, coming at a critical juncture in XM Cyber’s rapid expansion,” said UST Global Chief Cyber Officer Yuval Wollman. “This investment includes a strategic sales and integration agreement with CyberProof, UST’s managed security services subsidiary, to manage cyber risk as a measured outcome. The joint solution will appeal to many of our clients who are seeking to cost effectively reduce their cyber risk exposure.”

    About XM® Cyber

    XM Cyber provides the first fully automated APT simulation platform to continuously expose attack vectors, above and below the surface, from breach point to any organizational critical asset. This continuous loop of automated red teaming is completed by ongoing and prioritized actionable remediation of security gaps. In effect, HaXM® by XM Cyber operates as an automated purple team that fluidly combines red team and blue team processes to ensure that organizations are always one step ahead of the attack.

    XM Cyber was founded by the highest caliber of security executives from the elite Israeli intelligence sector. Together they bring a proven track record in both the offensive and defensive cyber security domain. The company has offices in the US, Israel and Australia.

    For more information: www.xmcyber.com

  • Trend Micro Redefines Endpoint Security with Trend Micro Apex One™

    All-in-one advanced endpoint security solution automates detection & response, delivers insight for stretched IT and security teams

    DALLAS, October 15, 2018 – Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global leader in cybersecurity solutions, today launched the evolution of its advanced endpoint security offering. Now re-branded as Trend Micro Apex One™, the product redefines endpoint security with the sheer breadth of capabilities delivered as a single agent, with consistency across SaaS and on-premises deployments. This simplified offering enhances automated detection and response and provides actionable insights that maximize security for customers and offers growth opportunities for the channel.

    Overextended IT security teams are increasingly overwhelmed by the number of products required to fully protect their endpoints. Combined with an increasing number of alerts and siloed log information, there is a struggle to respond quickly enough to today’s advanced threats.

    “Our latest release has advancements that address the most pressing endpoint security issues being faced in the industry today,” said Kevin Simzer, chief operating officer for Trend Micro. “Despite the claims of some so-called ‘next-gen’ vendors, effective protection requires multiple layers of security, which is foundational to our strategy. Apex One™ is a fantastic choice for businesses seeking to displace traditional AV or struggling next-gen deployments.”

    Trend Micro Apex One™ delivers three key highlights:

    • Automated Detection & Response:

    Apex One™ is built upon the XGen™ security techniques, which is a cross-generational blend of threat defense functionality that intelligently applies the right technology at the right time. The product includes the industry’s most timely virtual patching capabilities powered by Trend Micro’s Zero Day Initiative, along with a range of modern technologies to detect and block advanced attacks, including fileless threats.

    • Actionable Insights:

    Apex One™ introduces significantly expanded endpoint detection and response (EDR) capabilities. Additionally, it connects to Trend Micro’s managed detection and response (MDR) service option that boosts in-house teams with threat hunting and alert monitoring.

    • All-in-one:

    Apex One™ offers an industry-leading breadth of capabilities from a single agent, while many vendors are still only shipping two or more. In particular, Apex One™ powerful EDR with the automated detection & response tools, simplifying deployment and eliminating silos.

    Together, these key highlights of Trend Micro Apex One™ provide a major growth opportunity for channel partners looking to offer a higher-value product that meets the security needs of enterprises.

    “These days both channel leaders as well as discerning IT decision makers can end up confused due to the level of noise in the cybersecurity market. When it comes to endpoint security I encourage a focus on the proven performance, security improvements, and flexibility of delivery models of each solution in consideration,” said Doug Cahill, senior cybersecurity analyst and group director at ESG. “By offering automated detection and EDR investigation in a single agent that is easy to deploy and provides the right defense at the right time, Trend Micro offers a modern approach to endpoint protection.”

    “Our business is faced with constant security pressures, needing to defend against increasing threats like fileless malware and ransomware while meeting security compliance standards,” said Tim Masey, Director of Cybersecurity, for Carhartt. “Today, Trend Micro provides us with effective advanced endpoint security and we look forward to the expanded capabilities of Apex One™.”

    The product’s single agent form factor, available in November 2018, eases deployment while addressing today’s demanding protection and compliance requirements. Apex One™ furthers Trend Micro’s existing OfficeScan product and current OfficeScan customers will receive Apex One™ as a regular update at no additional cost; certain features such as EDR investigation require additional licensing, depending on current entitlements.

    For more information, please visit: www.trendmicro.com/apexone.

    About Trend Micro

    Trend Micro Incorporated, a global leader in cybersecurity solutions, helps to make the world safe for exchanging digital information.  Our innovative solutions for consumers, businesses, and governments provide layered security for data centers, cloud workloads, networks, and endpoints. All our products work together to seamlessly share threat intelligence and provide a connected threat defense with centralized visibility and investigation, enabling better, faster protection. With over 6,000 employees in 50 countries and the world’s most advanced global threat research and intelligence, Trend Micro enables organizations to secure their connected world.  For more information, visit www.trendmicro.com.

  • 5 Key 2018 Tech Predictions for the C-Suite

    5 Key 2018 Tech Predictions for the C-Suite

    The most important digital trends for C-level business leaders to consider in 2018 relate to digital transformation, artificial intelligence (AI), internet of things (IoT), General Data Protection Regulation (GDPR) compliance and cybersecurity. Read on for insights and predictions about why these topics will matter so much to C-suites in 2018.

    Prediction 1: Digital Transformation—All Aboard!

    As one of the armaments of business innovation and disruption, digital transformation has become such a buzzword that it turns people off. But in 2018, fates likely will be sealed. A company has either transformed, is on its way to doing so, is actively planning its transformation or has decided not to get on that train. That last group won’t be invited to the AI party and are making themselves targets for disruption. According to Forrester, more than 60 percent of executives believe they are behind in their digital transformation. That’s OK, as long as they keep moving. CEOs need to fund this expensive endeavor from the outset and not try to make it pay for itself. Nickel-and-diming digital transformation could be the last mistake a CEO makes.

    Prediction 2: By 2020, AI Will Be a Game-Changer

    Every so often a technology comes along that has the potential to completely change everything around it. The last such technology was cloud computing. And like cloud, which had several precursors, AI has been around for a long time. AI and machine learning/deep learning are catching up to the initial promise, and that will become more evident as the next few years unfold.

    The best options for near-term success with AI are business intelligence and decision support. Some enterprises are using machine learning/deep learning to plumb big data—especially unstructured data such as text and video—to drive new forms of data analytics.

    Even so, many companies will strike out with AI/machine learning largely because it’s no paint-by-numbers endeavor. Companies need talented people who know how to harness this technology, but those people are scarce and don’t come cheap. Companies need businesspeople actively making sure that the technology serves the business need, potentially in charge of the project. And companies need the right data. An AI-based decision-support system, a common application of the technology, is fueled by quality data. Do you have it? This HBR.org article, “A Survey of 3,000 Executives Reveals How Businesses Succeed with AI,” will help get your organization oriented toward AI success.

    AI is likely to be a largely experimental for the next year to two years as organizations give it a shakedown cruise. But early adopters have had some success, and many see potential for AI to deliver revenue growth.

    Ultimately, AI and machine learning/deep learning will be looked upon as major advances with far-reaching effects, much like cloud computing and the internet. In 2018, it may not seem that way as enterprises experimenting with it feel the pain of separating the hype from the reality, adjusting business processes to make it work, cultural resistance from tech teams and a lack of available talent. Stick with it to reap eventual rewards.

    Prediction 3: IoT—A Thousand Points of Entry?

    Enterprise implementations of IoT functionality are very popular these days. But security vulnerabilities and issues are both inherent and legion with this technology. It simply hasn’t been thought through. In 2018, the disregard for IoT security solutions will come home to roost for several major corporations. Until the security issues are resolved, IoT will begin to be seen by some, at least, as a promising technology that’s not ready for prime time.

    Prediction 4: The GDPR Powder Keg

    By the end of 2018, some companies will be getting out of European markets, while others will look for a means of circumventing the EU’s GDPR. Still others will be scrambling to comply. And a last group will be doing what they’re doing now: taking the risk that the cost of the penalty is less than the cost of compliance. Forrester predicts that 80 percent of firms will not fully comply with GDPR. The unfortunate part is that, while a company may be able to ride out a steep fine on non-compliance, damage to its brand may be irreparable or very slow to heal.

    Companies also can’t just throw money at GDPR—it probably will require new companywide policies and a shift in cultural thinking about personally identifiable data and the individuals behind them. Some companies are going to find it very difficult to make that cultural change.

    Prediction 5: Cybersecurity Needs New Thinking

    Customer experience and security are at odds with each other. Passwords don’t work. Biometrics aren’t completely safe. Security awareness is treated as an afterthought. Security breaches are an everyday headline. What’s it going to take to make society wake up? There is a huge need for a new type of user authentication system, as just one example. There are significant opportunities for those that can deliver new technologies, new products and new solutions. We need to think differently about cybersecurity. We need to teach it in schools. In 2018, we will hit bottom. It will become apparent to all of society that our security measures are antiquated and have no hope of meeting the rising threat from many quarters. As the digital world continues to assimilate more and more of our previous analog way of life at a rapid clip, security has trailed far behind. Cybersecurity desperately needs innovation.

    — Scot Finnie

  • DevOps, Security, AI Convergence on Horizon

    DevOps, Security, AI Convergence on Horizon

    DevOps is regarded as practice that can drive performance advantages. Artificial intelligence is showing very real promise across the security market. Most public and private-sector organizations know that they must explore new and different ways of defending their networks against modern threats. These three factors make it clear that DevOps, AI and security are ripe for convergence.

    Defining AI

    Anyone reading this post doesn’t need me to explain to them what DevOps and security are; both of these categories are well-defined. However, AI is really in an emergent stage, with different types in use and many definitions floating around. Because of this, I think it is important to let readers know that in this post, AI refers to a class of technology that can:

    • Consume data, learn and get smarter on its own
    • Automatically identify and solve problems
    • Operate independently, without human supervision
    • Scale massively
    • Move at near real-time speed
    • Achieve levels of accuracy that are beyond human capabilities

    DevOps and Security are United

    DevOps and security have merged. For several years now, organizations have been leveraging automation technologies and DevOps practices to continuously deliver security and compliance policies across data centers and clouds.

    Further legitimizing the union is the fact that leading DevOps and automation players such as Puppet, Chef and Ansible have formed numerous partnerships that deliver effective security capabilities to their customers.

    There are, of course, other signs that show how successful the DevOps and security marriage has been. One of which is the emergence of the term “rugged DevOps.” It is now so widely recognized that it commands its own section on this site and is often the subject of discussion at several notable security conferences.  

    DevOps and AI are Dating

    The relationship between DevOps and AI is in the early stages, with the courtship between the two well underway. Examples of its progress are found in numerous blogs and articles, several of which include:

    DevOps and AI have certainly not yet intertwined as deeply as DevOps and security have. These examples (and others out there) do show they the two will continue to integrate beyond what we are currently witnessing.

    DevOps, Security and AI

    DevOps and security are wed. DevOps and AI are moving closer toward each other. It’s only a matter of time until all three get together.

    Because several DevOps leaders are already in the business of security, it’s logical to assume that a partnership between one of them and an AI-driven security provider will be what ultimately leads to a marketable solution.

    DevOps provider candidates with the potential to move on a partnership that can combine DevOps, security and AI have a raft of new and established security providers available to work with. Several of the startups in this class are recognized in the CB Insights AI 100 2017 infographic. Companies such as Cloudera (NYSE: CLDR), which is using AI and machine learning to solve security problems, are among the more established providers that may make for a perfect partner. 

    How quickly will the market see such a partnership? That remains to be seen. However, with DevOps now fully accepted as a methodology that can positively impact bottom lines, AI coming into its own, and the need for new and different ways of defending organizations against attacks at a critical stage, it seems almost certain that the convergence will be upon us sooner rather than later.

    — Joe Franscella

  • Government Legislation Aims to Secure IoT

    Government Legislation Aims to Secure IoT

    The U.S. Senate is making moves to protect consumer interests, data, and privacy with regard to the internet of things (IoT). Sens. Mark R. Warner (D-VA) and Cory Gardner (R-CO), co-chairs of the Senate Cybersecurity Caucus, along with Sens. Ron Wyden (D-WA) and Steve Daines (R-MT), recently introduced bipartisan legislation called the Internet of Things Cybersecurity Improvement Act of 2017.

     

    Addressing IoT Market Failures

    According to a fact sheet released by the senators, “While ‘Internet of Things’ (IoT) devices and the data they transmit present enormous benefits to consumers, the relative insecurity of many devices presents enormous challenges. This legislation is aimed at addressing the market failure by establishing minimum security requirements for federal procurements of connected devices.”

    The proposed legislation drives home a new reality for IoT device manufacturers: While development organizations currently decide to invest in cybersecurity using a cost-benefit assessment, they are ultimately liable for the security of their data and systems.

    The U.S. Senate’s Proposal

    The proposed legislation requires vendor commitments:

    • To ensure devices don’t contain known security vulnerabilities when shipped.
    • To ensure proper disclosure of new security vulnerabilities discovered within their devices.
    • To prepare remediation plans for any IoT device where known vulnerabilities have been discovered.

    The Internet of Things Cybersecurity Improvement Act of 2017 is tied directly to federal government procurement of such devices but Sonatype predicts they likely will extend into private-sector guidelines moving forward. While the legislation is clearly aimed at consumer protections and privacy, it also focuses on quality, safety and regulatory standards applied to every other major manufacturing industry (“Thou shall not ship products with known defects“). It’s commonsensical in other manufacturing industries, and now Congress is directing development organizations to apply similar quality standards for the software it develops and ships.

    Certify IoT Devices are Free from Known Security Vulnerabilities

    The legislation specifically calls for vendors selling IoT devices “to provide written certification that the device does not contain, at the time of submitting the proposal, any hardware, software, or firmware component with any known security vulnerabilities or defects.”

    Notification When New IoT Vulnerabilities are Discovered

    Following the purchase of any IoT devices, the government wants the seller “providing the Internet-connected device software or firmware component to notify the purchasing agency of any known security vulnerabilities or defects subsequently disclosed to the vendor by a security researcher or of which the vendor otherwise becomes aware for the duration of the contract.”

    Ensure Remediation Paths are Available

    Protections go even further in the post-sale period, calling for clear remediation paths. The proposed legislation would require “any future security vulnerability or defect in any part of the software or firmware [of the IoT device] to be patched in order to fix or re-move a vulnerability or defect in the software or firmware component in a properly authenticated and secure manner.”

    20 Vulnerabilities Per Application

    Recently, Sonatype released its “2017 State of the Software Supply Chain” report that shares empirical evidence of the number of known software vulnerabilities that ship in applications—IoT or otherwise. The report found that development organizations building software with unmanaged software supply chains release applications with an average of 20 known security vulnerabilities, six of which had a Common Vulnerability Scoring System (CVSS) rating between 7 and 10.

    Sonatype’s report also reveals how national governments, federal agencies and industry associations are taking action to help organizations improve open-source hygiene and application security practices. In the past year, new guidelines have been introduced from the White House, Federal Trade Commission, Department of Homeland Security, Department of Health and Human Services and the Department of Commerce to improve the quality, safety and security of software supply chains, related to IoT devices and any other application development efforts.

    The Tide Has Turned

    While the proposed legislation is still open for debate, there is clear evidence that those once ignorant or turning a blind eye to such cybersecurity issues are now paying attention—and they are preparing to make significant changes.

    The full text of the proposed legislation for the Internet of Things Cybersecurity Improvement Act of 2017 can be found here.

    — Derek E. Weeks