A recent Simility blog post detailed how it is tracking online fraud. With the help of a SaaS-based machine learning tool, the company and its beta customers have seen a 50 to 300 percent reduction in fraudulent online transactions. This last January, they looked at 100 different behaviors across 500,000 endpoints scattered around the world. They found more than 10,000 of those devices were compromised, and then looked for patterns of similar behavior. They found seven commonalities, and some of them are surprising.
You can read my blog post on IBM’s SecurityIntelligence.com here.
Once you have decided to implement a bring your own device (BYOD) program, you need to think about how exactly to go about it. Here are a few aspects to consider, such as what you are trying to control, can you manage your devices from the cloud, and what granular level of policies you can create. It’s on the iBoss blog today.
Endpoint security used to be so simple: you purchase an anti-malware scanner, install across your endpoints, and you were protected. Not anymore. However, the days of simple endpoint protection are over. Scanning and screening for malware has become a very complex process, and most traditional anti-malware tools only find a small fraction of potential infections. The attackers have gotten more sophisticated, and so too must the endpoint detection and response (EDR) tools, which need to find more subtle exploits, even ones that don’t leave many fingerprints.
This week, I review of ten different endpoint detection and response (EDR) tools for Network World magazine. You can read the complete review package here.
I spent several months running Outlier Security, Cybereason, Sentinel One, Stormshield SES, ForeScout CounterAct, Promisec PEM, Countertack Sentinel, CrowdStrike Falcon Host, Guidance Software Encase, and Comodo Advanced Endpoint Protection. From this experience, I came up with a series of broad trends:
Virus signatures are passé. Creating a virus with a unique signature is child’s play, thanks to the nearly automated virus construction kits that have filled the Internet over the past several years. Instead, many of these products tap into security news feeds that report on the latest attacks such as VirusTotal.com and other reputation management services.
Second, tracking executable programs is also so last year. In the old days of malware, exploits typically had some kind of payload or residue that they left on an endpoint: a file, a registry key or whatnot. Then the bad guys graduated to run their business just in memory, leaving little trace of their activity, or hide inside PDFs or Word documents, or would force your Web browser to a phished site that contained Java-based exploits. Today’s hackers have become more sophisticated, using Windows Powershell commands to set up a remote command shell, pass a few text commands, and compromise a machine without leaving much of a trace on an endpoint.
Many products can track privilege escalation or other credential spoofing. Modern attackers try to penetrate your network with a legit user credential that uses a default setting when you installed SQL Server or some other product, and then escalate to a domain administrator or other more significant user with greater network rights.
Insider threats are more pernicious, and blocking them has become more compelling. One of the reasons why traditional anti-virus protection has failed is because attackers can gain access to your internal network and do damage from a formerly trusted endpoint. To block this kind of behavior, today’s tools need to map the internal or lateral network movement so you can track down what PCs were compromised and neutralize them before your entire network falls into the wrong hands.
In addition to insider threats, data exfiltration is more popular than ever. Moving private user data, or confidential customer information, out of your network is the name of the game today. Look no further than Sony or Target to see the harm of making public some of their data as examples of what the EDR tool has to deal with now.
Many tools are using big data and cloud-based analytics to track actual network behavior. One of the reasons why the sensors and agents are so compact is that most of the heavy lifting of these tools happens in the cloud, where they can bring to bear big data techniques and data visualization to identify and block a potential attack.
The variety of approaches is stunning, and worth a closer look at these tools, to see if you can leverage one or more of them to better protect your endpoints.
When it comes to stealing information, hackers know where to look, and it usually is those users who have the most privilege or greatest access to network and system resources. The typical attack is to somehow locate one of your network’s weakly-protected PCs, create a rogue guest account to gain initial access, and then try to escalate this account to an administrator or someone who has more access rights to do more damage or obtain sensitive information. I talk more about this on a recent blog post for iBoss here.
Sophos has developed an interesting and innovative new security product that bridges the gap between its endpoint and network protection products. Called Security Heartbeat, it requires a Sophos XG firewall and any of Sophos’ cloud-based endpoint protection agents. The entry level firewalls start at $300 and larger models can go for ten times that, with support contracts extra.
We tested the Sophos products during November 2015. Sophos is not as well known as other firewall vendors, but the use of the heartbeat is such an obvious benefit and the kind of innovation that you wonder why it hasn’t been done before.
Since we last looked at single sign-on products in 2012, the field has gotten more crowded and more capable. A number of new vendors have come to ply their wares, and a number of old vendors have been acquired or altered their products.
For this round of evaluations, we looked at seven SSO services: Centrify’s Identity Service (the overall winner who’s dashboard is pictured above), Microsoft’s Azure AD Premium, Okta’s Identity and Mobility Management, OneLogin, Ping Identity’s Ping One, Secure Auth’s IdP, and SmartSignin. In addition to these products, we also looked briefly at AVG’s Business SSO. Overall, products have expanded their authentication support, moving towards integrated mobile device management, using more cloud-based solutions, and supporting more apps. You can read here the entire text of my review, published today.
Remember when network access control (NAC) was all the rage? Remember the competing standards from Microsoft, Cisco, and the Trusted Computing Group? Back around 2006, there were dozens of NAC products, many of which turned out to be buggy and difficult to implement.
But NAC hasn’t disappeared. In fact, NAC products have evolved and improved as well. I reviewed Enterasys/Extreme Networks Mobile IAM, Hexis Cyber Solutions NetBeat NAC, Impulse Point SafeConnect NAC, Pulse Policy Secure, and Portnox NAC. Overall, Portnox (above) was tops.
Symantec’s Endpoint Protection.Cloud is a very useful tool to help small businesses get a handle on their security with a very streamlined interface and a large collection of automated protective features. It is a companion to Backup Exec.Cloud that can be used to provide cloud-based file and system backups, which you can watch here.
You can also watch this video of the server-based SEP features here.
Pricing starts at $35 per seat per year with quantity discounts available. It runs on Windows XP with SP3 and later versions. We tested on a small network with both XP and Windows server clients in June 2012.
Mountain View, Calif.
Follow @symanteccloud on Twitter
Wave Systems has developed software tools to work with the trusted computing module that is now included on many desktop and laptop business computers. This video will show you how to deploy it and some of its protective uses.
Wave Systems is a leading provider of self-encrypting drive management solutions. Self-encrypting drives are now included in many desktop and laptop computer hard drives. This video will show you how to deploy it and some of its protective properties.
Embassy Remote Administration Server
Price: Starts at $92 per seat MSRP, quantity discounts available
ERAS is a snap-in to Microsoft’s Management Console and integrates with Active Directory. It runs on any Windows Server. We tested it in November 2011.