STE WILLIAMS

End-user organizations have their security management tools, but so do cloud service providers, and that forces some hard questions about whose tools will be used to keep everything locked down, says Jesse Rothstein, CTO and Co-Founder of ExtraHop. And he makes the case that better data hygiene can help decrease the chances of a breach.

Article source: https://www.darkreading.com/cloud-services-require-a-shift-in-security-strategy/v/d-id/1335616?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft has (once again) joined the “our contractors are listening to your audio clips” club: up until a few months ago, your Xbox may have been listening to you and passing those clips on to human contractors, Vice’s Motherboard reported on Wednesday.

Like all the other revelations about tech giants getting their contractors and employees to listen in to voice assistant recordings – they’ve been coming at a steady clip since April – the purpose is once again to improve a device’s voice recognition.

Another similarity to earlier voice assistant news: Xbox audio is supposed to be captured following a voice command, such as “Xbox” or “Hey Cortana,” but contractors told Motherboard that the recordings are sometimes triggered and recorded by mistake. That’s the same thing that’s been happening with Siri: as we found out in July, Apple’s voice assistant is getting triggered accidentally by ambient sounds similar to its wake words, “Hey, Siri,” including the noise of a zipper.

This is Microsoft’s second eavesdropping headline this month: a few weeks ago we reported that humans listen to Skype calls made using the app’s translation function, as well as to clips recorded by Microsoft’s Cortana virtual assistant.

Can anybody NOT hear me?

Also earlier this month, thanks to whistleblowers who were disturbed by the ethical ramifications, we found out that Facebook has been collecting some voice chats on Messenger and paying contractors to listen to and transcribe them.

They were all doing it: Facebook, Google, Apple, Microsoft and Amazon.

The revelations started in April, when Bloomberg reported that Amazon employs thousands of people around the world to work on improving its Alexa digital assistant, which powers its line of Echo speakers. Amazon has confirmed that it keeps these recordings indefinitely instead of deleting the data.

It’s sometimes mundane work. It’s sometimes disturbing: contractors and employees have reported hearing what they interpret as sexual assault, drug deals, children screaming for help, and other recordings that users would be very unlikely to willingly share.

Then it was Google’s turn: in July, whistleblowing contractors who’d read the news about Amazon reached out to report that Google was doing the same thing. Next up was Apple: the Guardian ran a story revealing that contractors “regularly hear” all sorts of things Apple customers would probably rather they didn’t, including sexual encounters, business deals, and patient-doctor chats.

The vendors have said that the recordings are to some extent anonymized. It’s just done to improve Siri’s accuracy, Apple said. But according to the whistleblower who spoke to the Guardian, in some cases, the recordings that accompany the user data showed location, contact details, and app data.

Motherboard talked to several people who’ve worked on Xbox audio. One was a former contractor for Microsoft who did so from 2014 to 2015, shortly after Xbox One launched in 2013 with the option of being controlled by voice comments with the Kinect system. Cortana was implemented into the Xbox console in 2016.

The voice analysis continued with the incorporation of Cortana. The current contractor shared a memo from Microsoft that tells workers how to work with Cortana audio, including Xbox control commands. From a section of the document:

A domain for controlling gaming features, such as finding friends lists, creating a ‘party,’ inviting players to a party. Most Xbox controlling will belong to this domain.

Motherboard’s Joseph Cox explains that a “domain” is one of the topics that contractors who transcribed Cortana audio would sort clips into as they worked to improve the system.

It worked: as time went on, the former contractor said, the voice command feature got better, and the contractors picked up fewer accidental recordings. But those accidentally triggered recordings didn’t stop completely, said the current contractor:

Most of the Xbox-related stuff I can recall doing was obviously unintentional activations with people telling Cortana ‘No’ as they were obviously in the middle of a game and doing normal game chat.

Upshots

Google and Apple suspended contractor access to voice recordings after the media reports. In the aftermath of those reports, Amazon said it will let users opt out of human review of Alexa recordings, though users have to actually go in and, periodically, delete those recordings themselves. Here’s how.

After its own voice kerfluffle with Messenger, Facebook said that it had “paused” the voice program. It didn’t say if or when it might resume.

After the reports about Skype and Cortana recordings, Microsoft updated its privacy policy to be more explicit about humans potentially listening to recordings. It’s still getting humans to review that audio, however. The company’s privacy policy now reads …

Our processing of personal data for these purposes includes both automated and manual (human) methods of processing.

Microsoft also has a dedicated privacy dashboard page where you can delete voice recordings.

As far as the Xbox listening goes, a Microsoft spokesperson told Motherboard that the company recently stopped listening to Xbox audio for the most part, but that the company has always been upfront about the practice in its terms of service:

We stopped reviewing any voice content taken through Xbox for product improvement purposes a number of months ago, as we no longer felt it was necessary, and we have no plans to re-start those reviews. We occasionally review a low volume of voice recordings sent from one Xbox user to another when there are reports that a recording violated our terms of service and we need to investigate. This is done to keep the Xbox community safe and is clearly stated in our Xbox terms of service.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/8wgKaiztpuA/

Employees at Portland Public Schools were breathing easier this week after thwarting a business email compromise (BEC) scam that could have cost them almost $3m.

BEC is a sneaky form of attack in which a criminal impersonating a third party convinces someone at an organization to wire them money. The crook targets someone with control of the purse strings and uses what looks at first glance like a legitimate account owned by a supplier or business partner.

Sometimes, a BEC scammer might compromise the email account of a senior executive at the target company, or at their supplier, to get a better idea of how they communicate. They could even send an email directly from that account to someone with access to company funds. Sometimes, though, they can spoof an email and request the funds without hacking anything, relying entirely on social engineering.

Who, you may ask, would fall for such a thing? Lots of people apparently, including two employees at Portland Public Schools. A fraudster contacted them pretending to be from one of the institution’s construction contractors, asking them to send payment to an account. Of course, the request was illicit, and the account illegitimate. Nevertheless, the employees approved the payments, sending $2.9 million into the ether.

Luckily, Portland Schools moved quickly to stop the transaction. In a letter to employees and schools, superintendent Guadalupe Guerrero said that the banks involved froze the fraudulent funds, adding:

PPS has already begun the process to recover and fully return funds back to the district, likely within the next several days.

Guerrero didn’t reveal how Portland Public Schools found the fraud, but the institution acted quickly after it did. It immediately contacted the FBI and Portland Police, along with the Board of Education.

While employees’ quick thinking thwarted these crooks, many get away with it, which is why BEC is becoming so prevalent. According to the 2018 FBI Internet crime report, losses from BEC scams doubled in 2018, reaching $1.3 billion.

What can you do to protect yourself against the scammers? You could do worse than follow Portland Public Schools’ example. Guerrero said:

All district payment procedures and internal controls are being reviewed, additional protocols and actions have already been identified, and all district finance staff will receive mandatory, updated training this week to reinforce protocols and to ensure updated procedures are in place to prevent incidents like this from occurring.

Companies should train staff to be suspicious of requests for secrecy or pressure to take action quickly, the FBI has said. They should also put two-step verification procedures in place for wire transfer payments, and should directly confirm fund transfer requests with known individuals working for those vendors.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-aX8yPRl9QI/

Android spyware – open-source spyware, no less – has found its way onto the Google Play store, according to researchers from ESET.

The nefarious software masqueraded as a fully functional internet radio app targeted at the Balouch people of Pakistan, Afghanistan and Iran, the Slovakian threat intel outfit said.

As well as relaying genuine Balouchi music, the malicious radio app also incorporated the AhMyth open-source remote-access trojan. It can be found on Github, of all places.

“The malicious functionality in AhMyth is not hidden, protected, or obfuscated. For this reason, it is trivial to identify the Radio Balouch app – and other derivatives – as malicious and classify them as belonging to the AhMyth family,” opined Lukáš Štefanko, the ESET researcher who took a close look at the app.

In a detailed statement about the malware, ESET explained: “For CC communication, Radio Balouch relies on its (now defunct) radiobalouch[.]com domain. This is where it would send information it has gathered about its victims – notably information about the compromised devices, and the victims’ contacts lists. As with the account credentials, the CC traffic is transmitted unencrypted over an HTTP connection.”

The number of downloads of Radio Balouch’s app was noted by ESET to be in the hundreds.

What was most concerning, however, was ESET’s observation that the app was on the Google Play store – which is supposedly vetted to stop malware-laden apps from entering, but managed to enter at least twice to their knowledge.

The app’s legitimacy was astroturfed through the creation of YouTube and Instagram accounts, making it seem superficially legitimate.

Google Play’s review processes, whatever they are, are not known for their thoroughness. Just a few weeks ago 130,000 people were known to have downloaded stalkerware, intended for silently monitoring spouses without their knowledge, while in January security biz Trend Micro reckoned nine million had been infected with malware from… the Google Play store!

The best thing you can do to defend against dodgy apps is to check them out before downloading and scan new downloads with a reputable and up-to-date anti-malware suite, as well as keeping a close eye on what permissions new and existing apps alike are demanding.

Good luck out there, fandroids. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/22/google_play_malware/

On Thursday, Google reminded everyone who might have forgotten that “privacy is paramount to us” and announced an initiative called “Privacy Sandbox” that proposes paving over a few privacy pitfalls without suffocating its ad business.

It takes a certain chutzpah for a company with such a lengthy history of privacy scandals to insist that privacy is “paramount” – more important to the company than anything else. Note that the company’s avowed mission is “to organize the world’s information and make it universally accessible and useful.” Surveillance capitalism depends on the absence of privacy.

A decade ago, Eric Schmidt, Google’s CEO at the time, suggested that those who sought privacy were probably doing something wrong and argued that it’s too dangerous not to identify people online.

Things have changed since then, at least outside Google. Europe’s GDPR now has to be taken seriously. US regulators, after years of inconsequential wrist-slaps and petty-change fines, are scrutinizing the company’s business practices more closely.

Google, like the other major online ad company Facebook, still wants to identify people online for targeted ad delivery. But its current leadership, having seen Facebook raked over the coals for the Cambridge Analytica data spill, now understands it has moderate the data hunger exhibited by its developers, marketers and partners.

Time for a change

In early 2018, Google launched Project Strobe, “a root-and-branch review of third-party developer access to Google account and Android device data and of our philosophy around apps’ data access.”

The first casualty of this privacy and security audit was the shutdown of Google+ because the company gave developers access to the data of 500m Google+ profiles and only later recognized the privacy implications. If anyone had actually been using Google+, it could have been a real scandal.

The APIs for Gmail, Drive and Chrome extensions have come under scrutiny too, resulting in additional restrictions to limit how developers can access and use customer data.

Google’s Privacy Sandbox consists of a related series of proposals, teased at Google I/O, to address web privacy and security concerns related to HTTP cookies and their role in online tracking.

The proposals cover: privacy-preserving ad conversion measurement; tokens for preventing fraud without personalized tracking; limiting browser fingerprinting; interest-based advertising based on group rather than individual behavior; and an identity model for the web that works without cross-site tracking.

“Some ideas include new approaches to ensure that ads continue to be relevant for users, but user data shared with websites and advertisers would be minimized by anonymously aggregating user information, and keeping much more user information on-device only,” explained Justin Schuh, director of Chrome engineering, in a blog post. “Our goal is to create a set of standards that is more consistent with users’ expectations of privacy.”

Google’s goal is also to keep the web safe for advertising. As Schuh put it, “We want to find a solution that both really protects user privacy and also helps content remain freely accessible on the web.”

Master and servant

Therein lies the problem: Google wants to serve two masters, the user and the advertiser. It wants a world where privacy means something other than its dictionary definition: “the state or condition of being free from being observed or disturbed by other people.” It wants a world where privacy applies to everything outside the data points enumerated in its data use policy.

One aspect of its plan is to redefine first-party and third-party, concepts that remain critical to the browser security model. When an internet user visits, say example.com, that site is considered a first-party site and can set a first-party cookie. If example.com’s webpage code includes a Facebook Like button, Facebook could set a third-party cookie, which might be blocked or removed more readily than a first-party cookie.

Google’s identity proposal, “A Potential Privacy Model for the Web,” calls for redefining first-party status so third-parties can be treated as first-parties. With Apple and Mozilla now blocking third-party cookies by default, Google’s proposal looks like an attempt to throw a lifeline to the third-parties thrown overboard by rival browser makers.

Critics were quick to kick Google’s Privacy Sandbox to the curb, suggesting its proposals represent an attempt to redirect the technical momentum that has been moving the web toward meaningful online tracking protection.

The industry isn’t impressed

“There’s a giant elephant in the room you’re not acknowledging,” said Ben Adida, executive director of Voting Works, via Twitter. “Every other browser vendor is working on hard cookie blocking. You’ve got a conflict of interest about doing that very thing, and you don’t even mention it.”

Adida goes on to ridicule the conceit of privacy-preserving advertising. “We’re going to be in an everlasting fight between privacy and targeted advertising,” he said. “If you want to find a magical win-win, you’re gonna have to kill, or at least greatly hamper, the golden goose first.”

Plot twist: Google’s not spying on King’s Cross with facial recognition tech, but its landlord is

READ MORE

Aram Zucker-Scharff, ad engineering director for the research, experimentation and development team at The Washington Post, via Twitter said, “The problem, according to Google, is that users want privacy but ‘publishers’ economic viability’ (how they make money) is dependent on tracking users in a way that is similar to assigning them a web-wide global identity.”

He said he’s not convinced that cross-site tracking has to be saved, pointing to The Washington Post’s plan to develop an ad targeting system that doesn’t depend on third-party tracking.

Brendan Eich, CEO of Brave, a Chromium-based Chrome competitor, via Twitter said, “In conjunction with obstruction of privacy work at W3C, this looks like weak sauce in a misleading ‘privacy matters’ bottle, from a conflicted superpower that dominates the W3C.”

Eich added, “”Speaking for Brave, you cannot serve two masters. There is no ‘halfway tracked’ position on the dial…” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/08/22/google_chrome_privacy_sandbox/

Their struggles underscore the difficulties for small towns in dealing with cyberattacks.

Twenty-two Texas towns and local government organizations have begun to recover from a coordinated ransomware attack on their information systems, though many continue to struggle with outages and disruptions to their municipal services.

The city of Kaufman, Texas, for example, announced on Monday in a post on Facebook that its systems had been “severely affected by an outside source,” informing residents that “all of our computer and phone systems are down and our ability to access data, process payments, etc. is greatly limited.” 

The city, which has a population of approximately 7,000, issued an update later in the week that the “system has been restored” but city services were not completely operational. 

“We are currently working with a third party IT Company to identify and correct the issue,” city officials stated. “However, all City Hall services will be limited until our systems are back online. We ask for your patience while we work through the issue.” (A call to the city’s manager had not been returned as of this posting.)

State officials continue to offer aid to the nearly two dozen towns and cities affected by the coordinated ransomware attack. In an August 20 update, the Texas Department of Information Resources (DIR) announced it had reduced its count of the number of “entities” impacted to 22, and that more than a quarter of those victims had “transitioned from response and assessment  to remediation and recovery.”

Borger, a small Texas town of 13,250, announced it had been impacted on August 19, with vital statistics and utility-payment systems offline. “The City continues to actively work with responders to bring our computer systems back online and regain full operations,” the announcement stated. “Responders have not yet established a timeframe for when full, normal operations will be restored.”

Other towns acknowledging their systems had been impacted by the attack include Keene and Wilmer. In a threat alert, Richardson, Texas-based cloud-security firm Armor Defense identified four other local government organizations impacted by the coordinated attack: the offices in Lubbock and Grayson counties, and the police departments in Bonham, Vernon, and Graham.

Some initial reports indicated that a managed service provider links the various towns and agencies and could have been a vector for the attack. Like many small towns, many, but not all, identified as victims of the attacks use CivicPlus as their content management system. Another common provider seems to be Tyler Technologies, but that company denies being the vehicle for the attack.

Today at least one report cited a communications platform for police departments as the vector of compromise, but Armor urged caution.

“It is also plausible that the threat actors behind this attack spear-phished a list of curated targets — all of them working on behalf of Texas local government organizations,” says Chris Hinkley, a senior security researcher with Armor’s Threat Resistance Unit (TRU). “And if that was the case, it is likely that other small government organizations within Texas were also targeted, outside of the 22 victim entities, but did not fall for the attack.”

The company stressed that local governments, especially those in rural areas, are hard-pressed to fend off cyberattacks. By Armor’s accounting, at least 67 municipalities, and 133 US organizations in total, have been hit with ransomware to date in 2019. And while a typical ransomware framework or attack platform may cost only hundreds of dollars, attackers have claimed hundreds of thousands of dollars from affected towns.

“All government organizations should be aware that no entity is safe, no matter how small or obscure,” he says. “They must be diligent when protecting their digital assets, and it is imperative that they consider employing some of the key cybersecurity protections against ransomware attacks.”

An IT professional in one small Texas town that had not been impacted by the ransomware campaign stressed that local governments in rural areas have few resources to secure their computer systems. Speaking on background, the IT expert blamed the high cost of hiring cybersecurity professionals as well as the lack of interest on the part of vendors in serving small communities for the security shortfall.

While the mayors of larger towns have pledged to not pay ransoms to cybercriminals who use crypto-locking ransomware in hopes of removing financial incentives, one security professional expects the strategy to have little impact on the threat.

Zohar Pinhasi, CEO of attack-recovery service provider MonsterCloud — which helped the city of Kaufman recover from a previous ransomware attack and has reportedly used controversial methods to resolve incidents — argued that ransomware is here to stay.

“Paying or not paying is no deterrent, because their state-sponsored terrorism will not stop,” he says. “They aren’t going away — in fact, most are not after the dollars [but] rather in making a statement against the US.”

Related Content:

• Towns Across Texas Hit in Coordinated Ransomware Attack
• US Mayors Commit to Just Saying No to Ransomware
• Pledges to Not Pay Ransomware Hit Reality
• 8 Head-Turning Ransomware Attacks to Hit City Governments
• To Pay or Not To Pay? That Is the (Ransomware) Question

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “You Gotta Reach ‘Em to Teach ‘Em.“

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/texas-towns-recover-but-local-governments-have-little-hope-for-respite-from-ransomware/d/d-id/1335606?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A recent blog post explains how the social network is fighting to protect its users from interactions with fake accounts.

Fake accounts — those created by bots or malicious actors — are problems for every social network. In a recent blog post, professional community LinkedIn discussed what it has done, and is doing, to fight the fakes.

According to the post, LinkedIn took action on more than 21 million fake accounts in the first half of 2019; 95% of those were stopped during account creation by something in the process automation.

The remaining accounts were stopped by a combination of user reports and automated processes. In a related blog post, LinkedIn broadly described the machine intelligence it uses to detect, score, and act on fake accounts, whether they’re created in bulk by a bot or individually by a malicious actor. The company says that it has teams of engineers and investigators working to protect the 610 million members who use the service for connecting to professional networks and finding new jobs.

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “You Gotta Reach ‘Em to Teach ‘Em.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/linkedin-details-features-of-fight-against-fakes/d/d-id/1335608?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Gone are the days when users could take refuge from Windows threats with Apple devices, as malware writers are exploiting OSX and iOS with real vigor, says Mark Dufresne, VP of RD at Endgame. And though it’s taken a while, Mac security has achieved parity with Windows so that Apple users need no longer settle for “protected enough.”

Article source: https://www.darkreading.com/endgame-boosts-apple-security-to-be-commensurate-with-windows-security---/v/d-id/1335603?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Comparative research shows the relative strengths and weaknesses of five TIG vendors and which kinds of security organization will reap the most benefit.

It’s fashionable to say that in the age of cloud and teleworking, the network perimeter is no more. That with applications residing in cloud environments and employees, partners, and contractors logging in to work from just about anywhere, the old notion of a “castle-and-moat” defensive barrier around corporate assets is a thing of the past.

Well, the situation has certainly changed quite a bit, but the success of next-generation firewall (NGFW) vendors shows that there is still a lot of investment in good old edge security, i.e. technology deployed on the real, or increasingly on the theoretical edge of a network to keep bad guys and malicious stuff out.

Now, with estimates to suggest that enterprise IT systems are attacked every 39 seconds, or around 2,500 times per day, it is clear that whatever security measures we have in place to keep out attackers are under considerable pressure. Those will often include a firewall and, particularly, if it is of the aforementioned next-generation variety, it will come with a lot of compute power on board to inspect all incoming traffic in a stateful manner, all the way to the application layer (7 in the OSI model).

Enter the TIG
But what if we could lighten that burden by proactively blocking what we know to be bad before it even gets to the NGFW? Enter the threat intelligence gateway (TIG), a class of security tool that has emerged in recent years to do just this. TIGs are stateless devices deployed between a corporate router and an NGFW, effectively blocking the known bad, based on a prior knowledge of malicious URLs and compromised IP addresses, before the traffic ever gets to the firewall. This reduces the traffic to the firewall and enables the firewall to focus its CPU cycles on inspecting for the more complex and subtler attack types that warrant attention.

Where does that prior knowledge come from, and how trustworthy and up to date will it be when we get it? Clearly, this is outside the purview of the TIG itself, speaking instead to the kinds of threat intelligence enterprise customers are now commonly ingesting to inform their security decision-making. In a recent report, Ovum looked at the offerings of five of the most representative TIG vendors, and it is no coincidence that a number of them spoke of TIG’s ability to integrate with threat intelligence platforms, or TIPs, a very similar acronym describing technology that ingests, aggregates, and normalizes threat feeds from commercial and open source providers, often enhancing it with a customer’s own threat data.

The vendors and products we looked at were:

• Bandura: Bandura TIG
• Centripetal: RuleGATE
• Ixia: TheatARMOR
• LookingGlass: scoutSHIELD
• Netscout: Arbor Edge Defense

Of this group, Ixia and Netscout have the longest pedigrees in the industry, with Ixia being a major name in security testing and Netscout a network monitoring/service assurance vendor that expanded into security with its 2015 acquisition of Arbor Networks. Interestingly, only LookingGlass has both a TIG and a TIP in its portfolio, though clearly all the TIGs can integrate with third-party TIPs.

As a later entrant into the market, Netscout has sought to differentiate its offering by highlighting its ability to inspect both inbound and outbound traffic, enabling it to block data exfiltration attempts or simply employee errors, and making it both a first and last line of defense, as it were. Since then, the other vendors have also begun expounding their outbound credentials too.

Who Benefits?
To some extent, a TIG can be thought of as an instantiation in software, and sometimes with some dedicated hardware in support, of the black- and whitelists that have helped web and content filtering devices decide what to block for many years. More dynamically, however, their integrations with TIPs make it possible to make threat intel actionable, since TIPs are data processing platforms while TIGs are enforcement devices.

That said, they are clearly not for everyone. It was Ovum’s conclusion that TIGs can be a useful a useful additional to the arsenal of defensive tools employed by an enterprise, and particularly one that is in threat actors’ crosshairs, such as in the financial sector, healthcare, or the defense sector.

If you are already taking a threat feed or two and are reasonably happy with their accuracy and timeliness, applying them in a TIG for enforcement purposes may be a quick and easy win, in terms of reducing the burden on both your firewall estate and your security staffers.

Ovum is less certain that TIGs are appropriate for smaller or even midsize companies. While they hold the promise of automating away some of the blocking activity from your firewall and your security team, you should at least have a security team large enough to manage the TIG, periodically checking on the accuracy of the threat intel it is receiving and reviewing a list of what has been blocked to keep false positives at a minimum. If you don’t have someone to do that, the only way to use a TIG would be via a service provider and, as yet, such services are not available.

Related Content:

• A Password Management Report Card
• The State of IT Operations and Cybersecurity Operations
• 2019 Pwnie Award Winners (And Those Who Wish They Weren’t)
• Modern-Day SOCs: People, Process Technology

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “You Gotta Reach ‘Em to Teach ‘Em.

Rik is a principal analyst in Ovum’s IT security and technology team, specializing in cybersecurity technology trends, IT security, compliance, and call recording. He provides analysis and insight on market evolution and helps end users determine what type of technology and … View Full Bio

Article source: https://www.darkreading.com/cloud/threat-intelligence-gateways-a-useful-adjunct-to-overworked-perimeter-security--/a/d-id/1335518?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Better known for their essential role in networking, Domain Name Servers should be tapped as a means to identify – and shut down – suspicious or destructive activity, according to Anthony James, VP of Marketing for Infoblox. He also explains how to combine DNS with DHCP and IP address management to improve an organization’s security.

Article source: https://www.darkreading.com/make-dns-a-cornerstone-of-your-cyber-security-arsenal/v/d-id/1335604?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple