STE WILLIAMS

Sonrai Security, a new startup focused on cloud data security, today launched with $18.5 million in Series A funding and rolled out a new service designed to enable data and identity control across cloud accounts and within data stores.

Sonrai co-founders Brendan Hannigan and Sandy Bird met at Q1 Labs, where Bird was co-founder and Hannigan was CEO. The duo helped create its security analytics platform QRadar, and both joined IBM when it acquired Q1 Labs in 2011. Hannigan helped establish IBM Security and served as a general manager for the division, while Bird became IBM Security’s CTO.

Hannigan left IBM toward the end of 2015, and Bird a bit later, but both continued to work on issues related to data security as the space evolved. “What’s happening with cloud, and what I’d call agile development, is [they’re] clearly completely changing how companies deploy and run software,” Hannigan says. “[It’s] now happening at a rate which is intensifying.”

He references Gartner data from July 2018, when researchers predicted by 2025, 80% of enterprises will have shut down their traditional data centers, versus 10% today. The change demands companies to rethink their approach to security as data and infrastructure spans cloud platforms.

“In new infrastructure, you cannot take old solutions and try to jam them into the new world,” Hannigan says. The “old world,” he says, was very focused on perimeter security. In this new cloud-focused world, many of the controls are built into the infrastructure cloud providers deliver.

As they move into this world, Hannigan adds, businesses don’t have one cloud – they have multiple providers. Most use Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP), but they can have hundreds of cloud accounts for any one provider and multiple data stores within those accounts. Organizations need to know whether they have confidential data in the cloud, where it’s located, and who has access to it. Cloud accounts are packed with data spread across machine stores and accessed by people, virtual machines, and containers.

People need to understand their data and its associated risks, he continues. The idea prompted the idea for Sonrai, which Hannigan says “is about building a complete model of our identity relationships and access to that data across cloud accounts and cloud providers.” Traditional network-centric security controls don’t work in the cloud, its founders argue, so they wanted to prioritize cloud data control and build a risk mitigation model focused on data.

“Our focus across these clouds is the data – where is it, who has access, what type of stores are the data in,” he says. “There’s many different places people can store data in cloud accounts.”

How It Works
Cloud Data Control, Sonrai’s service, is a native cloud tool designed to track data and users across cloud services and third-party data sources. Hannigan and Bird used their experience in developing flexible platform solutions to create a service that lets users view identity and data relationships across cloud environments. A security pro trying to understand risk across AWS, Azure, and GPC would need only one query line to see, for example, whether encryption is automated for a data store housing confidential information, Bird explains.

The service is built on three values: continuous monitoring for unusual activity, audit and compliance, and driving efficiency for SecOps and DevOps teams, Hannigan says. Both groups need a broad view of cloud data and activity but have different use cases for that information. Sonrai had to bridge the gap between the data security teams want and the agility DevOp teams need.

“It’s a different view for both sides,” Bird says. The CISO and security team will be focused on whether a company’s hundreds of AWS accounts and Azure subscriptions have met policies and controls. DevOps want an API to call to check the state of compliance before production. Both teams can see dashboards, APIs, and a compliance framework, but with unique interfaces.

Sonrai’s Series A funding was led by TenEleven Ventures and Polaris Partners, where Hannigan was most recently an entrepreneur partner.

Related Content:

• Cryptomining Continues to Be Top Malware Threat
• Advanced Phishing Scenarios You Will Most Likely Encounter This Year
• 6 Serverless and Containerization Trends CISOs Should Track
• Who Takes Responsibility for Cyberattacks in the Cloud?

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/former-ibm-security-execs-launch-cloud-data-security-startup/d/d-id/1333653?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

With the world going digital, the dependence on the availability of IT infrastructure keeps exponentially growing, and many people don’t comprehend the true scope of the implications. The recent cyberattack on the Los Angeles Times is a prominent example, disrupting the delivery of the Los Angeles Times and Tribune newspapers across the entire US. And in May 2018, a number of distributed-denial-of-service (DDoS) attacks were launched targeting the Netherlands, affecting and temporarily shutting down the online banking of three of the country’s largest financial institutions.

Thanks to the emergence of the darknet, cybercrime has become widely accessible and procurable, blurring the lines between legitimate e-commerce and illicit trade. In the Netherlands, an 18-year-old man was arrested in connection with the DDoS attacks who apparently hired a cybercriminal through one of the various marketplaces in the darknet and who “wanted to show that a teenager can simply crash all banks” with a few clicks — unfortunately, he was right.

Society Is More Vulnerable to Cyberthreats
Indeed, society has become much more vulnerable to such attacks. The World Economic Forum (WEF) says business leaders in advanced economies see cyberattacks as their single biggest threat, even more so than terrorist attacks (No. 2), an asset bubble (No. 3), a new financial crisis (No. 4), or failure to adapt to climate change (No. 5).

This is no surprise because the business risks associated with cybercrime are growing along with companies’ ever-increasing dependence on technology. Moreover, the massive growth in the use of smart devices has opened up a universe of new ways for cybercriminals to launch attacks through large-scale botnets. By 2025, the number of smart devices in the world is projected to exceed 75 billion, outnumbering the global population by a factor of 10. Meanwhile, geopolitical rivalries are engendering larger and more sophisticated cyberattacks by smart, well-resourced IT teams with generous state backing. Particularly, large organizations need to take into account a whole range of cyber threats — including business interruption, theft, and extortion — reputational damage, economic espionage, and the infiltration of critical infrastructure and services. The evolving threat landscape combined with a mixture of highly sophisticated adversaries makes cyber-risk very challenging to manage.

An Under-Resourced Risk
Awareness of this risk is growing, and more organizations are directing efforts toward cyber-risk management. However, as the WEF highlights, cybersecurity is still under-resourced when measured against the sheer scale of the threat.

Cybercriminals are now estimated to pocket $1.5 trillion annually — a staggering amount equal to Russia’s gross domestic product, and five times the cost of approximately $300 billion resulting from natural disasters in 2017. Some studies predict that the takedown of a single cloud provider could result in $50 billion to $120 billion in economic damage — similar to the financial carnage stemming from Hurricane Sandy and Hurricane Katrina. 

Cyber Issues Reduce Value
Cyberattacks can wreak havoc on a company, and severe financial and legal blowback are only the start. Equifax’s stock dropped more than 31% after the firm revealed that it had been the victim of a breach. The disclosure erased $5 billion in market value, as reported by MarketWatch. After Yahoo disclosed two large-scale breaches, Verizon cut its buy offer by $350 million, or about 7% of the original price. The breach almost scuttled the deal. Yahoo had to pay a $35 million penalty to settle securities fraud charges levied by the US Securities and Exchange Commission (SEC), and another $80 million to settle lawsuits launched by irate shareholders.

When the Marriott breach hit the news, Sen. Charles E. Schumer (D-NY) called on the hotel chain to foot the bill and replace the passports for as many as 327 million people whose passport numbers might have been exposed in the attack. Marriott pledged to cover the cost, but at $110 per passport — the standard fee — it would have had to fork out an incredible $36 billion, an amount equivalent to the firm’s entire market capitalization.

New Risk Imperatives
Other factors influence the consequences of cybercrime. For instance, firms are more heavily leveraged than they were a few years ago. Since 2010, the debt-to-equity ratio for the median SP 1500 company has nearly doubled. Consequently, according to the WEF, their stability is even more threatened by cybercrime skullduggery.

In response, regulatory frameworks are being tightening up around the globe — witness the General Data Protection Regulation in Europe and the new SEC directives in the US. The authorities want to see better preparation that will mitigate risk, and more transparency after cyberattacks. In a press release, SEC Chairman Jay Clayton urged public companies to “examine their controls and procedures, with not only their securities law disclosure obligations in mind, but also reputational considerations around sales of securities by executives.”

Businesses need to focus on their resilience to cyber events and generally need to put emphasis on prevention and response. Research suggests that only about half (52%) of organizations have a CISO on their payroll, and only 44% say their corporate boards actively participate in their companies’ overall security strategy. In the digital age, this is no longer good enough and needs rethinking.

Because virtually every business is going digital in one way or another, it’s naive to think that today’s cyberattacks primarily affect technology companies. In fact, cybercrime is setting its sights on industries across the board, many of which were left alone in the pre-digital era. Hotels, airlines, and banks, for example, are now squarely in the cybercriminals’ crosshairs.

The upshot is that modern corporate innovation and growth must be balanced against cyber-risk and IT stability. More than ever, business leaders must create strategic plans that pave the road to emerging opportunities but also outline how their companies will ensure business continuity and deal with the complex set of cyber threats blighting the global digital landscape.

Related Content:

• 7 Steps to Start Your Risk Assessment
• Your Life Is the Attack Surface: The Risks of IoT
• Security Matters When It Comes to Mergers Acquisitions
• Managing Security in Today’s Compliance and Regulatory Environment

Marc Wilczek is a columnist and recognized thought leader, geared toward helping organizations drive their digital agenda and achieve higher levels of innovation and productivity through technology. Over the past 20 years, he has held various senior leadership roles across … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/why-cyberattacks-are-the-no-1-risk-/a/d-id/1333616?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

UPDATED 2:20 P.M. E.T. — A Ukrainian hacker was charged by US authorities, today, for offenses related to a hacking and illegal trading scheme; he still faces similar charges brought against him four years ago.  

Oleksandr Ieremenko, 26, and Artem Radchenko, 27, both of Kiev, Ukraine, were charged today for their roles in a 2016 attack on the US Securities and Exchange Commission (SEC). The SEC discovered and revealed the attack in September 2017.

Attackers invaded the SEC’s Electronic Data Gathering, Analysis and Retrieval (EDGAR) corporate filing database used by publicly traded companies and money managers. They were thus able to access these businesses’ non-public earnings information. Financial traders, recruited by Rachenko, traded illegally on this privileged inside information, according to the US Department of Justice.

Ieremenko is still at-large and facing charges brought against him in 2015 related to a $30 million securities fraud and hacking scheme. In that case, the attackers compromised newswire services—including PR Newswire, Marketwired, and Business Wire—accessed thousands of business press releases before publication, then illegally traded on that privileged insider information.

Read more here and here. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/sec-issues-charges-in-edgar-database-hack/d/d-id/1333655?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Image Source: Adobe Stock: deagreez

Privacy and security are often thought of as one and the same. While they are related, privacy has become its own discipline, which means security pros need to become more familiar with the subtle types of mistakes that can lead to some dangerous privacy snafus.

With GDPR going live last spring in Europe and the California privacy law becoming effective in 2020, companies should expect privacy to become more of an issue in the years ahead. Colorado and Vermont have passed privacy laws, as has Brazil, and India is well on its way to passingone of its own.  

First and foremost, companies have to think of privacy by design, says Mark Bower, general manager and chief revenue officer at Egress Software Technologies.

Privacy by design requires companies to ask the following questions: What type of data are we storing? For what business purposes? Does the data need to be encrypted? How will the data be destroyed when it becomes obsolete, and how long a period will that be? Are there compliance regulations that stipulate data destruction requirements? How will the company protect personally identifiable information for credit cards and medical information?

“Companies can’t understand risk if they don’t know where the data resides,” says Debra Farber, senior director of privacy strategy at BigID. “Privacy should be by default. Companies want to make sure that personal data is protected.”

Read on for the most common privacy mishaps. 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/endpoint/privacy/7-privacy-mistakes-that-keep-security-pros-on-their-toes/d/d-id/1333643?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

American law enforcement cannot force people to unlock devices using a facial or fingerprint scan, as stated in a new ruling intended to protect individuals from intrusive federal searches.

US judges had previously given authorities power to force people to unlock devices using biometric scans, even though they couldn’t force them to share passcodes. A new ruling, which says all passcodes are equal, has been called a “potentially landmark” verdict, Forbes reports.

It comes from the US District Court for the Northern District of California, where a search warrant for an Oakland property was rejected. As part of a Facebook extortion crime investigation, police wanted to access phones on the property with biometric scans. Magistrate judge Kandis Westmore ruled this was “overbroad” as it didn’t specify a person or device.

Even with a warrant, the judge said, government officials could not force people to incriminate themselves by using facial, fingerprint, or iris scans to unlock mobile devices. Passcodes and biometric scans can all be used to log into devices and should be treated the same. If someone cannot be forced to provide a passcode, they also cannot be forced into biometric scans.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/us-judge-police-cant-force-biometric-authentication/d/d-id/1333656?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Online fraud is a subset of cybercrime that typically takes place at the application layer. Although fraud was commonly associated with scams (for instance, Nigerian fraud), fraudulent transactions, and identity theft in the past, its “potential” has exploded in recent years — thanks to the many new ways to cash in on consumer-facing online services and applications.

Many of these new fraud attacks have already made headlines:

• Fake reviews and purchases to artificially boost a product or seller’s ranking
• Fake accounts created to take advantage of sign-up promotions/bonuses
• Fraudulent listings with counterfeit products or attractive prices to lure buyers off the platform into under-the-table (and potentially unsafe) transactions
• Bots generating artificial clicks, installations, and app engagement
• Virtual items in online games traded or resold for profit
• Fraudulent transactions
• Fraudulent credit card and bank account openings from stolen and/or fake identities.

The list goes on. But unlike other types of cybercrime that “hack” into a network or system by obtaining unauthorized access, these new fraud attacks can be launched by simply registering user accounts and abusing available product features offered by online services and applications. The online services have become a part of the attack platform. For cybercriminals, why pay for bulletproof hosting when you can freely and anonymously put up content on social networks and peer-to-peer marketplaces?

This shift away from specialized attack infrastructure means that blacklists and reputation lists traditionally used for detection are becoming ineffective. Fraudsters no longer need to maintain dedicated servers for hosting malicious content or launching attacks, and they can afford to switch up their operation frequently. In DataVisor’s recent Fraud Index Report, the median lifetime of a fraudulent IP address is reported to be only 3.5 days. As long as cybercriminals can access the online services and applications — either through anonymous proxies, peer-to-peer community VPNs, or even directly from their home network — the attack is possible.

Attacking at the Application Layer
Attacking at the application layer gives fraudsters a greater chance of blending in with normal users. It is difficult to tell whether an HTTP connection is generated by a human or a script, just as it is difficult to distinguish between a fake user account and a real one.

The application layer, which supports a variety of communication protocols, interfaces, and access by end users, has the widest attack surface. In addition to the application code, vulnerabilities could also exist in access control and web/mobile APIs. Attacks involving authorized users that have already logged in — such as the fraud attacks that leverage user accounts on consumer-facing online services — are the most difficult to prevent and detect.

Depending on the actions and features available on the online service or application, fraudulent accounts can perform a variety of benign actions to stay under the radar. Many lie in wait for weeks, months, or even years before launching the attack. For example, financial fraudsters open multiple credit cards using synthetic identities and accumulate credit history over time, only to cash out their credit limit and disappear. In another example, we have observed fake accounts created on social network sites becoming active after three years to update their profile information with phishing URLs.

These attacks are challenging to detect even for machine learning models. One aspect of this is due to how models “learn” to identify fraudulent and malicious activities. In many popular machine learning applications, such as image recognition or natural language processing, the labels are well-defined and unambiguous; an image of a chicken shows a chicken, not a duck. By giving many examples of “chicken” to the model, we can have pretty good confidence that it will learn to recognize chickens.

However, there is no single definition of fraud or fraudulent behavior. Thus, when applying machine learning to fraud, the labels are noisier. 

Changing Attack Dynamics
A second challenge is due to the dynamic nature of attacks. Without constraints on dedicated attack infrastructure, fraudsters can adapt their operation in a much faster manner to exploit loopholes in the applications. Relying on historical examples of attacks means that the model is always operating based on outdated information, limiting its effectiveness against future attacks.

To deal with sophisticated, fast-evolving online attacks, a robust solution should incorporate multiple layers of defenses. Adopting a strong authentication system, reviewing all API accesses, and performing automated code testing helps to establish a solid baseline defense. Also, organizations must vet developers and third-party apps, be aware of access given on nonstandard interfaces, and understand the types of attacks happening on your service or application to make an educated choice about the type of solution to implement.

To further address abuse involving authorized users, adopt advanced behavior profiling for a holistic analysis of user activities. Online fraud attacks are often performed at scale, involving hundreds to thousands of fraudulent accounts. These “bot” accounts are likely to exhibit behaviors that are very different from those of normal users. Explore technology solutions that focus on data analytics and uncovering new insights rather than the detection of known, recurring attack patterns alone.

It’s no longer enough to keep up with online fraud. In fact, if you are just keeping up, you’re already behind.

Related Content:

• 2019 Attacker Playbook
• Web Vulnerabilities Up, IoT Flaws Down
• Your Life Is the Attack Surface: The Risks of IoT

Ting-Fang Yen is a director of research at DataVisor, a company providing big data security analytics for online services and financial institutions. Her work focuses on network and information security data analysis, where she combines data science with security domain … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/online-fraud-now-a-major-application-layer-security-problem/a/d-id/1333633?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple