Preparing for Notifiable Data Breach: A Guide to Not Becoming Australia’s Breach Example

/0 Comments/in , /by

As Australians return to work after the holiday season, IT teams across the country will be pushing to make sure they are prepared for the implementation of the Notifiable Data Breach (NDB) amendment, which takes effect on 22 February.

It is important to point out that many businesses have had nearly a whole year in which executives and IT teams should have worked together to ensure their business networks are secure. The Office of the Australian Information Commissioner (OAIC) has worked hard to provide Australian businesses with the support they need to understand the legislation and prepare for the changes. Thus, many CEOs and CIOs will not be surprised by the change in legislation.

Due to the long lead in time of the legislation, it can almost be guaranteed that the first organisation to violate the legislation will be made an example of to the rest of businesses across Australia. On top of that, businesses will surely face reputational damage and the possibility of financial penalties. In order to avoid these punishments, it is important that companies understand who to worry about, be on the lookout for past breaches, and know how best to prepare for the changes coming.

How hackers operate

Understanding how hackers think could make the difference for how an IT team withstands a cyber attack. Generally speaking, the first objective of a hacker is to gain access into a business’s network undetected.

Once inside the network, hackers could lurk for weeks, months and sometimes even years looking for sensitive data and passwords or credentials. They most likely will add backdoors to ensure they have continued access long after the initial breach occurs. The hackers will proceed to add malicious software to the network that sits dormant until they are ready to take action or launch an attack. Sometimes this can be seen in an organisation’s environment in the form of unusual system issues, but more often than not is missed or passed off as a “glitch.” Businesses experiencing this could already be in danger and not even realise it.

Cover Your Past Before Looking to the Future

A common mistake companies make is looking to the future without analysing the past. If a company is going to implement a large — and most likely costly — security system to ensure they do not fall victim to hackers in the future, it is important to know that they have not already fallen victim to a hacker.

Cyber security controls needs to be installed from the ground up to ensure the investment is worthwhile. Investment in cyber security is like any other major purchase; it needs to have a strong foundation in order to be effective. If a business’s network has already been compromised, the security system in place will be for nothing, as organisations can still be breached down the road.

Cyber security 101: Always plan ahead

In order to prevent becoming a victim of cyber crime, it is important that organisations check and re-check for threats. This is especially important leading up to the implementation of the NDB legislation and investing in a top-of-the-line cyber security platform.

As mentioned, threats can stay hidden and dormant for months and often times can be missed in general security scans. It is not uncommon for IT professionals to find threats or backdoors into their organisation’s environment when testing for something completely different. This is why it is vital to test, re-test and test again to ensure all threats have been found and eliminated prior to investing and deploying a security system.

Falling victim to a cyber breach can be devastating to any organisation’s reputation and could further lead to financial implications. With the NDB legislation in effect, the government will be quick to make examples of organisations that fail to adhere to the new legislation.

In order to avoid penalties and other negative news associated with being breached, it is important for businesses to guarantee that they have not already fallen victim to hackers in the past. Then, and only then, can IT teams build a security system that will protect businesses moving forward, knowing a strong foundation is in place. Some general best practices include:

  • Ensure the cyber security strategy is scaled across wired, wireless, cloud and mobile networks, where applicable
  • Leverage next-generation firewalls to mitigate advanced cyber threats
  • Layer cyber security controls with cloud sandboxing, such as Capture ATP
  • Deploy email security controls to help identify and block phishing attempts
  • Map network data to understand what’s most valuable

While, the legislation will be something new to all Australian organisations, it is a step in the right direction for the safety of peoples’ private information.

For more information on common data breaches please visit https://www.sonicwall.com/en-us/legal/au-mandatory-data-breach-laws.

Email Security with Continuity, Multi-tenancy

/0 Comments/in /by

Email is vital to business communications and operations. However, as the volume of email increases, so too does the amount of ransomware, phishing, business email compromise (BEC), spoofing, spam and virus attacks.

What’s more, government regulations (e.g., PCI, HIPAA, GDPR, etc.) now hold your business accountable for protecting confidential data, ensuring it is not leaked and supporting the secure exchange of email that contains sensitive customer data or confidential information.

Deploying and maintaining an on-premises email security solution is CAPEX-intensive and creates administrative overhead. Organizations can benefit from replacing legacy solutions with an easy-to-use, affordable cloud-based security solution. This helps protect organizations from email-borne threats such as ransomware, zero-day attacks, spear-phishing and BEC ─ all while meeting email compliance and regulatory mandates.

The new SonicWall Email Security 9.1 solution now includes email continuity to minimize business impact during planned and unplanned outages to your email servers.

Hosted Email Security

SonicWall HES is a cloud-based, multi-tenant security service that protects against today’s advanced email threats.

Hosted email security

SonicWall Hosted Email Security (HES) offers comprehensive cloud-based email protection to stop ransomware and other email-borne threats before they reach your network.

Email attachments are scanned by the SonicWall Capture Advanced Threat Protection (ATP) service, a multi-engine sandbox that automatically detects and prevents advanced threats from reaching your network. The solution blocks ransomware and zero-day threats in the cloud and ensures only safe emails are delivered to your inbox. Get the scalability you need with no upfront costs and predictable subscription rates.

SonicWall Email Security 9.1 firmware

With focus to improve our email security solution to better protect and enable our customer’s businesses, SonicWall is releasing an update to its firmware with security enhancements, updated and modern UI, and the following features.

Why email continuity is important

Business are global, operate 24/7 and depend on email. Outages to email services have significant impact on an organization’s productivity and disrupts business.

Traditional approaches to email continuity — designed to ensure high availability with on-prem email deployments — have proven costly and ineffective. In many cases, this leaves organizations with continued outages.

Small- and medium-sized business (SMB) can rarely justify the cost of building a highly redundant messaging infrastructure. Moving to cloud-based solutions enables organizations to lower costs and deliver better service, but outages are inevitable.

For example, Microsoft Office 365 claims a high degree of service availability (via their service-level agreements, or SLAs) at a global level, but when individual regions or businesses are involved, impact can be high. (For a helpful resource, outages to cloud service providers are recorded at downdector.com.)

Email continuity for SonicWall HES

SonicWall HES delivers simple, cost-effective protection against planned or unplanned downtime events, whether your email servers are on-premises, hybrid environments or in the cloud.

Email Continuity Infographic

Achieve 24/7 service availability with email continuity.

With SonicWall Continuity for Hosted Email Security,* ensure emails are always delivered and productivity is not impacted during planned and unplanned outages of on-prem email servers or a cloud provider, such as Office 365.

During outages, users can access a secure, browser-based Emergency Inbox to compose, read and respond to messages. Email spooling ensures no messages are lost when email servers are unavailable, and delivers them when the servers are up.

Managed service providers

When investigating an email security offering best suited for their customers, managed service providers (MSP) should not only select the most comprehensive solution, but also one that enables them to differentiate.

By deploying SonicWall Email Security, MSPs can deliver a managed email security service with robust multi-tenancy support, customized environment configurability for Microsoft Office 365, and an advanced security platform. The solution’s MSP-friendly capabilities include:

  • Flexible deployment options
  • Enhanced multi‐tenancy
  • RESTful APIs
  • Easy integration with Microsoft Office 365
  • Customized branding
  • Comprehensive reporting and monitoring

For more details, explore our resources for Email Continuity, Multi-tenancy for MSPs, and SonicWall Hosted Email Security.

* Continuity for Hosted Email Security will be available as an add-on subscription beginning February 2018. For more details, visit mysonicwall.com or contact your preferred SonicWall partner.

8 Cyber Security Predictions for 2018

/0 Comments/in /by

In preparation for the upcoming publication of the 2018 Annual SonicWall Threat Report, we’re busy reviewing and analyzing data trends identified by SonicWall Capture Labs over the course of 2017.

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from more than 1 million sensors around the world, performs rigorous testing and evaluation, establishes reputation scores for email senders and content, and identifies new threats in real-time.

With the New Year, it’s appropriate to recap last year’s trends, and offer a few preliminary insights into noteworthy trends we expect to see in 2018.

Ransomware will persist, evolve

Ransomware will continue to be the malware of choice. It has never been easier to make your own ransomware. With the rise of ransomware-as-a-service, even the most novice developer can create their own ransomware. As long as cybercriminals see the potential to make enough in ransom to cover the costs of development, we will continue to see an increase in variants.

However, an increase in variants does not mean an increase in successful attacks, which we will explore in detail in the 2018 Annual Cyber Threat Report.

SSL, TLS encryption will hide more attacks

For the first time, Capture Labs will publish real metrics on the volume of attacks uncovered inside encrypted web traffic. At the same time, the percentage of organizations that have deployed deep-packet inspection of encrypted threats (DPI-SSL/TLS) remains alarmingly low.

In the year ahead, we expect there will be more encrypted traffic being served online, but unencrypted traffic will remain for most public services. More sophisticated malware using encrypted traffic will be seen in cyberattacks.

In response, we expect more organizations will enable traffic decryption and inspection methods into their network security infrastructure. This expanded deployment of DPI-SSL/TLS will rely in part on the success of solution providers reducing deployment complexity and cost to lower operating expense.

Cryptocurrency cybercrime expected to be on the rise

Due to rapid rise in cryptocurrency valuations, more cryptocurrency mining and related cybercrime is expected in the near future. Attackers will be exploring more avenues to utilize victim’s CPUs for cryptocurrency mining and cryptocurrency exchanges and mining operations will remain the targets for cyber theft.

UPDATE: On Jan. 8, SonicWall Capture Labs discovered a new malware that leverages Android devices to maliciously mine for cryptocurrency.

IoT will grow as a threat vector

As more devices connect to the internet, we expect to see more compromises of IoT devices. DDoS attacks via compromised IoT devices will continue to be a main threat for IoT attacks. We also expect to see an increase in information and intellectual property theft leveraging IoT, as capability of IoT devices have been largely improved, making IoT a richer target (e.g., video data, financial data, health data, etc.). The threat of botnets will also loom high with so many devices being publically exposed and connected to one another, including infrastructure systems, home devices and vehicles.

Android is still a primary target on mobile devices

Android attacks are both increasing and evolving, such as with recently discovered malware. Earlier ransomware threats used to simply cover the entire screen with a custom message, but now more are completely encrypting the device — some even resetting the lock screen security PIN. Overlay malware is very stealthy. It shows an overlay on top of the screen with contents designed to steal victim’s data like user credentials or credit card data. We expect more of these attacks in 2018.

Apple is on the cybercrime radar

While rarely making headlines, Apple operating systems are not immune to attack. While the platform may see a fewer number of attacks relative to other operating systems, it is still being targeted. We have seen increases in attacks on Apple platforms, including Apple TV. In the year ahead, macOS and iOS users may increasingly become victims of their own unwarranted complacency.

Adobe isn’t out of the woods

Adobe Flash vulnerability attacks will continue to decrease with wider implementation of HTML5. However, trends indicate an increase in attacks targeting other Adobe applications, such as Acrobat. There are signs that hackers will more widely leverage Adobe PDF files (as well as Microsoft Office file formats) in their attacks.

Defense-in-depth will continue to matter

Make no mistake: Layered defenses will continue to be important. While malware evolves, much of it often leverages traditional attack methods.

For example, WannaCry may be relatively new, but it leverages traditional exploit technology, making patching as important as ever. Traditional email-based threats, such as spear-phishing, will continue to become more sophisticated to evade human and security system detection. Cloud security will continue to grow in relevance, as more business data becomes stored in the data centers and both profit-driven cybercriminals and nation-states increasingly focus on theft of sensitive intellectual property.

Conclusion

When gazing into our crystal ball, we’re reminded that the only thing certain is change. Look for more detailed data in our soon-to-be-published 2018 SonicWall Annual Threat Report.

View Tech Brief

How to Hide a Sandbox: The Art of Outfoxing Advanced Cyber Threats

/0 Comments/in /by

Malware often incorporates advanced techniques to evade analysis and discovery by firewalls and sandboxes. When malware sees evidence that dynamic analysis is occurring, it can invoke different techniques to evade analysis, such as mimicking the behavior of harmless files that are typically ignored by threat detection systems.

Traditional sandboxing approaches that signal their own presence — for example, by instrumenting underlying virtual machines (VM) to intercept malicious function calls — make the analysis environment visible. This can trigger an action by malware to conceal itself.

Because of the increased focus by malware authors on developing evasion tactics, it is important to apply a multi-disciplinary approach to analyzing suspicious code, especially for detecting and analyzing ransomware and malware that attempt credential theft.

SonicWall’s award-winning Capture Advanced Threat Protection (ATP) multi-engine sandbox platform efficiently discovers what code wants to do from the application, to the OS, to the software that resides on the hardware. In fact, SonicWall formed a partnership with VMRay to leverage their agentless hypervisor-level analysis technology as one of the three powerful Capture ATP engines. The VMRay technology executes suspicious code, analyzes changes within the memory of a system to detect malicious activity, while resisting evasion tactics and maximizing zero-day threat detection.

How VMRay enhances Capture ATP

VMRay brings an agentless hypervisor-based approach to dynamic malware analysis. The hypervisor is the underlying computing platform that creates, runs and manages virtual machines on the underlying hardware. Most sandboxing solutions use a hypervisor as a launch pad for either the emulators or virtual machines that are hooked and monitored.

Figure 1 VMRay runs as part of the hypervisor on top of the host OS

VMRay takes a different approach to sandbox analysis by monitoring the activity of the target machine, entirely from the outside, using Virtual Machine Introspection (VMI). VMRay combines CPU hardware virtualization extensions with an innovative monitoring concept called Intermodular Transition Monitoring (ITM) to deliver agentless monitoring of VMs running a native OS without emulation or hooking (to avoid being detected by advanced malware). VMRay runs as part of the hypervisor on top of the host OS, which, in turn, is running on bare metal.

Because VMs in the sandbox aren’t instrumented, threats execute as they would in the wild, and the analysis is invisible — even to the most evasive strains of malware.

VMRay’s agentless hypervisor-based approach provides four key benefits to the SonicWall Capture ATP cloud service:

  • Resistance to evasive malware
  • Detailed analysis results
  • Extraction of IOCs
  • Real-time, high-volume detection

To learn more about these benefits in greater detail, read the Solution Brief: Five Best Practices for Advanced Threat Protection.

DOWNLOAD SOLUTION BRIEF