Posts

Ransomware, Variants, Snipers & Kung Fu

The 2018 SonicWall Cyber Threat Report reported a 71.2 percent decline in the number of ransomware attacks, but a 101.2 percent increase the number of ransomware variants. Let me ask you, is this good news or bad?

If this was a military battle, would you celebrate the news the enemy reduced the number of machine guns by nearly three quarters but doubled the number of snipers? Perhaps, but now you’d have to keep your head lower and stay out of sight.

2016 saw a flood of “spray-and-pray” ransomware attacks as hackers were taking advantage of soft defenses and low levels of employee awareness. In fact, in 2016 SonicWall blocked nearly 640 million ransomware attacks; that was over 1,200 ransoms not seen (or paid) each minute.

Because of this intense pressure, organizations around the globe bolstered their defenses and education efforts. Simply put, we got tired of getting beat up for our lunch money and took Kung-Fu lessons.

Attackers retool ransomware strategies

In 2017, attackers retooled with new exploits. From that, WannaCry, NotPetya and Bad Rabbit were born. Each were designed to be malware cocktails that infected a system and then move on to the rest of the network through shared drives. But these are just three of the 2,855 variants SonicWall created defenses for in 2017 alone.

With these new malware cocktails in the wild, threat actors targeted specific roles within companies through social engineering. Instead of annoying thousands of people with a small ransom with a shrinking chance they will pay, many switched to hard-hitting attacks with larger demands.

Unique Ransomware Signatures

One such instance was the city of Atlanta, where the SamSam ransomware variant affected five out of 13 city departments and shut down systems for 10 days. Fortunately, the $51,000 ransom went unpaid but the damages to systems, lost files and productivity far outweigh the demand.

How to stop ransomware attacks, avoid ransom payouts

So, what can we do in this period of the threat landscape? Employee awareness for social engineering attacks (e.g., phishing attempts) still needs to drastically improve. Strong password hygiene also needs to be in place to block attacks like SamSam that work off of guessed passwords.

From there, we need ransomware protection technology in place that stops attacks. Here are two core technologies have may not have thought of recently:

  1. Implement a network sandbox that can identify and stop unknown attacks.

    A network sandbox is an isolated environment on the firewall that runs files to monitor their behavior. SonicWall Capture Advanced Threat Protection (ATP) is a multi-engine sandbox service that holds suspicious files at the gateway until a verdict can be achieved.

    Capture ATP also features Real-Time Deep Memory InspectionTM (RTDMI). RTDMI is a memory-based malware analysis engine that catches more malware, and faster, than behavior-based sandboxing methods. It also delivers a lower false-positive rate to improve security and the end-user experience. Learn about its ability to find and block malicious PDFs and Office documents.

  2. Use advanced endpoint client security

    For years, companies deployed traditional anti-virus (AV) on their computers, which was fine when the total number of signatures they had to write and update numbered in the hundreds of thousands. Last year, SonicWall discovered 58 million new forms of malware that take time to signature and push to defense points like firewalls.

    Even if these are pushed within 24 hours, it leaves a gap that new and advanced malware can walk right through. I recommend using a next-generation anti-virus (NGAV) solution that can monitor the behavior of a system to look for malicious activities, such as the unauthorized encryption of your files. For example, SonicWall Capture Client delivers advanced malware protection and additional security synergies for SonicWall firewall users.

On top of these two new forms of technology, please follow best practices when securing and managing your networks, such as network segmentation.

Download the 2018 SonicWall Cyber Threat Report

The cyber arms race is a challenge we face together. And it’s the core reason we’re committed to passing our findings, intelligence, analysis and research to the global public via the SonicWall 2018 Cyber Threat Report.

READ THE FULL REPORT

The Shortest Line at RSA Conference 2018: Where are all the Women?

Anyone who has attended an RSA Conference knows that it is typically a male-dominated event. In keeping with this year’s theme, “Now Matters,” I decided that this was the year for me to take a step toward shifting that gender imbalance.

I reached out to my leadership team to request that I attend RSA Conference 2018 as a part of the SonicWall team. My motivations were clear: as a woman working in cyber security, I believe more women need to be represented at the RSA Conference (and every other information security event).

In early March, the organizers behind RSA Conference 2018 announced their preliminary lineup of keynote speakers to much backlash and outcry in the industry. Critics and concerned industry experts were quick to highlight that the lineup was stacked with 19 men out of a total of 20 speakers. The sole female speaker: Monica Lewinsky. Lewinsky, although undoubtedly an interesting and relevant keynote on the topic of anti-cyber-bullying, is not exactly a name synonymous with cyber security.

RSA’s position
To their credit, RSA Conference organizers were quick to clarify that the list was not yet complete. The initial list only included speakers that had been confirmed early, many of whom were connected to the conference through sponsorship deals. In a matter of days, the RSAC organizers clarified that the conference would “feature more than 130 female speakers tackling everything from data integrity to hybrid clouds to application security, among other topics.”

In a statement that seemed to shift the blame back to the industry, RSA highlighted that 20 percent of overall speakers at the event were women, even though Forrester estimates that 11 percent of cyber security positions are held by women.

Observations at RSA Conference
As a member of SonicWall’s booth team, I spent the majority of my time at the conference on the expo floor where, interestingly, there seemed to be a decent representation of both men and women. On closer examination, the majority of women present were wearing exhibitor badges, indicative of women gravitating toward marketing or sales roles in the technology industry. Though, admittedly, this is anecdotal evidence.

Over at Moscone West, where the keynote speeches and sessions required a full conference pass costing $2,000-plus per attendee, it was a different story. A SonicWall colleague who attended the first morning’s keynote sessions jokingly shared with me that it was the first time he had experienced longer waits for the male restrooms while the female restrooms were relative ghost towns.

Organizers even made changes to the restroom configuration: In the North Expo hall, the women’s restrooms were converted to be gender-neutral in order to facilitate demand.

Lines for the Men’s Restrooms at RSA Conference 2018. Photo Credit: Samantha Schwartz

A history of change

It wasn’t all negative news for female representation at the RSA Conference. The organizers at RSA have been adapting to the changing industry landscape long before this year’s criticism. As recently as five years ago, it was common to see technology vendors at trade shows advertising their products with the assistance of “booth babes.”

It wasn’t until 2015 that RSA, under industry pressure largely driven by social media, issued a ban on so-called “booth babes.” Exhibitors are contractually obliged to have all expo staff adhere to a dress code described as “business and/or business casual attire.” This move has forced marketers to find creative and unique ideas to garner booth traffic — everything from magicians to virtual reality experiences were on display at this year’s expo.

Women in cyber security
This year’s conference also featured several panels and discussions dedicated to the topic of women in the industry. An unexpectedly optimistic discussion, “Women in Computing: Why Are Women Leaving Computing Professions?,” provided valuable insights to help leaders address female turnover in the industry.

Caroline Wong led a panel discussion on “Women in Security: A Progressive Movement,” which focused on the value that a woman’s perspective can bring to the table along with actionable takeaways for addressing problems with hiring practices.

Diversity is everyone’s responsibility

While tech conference organizers certainly have a responsibility to ensure the conversation around gender disparity has a forum and that women are represented fairly, opportunities to accelerate the progress in this area lie within companies, leadership and individual employees at all levels.

The Frost & Sullivan report, “The 2017 Global Information Security Workforce Study: Women in Cybersecurity,” published some telling statistics about this effort. Although just 11 percent of information security professionals globally are women according to the report, women in the field are more likely (52 percent) than their male coworkers (46 percent) to hold a master’s degree or higher. Despite this, they still hold less workplace authority.

Many organizations say they want to hire more women, yet most companies, especially in male-dominated fields of technology and cyber security, are far from reaching hiring parity. In North America, for example, women represent 14 percent of the cyber security workforce — the highest percentage when compared to other regions like Asia-Pacific (10 percent), Africa (9 percent), Latin America (8 percent), Europe (7 percent) and the Middle East (5 percent). For context, in the United States alone, females make up 48 percent of the workforce, said the report.

Organizations need to increase their investment in women. Beyond the obvious opportunities — closing pay gaps and advancing women in top leadership — organizations need to make workplaces trusted spaces, implement unconscious bias education and share best practices.

If you are a woman involved in the tech industry, you have an opportunity to serve as a much-needed role model — both to other women and to your male colleagues, many of whom are eager to hear and understand the female perspective in this industry. In short, if you are a woman in tech … get out there, be seen and be heard.

Resources for Women in Cyber Security

Organizations
WiCyS Women in CyberSecurity
Women in Security and Privacy
National Center for Women & Information Technology
SWE – Society of Women Engineers
Conferences and Events
WiCyS Women in CyberSecurity
Grace Hopper Celebration
OURSA – Our Security Advocates
Scholarships
Raytheon’s Women Cyber Security Scholarship Program
(ISC)² Women’s CyberSecurity Scholarships
Scholarship for Women Studying Information Security

SonicWall is proud to be an equal-opportunity employer. We are committed to providing employees with a work environment free of discrimination and harassment and welcome the opportunity to support skilled, talented women and men in their cyber security careers. If you are interested in pursuing a career at SonicWall, please explore our careers page: https://www.sonicwall.com/en-us/about-sonicwall/careers

Cyber Security News & Trends

Each week, SonicWall collects the cyber security industry’s most compelling, trending and important interviews, media and news stories — just for you.


SonicWall Spotlight

Jonesboro Council Tackles Cybersafety — The Clayton News Daily

  • Due to the recent Atlanta data breach, other cities are taking the initiative to bolster their preventative cybersecurity measures such as Georgia’s Jonesboro City Council who recommend SonicWall’s TZ300 Firewall solution to protect the city’s financial data.

SonicWall Bags the Most Promising Cybersecurity Vendor of the Year Award — InfoSecurity Live

  • In India, SonicWall has been awarded the InfoSecurity Live Editor’s Choice Award for the Most Promising Cybersecurity Vendor of the Year for 2017 through 2018.

SonicAlert: New Variant Family of PUBG Ransomware — SonicWall Security Center

  • The SonicWall Capture Labs Threat Research Team has observed reports of a new variant family of PUBG Ransomware [Pubg.RSM] actively spreading in the wild. PUBG Ransomware encrypts the victim’s files and forces them to play an hour of a game called PlayerUnknown’s Battlegrounds to get their files back.

10 Hot New Cloud Security Products Announced at RSA 2018 — CRN

  • The SonicWall Capture Cloud Platform is featured as the second product to make CRN’s 10 Hot New Cloud Security Products list announced at RSA this week.

20 Hot New Security Products Announced At RSA 2018 — CRN

  • SonicWall’s NSv Virtual Firewall is featured in CRN’s 20 Hot New Security Products listing at RSA 2018.

20 Hot New Security Products Announced At RSA 2018 — CRN

  • The 20 Hot New Security Products list at RSA 2018 also highlights SonicWall’s Capture Client for enabling advanced endpoint security.

EXCLUSIVE: Britain Facing Cyber War as Online Attacks Soar by 300% — Daily Express

  • In an exclusive interview with The Daily Express’ John Ingham, SonicWall President and CEO Bill Conner discusses the 300 percent increase in UK cyber attacks, compared to a 151 percent increase worldwide.

Cyber Security News

Huawei and ZTE Hit Hard as U.S. Moves Against Chinese Tech Firms — The New York Times

  • The United States undercut China’s technology ambitions on Tuesday, advancing a new rule that would limit the ability of Chinese telecommunications companies to sell their products in this country.

This Ransomware was Rewritten to Mine Cryptocurrency – and Destroy Your Files — ZDNet

  • Some criminals are shifting from ransomware to cryptocurrency miners – those behind XiaoBa have rejigged the code to shift the same malware towards a different focus.

Critical Infrastructure Needs Shoring Up After U.S., U.K. Blame Russia for Attacks — SC Magazine

  • The U.S. is prepared to take aggressive action against Russia for a recent, extended campaign of cyberattacks on infrastructure assets around the world by compromising devices such as routers and firewalls, the White House cybersecurity coordinator, who has since left his position, said Monday.

DHS Secretary: U.S. Could Cyberattack Countries Sponsoring Hacks — CNet

  • Kirstjen Nielsen tells RSA conference the U.S. hasn’t ruled out offensive cyberattacks to prevent hacks from other countries.

SamSam Explained: Everything You Need to Know About This Opportunistic Group of Threat Actors — CSO

  • In his latest article, Steve Ragan talks about the group behind the SamSam family of ransomware, known for recent attacks on healthcare organizations and other targets.

In Case You Missed It


Upcoming Events & Webinars

April 25
Webinar
11 a.m. PDT
Stop Fileless Malware with SonicWall Capture Client
> Register Now

RSA Conference 2018: See You Next Year

Every year, RSA Conference 2018 is a fast-paced, high-energy gathering for cyber security discussion, networking, innovation and learning for attendees, panelists, speakers and exhibitors alike. It’s almost impossible to see and hear all the show has to offer.

To help, we’ve collected all the interesting events and news from the week. It was an amazing four days — or eight days if you are part of our event staff — and we thank everyone for visiting us.

Endpoint protection still top of mind

While endpoint protection was a major theme at RSA, the technology partnership between SonicWall and SentinelOne stole the show with a modern take on endpoint protection. Throughout the week, SonicWall and SentinelOne collaborated to show off the new SonicWall Capture Client and integrated SentinelOne capabilities, like continuous behavioral monitoring and unique rollback capabilities.
> READ MORE

Awards and honors deserve a ‘thank you’

The CRN accolades noted above were just the start for SonicWall, which collected eight awards, including Gold in the CEO of the Year and Security Marketing Team of the Year, at the 2018 Info Security Product Guide Global Excellence Awards ceremony Monday in San Francisco. Also at RSA, SonicWall was named Cybersecurity Company of the Year in the Cyber Defense Magazine InfoSec Awards 2018.

These honors were the result of true dedication from our amazing SonicWall SecureFirst Partners and loyal customer base that spans 200 countries across the globe. Sincerely, thank you.

Streaming RSA Conference live

No matter your good intentions, sometimes it’s impossible to make it out to RSA every year. But that doesn’t mean you have to miss out on SonicWall’s presentation on the cyber arms race. That’s why we streamed a session from SonicWall malware expert Brook Chelmo on Facebook Live. Relive his presentation again and again, or watch it for the first time.

Music to inspire

While this musical inspiration was published before RSA kicked off, we had so much fun with our RSA Conference 2018 playlist on Spotify we’d be remiss in not offering it up once again.

Worn out

By the final day of RSA Conference, we’re spent. Our presenters logged dozens of hours presenting during the week. Their voices tired. Their legs weak. And some couldn’t even wait to get back to the hotel for some much-needed rest. And you know what? We can’t wait to do it again next year. See you at RSA Conference 2019, March 4-9.

Farewell, RSA Conference 2018

SonicWall Named 85th Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA)

SonicWall has recently been named the 85th Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA) by the MITRE Corporation, an international not-for-profit security institute.

What does this mean for SonicWall and the cyber security world at large? SonicWall has a new way to contribute to cyber security education and defense. The purpose of the CVE program is to provide a method and consortium for identifying vulnerabilities in a standardized manner.

SonicWall now has the authority to identify unique vulnerabilities within its products by issuing CVE IDs, publicly disclose vulnerabilities that have been newly identified, assign an ID, release vulnerability information without pre-publishing, and notify customers of other product vulnerabilities within the CNA’s program.

“This program takes us one step closer to reaching the transparency security administrators need in order to make swift and educated decisions when it comes to threat protection,” said SonicWall Chief Operating Officer Atul Dhablania in an official announcement. “SonicWall looks forward to working with MITRE in a collaborative effort to expand the arsenal of information needed to properly equip those who are being targeted or looking to strengthen their security posture.”

On a larger scale, the program is effective because an entire network of certified organizations works together, with the backing of numerous researchers and support personnel, to identify and stay ahead of emerging threats.

CVE Numbering Authorities (CNAs) are organizations that operate under the auspices of the CVE program to assign new CVE IDs to emerging vulnerabilities that affect devices and products within their scope.

The program is voluntary but the benefits are substantial, among them the opportunity to disclose a vulnerability with an already assigned CVE ID, the ability to control disclosure of vulnerability info without pre-publishing, and the notification of vulnerabilities for products within a CNAs scope by researchers who request a CVE ID from the CNA.

Becoming a part of the CVE program is a chance to not only connect to a vast network of organizations working to identify cyber threats, but also to contribute to the effort as a whole.

Cyber Security News & Trends

Each week, SonicWall collects the cyber security industry’s most compelling, trending and important interviews, media and news stories — just for you.


Special Section: 2018 SonicWall Cyber Threat Report

‘Malware-cocktail’ cyber attacks double in one year, shocking report warns — London Evening Standard

The News: The popular UK news publication highlights the shifting behavior of malware authors examined in the 2018 SonicWall Cyber Threat Report.

Quotable: SonicWall CEO Bill Conner described the attacks as a “cyber arms race affecting every government, business, organization and individual.”

Malware Attacks Up, Ransomware Attacks Down in 2017, SonicWall Reports — eWeek

The News: eWeek offers a slideshow that visually explores findings of this year’s SonicWall Cyber Threat Report.

Quotable: “There were a lot of mixed signals in the cyber security attack landscape in 2017 …”

Ransomware decreasing in quantity but increasing in potency — SecurityBrief

The News: SecurityBrief reporter Ashton Young outlines the increase in ransomware variants.

Quotable: “The risks to business, privacy and related data grow by the day — so much so that cybersecurity is outranking some of the more traditional business risks and concerns,” says SonicWall CEO Bill Conner.


Cyber Security News

A New Mira-style Botnet is Targeting the Financial Sector  ZDNet

  • Three financial sector institutions have become the latest victims of distributed denial-of-service (DDoS) attacks in recent months in what looks like an attack by the IoTroop botnet known to target financial firms.

Cyberattack Shows Vulnerability of Gas Pipeline Network The New York Times

  • Last week’s attack on four of the nation’s natural-gas pipeline operators that temporarily shut down computer communications with customers shines a light on the potential vulnerability of the nation’s energy system.

Iranian Hackers Breach Singapore Universities to Access Research Data — ZDNET

  • Believed to be part of last month’s attacks against global education institutions, the hackers breached 52 accounts across four Singapore universities, including NTU and NUS, to gain access to research articles.

Equifax Taps Mark Begor as CEO Following Cyber Attack That Exposed Data for 148M Consumers — USA Today

  • New Equifax CEO named. Mark Begor to lead the credit reporting giant’s bid to recover from a cyber breach that exposed the personal data of 148 million consumers.

20 suspect hackers arrested over online banking fraud ZDNet

  • On March 28, a series of arrests took place across Europe. In total, the raids resulted in the arrest of nine individuals from Romania and 11 in Italy, all of which are remanded in custody.

In Case You Missed It


Upcoming Events & Webinars

April 25
Webinar
11 A.M. PDT
Stop Fileless Malware with SonicWall Capture Client
Register Now

April 16-20
RSA Conference
San Francisco
Moscone Center
Booth 4115, North Hall

Sneak Peek: 2018 SonicWall Cyber Threat Report

The cyber security industry relies on perpetual cadence of collaboration, research, analysis and review.

For SonicWall, that comes via our in-depth cyber threat report. This year, we’re excited to announce that we will publish the 2018 SonicWall Cyber Threat Report on Tuesday, March 6.

This premier cyber security industry report puts you a step ahead of cyber criminals in the global cyber war, empowering you with proprietary security data, global knowledge and latest trends, gathered and analyzed by our leading-edge SonicWall Capture Labs Threat Network.

Reimagined and refreshed, the 2018 SonicWall Cyber Threat Report is more comprehensive, informative and actionable than ever before with:

  • A comprehensive comparison of security industry advances versus cybercriminal advances year-over-year, to help you know where you stand
  • Proprietary empirical data that you will get nowhere else, to help you confidently understand key threat trends
  • Detailed predictions on trending threats and security solutions, to help you plan and budget resources
  • Expert best practices and valuable resources, to help successfully guide you forward

Here is a sneak preview

The modern cyber war — against governments, businesses and users alike — is comprised of a series of attacks, counterattacks and respective defensive countermeasures. Many are simple and effective. Others are targeted and complex. Yet they are all highly dynamic and require persistence, commitment and resources to mitigate.

Unfortunately, organizations large and small are caught in the middle of a global cyber arms race with vastly different resources at their disposal. And while growing budgets do make a positive impact on the effectiveness against known exploits, the threat landscape evolves at such a rate that yesterday’s investment in technology could already be insufficient to deal with tomorrow’s cyber threats.

No one has immunity.

Headline breaches

2017 was another record year for data breaches. The 2018 SonicWall Cyber Threat Report breaks these down by the numbers.

Ransomware

With WannaCry, Petya and Bad Rabbit all becoming headline news, ransomware was a hot topic for the second year in a row. The 2018 SonicWall Cyber Threat Report reveals a key indicator of how attack strategies are shifting.

Memory attacks

While the Meltdown and Spectre vulnerabilities were first publicly known in early 2018, the processor vulnerabilities were actually exposed last year. In fact, Intel notified Chinese technology companies of the vulnerability before alerting the U.S. government.

Threat actors and cybercriminals are already leveraging memory as an attack vector. Since these memory-based attacks are using proprietary encryption methods that can’t be decrypted, organizations must quickly detect, capture and track these attacks once they’re exposed in memory — usually in under 100 nanoseconds. Chip-based attacks will be at the forefront of the cyber arms race for some time to come.

IoT

The Internet of Things (IoT) also had a big year. The 2018 SonicWall Cyber Threat Report examines last year’s trends to predict what will be in the crosshairs next.

Business risk

Data breaches and cyber attacks are no longer back-of-mind concerns. The 2018 SonicWall Cyber Threat Report explains why they are the No. 1 risk to business, brand, operations and financials.

The battle within encrypted traffic

For the first time ever, the 2018 SonicWall Cyber Threat Report will provide key empirical data on the volume of attacks leveraging SSL/TLS encryption.

Want the report first?

The cyber arms race is a challenge we face together. And it’s the core reason we’re committed to passing our findings, intelligence, analysis and research to the global public via the SonicWall 2018 Cyber Threat Report.

About the SonicWall Capture Labs Threat Network

Data for the 2018 SonicWall Annual Threat Report was gathered by the SonicWall Capture Labs Threat Network, which sources information from global devices and resources including:

  • More than 1 million security sensors in more than 150 countries and territories
  • Cross‐vector, threat‐related information shared among SonicWall security systems, including firewalls, email security, endpoint security, honeypots, content-filtering systems and the SonicWall Capture Advanced Threat Protection multi‐engine sandbox
  • SonicWall internal malware analysis automation framework
  • Malware and IP reputation data from tens of thousands of firewalls and email security devices around the globe
  • Shared threat intelligence from more than 50 industry collaboration groups and research organizations
  • Intelligence from freelance security researchers

The full 2018 SonicWall Cyber Threat Report will feature detailed threat findings, best practices, predictions and more, to help you stay a step ahead in the global cyber war.

SonicWall CEO Bill Conner Joins Cyber Security Panel on Capitol Hill

Cybercrime is a lucrative and booming industry, with recent reports estimating $600 billion in damages to businesses. With the introduction of innovative cyber security technologies and new cyber attack variants, the race is on for private and public organizations to arm themselves for a battle that is being waged in a dynamic threat landscape.

Bill Conner Portrait

On March 6, cyber security experts and policymakers will come together in a panel discussion to address the current threat landscape and its impact on the U.S. economy. Featuring Congressman Lamar Smith, SonicWall CEO Bill Conner and the Honorable Secretary Michael Chertoff, the panel will foster dialogues that focus on the preventative measures organizations should take to thwart cyber attacks, as well as the joint efforts of government and law enforcement agencies combatting modern-day cyber attacks, cybercriminals and threat actors.

Preceding the event, Conner and Chertoff penned an opinion piece, “SEC, Congress take steps toward cyber accountability and transparency,” on The Hill.

Michael Chertoff Portrait

“Cyber risk affects virtually every kind of enterprise. It is not a matter of if, but when,” they wrote on The Hill. “Companies should start with the presumption that they will be attacked and have a comprehensive incident response plan in place. An incident response plan should include a consumer notification process especially when sensitive data such as Social Security numbers and financial information is corrupted.”

Event: Cybersecurity Panel Discussion – 2018 SonicWall Cyber Threat Report
Date: Tuesday, March 6, 12:30 p.m. EST
Location: Committee Room 2325, Rayburn House Office Building, Washington D.C.
Panel:

  • Chairman Lamar Smith, Congressman, 21st Congressional District of Texas
  • Honorable Secretary Michael Chertoff, former head of the U.S. Department of Homeland Security
  • Bill Conner, President and CEO, SonicWall
  • Michael Crean, CEO, Solutions Granted

The panel also will leverage and discuss the findings and intelligence from the 2018 SonicWall Cyber Threat Report, which provides key advances for the security industry and cybercriminals; exclusive data on the 2017 threat landscape; cyber security predictions for 2018; cyber security guidelines and best practices.

Get the 2018 SonicWall Cyber Threat Report

The cyber arms race is a challenge we face together. And it’s the core reason we’re committed to passing our findings, intelligence, analysis and research to the global public via the SonicWall 2018 Cyber Threat Report.

Three Tough Questions You Must Ask About HTTPS to Avoid Cyber Attacks

Preventing your organization from being the victim of an inevitable cyber-attack is paramount so it is important for us to kick off this blog with an important risk question.

Do you know whether or not your organization‘s firewall is inspecting HTTPS traffic traversing its networks?

I have polled this question on numerous webinars I have conducted over the past year. The results consistently showed the majority of organizations have yet to perform HTTPS inspection as part of their defense strategy. With HTTPS on the rise, accounting for nearly two-third of your organization’s internet traffic today, hackers have expanded their craft to use the protocol to obfuscate their attacks and malware from security systems. Your timely response to this new threat could mean the difference between experiencing a material breach versus successfully averting one. Of course, the latter would be desirable. So, should you have the slightest doubt about your organization’s security posture to deal with encrypted threats, I want you to immediately pause and resume reading this post after you have spoken to your IT security leaders. I’d like you to raise your concerns about the potential millions of intrusions and tens of thousands of malware attacks launched against your organization each and every hour – many of which are likely new versions of ransomware delivered inside of HTTPS sessions. If the firewall is not inspecting this traffic, it would not have the ability to understand what is inside that traffic – whether a file is benign or malicious, credit cards being stolen or financial and health records were being shared with an external system. I hope you return to this blog with a sigh of relief that your organization is not among the majority of respondents that do not.

You got the good news that your organization is inspecting HTTPS traffic. The next logical question is:

“Has your organization experienced frequent network service disruptions or downtime as a result of a total collapse of your firewall performance when inspecting HTTPS traffic?”

Inspecting encrypted traffic is not without its set of big challenges. There are two key components of HTTPS inspection that severely impact firewall performance – establishing a secure connection and decrypting and later re-encrypting packets for secured data exchange. Unlike inspecting internet traffic in plain text, encrypted traffic introduces six additional compute processes that must occur before data is sent back and forth between a client’s browser and the web server over an HTTPS connection. Each process is highly complex and compute-intensive. Most firewall designs today don’t provide the right combination of inspection technology and hardware processing power to handle HTTPS traffic efficiently. They often collapses under the load and subsequently disrupt business-critical operations. According to NSS Labs, the performance penalty on a firewall when HTTPS inspection is enabled can be as high as 81 percent. In other words, your firewall performance is degraded to a level that it is no longer usable.

This leads us to the final and most important question:

“How can you scale firewall protection to prevent performance degradation, lag and latency of your network when inspecting HTTPS traffic?”

The right answer begins with the right inspection architecture as the foundation. Most modern firewalls today have deep packet inspection (DPI) capability claiming to solve many of the above security and performance challenges. However, not all firewalls perform equally or as advertised in the real world. In fact, many of them have inherent design inefficiencies that reduce their ability to handle today’s massive shift towards an all-encrypted Internet. You have one of two choices when it comes to inspection technology. These are Reassembly-Free Deep Packet Inspection (RFDPI) and Packet Assembly-based. Each uses different inspection method to scan and analyze data packets as they pass the firewall. You will quickly discover the performance of most firewalls will collapse under heavy HTTPS load. To avoid a post-deployment surprise, my recommendation is to do your due diligence. Thoroughly qualify and measure all firewalls under consideration and select one that meets both your desire level of performance and security effectiveness without hidden limitations. These are fundamental metrics that you want to heavily scrutinize when selecting a firewall to perform HTTPS inspection. Establishing the right firewall foundation will give you the agility to scale your security layer and solve the performance burden of inspecting HTTPS traffic inside your data center operations.

Uncovering evasive threats hiding inside encrypted network traffic is central to the success of your network defense. For more detail information, read our Executive Brief titled, “The Dark Side of Encryption – Why your network security needs to decrypt traffic to stop hidden threats.”

Tech Data and SonicWall Partner to Build Industry Leading Security Solutions

The following is a guest post from Sid Earley, Vice President, SonicWall Solutions Group, Tech Data Corp.

The Peak 2016 conference is taking place next week from Aug. 28-31 in Las Vegas. The partner education conference offers an opportunity to learn and explore how to push beyond traditional boundaries and safely dive into cloud, mobility and the Internet of Things. It’s an opportunity to gain insights about security trends, ways to grow their business with SonicWall. As a distribution sponsor,Tech Data is proud to partner with SonicWall to provide education and consulting for resellers focused on industry-leading solutions.

As the need for security solutions have increased, so has the number and complexity of cyber threats. According to Gartner, the market for cybersecurity software and services is about $75 billion, and is expected to reach $170 billion by 2020. Tech Data is committed to developing security solutions that help identify, protect against and respond to this rapidly evolving landscape. Tech Data offers comprehensive security solutions that meet the evolving needs of this dynamic market, helping you protect your business and your customers’ data.

While our Tech Data Cloud business unit has been enabling our customers for more than five years, and continue to innovate, we recently introduced two new dedicated teams to further support our customers in a very dynamic market. In May, Tech Data launched its Security and Information Management business unit, which is strategically focused on the delivery of customer enablement tools, including security assessments and professional services, to help solution providers build security practices and increase their overall knowledge of the market. In July, Tech Data launched its new Internet of Things (IoT) business practice, Smart IoT Solutions by Tech Data. The new practice is designed to aggregate IoT solutions and provides a simplified route to the rapidly expanding IoT market for solution providers.

Tech Data also provides best-in-class customer service and customized partner enablement programs including sales and technical training, lead generation and marketing services. We are committed to arming you with the tools and services your business’s security network needs to grow your business and meet evolving market demands, reduce distractions and ultimately increase profitability.

 Curtis Hutcheson, VP and GM of SonicWall and One Identity

SonicWall offers industry-leading security solutions. Together with Tech Data’s dedicated team of industry experts including software licensing specialists, system engineers, and product sales champions we will work with you and your sales team to establish a customized, value-added channel enablement strategy that works for your business.

Please plan to visit us at booth #103 during the event for a one-on-one consultation. See you in Las Vegas!

Engage in event activities and follow the conversation on Twitter at @SonicWall and @Tech_Data using the conference hashtag #YesPeak16.