Posts

The RSA Report: Boots on the Ground

/0 Comments/in /by

All good things must come to an end, and the RSA Conference is no exception. But this year’s RSAC ended on a definite high note, packing as many actionable insights as possible into the final few sessions.

Much of today’s cybersecurity guidance advises businesses to think in terms of when an attack occurs, not if. But very little of it explains what that eventuality might look like. “Ransomware: From the Boardroom to the Situation Room” pulled the curtain back on the government’s response to a series of ransomware attacks on our country’s critical infrastructure. The real-time simulation offered the audience a seat at 1600 Pennsylvania Avenue as key members of the National Security Council’s staff, staff of the National Cyber Director and representatives of various federal departments convened to discuss what had happened and how best to respond.

Obviously, given the high total cost of ransomware, it’s best to avoid an attack in the first place. SonicWall’s multi-layer solutions are designed to stop even the most advanced ransomware attacks. SonicWall has helped countless companies harden against ransomware, including McAuley House School, which switched to SonicWall after a series of successful ransomware attacks and called their new SonicWall solution the “best security investment decision we’ve ever made.”

Incident response was also a theme in the next session, “Investigation & Incident Response Challenges for the Hybrid Enterprise.” This session explored a survey of more than 250 individuals involved with cyber investigations in a wide swath of industries, in public, private and government organizations of all sizes. This survey yielded some alarming results: Less than a third of respondents were confident in their team’s ability to track an incident through both cloud and legacy environments, and nearly three-fourths weren’t confident that they collected all data needed to investigate a breach.

Part of the problem stemmed from the tools used: While 74% said they used a SIEM, there were limits on the collection and retention of data due to the work and cost intensiveness involved. And with under a third of respondents integrating non-security data into investigations, investigating some incidents — particularly those involving insiders — will prove much more difficult.

Unfortunately, incidents involving insiders are increasingly common: In “Ghosts in the Machine: Is There a Security Patch for People?,” FBI Special Agent Greg Concepcion and Nisos Intelligence Advisor Paul Malcomb revealed that today, 82% of security incidents are related to insiders — up 72% since 2020. The speakers explained the various groups who generally represented insider threats, from VIPs and Money Movers to Sensitive IP handlers and System Admins and Developers — along with what sort of threat they were most likely to fall for (phishing ranked high on the list for almost everyone) and the best way to limit their ability to cause accidental or intentional harm.

Sine most of the harm is non-malicious, there are many steps that can be taken to reduce your risk, such as implementing multifactor authentication and ensuring employees are following basic best practices concerning password hygiene, double-checking urgent requests for money or sensitive information, and phishing awareness.

Another step that can help is the implementation of Zero Trust, but as the panelists in “It’s All Geek to Me: Communicating the Business Value of Zero Trust” explained, it can be difficult to get leaders and stakeholders on board with making that investment. However, since the impact Zero Trust can have on your security posture can be enormous, it’s important to frame the ideas of identity, the integration of security controls, and risk in a way that’s accessible and not overly technical or complex.

If you’re ready to explore a zero-trust solution, SonicWall or one of our trusted partners can help you put together the case for taking this positive step for your network security.

While we’re always a bit sad to see RSA draw to a close, we know the lessons and key learnings we gained on this journey will continue to inform and enrich us well into the future. Thanks for following our RSA coverage, and we hope to see you next year at RSAC 2024!

RSA Report: New Tactics, New Technologies

/0 Comments/in /by

While the official theme of this year’s RSA Conference is “Stronger Together,” one throughline keeps repeating over and over, through the Exhibit Hall, from the stage in keynotes and sessions, and in casual conversations — the revolutionary power of emerging technologies, particularly AI. While some see it as a positive, revolutionizing force and others take a more cautionary (or even dire) view, most everyone agrees on one thing: We’ve entered a new era, both for cybersecurity and for the world at large.

In “Security as Part of Responsible AI: At Home or At Odds,” panelists discussed the dark side of revolution: Disruption. Currently, they argued, not enough attention is being paid to the downstream effects of AI — such as its potential for use in cybercrime, the existence of so-called “hallucinations” (things AI presents as truth, but which are false or completely fabricated) and other factors. But who, ultimately, will be responsible for mitigating the potential for AI to invent falsehoods, leak personally identifying data, and more?

Some feel this responsibility belongs in the realm of Responsible AI, which has generally been limited to things like mitigating biases and improving fairness. Others agree that it should belong in the security wheelhouse, because things like AI data leaks overlap somewhat with cyberattacks in terms of the need for a rapid response (and also because some cyberattacks will be directly on the AI itself).

Either way, however, network visibility will continue to be paramount. SonicWall customers will be well-positioned to face this new era, as we already have an upper hand when it comes to visibility. We have a long history of helping companies move from siloed point solutions to greater visibility, and customers such as SADAFCO, Al Qayed Holding Group, awfis space solutions, InfoStream and many others have specifically called out increased visibility with SonicWall solutions in just the past few months.

While AI comes with a great deal of risk, it also has the potential in some ways to save us from ourselves. The “SIEM There, Done That: Rising Up in the SecOps Revolution” specifically zeroed in on AI’s ability to move us past legacy solutions such as SIEM, which many organizations are still relying on. While SIEM provides a great deal of valuable telemetry, it also requires a great deal of human intervention, exacerbating the cyber skills shortage, causing alert fatigue and contributing to the problem of burnout among cyber professionals.

While gamification and other initiatives can help ease the skills shortage by attracting the next generation of cybersecurity professionals to the field, there are also things we can do in the meantime, such as deploying solutions that use machine learning and AI to automate processes and ease demands on staff. These solutions include SonicWall’s Capture ATP with RTDMI, which won Best AI and Machine Learning Based Security Solution of the Year in 2020, and has only continued to build on this foundation since.

“Why I’m Optimistic (and You Should Be, Too)” took a similarly uplifting tone, emphasizing that security is, in fact, solvable. Moreover, we already know what’s needed for effective security, including hardening the attack surface, implementing zero-trust access policies, preventing all known attacks and detecting unknown threats.

These objectives already form the cornerstones of how SonicWall does business. For the past three decades, we’ve offered firewalls and other solutions that allow our customers to harden their environment. While our signature-based protections ward against known attacks, emerging technologies such as our Capture ATP with patented Real-Time Deep Memory Inspection (RTDMI™) excel at detecting threats never before seen by anyone in the cybersecurity industry — often before they’ve exhibited any malicious behavior. And with our comprehensive zero-trust solution, SonicWall SMA 1000, organizations can control access and segment networks to limit inside threats as well as outside threats.

Unfortunately, the need to harden networks has never been more urgent, as the past several years have brought a sharp increase on critical infrastructure. In “Defending OT Systems from Ransomware,” speakers Jeff Jones and Tom VanNorman discussed why OT (Operational Technology) differs from IT. The world of OT brings with it inherent environmental risks such as large equipment, scaffolding, temperature extremes and other operational hazards, and to keep these environments safe, the systems running them have been designed for near-24/7/365 uptime. Unfortunately, cybercriminals are aware that these critical infrastructure environments cannot afford downtime — and as a result, manufacturing is now the hardest-hit industry, with groups like the Royal ransomware gang targeting critical infrastructure specifically.

While the culture of safety that drives OT environments can help foster a prevention mindset when it comes to cyberattacks, there are specific changes from the IT world that can also help. The speakers called out the need for better password hygiene, the development of an incident response plan that brings in all concerned parties as necessary steps for securing our most critical infrastructure and better phishing education as critical to beating back the rising wave of attacks on our manufacturing and other critical infrastructure.

Unfortunately, with the advent of AI, the sophistication of phishing attacks is rising rapidly. In “CatPhish Automation: The Emerging Use of AI in Social Engineering,” speaker Justin Hutchens outlined the accelerating development of AI, from the Turing test to the recent release of ChatGPT. Pulling back the curtain on the code and commands used in AI “catphishing” attacks — wherein an AI pretends to be a human in order to conduct a phishing attack — Hutchens showed how terrifyingly easy it is to conduct such attacks, and their potential for fooling even otherwise savvy users.

But catphishing isn’t the only new tactic threat actors are employing. “Hacking Exposed: Next-Generation Tactics, Techniques and Procedures” outlined a real-life attack in which the adversary uses no malware at all. By using vishing, readily available tools such as AnyDesk, and LoTL attacks, these attackers launch an attack that will be virtually undetectable by many antimalware solutions — making increased visibility and good telemetry more important than ever.

But while most of the day’s sessions dealt with the near future, some are already looking to what the more distant future will hold. In “The Next 50 Years,” theoretical physicist Michio Kaku discussed the transition from the digital era to the quantum era—a time in which extraordinarily powerful computers will revolutionize the economy, science, medicine and our way of life.

In this new era, Kaku explains, brains will interface with computers, technology will send designs directly from the minds of artists and designers to 3-D printers who will immediately bring them to life, and the libraries of the future will house elements of our personalities, digital footprints, and more — lending us a form of immortality.

While these sessions dealt with the emerging technologies, these advancements don’t supplant existing issues in cybersecurity, such as the rise of misinformation and nation-state attacks. Check back later for more on the role of government and international partnerships in fighting today’s increasingly powerful adversaries. And don’t forget to stop by Booth #5585 in Moscone North for demos, presentations and more!