Do You Need a More Intelligent and Secure Network?

By the third quarter of 2021, the number of recorded network breaches already exceeded the total breach volume of 2020 by 17 percent. What’s more, the total cost of breaches continued to rise. Data from IBM and the Ponemon Institute found that the average cost of a data breach topped $4.24 million in 2021, the highest this value has been in nearly two decades.

What does this mean? Businesses need better ways to react and respond to network security vulnerabilities. While this starts with basic security measures to mitigate the impact of issues as they occur, it also requires the creation of more intelligent networks capable of proactively detecting, identifying, and responding to threats.

Why Security Should Be a Top Priority for Every Organization

Effective security tools are now table stakes for organizations to ensure they meet evolving legislative standards around due diligence and data control. But these straightforward security measures aren’t enough to address the evolving nature of information technology (IT) environments — from rapid cloud adoption to mobile-first environments to the update of edge computing. The sheer volume and variety of corporate IT environments create organizations’ ever-changing challenges.

Increasing complexity also plays a role in security. Driven by the rapid shift to remote work and underpinned by the unstable nature of return-to-work plans, security teams now face the challenge of distributed and decentralized security environments which naturally frustrate efforts to create consistent security policies.

Consider some of the biggest data breaches of recent years:

  • Android: 100 million records exposed. In May 2021, the records of more than 100 million Android users were exposed as a result of cloud misconfigurations. Personal information, including names, email addresses, dates of birth, location data, payment information, and passwords, were available to anyone who knew where to look.
  • Facebook, 553 million records exposed. Facebook records of more than 553 million users from 106 countries were leaked online. Leaked data included phone numbers and email addresses, which according to security researcher Alon Gal, “would certainly lead to bad actors taking advantage of the data to perform social-engineering attacks [or] hacking attempts.”
  • LinkedIn, 700 million records exposed. Over 90 percent of LinkedIn members had their data compromised when it appeared for sale online. Information up for grabs included full names, phone numbers, physical addresses, email addresses, and details of linked social media accounts and user names.

Enterprises aren’t the only target for cybercriminals. As noted by Forbes, 43 percent of all cyberattack victims are small and midsize businesses (SMBs). While breaching a large enterprise can be a multimillion-dollar jackpot, SMBs are often easier targets that offer quick gains.

As a result, robust security must be a priority for every organization, regardless of size or industry.

Why Intelligence Matters for Effective Network Defense

While security is a solid starting point, it’s not enough in isolation. To handle evolving threats, companies need intelligent frameworks capable of identifying critical assets, pinpointing key vulnerabilities, and prioritizing security response. This intelligence-led approach is essential to defend IT environments now underpinned by interconnected devices, multiple cloud frameworks, and expanding edge services.

Consider that 92 percent of companies now leverage a multi-cloud approach to maximize efficiency and drive return on investment (ROI). Using multiple clouds offers a way for companies to pinpoint — and pay for — the specific solutions and services they need to achieve business aims. However, ensuring security across multiple cloud touch points rapidly becomes complex, especially as these clouds share and modify data in real-time.

What’s the best-case scenario during an attack? Compromise in one cloud hampers the efficacy of others but poses no substantive risk. And the worst case? Attacks on primary cloud services lead to successive service failures and significant downtime.

To address the challenges of expanding IT environments, companies must take an intelligence-led security approach. In practice, this means deploying tools capable of autonomous action to help detect and report IT threats, combined with robust data collection and analysis to help pinpoint root causes, rather than simply solving for symptoms.

How to Increase Your Network Intelligence and Security

While there’s no one-size-fits-all approach to increasing network intelligence and security, four functional approaches can help reduce total risk and boost your protective potential.

  1. Comprehensive Cloud Asset Identification: As cloud environments become more complex, the risk of asset blind spots that allow malicious actors to infiltrate networks without detection increases. Robust asset identification across all cloud services — from private clouds to public services such as AWS, Azure, and Google — is critical to limit overall risk.
  2. Complete Network Visualization and Access Management: Sight drives better security. If you can see what’s on your network and how it all connects, you can better identify where potential threats may occur. As a result, companies must deploy tools that offer complete visibility across all network environments and provide robust access control to ensure the right people have access to the right resources.
  3. Consistent Network Compliance: Today’s organizations must follow standards such as the Payment Card Industry Data Security Standard (PCI DSS) and cybersecurity maturity model certification, along with legislation including the General Data Protection Regulation (GPDR) and California Consumer Privacy Act (CCPA). Adhering to these standards and mandates is essential to demonstrate due diligence and protect your organization against penalties or legal action if security breaches do occur.
  4. Critical Vulnerability Prioritization: The scope and scale of new attack vectors make security triage a priority. End-to-end assessment of potential network risks based on exposure and access can help your teams prioritize vulnerabilities and design effective response frameworks.

Closing the Security Gap

No matter your business size, specialization, or industry, you need a more secure and intelligent network. Informed by increasingly complex IT environments and driven by evolving attack vectors, malicious actors are finding — and exploiting — new ways to compromise critical functions. Intelligent response is now critical to increase user confidence, and you must capture key data and protect your network.

RedSeal can help you close the security gap with an adaptable and intelligent approach to network security. From cloud security frameworks to robust network compliance solutions, access and visibility tools, and critical vulnerability prioritization, we have the technology tools and expertise to help your team build a reliable and responsive security framework.

Increase intelligence, navigate network security challenges and reduce real-life risks with RedSeal. Let’s get started.

On the Internet We’re All in a War Zone: Why it’s Time to Prepare for the Worst

Sadly, once again we find ourselves watching war as it unfolds. More than any previous conflict, this one is being fought in cyberspace as well as on land and in the air. Many commentators raised their eyebrows when NATO officially added cyber to Article 5 of its founding treaty back in 2016. That now seems like a prescient move. But while the fighting, both online and off, has been largely confined to Ukrainian targets thus far, that’s unlikely to last for long.

The truth is that, by accident or design, we’re all in a war zone online, because online conflict does not respect country boundaries or even physical distance. Western targets must prepare accordingly, by understanding their attack surface in granular detail, and probing for weaknesses that could be exploited by adversaries in the days, weeks and months to come. Resilience is the name of the game here, and that will only come about by plugging the highest risk gaps now across cloud and on-premises infrastructure.

Upping the Stakes

We’ve already heard of multiple offensive cyber-campaigns traced back to the Kremlin. They began even before the invasion, when scores of Ukrainian government websites were defaced and wiper malware known as WhisperGate was discovered targeting multiple organizations in the region. More destructive malware variants, HermeticWiper and IsaacWiper were launched in the early days of the campaign, reportedly rendering hundreds of machines unusable. 

By targeting the Master Boot Record (MBR) and strategically important folders of the Windows OS, the malware is eerily reminiscent of NotPetya, another wiper variant disguised as ransomware and aimed at Ukrainian targets in 2017. NotPetya is important because it tells us something very important about destructive cyber-attacks: they can very easily “spill over” and impact organizations that weren’t originally intended as targets. It also happened with Stuxnet—a weapon that was designed with high precision to target Iranian uranium enrichment facilities, but still spilled over and infected other machines.

In short, war is never as clean and precise as Hollywood movies make it seem. In the case of NotPetya, multinationals in Ukraine found their networks impacted, and the worm-like threat eventually travelled down corporate VPNs to spread globally, causing billions of dollars’ worth of damage. One victim, US pharma giant Merck, was only recently awarded a $1.4B payout from its insurer to cover costs incurred during the attack.

That said, Western firms may also need to contend with genuine Russian state-backed cyber-attacks if tensions ratchet up further and economic sanctions begin to hit the Putin regime hard. Just what they’re capable of should be clear following the SolarWinds attacks which compromised nine US government agencies. Russia also has an ace in the hole: an ‘army’ of organized cybercrime groups prepared to turn their nefarious talents to hitting critical infrastructure and other strategically important Western sectors. With big budgets to spend on attack tools and exploits, plenty of know-how, and a sophisticated cybercrime supply chain in place, they could do significant damage.

Building Resilience

If geopolitical tensions remain high for an extended period of time, the chances increase significantly of innocent organizations being drawn into the online conflict. The lesson for defenders is to fix defensive gaps now, before they’re exposed—intentionally or otherwise. Just as First World War gas attacks spread indiscriminately, harming anyone without a well-fitted and sealed gas mask on, cyber-weapons will go anywhere, through whatever gaps are left open.

Finding these vulnerabilities and misconfigurations first requires a detailed understanding of the entire corporate network, which for most organizations will extend from on-premises servers and data centers across multiple public cloud environments. That means knowing and mapping every single network device, application, service and data pathway. From this position of enhanced visibility, it’s then possible to enforce security policy to minimize exposure, and continuously check for and correct any policy compliance drift. The “continuous” qualifier is particularly important given the dynamic and ephemeral nature of cloud assets.

Ultimately, war, in whatever theater it’s fought, is about resilience. So if it wasn’t already before, take some inspiration from the brave men and women protecting their Ukrainian homeland, and make cyber-resilience a priority for your organization today. 

How Security Vulnerabilities Expose Thousands of Cloud Users to Attacks

Cloud computing has revolutionized data storage and access. It’s led the charge for digital transformation and allowed the increased adoption of remote work. At the same time, however, cloud computing has also increased security risks.

As networks have grown and cloud resources have become more entrenched in workflow, cloud computing has created larger potential attack surfaces. To safeguard their mission-critical data and operations, organizations need to know chief cloud cyber risks and have to combat them.

Why Cloud Users Are at Risk

Cloud platforms are multi-tenant environments. They share infrastructure and resources across thousands of customers. While a cloud provider acts to safeguard its infrastructure, that doesn’t address every cloud user’s security needs.

Cybersecurity in the cloud requires a more robust solution to prevent exposure. Instead of assuming that service providers will protect their data, customers must carefully define security controls for workloads and resources. Even if you’re working with the largest cloud service providers, new security vulnerabilities emerge every day.

For example, Microsoft says it invests about $1 billion in cybersecurity annually, but vulnerabilities still surface. Case in point: The technology giant warned thousand of cloud customers that threat actors might be able to read, change, or delete their main databases. Intruders could uncover database access keys and use them to grab administrative privileges. While fixing the problem, Microsoft also admitted it could not change the database access keys, and the fix required customers to create new ones. The burden was on customers to take action, and those that didn’t were vulnerable to cyberattacks.

What Type of Vulnerabilities Affect Cloud Customers?

Despite the security protections cloud providers employ, cloud customers must use best practices to manage their cyberattack protection.

Without a solid security plan, multiple vulnerabilities can exist, including:

1. Misconfigurations

Misconfigurations continue to be one of the biggest threats for cloud users. A few examples:

  • A breach at Prestige Software due to a misconfiguration using Amazon S3 services caused widespread data compromise. This single event exposed a decade’s worth of customer data from popular travel sites, such as Expedia, Hotels.com, and Booking.com.
  • A misconfigured firewall at Capital One put the personal data of 100 million customers at risk.

2. Access Control

Poor access control allows intruders to bypass weak authentication methods. Once inside the network, many organizations do not adequately restrict lateral movement or access to resources. For example, security vulnerabilities in Amazon Web Services (AWS) put up to 90% of S3 buckets at risk for identity compromise and ransomware. The problem? Businesses failed to remove permissions that allowed users to escalate privileges to admin status.

3. Insecure APIs

APIs require access to business data but can also provide vectors for threat actors. Organizations may have hundreds or even thousands of public APIs tied to microservices, leading to a large attack surface. Insecure APIs are cited as the cause of the infamous Equifax breach, which exposed nearly 150 million consumers’ records, along with security lapses at Geico, Facebook, Peloton, and Experian.

4. Lack of Shared Responsibility

Cloud providers manage the security of the cloud, but customers are responsible for handling the security of the data stored in the cloud. Yet, many users fail to keep up their end of this shared responsibility. According to Gartner, 99% of cloud security failures are due to customer errors.

5. Vendors or Third-Party Software

Third-party cloud components mean your networks are only as secure as your vendor’s security protocols. If they are compromised, it may provide a pathway for attackers into your network.

More than half of businesses have seen a data breach caused by a third party. That’s what happened to Audi, Volkswagen, and dozens of others. The infamous REvil ransomware group exploited a vulnerability in Kaseya, a remote monitoring platform, and used it to attack managed service providers (MSPs) to gain access to thousands of customers.

How Can Cloud Users Protect Themselves?

With the acceleration of remote workers and hybrid cloud and multicloud environments, attack surfaces have increased greatly over the past few years. At the same time, hackers have become more sophisticated in their methods.

Since most security tools only work in one environment, it can create a complex web that becomes difficult to manage.

Figuring out how to prevent cyberattacks requires a multi-pronged approach, but it starts with understanding how all of your security tools work together across on-prem, public clouds, and private clouds. You need strategies to monitor all of your networks, including ways to:

  • Interpret access controls across both cloud-native and third-party firewalls (service chaining)
  • Continuously validate and ensure security compliance
  • Manage network segmentation policies and regulations

Security teams must be able to answer these concerns:

  • What resources do we have across our cloud and on-premises environments?
  • What access is possible?
  • Are resources exposed to the public internet?
  • Do our cloud deployments meet best practices for cybersecurity?
  • Do we validate cloud network segmentation policies?

Without a comprehensive cybersecurity solution that evaluates and identifies potential risks, it will be challenging to mitigate vulnerabilities and identify the downstream impacts from security lapses. Even if you believe you have every security measure you need in place across all of your cloud resources, you need a way to visualize resources, identify potential risks, and prioritize threat mitigation.

A Comprehensive Cloud Security Posture Management Solution

Solving a problem starts with identifying it. You need a way to visualize potential vulnerabilities across your networks and cloud resources.

A Cloud Security Posture Management (CSPM) solution will identify vulnerabilities, such as misconfigurations, unprotected APIs, inadequate access controls, and flag changes to security policies. This helps you better understand exposure risks, create more robust cloud segmentation policies, and evaluate all of your cloud vulnerabilities.

Many CSPM solutions, however, only present their finding in static, tabular forms. It can be challenging to understand relationships and gain full awareness of the interconnectivity between cloud resources. Beyond just monitoring traffic, security teams also need to see how instances get to the cloud, what security points it goes through, and which ports and protocols apply.

RedSeal Classic identifies what’s on your network environments and how it’s all connected. This helps you validate security policies and prioritize potential vulnerabilities. RedSeal Classic can evaluate AWS, Azure, Google Cloud, and Oracle Cloud environments along with Layers 2, 3, 4, and 7 in your physical networks for application-based policies and endpoint information from multiple sources.

RedSeal Stratus allows users to visualize their AWS cloud and Elastic Kubernetes Service (EKS) inventory. We’re currently offering an Early Adopters program for RedSeals Stratus, our SaaS-based CSPM, including concierge onboarding service, so you can see the benefits first-hand.

To learn more about how RedSeal can help you see how your environment is connected and what’s at risk, request a demo today.

Doing More with Less: Consolidating Your Security Toolkit

Cyber threats are fast-evolving, and organizations must stay vigilant at all times to protect their business-critical information from prying eyes. One oversight or outdated control could expose your network to different types of cyberattacks, leading to costly breaches.

Information security has become even more challenging in the past year as organizations had to shift their IT budget to tackle the sudden changes brought on by the COVID-19 pandemic. As the dust settles, many security teams are left with a smaller cybersecurity budget. The constraints are affecting staffing decisions and technology adoption. Today, many IT departments are stretched thin, making it even harder to be proactive about their security measures. However, organizations can consolidate their security toolkits and conserve funds while weathering the storm.

The Problem: Tight Budgets, Reduced Staffing, Increased Threats

To cope with new business demands, many organizations had to restructure their IT budgets, leaving less funding and fewer team members. Meanwhile, the number of cyberattacks has increased significantly since the pandemic. Many organizations had to respond quickly to support remote working, leaving security gaps and vulnerabilities in their networks. Additionally, the proliferation of devices used by remote workers increases the attack surface dramatically while making it even harder for security teams to gain a holistic view of their environments.

Furthermore, the fast pace of digital transformation has accelerated cloud adoption. Yet, cloud security is complex and distributed. There’s an exponential growth in misconfigurations of cloud security settings, which leave sensitive data and resources unintentionally exposed to the public internet.

To plug security holes quickly, companies cobbled together multiple point solutions. While this approach may seem reasonable in a pinch, security teams soon realized they have to piece together data from various sources to analyze threats and parse through duplicate alerts to get to the bottom of an issue. Using multiple security tools is time-consuming and labor-intensive and drastically increases response time.

This heavy reliance on digital assets and processes, along with the complexity of cybersecurity and the distributed nature of cloud computing, has created the perfect storm where threat actors can exploit various vulnerabilities to attack organizations and steal their data.

How Organizations Can Weather the Cybersecurity Storm

Companies are under constant pressure to do more with less when it comes to cybersecurity. But piling on more point solutions will only add inefficiency to already overwhelmed IT resources.

To improve performance on a tight budget, you must direct resources to focus on the interaction between technologies, systems, and processes. You can achieve this most effectively by consolidating your existing security tools into a single pane of glass solution, which gives you a holistic view of your environment.

The Benefits of Consolidating Your Security Toolkit

From saving money to improving your security, here are the advantages of consolidating your cybersecurity tools:

  • Reduce vulnerability. Each security system that connects to your network is a potential vulnerability. Using different tools can actually increase your attack surface and make your IT infrastructure less secure.
  • Lower total cost of ownership. The cost of point solutions can add up quickly. By using fewer tools, you can spend less on these products while saving on training, management, and maintenance.
  • Increase IT productivity. Point solutions often have overlapping functionalities and generate duplicate alerts. IT teams have to spend extra time sorting through all the information before taking action.
  • Reduce resource needs. A consolidated toolkit requires fewer resources to operate and monitor. The streamlined workflows also help free up IT resources to respond to critical issues.
  • Shorten response time. A single pane of glass view helps minimize duplicate or missed alerts, allowing security teams to identify issues and respond more quickly.
  • Improve cost-efficiency. Consolidation and automation simplify IT management so you can perform system backup, maintenance, monitoring, and other essential functions more efficiently.
  • Eliminate silos. Tool sprawl can create silos between teams. A consolidated toolkit helps you improve visibility, enhance collaboration, and gain a holistic understanding of your entire IT infrastructure.

How to Consolidate Your Security Toolkit

Start by designing a strategy, conducting a risk assessment, and performing a gap analysis to identify what you need in a consolidated security solution. Apply security frameworks (e.g., NIST-800 and ISO 27001) and refer to compliance standards (e.g., HIPAA, PCI-DSS, DFARS) to determine your cybersecurity requirements.

Then, take stock of all the features you’re using in the current point solutions. Your consolidated toolkit should cover these functionalities without compromising the ability to safeguard your networks, systems, applications, data, and devices.

Use a solution provider that understands your strategy and can help you design a solution that integrates with your existing infrastructure to reduce friction during implementation and migration. Your partner should also help you address the human change elements during the adoption process by providing training guides and ongoing support.

Strengthen Your Cybersecurity Posture Through Consolidation

There are many benefits to consolidating your security toolkit, including better security, improved IT productivity, and higher cost-efficiency. But not all security solutions are created equal.

To cover all your bases, choose a consolidated solution that addresses these critical aspects:

  • Cloud security. Your toolkit should allow you to visualize all your environments, including public cloud, private cloud, and on-premise servers, all in one place.
  • Incident response. Your solution should help you detect network incidents, facilitate investigations, and offer containment options to minimize loss.
  • Compliance monitoring and reporting. Your security tool should automate monitoring and document any changes you implement to help streamline security audits and compliance reporting.
  • Remote workforce support. Your vendor should ensure that your networks and cloud platforms have the appropriate security configurations to ensure secure remote access.
  • Vulnerability management. Your tool should visualize all network assets, so you can understand the context and focus resources on mitigating risks that are of the highest priority.

RedSeal offers comprehensive cybersecurity solutions in today’s business environment where cyber complexity and threats are rapidly escalating. Global 2000 corporations and government agencies trust us to help them secure their networks and assets.

Watch our demo to see how we can help you get all your cybersecurity needs covered.