Using RedSeal for Cybersecurity and Compliance
A recent study by independent industry analysts at TAG Infosphere concluded that the exposure analytics capabilities of the RedSeal platform— specifically, network modeling, attack path analysis, risk prioritization, and compliance management— are well-suited to reduce risk and strengthen the security posture of complex hybrid networks.
Click here to download the full report and schedule a demo today.
Last week approximately 40,000 cybersecurity professionals, researchers, and experts, met in Las Vegas for the annual Black Hat conference to discuss the latest trends, emerging threats, and groundbreaking technologies in cybersecurity. The RedSeal team engaged in all the event had to offer and left with several key takeaways into the current state of cybersecurity and market transitions that are driving up cyber risk.
GenAI: Pioneering Technologies, Unveiling Novel Vulnerabilities
The advent of Artificial Intelligence (AI), particularly Generative AI, has ushered in a new era for organizations. Maria Markstedter, the founder of Azeria Labs—a prominent company specializing in ARM exploit development, reverse engineering, vulnerability research, and cybersecurity training—delivered an insightful keynote revolving around the emergence of AI. Confirming that while artificial intelligence and machine learning fuel innovation, they concurrently expose unprecedented security vulnerabilities. This dual nature of AI underscores the imperative for a proactive security approach.
On the heels of our experience at the Omdia Analyst Summit, Maria’s keynote fortified the belief in expanding strategies to deepen proactive measures. This entails educating teams, crafting new policies, deploying innovative cybersecurity technologies, and embracing a forward-thinking perspective. Central to this is the deployment of a robust cybersecurity solution, like RedSeal, to stop breaches by detecting vulnerable attack paths.
2023 White House Cybersecurity Strategy: A Path Forward Amid Challenges
The unveiling of the 2023 White House cybersecurity strategy heralded a new phase for national security initiatives. The prominence of the Cybersecurity and Infrastructure Security Agency (CISA) in this strategy symbolizes the government’s dedication to bolstering cyber defenses.
The introduction of a new rule mandating critical infrastructure entities to promptly report cyber-attacks within 72 hours, alongside ransom payments within 24 hours, holds immense potential for elevating incident response and coordination. The efficacy of this strategy hinges on seamless execution and adaptability in the face of the ever-evolving threat landscape and strives for collaboration across government and commercial accountability for establishing robust cyber defenses. Learn more about RedSeal’s position on the National Cyber Strategy here.
Bridging Silos: Navigating Cloud, OT/IoT, Data Center, and IT Convergence
As organizations embrace cloud migration, adopt IoT/OT devices, and integrate modern data center technologies, challenges arise—including the risks of lateral movement between these domains. Despite the ongoing convergence of these realms, numerous cybersecurity vendors remain entrenched within traditional infrastructure silos. Engaging discussions on enterprise applications and data during Black Hat highlighted the pressing need for product enhancements that streamline the incorporation of applications and data via ports and protocols information. “Attack Path Analysis” and “Security Graph” resonated within all security circles, underscoring the growing emphasis on mapping potential attack vectors, visualizing security postures and their impact within complex, hybrid environments.
Amidst these insights, RedSeal offered demos to hundreds of conference attendees. These demonstrations showcased how the RedSeal platform accurately uncovers potential lateral spread pathways across on-prem and cloud environments, enabling organizations to fortify their defense strategies comprehensively and address vulnerabilities proactively.
RedSeal also announced the unique support for third-party firewalls in public clouds, driven by experience that breaches stem from complexity. The automation of understanding third-party firewalls deployed in public clouds eliminates blind spots arising from distinct security consoles. With a unified view, the fragmentation of defenses is mitigated, preventing potential vulnerabilities. RedSeal’s integrated end-to-end perspective into cloud and on-prem environments calculate attack paths to critical data and applications, offering unparalleled insights to mitigate risk.
CISO Dialogues: Addressing the Cybersecurity Talent Gap
Engaging in conversations with Chief Information Security Officers (CISOs), we learned that while traditional IT security concerns and the rise of cloud and OT infrastructures remain top challenges, one concern consistently looms large – the scarcity of cybersecurity talent. As organizations grapple with a growing skills gap, CISOs are compelled to look outside the organization for resources to not only support team development but also have the people and tools required to confront evolving threats head-on.
Promisingly, solutions do exist. Organizations can bridge this gap by engaging with experts, allowing their teams to focus on core competencies. RedSeal’s recent case study, “Regional Health System Increases Network Visibility and Mitigates Cybersecurity Risk,” demonstrates the efficacy of engaging RedSeal’s Fully Managed Services (FMS) team to augment security teams to prioritize and focus on critical security issues, enabling the health network to redirect resources towards pivotal issues, deliverables, and patient care. Read more here.
Black Hat 2023 has our team exploring a myriad of insights into the present and future of cybersecurity challenges and opportunities. From the dynamics of cutting-edge technologies like GenAI to evolving governmental strategies and the indispensable need to bridge security gaps, the conference underscored the need for proactive approaches in securing our digital future with the right tools and the right teams. As we act on these key takeaways, RedSeal remains committed to driving innovation and empowering organizations with the most comprehensive, dynamic model of your hybrid network allowing you to navigate the dynamic cybersecurity landscape with confidence, trust and resilience. Get in touch to see how we can help you stay ahead in today’s fast-evolving digital environment.
Today, the international cybersecurity consortium known as The Five Eyes (Australia, Canada, New Zealand, the UK, and the US) published a joint Cybersecurity Advisory. It’s a scary read, on several fronts. It details the top 12 vulnerabilities that are actively being exploited, in current breaches. The advisory doesn’t detail the breaches, because a lot of that data is not public, but we can safely assume that these organizations are trying to offer a wake-up call about what they are seeing in the real world.
One shocking aspect of the advisory is the vulnerabilities are quite old – the top spot is taken by a vulnerability that was disclosed in 2018! The lingering question is how can antiquated vulnerabilities still pose a threat? The answer lies in the struggles faced by organizations in locating and effectively patching patch their Internet facing equipment.
This is why RedSeal builds a digital twin of your network, then shows you where you have blind spots, defensive gaps, and (most relevant to this advisory) uncover exactly what you have that is exposed to the Internet.
The Five Eyes Advisory is an important reminder that vulnerabilities exist in our Internet-facing systems. RedSeal is a trusted partner to 75 federal agencies, 6 arms of the military, and 100s of F1000 organizations, helping identify and address vulnerabilities; securing networks against the growing complexity and frequency of threats.
Let’s talk about how we can help your organization stay secure. Contact us today.
In March 2023, the Biden Administration announced the National Cybersecurity Strategy, which takes a more collaborative and proactive approach.
RedSeal teamed up with cyber security experts, Richard Clarke, founder and CEO of Good Harbor Security Risk Management, and Admiral Mark Montgomery (ret.), senior director of the Center of Cyber and Technology Innovation, to discuss the latest strategy. Both have developed previous national cybersecurity strategies so we couldn’t be more privileged to hear their take on the newest national strategy’s impact on cybersecurity regulations. This blog covers the importance of harmonizing the rules, trends in resilience planning, the role of cyber insurance, the transfer of liability, and the need to keep pace with AI and quantum computing. Keep reading to learn more, or click here to listen in.
Although this is the first time the administration gives a clear and intentional nod to cybersecurity regulations, the federal government has regulated every other major sector for over 20 years. This step makes sense. Clarke points out, sectors with heavy cyber regulations have fared better in the past two decades than those without. Montgomery predicts that most changes will happen in areas where regulations are lagging, such as water, oil pipelines, and railroads.
But many agencies don’t have the resources for effective enforcement. The government must thus use a combination ofregulations, incentives, and collaboration to achieve meaningful outcomes.
The new strategy aims to “expand the use of minimum cybersecurity requirements in critical sectors to ensure national security and public safety and harmonize regulations to reduce the burden of compliance.” But the expansion of cybersecurity regulations must come hand in hand with better coordination.
Clarke observes, today’s regulations aren’t well-coordinated. Agencies must share lessons learned and align their approaches. Private sectors will benefit from the standardization of various regulations to streamline compliance, reducing cybersecurity complexity and lowering costs.
However, coordination and standardization doesn’t mean a one-size-fits-all solution. Agencies must tailor their regulations to each specific sector. The good news is that we can apply the same network security technologies to any industry and encourage knowledge-sharing across verticals. For instance, we can take the high standards from the defense industry and apply them to healthcare and transportation without reinventing the wheel.
The cybersecurity definition of resilience has evolved as the world has become more digital. We will get hacked. It is a certainty. Instead of only looking to protect systems from attacks, regulatory mandates must also focus on prompt recovery. The government should also hire industry experts to assess digital resilience plans and stress-test them for reliance.
Cyber resilience must be applied to national security as well as private business. Transportation infrastructure must be able to operate without extended interruption. The economy (e.g., the power grid and financial systems) is our greatest weapon, and must keep functioning during conflicts and crises. Lastly, we must have the tools to quickly and effectively battle disinformation, a new frontier in the fight against nation-state threats.
Regulations must also cover IoT devices, but focus on the networks instead of the thousands of individual endpoints. Clark suggests that organizations should install sensors on their networks and conduct regular vulnerability scans. Montgomery adds to this, emphasizing the need for certification and labeling regimens as part of a long-term plan to make vendors responsible for their products’ performance and security.
Speaking of making vendors responsible for their products’ performance and security, the new strategy intends to transfer liability to software vendors to promote secure development practices, shift the consequences of poor cybersecurity away from the most vulnerable, and make our digital ecosystem more trustworthy overall.
Clarke agrees that this approach is necessary, but holds that the current regulatory framework can’t support the legal implementation. IT lobbyists, some of the most well-funded and influential players on Capitol Hill, will make enforcement of such a shift an uphill battle. Clarke believes that, unfortunately, this hard but necessary shift may not happen until a tragedy shakes the nation and leaves it the only way forward.
We, as a nation, have many issues to consider around AI, including beyond security. Clarke points out that we must establish rules about transparency: what’s the decision-making process? How did AI get to a conclusion? Is it searching an erroneous database? Is the outcome biased? Large language models (LLMs) are constantly learning, and adversaries can poison them to impact our decision-making.
While AI is the big problem of the moment, we can’t afford to continue ignoring quantum encryption challenges, cautions Montgomery. We have already fallen behind and must spend a substantial sum today to prepare for what’s in store in 10 years. We must start building quantum security into our systems instead of attempting to jury-rig something on later, adds Clarke.
The Rise of Cyber Insurance and Real-time Monitoring
Montgomery predicts that, if run properly, the cyber insurance market can bring these pieces together. Insurance companies may, for instance, encourage proactive measures by reducing premiums for organizations that invest in cybersecurity upfront and establish a track record of reliability and resiliency.
But organizations must prove they’re continuously protected instead of merely showing “point in time” compliance to take advantage of lower premiums. Real-time monitoring will play a critical role in lowering premiums and maintaining cybersecurity.
The new National Cyber Strategy introduces timely and much-needed shifts. We must harmonize regulations to maximize the benefits without overburdening the private and public sectors.
In anticipation of the impending changes, organizations must approach their cybersecurity strategies proactively and implement the right tools and services to stay compliant. These include a comprehensive network security solution for complete visibility and ongoing monitoring, cloud security tools to protect all IT assets, and professional services to ensure airtight implementation and continuous compliance.
RedSeal has extensive expertise and experience in delivering government cybersecurity and compliance solutions. Get in touch to see how we can help you stay ahead in today’s fast-evolving digital environment.
The recent disclosure that Toyota left customer data accidentally exposed for a decade is pretty startling, but can serve as a wake up call about how cloud problems can hide in plain sight.
It’s not news that humans make mistakes – security has always been bedeviled by users and the often foolish choices that they make. Administrators are human too, of course, and so mistakes creep in to our networks and applications. This too is a perennial problem. What’s different in the cloud is the way such problems are hard to see, and easy to live with until something bad happens. Cloud isn’t just “someone else’s computer”, as the old joke goes – it’s also all virtual infrastructure. If you’ve never seen how cloud infrastructure is really built and managed, you may not realize how inscrutable it all is – think of it like a computer in an old movie from the 1970’s, all blinking lights and switches on the outside, but no way to see what is really happening inside. These days, we are used to visual computers and colorful phones, where we can see what we are doing. Cloud infrastructure is not like that – or at least, is not if you just use the standard management interfaces that are frustrating, opaque, and vendor specific. Are there ways you can escape the lock-in to your specific cloud vendor? Sure – inventions like Kubernetes free you up, but the price is even worse visibility as you drive everything through shell scripts, CLI commands, and terminals. The 1970’s computer has moved up to the 1980’s green screen, but it’s a far cry from anything visual.
I don’t mean to just pick nits with the old-world interfaces of cloud – this isn’t a debate about style, it’s a problem with real world consequences, especially for security. You can’t see through a storm cloud in the sky, and similarly, you really can’t see what’s going on inside most cloud applications today, let alone ensure that everything is configured correctly. Sure, there are compliance checkers that can see how individual settings are configured, but trusting these is like saying a piece of music is enjoyable because every note was tuned exactly – that rather misses the big picture of what makes music good, or what makes a cloud application secure.
This is why you need to be able to separate security checking from the CI/CD pipelines used to set up and run cloud infrastructure. The much-hyped idea of DevSecOps has proven to be a myth – embedding security into DevOps teams is no more successful than embedding journalists with platoons of soldiers. The two tribes don’t see the world the same way, don’t have the same objectives, and largely just frustrate each other’s goals.
Central security has to be able to build the big picture, and needs to check the ultimate result of what the organization has set up. Ideas like “shift left” are good, but do not cover the whole picture, as the Toyota exposure makes clear. Every detail of the apps was working, and was quite likely passing all kinds of rigorous low level checks. But just like checking whether each note is tuned correctly, while not listening to the piece as a whole, Toyota lost track of the big picture, with all the embarrassment that goes with admitting a ten year pattern of unintended exposure.
Solving this is the motivating mission at RedSeal. We know what it takes to build a big picture view, and then assess exposure at a higher level, rather than getting stuck in implementation details. It’s the only way to make sure the song plays well, or the application is built out sensibly. This is why we build everything starting from a map – you can’t secure what you can’t see. This map is complete, end-to-end, covering what you have in the cloud and what you keep on your premises. We can then visually overlay exposure, so you get an immediate, clear picture of whether you have left open access to things that surprise you. We can give you detailed, hop-by-hop explanation of how that exposure works, so that even people who are not cloud gurus can understand what has been left open. We can then prioritize vulnerabilities based on this exposure, and on lateral movement. And finally, we can boil it all up into a score that senior management can appreciate and track, without getting lost in the details. As Toyota found to their cost, there are an awful lot of details, and it’s all too easy to lose the big picture.
Modern businesses are increasingly storing data in the cloud and for a good reason — to increase agility and cut costs.
But as more data and applications migrate to the cloud, the risk of data and systems being exposed increases. Conventional methods for addressing security aren’t equipped to manage containers and server-less environments. Therefore, gaps, silos, and overall security complexity increase.
This is where Cloud-Native Application Protection Platform (CNAPP), an extension of Cloud Security Posture Management (CSPM), excels. This new cloud platform combines the features of CSPM, Cloud Infrastructure Entitlement Management (CIEM), Cloud Workload Protection Platforms (CWPPs), CI/CD security, and other capabilities into a unified, end-to-end encrypted solution to secure cloud-native applications across the full application lifecycle.
It’s important to point out that many CNAPP vendors focus on providing security measures, such as CIS compliance checks or a basic “connectivity” view and segmentation to protect an organization’s applications and infrastructure in the cloud. These measures help prevent malicious actors from gaining unauthorized access to an organization’s resources, but they don’t necessarily provide visibility into potential exposures that may exist in an application’s design or configuration, thus providing a false sense of security.
Most vendors can correlate resources to compliance or identity violations, but the network context of these solutions is often limited, leading to a lack of visibility into the hidden attack surface. This results in insights that are often irrelevant and unactionable, causing security teams to chase false positives or negatives and reducing their overall effectiveness. Additionally, the shortcomings of these solutions can cause DevOps teams to lose trust in the security measures in place, hindering their confidence in the infrastructure.
The most critical gap is CNAPP vendors lack the ability to calculate net effective reachability, which determines the network’s overall connectivity, including identification of potential points of failure or bottlenecks. In simple terms, they cannot accurately determine if their critical resources are exposed to the Internet. Without this information, security teams will be unable to identify the main cause of a problem or effectively prioritize potential threats. The result is inefficiencies and delays in the security response process, leaving the company vulnerable to attacks and flag false positives/negatives to the DevOps teams.
To identify exposures, organizations need to conduct assessments that look for end-to-end access from the internet that drive up risks to the organization from malicious activities such as insufficient authentication or authorization, unvalidated input/output, SQL injection, cross-site scripting (XSS), insecure file uploads, and more.
CSPM is an automated set of security tools designed to identify security issues and compliance risks in cloud infrastructure.
CNAPPs consolidate the capabilities and functionalities offered by CSPM and CWPPs, providing centralized access to workload and configuration security capabilities. They help teams build, deploy, and run secure cloud-based apps in today’s heavily dynamic public cloud environments.
A CNAPP solution comes with a single control panel with extensive security features such as automation, security orchestration, identity entitlement management, and API identification and protection. In most cases, these capabilities are used to secure Kubernetes workloads.
CNAPP uses a set of technologies, such as runtime protection, network segmentation, and behavioral analytics, to secure cloud-native applications and services. CNAPP provides a holistic view of the security of cloud applications by monitoring and implementing security protocols across the entire cloud application profile.
CNAPP works by identifying the different components that exist in a cloud-native application, such as containers and microservices, and then applying security controls to every component. To do this, it uses runtime protection to monitor the behavior of the application and its components in real time. It leverages methods such as instrumentation to identify vulnerabilities in the application.
Also, CNAPP uses network segmentation to separate different parts of the application and reduce communication between them, thus reducing the attack surface. In addition, CNAPP includes features such as incident response and compliance management to help businesses respond quickly to security incidents, as well as ensure that apps and services comply with industry standards and regulations.
Cloud-native application environments are quite complex. Teams have to deal with app workloads that continuously move between the cloud, both private and public, with the help of various open-source and custom-developed code. These codes keep on changing as release cycles increase, with more features being rolled into production and old code is replaced with new.
To deal with the challenges of ensuring the security of highly dynamic environments, IT teams often have to put together multiple types of cloud security tools. The problem is that these tools offer a siloed, limited view of the app risk, increasing the company’s exposure to threats. DevSecOps teams often find themselves having a hard time manually interpreting information from multiple, disjointed solutions and responding quickly to them.
CNAPPs help address these challenges by combining the capabilities of different security tools into one platform to provide end-to-end cloud-native protection, allowing security teams to take a holistic approach to mitigate risk and maintain security and compliance posture.
The challenge most enterprises face is that they cannot get clear visibility of their entire network. Most networks are hybrid, with both public and private cloud environments, along with a physical network framework. This provides siloed visibility, which raises security risks.
When CSPM, CWPPs, CIEM, and CI/CD security work together, companies can quickly get a glimpse of what is happening on their network, allowing IT teams to take immediate action.
RedSeal Cloud, a CNAPP solution, provides organizations with a view of their entire cloud framework to identify where key resources are located and a complete analysis of the system to identify where it’s exposed to attacks. RedSeal maps every path and checkpoint, and calculates the net effective reachability of all aspects of your cloud, enabling you to quickly pinpoint areas that require immediate action. Furthermore, it avoids false positives and negatives, and supports complex deployments with different cloud gateway and third-party firewall vendors.
Ensuring the security of assets in the cloud has never been more important.
Companies can leverage CNAPP capabilities to secure and protect cloud-based applications, from deployment to integration, including regular maintenance and eventual end-of-life. That said, CNAPP solutions are not one-size-fits-all options but rather a combination of different vendor specialties under a single platform, proving single-pane-of-glass visibility to users.
Companies wanting to adopt CNAPPs should focus on how vendors interpret the underlying cloud networking infrastructure, the per-hop policies at every security policy point, including third-party devices, to identify any unintended exposure, and how the solution interacts with other services, both on-premises and in the cloud.
In summary, every company should ask potential CNAPP vendors:
RedSeal’s CNAPP solution, RedSeal Cloud, lets security teams know if critical cloud resources are exposed to risks, get a complete visualization of their cloud infrastructure, and obtain detailed reports about CIS compliance violations.
Want to know how you can stop unexpected exposure and bring all your cloud infrastructure into a single comprehensive visualization? Book a demo with our team to get started!
Audacy | May 1, 2023
Tune in to KCBS and hear Dr. Mike Lloyd, RedSeal’s CTO, share insights into double dip ransomware attacks, why segmentation matters, hardening your infrastructure and a quick perspective on the importance of Biden’s National Cyber Strategy.
It happens all the time. A company has the right security policies in place but misconfigures the environment. They think they are protected. Everything looks fine. They locked the doors and boarded up the windows to the room where the crown jewels are kept, but nobody noticed that the safe that holds the jewels is no longer in that room. Accidentally, it was moved to another location, which is left wide open.
Here’s another common scenario. When working in the cloud, someone in your company can easily turn on a policy that allows anyone to gain access to your critical resources. Or, maybe you grant temporary access to a vendor for maintenance or troubleshooting but then forget to revoke the access. There may be legitimate reasons to grant access, but if that resource is compromised, your cloud can be infected.
The challenge in today’s cloud environment is that things are never static. Things are spinning up constantly, new endpoints are being added, and new connections are being made. Cloud users can easily misconfigure or forget to revoke access to critical resources. So you lock the front door and think you’re safe when the back door might be open or someone is opening and closing new windows all the time.
Nearly seven in 10 organizations report dealing with cyberattacks from the exploitation of an unknown or unmanaged asset connected to the internet. With today’s complex cloud, multi-cloud, and hybrid cloud environments, uncovering the hidden attack surface is crucial to uncover every potential resource that could be compromised.
Uncovering the hidden attack surface involves knowing all unknown resources in your cloud and finding all attack paths to the resources – not just the most likely paths like most CNAPP/CSPM vendors. Finding all attack paths requires deep intelligence to map the full cloud network and determine every potential exposure point.
Cybercriminals are constantly looking for pathways, or hidden attack paths, to get to your crown jewels. With today’s emphasis on cybersecurity, companies rarely leave the front door open to let hackers walk right in. But there may be vulnerabilities that do allow access and then a pathway to reach the jewels. It may be a twisted and convoluted path, but it gets hackers where they want to go.
An attack path analysis details every endpoint and connection to show how threat actors could enter your house and travel the path to find what they’re looking for. By highlighting every possible path and policy detail associated with these pathways, you gain comprehensive visibility into your network.
This information details the traffic that can enter or exit a hop on the attack path and what controls are enabling them to uncover areas of unintended access to critical cloud resources.
Some other solutions are also inadequate to map the entire infrastructure.
Let’s say you have someone conducting penetration testing. Pen testing focuses on the major attack points but doesn’t identify every single way, inside out, to connect to those resources. Think of it this way: You want to drive from San Jose to San Francisco. Nearly everyone making that drive will use the 101 or 280. But 880 can also connect, and there are thousands of side routes that you could use to make the ride. It may take a long time, but you’ll ultimately get to your destination.
Pen tests focus on the most typical routes. Plus, routes are constantly changing. They don’t take into account that new subdivision that didn’t exist last week that allows through traffic. You may segment your data, but new pathways evolve that suddenly allow lateral movement. Without real-time attack path analysis, you may be secure one moment and insecure the next.
When looking to analyze attack paths, it’s crucial to choose the right vendor. Not everyone approaches attack path analysis the same way, and the wrong solution may give you a false sense of security.
Just like penetration testing, most CNAPP/CSPM companies focus on the same major pathways. For example, if you’re using AWS and want to know which resources may be exposed, most vendors will check AWS security groups, AWS network access control lists (NACL), and AWS gateways. But are they also checking gateways such as AWS Transit Gateways, Third Party Firewalls, Load Balancers and all other cloud networking resources.
Effective security demands that you view everything end-to-end including every endpoint, pathway, and policy. While you may start with the obvious paths, it’s not enough. Attackers know that the most obvious spots are usually protected, so they’re constantly probing for the path that’s not so obvious and less likely to be guarded. This is uncovering the hidden attack surface that results in most cloud security breaches.
RedSeal uncovers the hidden attack surface by providing a comprehensive attack path analysis of every possible entry point and pathway within your infrastructure to determine what resources may be exposed. Besides end-to-end mapping, RedSeal also shows you how the exposure occurred and provides remediation guidance.
You get:
You can complement your cloud service provider’s operational tools by getting a real-time evaluation of all affected resources across multiple cloud environments. Using an agent-less, API-based approach, RedSeal Stratus uncovers all resources deployed within your environment and lets you view them in a single pane of glass.
Not only do you get a comprehensive view of your cloud infrastructure and insight into potential exposure points, but you also get a roadmap for remediation. Stratus identifies and calculates every possible path, port, and protocol — not just active traffic — to help you prioritize your remediation efforts. Security teams can then perform root cause analysis and raise a remediation ticket for resource groups that may be impacted by security policies.
This ticket would include information about the affected resources, verification, remediation steps, and the potential risk if they are not mitigated.
RedSeal mitigates exposure with:
RedSeal’s cloud security solutions can bring all multi-cloud environments into one comprehensive, dynamic visualization and know the unknowns. This allows you to protect your cloud, conform to best practices and gain continuous monitoring for compliance.
Learn more by downloading our Solution Brief: Stop Unintended Exposure.
Since 2004, RedSeal has helped our customers See and Secure their entire complex network. And while those customers may have understood the value of understanding their environment, how it was connected and see what’s at risk, there is often an “Aha” moment when the true significance is clear. The stories of these moments are lore within the walls of RedSeal. But these tales so clearly illustrate the value of RedSeal beyond just theory that we think they’re worth sharing. In the words of our team in the field, the ones working directly with our customers, this blog series will share the moments where it all gets real.
In this edition of the series Michael Wilson, Senior Network Security Engineer, explains how RedSeal empowers customers to verify their contractors are following security best practices and have their organization’s best interest in mind.
In my customer’s environment, the network is segmented and managed by both the customer and several contracted partners. It is a difficult task to have visibility into an entire network that is distributed across several different contracted partners, let alone keep track of all of the devices and changes that can occur across a network. The adage of ‘you don’t know what you don’t know’ is very relevant in a situation like this. RedSeal has the ability to provide my customer with a single pane of glass to see all these network segments that are managed by different contracted partners.
The customer’s RedSeal deployment runs daily collection tasks, and the customer can see any changes that occur to their network from day to day. One morning, I logged into RedSeal and started my daily maintenance tasks, which includes ensuring that data collections ran correctly, and analysis was performed successfully, and I noticed that there was an increase in device count. This was a cause for investigation, as new devices being brought into RedSeal without any new data collection tasks is a possible indicator of compromise.
I notified the customer, and I started to investigate. I noticed that these changes occurred in the customer’s SDWAN environments. This SDWAN environment uses clusters to manage edge devices, and the customer has devices spread around in many different locations. The environment is managed by one of the customer’s contracted organizations and, previously, the environment used 4 clusters to serve all the customer’s edge devices in this SDWAN environment. The additional devices that RedSeal discovered were an additional 20 clusters that upped the total from 4 to 24. Once I started to arrange the new clusters on the map, I started to see that these new clusters were connected in such a way that they were serving specific geographic regions of the customer’s environment. This indicated the contracted partner was making significant changes to the SDWAN environment and the new devices were likely not an indicator of compromise.
Once I determined that this was likely a planned network change, I asked the customer if they were aware that these changes were planned and being implemented to the network. They were not aware of any plans and changes being implemented. I asked the customer to immediately verify that the changes were planned, and the customer discovered that not only were these changes planned, but they had never been notified of these planned changes. This demonstrated a significant lack of communication between the customer and their contracted partners. I was able to use RedSeal not only to discover network changes that occurred on the network, but a fundamental operational flaw of the entire customer’s workflow surrounding network changes. It gave the customer the ability ‘to know what they didn’t know’.
The risks that the customer was unknowingly accepting (and by default, unable to mitigate or remove) through this lack of communication was that the contracted partner was making changes to the customer’s network, which contains devices that have Payment Card Industry (PCI) data running through them. By making changes without consulting the customer, the contracted partner was potentially exposing the customer to a disastrous breach of customer financial information. The reason this could be the case is that the contracted partner does not control the entire customer network and changes in their network segment may unknowingly lead to security holes in other parts of the network that is managed by either the customer directly or another contracted partner. To top it off, the customer would have had no idea of this risk because they were unaware of what was happening on their network. RedSeal was able to become the stop gap and identify that risk and provide the information needed to make an informed and educated decision on what risks to accept, mitigate, or remove.
Interested in how RedSeal can help your team? Click here to set up a demo or an introductory call.
Ransomware attacks affected at least 948 U.S. government entities in 2019 and cost local and state governments over $18 billion in 2020. These agencies are prime targets for cyberattacks. Their dispersed nature, the complexity of their networks, the vast amounts of valuable personal data they process and store, and their limited budget prevent them from staying current with the latest best practices.
Strengthening your defense starts with understanding the top reasons why threat actors choose to target state and local governments. Then, implement the latest technologies and best practices to protect your organization from attacks.
There are 89,004 local governments in the U.S., plus numerous special districts and school districts. That equates to 2.85 million civilian federal employees and 18.83 million state and local government employees — each representing a potential target for threat actors.
Since it takes only one person to click on one malicious link or attachment to infect the entire system with ransomware, the large number of people who have access to sensitive data makes government entities prime targets for social engineering attacks.
Moreover, the dispersed nature of these networks makes it extremely challenging for government agencies to gain visibility of all the data and activities. When one agency suffers an attack, there are no procedures or methods to alert others, coordinate incident response plans, or prevent the same attack from happening to other entities.
How much personal data have you shared with state and local government agencies? Somewhere in their dispersed systems reside your social security number, home addresses, phone numbers, driver’s license information, health records, etc. The information is attractive to cybercriminals because they can sell it on the dark web or use it for identity theft.
Many of these agencies also hire contractors and sub-contractors to handle their computer systems or process user data. The more people with access to the data, the larger the attack surface — creating more opportunities for supply chain attacks where criminals target less secure vendors to infiltrate their systems.
Without the know-how or resources to partition their data or implement access control, many government agencies leave their door wide open for criminals to access their entire database. All malicious actors have to do is target one of the many people who can access any part of their systems.
Almost 50 percent of local governments say their IT policies and procedures don’t align with industry best practices. One major hurdle is that they don’t have the budget to offer wages that can compete with the private sector and a workplace culture to attract and retain qualified IT and cybersecurity professionals.
Meanwhile, cybercriminals are evolving their attack methods at breakneck speed. Organizations must adopt cutting-edge cybersecurity software to monitor their systems and detect intrusions. Unfortunately, the cost of these advanced tools is out of reach for many government entities due to their limited budgets.
Moreover, political considerations and bureaucracy further hamstring these organizations. The slow speed of many governmental and funding approval processes makes preparing for and responding to fast-changing cybersecurity threats even more challenging.
From smart building technology and digital signage to trash collection and snow removal, Internet of Things (IoT) tools, mobile devices, and smart technologies play an increasingly vital role in the day-to-day operations of local governments.
While these technologies help promote cost-efficiency and sustainability, they also increase the attack surface and give hackers more opportunities to breach a local government’s systems and networks — if it fails to implement the appropriate security measures.
Unfortunately, many agencies jump into buying new technologies without implementing proper security protocols. Not all agencies require IoT devices to perform their functions. You should therefore balance the cost and benefits, along with the security implications, to make the right decisions.
An ounce of prevention is worth a pound of cure. The most cost-effective way to avoid the high costs of ransomware attacks and data breaches is to follow the latest cybersecurity best practices. Here’s what state and local governments should implement to stay safe:
Cybersecurity is an ongoing endeavor, and it starts with building a solid foundation and knowing what and who is in your systems.
You must map your networks, take inventory of every device, and know where all your data is (including the cloud) to gain a bird’s-eye view of what your security strategy must address. Next, assess your security posture, evaluate your network against your policies, and prioritize resources to address the highest-risk vulnerabilities. Also, you must continuously monitor network activities and potential attack paths to achieve constant visibility, prioritize your efforts, and meet compliance standards.
State and local governments worldwide trust RedSeal to help them build digital resilience. Request a demo to see how we can help you gain visibility of all network environments to jumpstart your cybersecurity journey.