Ransomware commonly comes up with an email that tricks users into trusting a malicious file. Many of the most recent data breaches have been completed because a user has been the victim of such an attack in the previous period. Threats such as ransomware, which focus on user compromise, are causing more and more companies to adopt user and entity behavior analysis (UEBA) in their security operations center (SOC). The new functions of the SOC service, including long-term search, are oriented towards the increasing offer of additional tools for the optimal management of corporate security.
We continue to innovate our platform to increase the power of SOC in fighting ransomware and other threats. In our latest release, we have added even more machine-learning and context-aware detection capabilities that enable security analysts to tackle the most sophisticated attacks. Furthermore, the latest updates bring an ever greater ease of use for security architects.
Long-term search for the security analyst
The service introduces a number of innovations to reduce detection and response times for security analysts and threat seekers.
Improved detection of sophisticated threats
– Long-term search helps analysts discover hidden threats by providing a search capability on archived data. The search is scalable and does not affect SIEM performance.
– Analytics Sandbox helps break down false positives by providing an online QA environment to test and validate use cases.
– Persona-based threat chains detect advanced threats more accurately, including the dynamic relationship between users, hosts, IP addresses, and email addresses. Analysts benefit from greater visibility into the progression of an attack. This feature combines suspicious activity from a single user into a single priority alert, instead of separate and unrelated alerts.
– Relative Rarity offers analysts a broader context on how rare an event is compared to all other events in their environment.
– Viewing security alerts using the MITER ATT&CK Threat Framework helps analysts prioritize risk and reduce response times.
Reduction of response times
– Improved case management allows for better management, sharing and investigation of alarms, allowing operators to respond more quickly.
– New EDR integrations improve incident response by providing additional endpoint data from CarbonBlack Defense, Tanium, Symantec DLP and others.
– Better search views improve the analyst experience by reducing detection and response times. They help analysts easily identify compromised accounts, data exfiltration, and associated hotspots.
Why long-term search is so important
With a global dwell time of around 60 days on average, threat hunting continues to be an important part of cybersecurity resilience. However, searching through the data history usually takes a long time.
Many vendors are unable to dynamically scale a quick search through archived data without significant effort. The latest features of our SOCaaS provide this possibility for threat hunters with long-term search on an almost unlimited scale. With long-term research, organizations can reduce the time it takes to investigate and find threats that are already in their environment.
Analysts need to continually query the data to see if there are new threats. For example, an analyst might learn from a trusted source that their industry has been targeted. At this point we need to investigate a new indicator of compromise that has just been discovered to verify if an attacker is already inside.
Through long-term search, SOD’s native SOCaaS SIEM allows threat hunters to be proactive, making historical data research fast and convenient.
By introducing new technologies into our SOC service, we are offering more and more security for our customers.
We take care of your data by verifying not only that it is not safe now, but also that it has not been breached in the past. In case we suspect a new threat, we know how to spot it.
If you have any questions, contact us, we will be happy to answer all your questions.
The practice of shadow IT is the use of computer systems, devices, software, applications and services without the explicit approval of the IT department. In recent years, it has grown exponentially with the adoption of cloud-based applications and services.
While shadow IT could improve employee productivity and drive innovation, it can also introduce serious security risks to the organization due to data breaches, potential compliance breaches and more.
Why users practice shadow IT
One of the main reasons employees apply shadow IT is simply to work more efficiently. A 2012 RSA study reported that 35% of employees believe they need to bypass their company’s security policies just to get their job done right. For example, an employee may discover a better file sharing application than is officially allowed. Once you start using it, the use may spread to other members of your department.
The rapid growth of cloud-based consumer applications has also increased the adoption of shadow IT practices. The days of packaged software are long gone; Common applications such as Slack and Dropbox are available with a simple click, and corporate data is easily copied beyond work applications to employee personal devices, such as smartphones or laptops, especially in BYOD (Bring Your Own Device) working conditions .
Shadow IT: Security Risks and Challenges
The point is that if the IT department is not aware of the use of an application, they cannot support or guarantee that it is secure. Industry analyst firm Gartner predicted, in 2018, that by 2020, one-third of successful attacks businesses experience focus on their shadow IT assets.
While it is clear that the practice will not go away, organizations can minimize risks by educating end users and taking preventative measures to monitor and manage unauthorized applications.
Not all shadow IT is inherently dangerous, but some features like file sharing and storage and collaboration (for example, Google Docs) can cause sensitive data leaks. This risk goes beyond applications alone: the RSA study also reports that 63% of employees send work documents to their personal email to work from home, exposing data to networks that cannot be monitored.
In times like the one we are experiencing, in which teleworking is encouraged and, in some cases, the only possible solution, it is essential to have an eye for the applications in use on employees’ computers.
Benefits of Shadow IT
Despite the risks, shadow IT has its advantages. Getting IT approval can take time that employees can’t afford to waste.For many employees, approval is a productivity bottleneck, especially when they can get a fix in minutes.
Having IT behaving like an Orwellian “Big Brother” doesn’t always help productivity. Discerning cases of positive shadow IT can be the best compromise. Finding a middle ground can allow end users to research solutions that work best for them. This gives IT time to control user data and permissions for applications. If end users do not need to request new solutions, the IT department has been given time to focus on more critical tasks.
Whatever the reason why shadow IT occurs, if the IT department is unaware of it, the risk of breach is high. What the corporate cyber security departments should do is implement automated traffic and behavior control systems.
The solution offered by a SOC as a Service is the most complete in this respect. It allows you to keep an eye on all the devices in the system and also monitor user behavior.
Thanks to the Nextgen SIEM and UEBA systems, in fact, the collection of usage data is easy and manageable in real time. The data collected is enriched and aggregated to give analysts the most complete view possible and allow rapid intervention. Meanwhile, the UEBA system checks that there are no anomalous behavior by users or suspicious outgoing data traffic.
Shadow IT, while not usually a malicious attack, is a practice that should be discouraged and, as it is risky, stopped in the bud.
An increasing number of companies leverage SOAR to improve the effectiveness of their cybersecurity operations. In this article, we explain how harnessing the value of SOAR could be crucial to improving the security of your organization.
What is SOAR?
Coined by the research firm Gartner, Security Orchestration, Automation and Response (SOAR) is a term used to describe the convergence of three distinct technology markets:
1. Security orchestration and automation.
2. Security Incident Response Platforms.
3. Threat Intelligence Platforms.
SOAR technologies allow organizations to collect and aggregate large amounts of data and security alerts from a wide range of sources. As a result, human and mechanical analysis has improved, as have standardization and automation of threat detection and recovery.
It is estimated that by the end of 2020, 15% of organizations with a security team will leverage SOAR technologies. In 2018 they were 1%.
How is SOAR helping companies overcome security challenges?
Rapid technological evolution is bringing complicated challenges to the IT industry. The threats are constantly evolving, the qualified staff is in constant shortage and the IT properties to be managed are constantly increasing. As a result, the SOAR concept is helping companies of all sizes improve their ability to detect and respond to attacks quickly. Let’s see how, in practice, SOAR can improve corporate security.
1. Provide better quality intelligence
Tackling the latest and most sophisticated cyber security threats requires a thorough understanding of attackers’ tactics, techniques and procedures (TTP), as well as the ability to identify indicators of compromise (CIO).
SOAR aggregates and validates data from a wide range of sources. Specifically, these are threat intelligence platforms, security technologies, intrusion detection systems, and SIEM and UEBA technologies. Thus, through the collected and validated data, SOAR helps SOCs to become more intelligence oriented.
The effect of this is that security personnel are able to contextualise incidents, make more informed decisions and accelerate incident detection as well as threat response.
2. Improve the efficiency and effectiveness of operations
The need to manage so many disparate security technologies can put a strain on security personnel. Systems need constant monitoring to ensure efficient performance. Furthermore, the thousands of daily alarms they generate can also lead to dangerous fatigue. The constant transition from one system to another only makes the situation worse, costing teams time and effort, as well as increasing the risk of errors.
SOAR solutions help SOCs automate and semi-automate some of the daily tasks of security operations.
By presenting intelligence and controls through a single panel and using artificial intelligence and machine learning, SOAR tools significantly reduce the need for SOC teams to perform ‘context switching’.
In addition, they can help ensure that processes are managed more efficiently. This improves the productivity and the ability of organizations to deal with a greater number of incidents without the need to hire additional staff. A key goal of the SOAR approach is to help security personnel work smarter and not harder.
3. Improve incident response
To minimize the risk of breaches and limit the extensive damage they can cause, a quick response is vital. SOAR helps the organization reduce mean time to detection (MTTD) and mean time to response (MTTR). Security alarms can be qualified and remedied in minutes, rather than days, weeks or months.
SOAR, therefore, allows security teams to automate incident response procedures. Automated responses can include blocking an IP address on a firewall, suspending user accounts, or quarantining infected endpoints on a network.
4. Simplify reporting
In many cyber security operations centers, frontline workers spend a lot of time managing cases, writing and reporting, and documenting incident response procedures. Instead, by aggregating information from a wide range of sources and presenting it via visual and customized dashboards, SOAR can help organizations reduce collateral work while improving internal communication.
In addition, by automating the tasks of procedures, SOAR helps encode knowledge about threats.
Ultimately, doing tasks faster means more time for threat resolution and mitigation. The longer these are not addressed, the greater the chances of damage and malfunctions.
While both security information, event management (SIEM) and SOAR accumulate relevant data from multiple sources, SOAR services integrate with a wider range of internal and external applications.
At present, many companies are using SOAR services to potential internal SIEM software. In the future, it is expected that as SIEM suppliers begin to add SOAR functionality to their services, the market for these two product lines will merge.
SOD applies SIEM Next Generation and UEBA technology for the management of cyber threats and SOAR processes. This guarantees prevention and timeliness of an excellent level. If you want to know more, visit our SOCaaS service page and contact us for more information.
A SIEM solution in IT is one of the essential components of a SOC (Security Operation Center). Its task is to collect information and analyze it in search of anomalies and possible breaches in the system. But the defense process hasn’t always been that simple. What we now call SIEM, Security Information and Event Management, is the union of two different types of cyber security tools.
SIM and SEM: the origins
Before the arrival of a complete SIEM solution in computing, security was heavily focused on perimeter security and did not keep the internal network adequately controlled. The first solutions developed in the 90s were basic and basically dealt with security information management (SIM) or security event management (SEM). They were solutions available as tools that had to be deployed on-site in the data center to be protected. This limited scalability, because adding capacity required the purchase of additional equipment.
These early solutions were also built on proprietary databases that forced customers to use technology from a single vendor. If you wanted to move your data to another system, the process was long and complicated. It should also be noted that archiving was more expensive, so only the most valuable data was collected. Furthermore, although the SIM and SEM solutions contained all the data necessary for the defense, the search and alarm were rudimentary. Additionally, they depended on experienced security analysts to research, understand and interpret what they found in the data.
SIEM origins in computer science
As data became more sensitive and technology more powerful, SIEM systems (SIM + SEM) became capable of ingesting, processing and storing a great deal of data. Next-generation SIEM IT solutions are able to use signature-based alerts to identify threats in collected data. However, only those alerts that have identified indicators of compromise (IOC) of a certain threat can be identified in this way.
To be clear, if the type of attack to which a system is subjected has not been cataloged in a series of IOCs, a first generation SIEM is not able to detect it. The main drawback of those systems was the very limited ability to detect unknown cyber threats.
To give a practical example: it was possible to use a rule like this: “give a warning if a user enters 10 consecutive wrong passwords“. In theory this could be used to detect brute force password attacks. But what if the attacker only tried 9 passwords in a row? Or what if the alarm was given for a very forgetful user?
Next Gen SIEM (NGS)
A next generation SIEM is built on a large data platform that provides unlimited scalability and is hosted in the cloud. A next gen SIEM includes log management, advanced threat detection based on behavior analysis and automatic incident response, all on a single platform.
This eliminates the problems that old on-premises systems were prone to. Not having to install anything and being able to send the necessary data to the cloud quite simply, the computing power of the local machine is not compromised and the SIEM can manage all the data safely.
How a SIEM proceeds in cyber threat analysis
1. Data Collection: An IT SIEM solution collects data from across the organization using agents installed on various devices, including endpoints, servers, network equipment and other security solutions. Next generation SIEM includes support for cloud applications and infrastructure, business applications, identity data and non-technical data feeds.
2. Data enrichment: Enrichment adds further context to events. SIEM will enrich data with identity, resources, geolocation and threat information.
3. Data storage: The data will then be stored in a database so that it can be searched for during investigations. The next generation SIEM exploits open source architectures and big data architectures, exploiting their scalability.
4. Correlation and Analysis: SIEM solutions use several techniques to draw actionable conclusions from SIEM data. These techniques vary greatly.
5. Report: A SIEM, particularly a next generation SIEM, gives you the ability to quickly search for data, allowing you to dig through alerts and search for threat actors and indicators of compromise. The displayed data can be saved or exported. It is also possible to use out-of-the-box reports or create ad hoc reports as needed.
What a SIEM is used for
Threat hunting and investigation
The ability to perform threat hunting on a SIEM is critical to understanding the true patterns of attacks based on access, activity and data breaches. By developing a detailed and contextual view of attacks, security analysts can more easily develop policies, countermeasures and incident response processes to help mitigate and remove the threat.
Response in case of an accident
An effective response to incidents is essential to intervene more quickly and reduce the residence time of the threat. For this, a SIEM provides an incident response playbook with configurable automated actions. A SIEM is able to integrate with third party solutions for security orchestration (SOAR) or individual case management.
Defense against insider threats
The reason why insider threats are such a big problem is because it’s not about entering the perimeter, but about exploiting insider positions. They can be your employees, contractors or business associates. It may be they themselves wanting to exploit their location, or their account may have been hacked.
With all kinds of internal threats, the attacker tries to stay hidden, gathering sensitive data to exploit. This could cause significant damage to the company, its position in the industry and its relationship with consumers or investors. By using a SIEM, you avoid this risk.
Cyber threat detection
Your organization is likely to have at least one sensitive data repository. Cybercriminals thrive on looting this data for financial gain. Many breaches begin with a simple phishing email against an organization’s target. Simply clicking on an attachment can leave malicious code behind. A SIEM will allow you to monitor advanced cyberthreat patterns such as phishing, beaconing and lateral movement.
For many industries, adherence to compliance standards is critical. A SIEM can help by providing reports focused on data compliance requests. Integrated packages covering all major mandates, including PCI DSS, SOX, and ISO 27001, are a standard feature of SIEMs as well.
Next Generation SIEM
A next generation SIEM is not just a cloud hosted system. It also makes use of the implementation of AI and Machine Learning to increase the defense of the IT system.
We will see it in a future article, but it is right to specify that the SOCaaS offered by SOD makes use of the latest generation technology offered by Next Gen. SIEM systems. Contact us to find out more about it and talk to experts who can dispel all your doubts.
Evolving beyond its roots in log file management, today’s security information and event management (SIEM) software vendors are introducing AI, advanced statistical analysis and other analytical methods into their products. . But what is SIEM software and what are its uses?
Acronym for Security Information and Event Management, it is a product that provides cyber security professionals in companies with an overview and a track record of the activities within their IT environment.
The technology used has been around for more than a decade, and has evolved from the practice of managing log files. It combined security event management (SEM), which analyzes log and event data in real time to provide threat monitoring, event correlation and incident response, with security information management (SIM) that collects, analyzes and reports log data.
How does it work?
SIEM collects and aggregates log data generated across the organization’s technological infrastructure, from host systems and applications to network and security devices such as firewalls and virus filters. Then, it identifies and categorizes incidents and events, as well as analyzing them.
The software has two main objectives, which are: to provide reports on incidents and events related to cyber security, such as successful and unsuccessful logins, malware activities and other possible malicious activities, and to send alerts if the analysis shows that an activity ‘goes against established rules, indicating a potential security problem.
According to experts, corporate demand for more security measures has pushed the market to expand in recent years. Today, large organizations look to SIEM as a basis for the creation of a security operations center (SOC).
Analysis and intelligence
One of the main factors underlying the use of SIEM software for security operations is represented by the features offered.
Many products offer threat intelligence feeds in addition to traditional log file data. Some SIEM software also has security analysis capabilities and examines network and user behavior to provide more information on whether or not an action indicates malicious activity.
Generally speaking, SIEM tools provide:
1. Real-time visibility through an organization’s IT security systems
2. Event log management that consolidates data from numerous sources
3. A correlation of collected events from different logs or security sources, using rules that add important information to the raw data
4. Automatic notifications of security events. Most SIEM systems provide dashboards for security issues and other direct notification methods
The SIEM operation process
In practice, the operating process of a SIEM system can be divided into the following steps:
1. Data collection: All sources of network security information (eg servers, operating systems, firewalls, anti-virus software and intrusion prevention systems) are configured to send event log files. Most modern SIEM tools use agents to collect event logs from business systems, which are then processed, filtered, and sent to the system.
2. Policy: A policy profile is created by the administrator. This defines the behavior of business systems, both under normal conditions and during predefined security incidents. We provide predefined rules, alerts, reports and dashboards that can be adjusted and customized to your specific security needs.
3. Data Consolidation and Correlation: These software consolidate, analyze and control log files. The events are then categorized based on the raw data and correlation rules are applied that combine the individual events.
4. Notifications: If an event or set of events triggers a SIEM alarm, the system notifies the security personnel.
It is clear that a SIEM stops at the analysis of threats and subsequent notification. Following these, someone needs to intervene, both by checking the reports and taking measures to mitigate any threat. This can only happen if there is a team of trained technicians behind the software 24/7 to carry out maintenance and intervene when necessary.
While these solutions offer various benefits to businesses of all sizes and shapes, they also have limitations and vulnerabilities that should not be ignored.
A SIEM requires constant 24/7 monitoring of logs and alarms, regular maintenance and configuration, as well as a dedicated security team responsible for managing the software. Most of the work begins after the SIEM implementation. Therefore, organizations cannot rely on these solutions alone to protect critical IT infrastructures.
Even with such a system in place, security professionals must ensure that they have adequate resources, tools, budget and time to be able to exploit the features and ensure complete protection against potential security threats.
From this point of view, the most interesting solution for companies is that of a SOCaaS, which includes SIEM and other suitable tools for a complete management of a company’s cyber security.
Ransomware commonly comes up with an email that tricks users into trusting a malicious file. Many of the most recen… https://t.co/wIarD0ojXT
Tempo di lettura: 5 minSul web sono disponibili moltissime applicazioni open source che permettono di gestire le pi… https://t.co/SjCg383iEF
On the web there are many open source applications that allow you to manage the most various situations. It is comm… https://t.co/e5OZvRPAqm
Tempo di lettura: 4 minLa pratica dello shadow IT e' l'utilizzo di sistemi informatici, dispositivi, software, appl… https://t.co/9wQPtvqemG
The practice of shadow IT is the use of computer systems, devices, software, applications and services without the… https://t.co/CgzjblglX9