Category: For technologists

Software composition analysis — SCA – is a layer of the security stack that, more so than ever, plays a prominent role in protecting modern business networks.

Related: All you should know about open-source exposures

This is especially true as software developers increasingly rely on generic open source and commercial components to innovate in hyperkinetic DevOps and CI/CD mode.

Open source coding has come to dominate business software applications; rising to comprise 75 percent of audited code bases and putting open source on a trajectory to become a $50 billion subsector of technology by 2026.

As RSA Conference 2023 gets underway today at San Francisco’s Moscone Center, advanced ways to secure open source components is getting a good deal of attention. The infamous SolarWinds breach put a spotlight on the risk of malicious open-source components, and the White House has put its weight behind software supply chain best practices.

Guest expert: Rami Sass, CEO, Mend

I had the chance to visit with Rami Sass, CEO of Mend, a Tel Aviv-based supplier of automated remediation technologies designed to help keep open source components as secure as possible. For a full drill down on our conversation please give the accompanying podcast a listen.

Sass filled me in about a trend that started about two and a half years ago; he noted that bad actors have turned their full attention to seeking out and exploiting fresh vulnerabilities in fully updated open-source components in live service.

Mend and other SCA solution vendors are stepping up their game to counter this trend. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

Patch management has always been time-consuming and arduous. But it gets done, at least to some degree, simply because patching is so crucial to a robust cybersecurity posture. Patch programs are rarely perfect though, and imperfect patching arguably enables successful cybersecurity breaches – it’s an ever-growing concern for countless IT teams.

Related: MSSPs shift to deeper help

Managed Security Service Providers (MSSPs) do their best to patch their client’s systems while also juggling a long list of other tasks associated with developing, monitoring, and maintaining their client’s overall security and compliance program.

The resources an MSSP can dedicate to patching are, however, limited: MSSPs operate within a fixed client servicing budget, and no client will accept being billed whenever a vulnerability needs to be patched.

To patch or not to patch?

It poses a huge conundrum for MSSPs: patching everything everywhere sounds like a great idea because, after all, a single failure to patch can lead to a breach. Thorough patching means secure client systems. But patching that thoroughly isn’t economical. Some vulnerabilities are more critical – and some systems are more central to operations than others.

There is a balance to strike, but choosing where to prioritize is a tough call. Absent a game-changing technology the best solution would be to simply throw more resources at the patching problem, but that would drive up costs for MSSPs which could lead them to become uncompetitive.

There’s another problem that makes consistent patching tough to achieve: pushback from the client. Patching disrupts user workflows, causing frustration and impacting productivity. After all, patching commonly requires that the MSSP takes a service offline, restarting to apply the patch.

Jackson

A competently managed patching process should lead to no more than performance degradation, but manage patching poorly and it means downtime and big chunks of potential revenue loss. Companies need to plan for these disruptions which makes for a complex conversation between MSSP and their client.

Again, there’s a trade-off. Patching more can translate into more disruption, but patching less means taking a larger risk. The net effect is often less patching because MSSPs may judge that preserving the client relationship matters more than closing just one more vulnerability.

Enter live patching

Clearly, the patching conundrum needs a solution. Patching automation helps, and so does a sophisticated patch management program. But neither negates the labor hours involved in patching nor do these methods eliminate the disruption. Someone still needs to double-check that a restarted system goes back online correctly, and downtime must be managed (or tolerated).

There is a cybersecurity approach that changes the game. It’s called live patching, a patching method that applies updates to a running software system, typically an operating system or a kernel, without requiring reboots.

When MSSPs implement live patching it enables continuous system operation, particularly useful for critical systems and servers where uptime matters – but of value everywhere because it reduces the staff-hour workload and virtually eliminates disruption.

Several vendors developed live patching solutions. For Linux systems that includes Ksplice, offered by Oracle, which live patches Oracle Linux and a few other Linux distributions. Canonical offers Livepatch, compatible with Ubuntu.

IBM offers a live patching solution called Kernel Live Patching for IBM Z and LinuxONE systems. Microsoft introduced Azure Hotpatching which allows Azure users to apply security updates to their virtual machines (VMs) with zero downtime.

Integrated toolsets

Vendor solutions are, however, often tied to expensive support contracts and commonly compatible with just the vendor’s product. Third-party providers can sometimes offer a better package. For example, TuxCare’s KernelCare product covers the most commonly-used enterprise Linux distributions – while also delivering live patching across open-source databases, libraries, and virtual environments.

The best live patching tools integrate with vulnerability scanners and other automation tools to speed up the security and compliance process. MSSPs can therefore efficiently identify, prioritize, and remediate vulnerabilities all through a centralized platform.

This integration allows MSSPs to patch consistently, reducing the compromises inherent to patching programs so that clients can readily meet standards such as NIST 800-53 and PCI DSS. MSSPs also worry less about costs and maintain excellent client relationships because live patching removes friction.

By including live patching in the process, MSSPs minimize disruption and ensure the needed security updates are applied promptly and consistently. Thanks to the time saved, MSSPs can now allocate more resources to other aspects of cybersecurity.

About the essayist: Jim Jackson serves as President and Chief Revenue Officer at TuxCare.

 

Managed Security Service Providers, MSSPs, have been around for some time now as a resource to help companies operate more securely.

Related: CMMC mandates best security practices

Demand for richer MSSP services was already growing at a rapid pace, as digital transformation gained traction – and then spiked in the aftermath of Covid 19. By one estimate, companies are on track to spend $77 billion on MSSP services by 2030, up from $22 billion in 2020.

At RSA Conference 2023 , which gets underway next week at San Francisco’s Moscone Center, I expect that there’ll be buzz aplenty about the much larger role MSSPs seem destined to play.

I had the chance to visit with Geoff Haydon, CEO of Ontinue, a Zurich-based supplier of a managed extended detection and response (MXDR) service. We discussed the drivers supporting the burgeoning MSSP market, as well as where innovation could take this trend.

Guest expert: Geoff Haydon, CEO, Ontinue

For its part, Ontinue is leveraging Microsoft collaboration and security tools and making dedicated cyber advisors available to partner with its clients. “Microsoft has emerged as the largest, most important cybersecurity company on the planet,” Haydon told me. “And they’re also developing business applications that are very conducive to delivering and enriching a cyber security program.”e

I covered Microsoft as a USA TODAY technology reporter when Bill Gates suddenly ‘got’ cybersecurity, so this part of our discussion was especially fascinating. For a drill down, please give the accompanying podcast a listen. Meanwhile, I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

 

Good intelligence in any theater of war is invaluable. Timely, accurate intel is the basis of a robust defense and can inform potent counterattacks.

Related: Ukraine hit by amplified DDoS

This was the case during World War II in The Battle of Midway and at the Battle of the Bulge and it holds true today in the Dark Web. The cyber underground has become a highly dynamic combat zone in which cyber criminals use engrained mechanisms to shroud communications.

That said, there are also many opportunities for companies to glean and leverage helpful intel from the Dark Web. As RSA Conference 2023 gets underway next week at San Francisco’s Moscone Center, advanced ways to gather and infuse cyber threat intelligence, or CTI, into fast-evolving network defenses is in the spotlight.

I had the chance to visit with Jason Passwaters, CEO of Intel 471, a US-based supplier of cyber threat intelligence solutions.

Guest expert: Jason Passwaters, CEO, Intel 471

We discussed how the cyber underground has shifted from being perceived as deep and dark to a well-organized world with defined business models, supply chains, and relatively low barrier of entry.

“As the cyber underground becomes more sophisticated, the level of threat increases exponentially for legitimate businesses and nation-states,” Passwaters told me. “The underground is now the domain of organized cybercriminals with clear hierarchies and targeted revenue goals.”

Intel 471 directs comprehensive threat intelligence at identifying, prioritizing and preventing cyber attacks. For a full drill down, please give the accompanying podcast a listen. Good intel in warfare can’t be overstated. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

 

Embedding security into the highly dynamic way new software gets created and put into service — on the fly, by leveraging ephemeral APIs — has proven to be a daunting challenge.

Related: The fallacy of ‘security-as-a-cost-center’

Multitudes of security flaws quite naturally turn up – and threat actors have become adept at systematically discovering and exploiting these fresh vulnerabilities.

As RSA Conference 2023 gets underway next week at San Francisco’s Moscone Center, advanced application security and API security tools and practices are grabbing a lot of attention.

I had the chance to visit with Scott Gerlach, chief security officer and co-founder of StackHawk, a Denver-based software company launched in 2019 to join the phalanx of vendors innovating like crazy to dial-in meaningful code checks, in just the right measure, at just the right moment.

Guest expert: Scott Gerlach, CSO, StackHawk

We had a great conversation about how the venerable “shift left” security philosophy is being refined so that it better aligns with the way software gets developed today – at light speed. This has led to security vendors, StackHawk among them, putting great energy into weaving security more tightly into DevOps, CICD and more.

“Shift left still applies because you do want to get security processes into the left side where you design, develop, test and deploy,” Gerlach told me. “But it’s really about how can we get security information closer to the people who are writing code, changing code and fixing code.”

In short, “shift everywhere” is the new “shift left.” For a full drill down, please give the accompanying podcast a listen. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

 

In the age before the cloud, data security was straightforward.

Related: Taming complexity as a business strategy

Enterprises created or ingested data, stored it and secured it in a physical data center. Data security was placed in the hands of technicians wearing tennis shoes, who could lay their hands on physical servers.

Today, company networks rely heavily on hybrid cloud and multi-cloud IT resources, and many startups are cloud native. Business data has been scattered far and wide across cloud infrastructure and just knowing where to look for sensitive data in the cloud, much less enforcing security policies, has become next to impossible for many organizations.

If headline grabbing cyber-attacks weren’t enough, the Biden Administration has begun imposing long-established, but widely ignored data security best practices on any contractor that hopes to do business with Uncle Sam.

Guest expert: Yotam Segev, co-founder and CEO, Cyera

This is where a hot new security service comes into play – designated in 2022 by Gartner as “data security posture management,” or DSPM. With RSA Conference 2023 taking place at San Francisco’s Moscone Center next week, I had the chance to visit with Yotam Segev, co-founder and CEO San Mateo, Calif.-based security startup Cyera, that is making hay in this emerging DSPM space.

Segev and I discussed how, in the rush to the cloud, companies have lost control of data security, especially in hybrid environments. The core value of DSPM systems, he argues, is that they can help demystify data management, with benefits that ultimately should go beyond security and compliance and actually help ease cloud migration.

Please give a listen to the case Segev makes in the accompanying podcast. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

 

Domain Name Service. DNS. It’s the phone directory of the Internet.

Related: DNS — the good, bad and ugly

Without DNS the World Wide Web never would never have advanced as far and wide as it has.

However, due to its intrinsic openness and anonymity DNS has also become engrained as the primary communications mechanism used by cyber criminals and cyber warfare combatants.

If that sounds like a potential choke point that could be leveraged against the bad actors – it is. And this is where a fledgling best practice —  referred to as “protective DNS” – comes into play.

What has happened is this: leading security vendors have begun applying leading-edge data analytics and automated remediation routines to the task of flagging DNS traffic that’s clearly malicious.

Guest expert: David Ratner, CEO, HYAS

One sure sign that protective DNS has gained meaningful traction is that Uncle Sam has begun championing it. Last fall the U.S. Cybersecurity & Infrastructure Security Agency (CISA) began making a protective DNS resolver availabile to federal agencies.

With RSA Conference 2023 taking place at San Francisco’s Moscone Center next week, I had the chance to visit with David Ratner, CEO of Vancouver, Canada-based HYAS, security company whose focus is on delivering protective DNS services. Ratner explains what protective DNS is all about, and why its widespread adaption will make the Internet much safer.

For a full drill down, give the accompanying podcast a listen. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

One of the nascent security disciplines already getting a lot of buzz as RSA Conference 2023 gets ready to open next week at San Francisco’s Moscone Center is “software supply chain security,” or SSCS.

Related: How SBOMs instill accountability

Interestingly, you could make the argument that SSCS runs counter-intuitive to the much-discussed “shift left” movement.

Shift left advocates driving code testing and application performance evaluations as early as possible in the software development process.

By contrast, SSCS vendors are innovating ways to direct automated inspections much later in DevOps, as late as possible before the new software application is deployed in live service.

Guest expert: Matt Rose, Field CISO, ReversingLabs

I had the chance to visit with Matt Rose, Field CISO at ReversingLabs, which is in the thick of the SSCS movement. We discussed why reducing exposures and vulnerabilities during early in the coding process is no longer enough.

“True software supply chain security is about looking at the application in a holistic way just prior to deployment,” Rose told me. “Most software supply chain issues are novel, so looking for problems too early, before the code is compiled, won’t tell you much.”

Like everyone else, SSCS solution vendors are leveraging machine learning and automation – to focus quality checks and timely remediation in very specific lanes: on open-source components, microservices containers and compiled code, for instance. For a drilll down please give a listen to the accompanying podcast.

I’m looking forward to attending RSAC in person, after a couple of years of remote participation. No doubt there’ll be some thoughtful discussion about how best to protecting software in our software defined world.

I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(LW provides consulting services to the vendors we cover.)

No organization is immune to cybersecurity threats. Even the most well-protected companies can be susceptible to attacks if they are not careful about a proactive approach towards cyber security.

Related: Why timely training is a must-have

That’s why businesses of all sizes need to understand the biggest cybersecurity weaknesses and take steps to mitigate them. Here are a few of the top security weaknesses that threaten organizations today:

Poor risk management. A lack of a risk management program or support from senior management is a glaring weakness in your cybersecurity strategy.

A robust risk management program should include regular assessments of security controls and audits to ensure compliance with industry standards and best practices.

Tick-in-the-box training. Unfortunately, many organizations fail to educate their employees on the importance of cyber hygiene, leaving them vulnerable to phishing scams, malware infections, data breaches, and other cyber attacks.

By not involving your audience and understanding their context, i.e., organization users are susceptible users being the weakest link that in fact could be your strongest link.

Anemic asset management. Integrating asset management into your organization can help you understand where your vulnerabilities lie so that you can take steps to protect yourself accordingly.

By understanding what data or systems you manage, you can then determine which security measures need to be implemented. This will enable you to better safeguard your organization’s sensitive information against potential threats.

Lackadaisical set up. Getting security right early in the development cycle with well-architected services and systems reduces attack surface significantly.

Singh

When designing new systems or modifying existing ones, think about the principles of least privilege and need to know. By taking a proactive approach towards security in your architecture and configuration, you are better able to protect critical data from potential threats.

Spotty patching. Vulnerability management is another key consideration when it comes to security. It ensures that all systems are regularly updated, vulnerabilities are triaged accordingly, and legacy equipment is managed securely.

To do this effectively, you must have an effective patch management process in place which takes into account the different operating systems you use across your organization as well as their respective patch cycles.

Weak access controls. Identity and Access Management (IAM) plays an important role in reducing attack surface by controlling who has access to what data within your system environment. All access should be granted on a need only basis, meaning that users should only be able to access the data they need for their role or job function within the organization.

Lack of monitoring. Logging events is the first step in understanding which services or systems are used within an organization. Security monitoring, meanwhile, provides us with visibility into what is happening on our systems so that we can identify and respond to potential threats quickly.

No disaster plans. It is also essential to have an effective incident management strategy if a security incident occurs. This involves having a plan for detecting incidents quickly and responding effectively. You should also have procedures to reduce incidents’ impact through recovery planning.

Visibility gaps. A key issue many organizations face is they don’t always know where their data is stored, who has access to it or how it is processed. This lack of clarity leaves organizations vulnerable to threats such as insecure cloud buckets or permissions-based misconfigurations which can lead to data breaches.

Supply chain blindness. Organizations increasingly rely on third-party suppliers for their product components or services. Unfortunately, these third parties may not have the same level of security as your organization; therefore, the lack of risk-based approach adds another layer of vulnerability.

By taking a risk-based approach to supply chain security, organizations can better protect themselves from malicious actors looking to access confidential information or disrupt operations with cyber attacks or data breaches.

Overall, it is clear that there are many different security weaknesses an organization can face. This fundamentally reflects a failure to acknowledge that cybersecurity has moved to risk-based approach, one that offers measurable outcomes, not just investment into tooling.

A starting point should be assessing the gaps fairly, usually utilizing a third-party cyber security services company. This would ensure you are aware of your blind sports, more importantly, help you with analysis and preparing a risk remediation plan.

About the essayist: Harman Singh is a security consultant serving business customers at Cyphere. He has also delivered talks and trainings at Black Hat and regional conferences – on Active Directory, Azure and network security.

At 10 am PDT, next Wednesday, April 19th,  I’ll have the privilege of appearing as a special guest panelist and spotlight speaker on Virtual Guardian’s monthly Behind the Shield cybersecurity podcast.

Related: The Golden Age of cyber spying is upon us

You can RSVP – and be part of the live audience – by signing up here. The moderator, Marco Estrela, does a terrific job highlighting current cybersecurity topics ripped from the headlines. For my part, I’m going to ‘follow the money’ with respect to the strategic use of weaponized ransomware on  the part of Vladimir Putin.

I recently had the chance to drill down on this topic as part of a Last Watchdog Fireside Chat podcast I’m currently producing. Stay tuned for my eye-opening discussion with BullWall, a Danish startup that’s in the midst of helping companies effectively mitigate cyber extortion.

Meanwhile, in the April 19th episode of Behind the Shield,  I’m going to attempt to summarize the big theme I’m hearing from BullWall and numerous other security vendors as I get ready to make the trek to San Francisco’s Moscone Center to cover RSA Conference 2023 in person – after two years of covering it remotely.

And that theme is . . . the unfolding reconstitution of network defense. There’s a common thread running through all of the advanced tools, new security frameworks and innovative security services that are rapidly gaining traction.

At some level, they all drive us in the direction of creating a new tier of overlapping, interoperable, highly automated security platforms.  The end game quite clearly must be to bake security deep inside the highly interconnected systems that will give us climate-rejuvenating vehicles and buildings and spectacular medical breakthroughs.

I’ll get this discussion going at Virtual Guardian’s Behind the Shield podcast next week. And I’ll try to ramp it up in my upcoming series of Last Watchdog RSA Insights Fireside Chat podcasts to follow. I’ll keep watch and keep reporting.

Acohido

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.