Author: elinks

Categories
Uncategorized

Bitdefender Achieves Highest Scores in AV-Comparatives Advanced Threat Protection Tests

Linkedin

Bitdefender Achieves Highest Scores in AV-Comparatives Advanced Threat Protection Tests

30 NOVEMBER 2023

Independent Testing Illustrates Superior Ability to Detect and Prevent Advanced Threats to Both Enterprises and Consumers

BUCHAREST, Romania and SANTA CLARA, Calif. – Bitdefender, a global cybersecurity leader, today announced it achieved remarkable success in the AV-Comparatives’ Advanced Threat Protection Test, excelling in both the Enterprise and Consumer categories. Bitdefender attained the highest score of all vendors evaluated showcasing superior capabilities in blocking advanced threats.

Bitdefender GravityZone, the company’s flagship threat prevention, protection, detection and response platform earned the prestigious Certified Advanced Protection status in the Enterprise category. Similarly, its Consumer solution was one of just three vendors rated as Advanced+ for detecting and blocking threats. These top designations were given based on strict evaluation from the highly respected independent testing organization.

“Cyberattacks are becoming much more advanced and frequent, putting organizations and individuals at significant risk for monetary and reputational damage,” said Dragos Gavrilut, vice president of threat research at Bitdefender. “Achieving the highest marks in AV-Comparatives’ Advanced Threat Protection tests shows that Bitdefender delivers the highest level of protection against existing and emerging cyber threats. Our relentless focus on detecting and stopping attacks before they do harm sets us apart in the marketplace.”

The AV-Comparatives Advanced Threat Protection tests mimicked tactics, techniques, and procedures (TTPs) that adversaries employ to gain unauthorized access to a system, remain undetected for as long as possible, and move laterally across networks. AV-Comparatives performed a total of 15 different attacks that reflect the MITRE ATT&CK® framework and are analyzed using the kill chain established by Lockheed Martin’s Cybersecurity Kill Chain and a variety of scenarios to deliver malicious payloads such as spear-phishing, access through stolen credentials, infected removable media, and exploits involving trusted relationships.

Of the nine vendors evaluated in the enterprise category and eight for consumer protection, Bitdefender was the top performer. While no vendor achieved a perfect score on both tests, Bitdefender stood alone as the only vendor to block 14 of the 15 attacks.

Additionally, Bitdefender blocked attacks more often than any other vendor at the pre-execution stage. By stopping attacks before they can activate any part of their malicious payload, Bitdefender significantly reduces the risk of data loss, system compromise, or operational disruption. This preemptive approach protects critical assets at the outset and minimizes the need for costly and time-consuming remediation efforts that would be necessary if an attack were to proceed undetected.

“Bitdefender continues to demonstrate its remarkable cybersecurity efficacy and reliability each year that we’ve tested their solutions,” said AV-Comparatives’ founder and CEO Andreas Clementi. “We put vendor solutions through rigorous multi-step testing using the same techniques cybercriminals are using across an expanding attack surface. Products that perform well are a strong testament to their capabilities and effectiveness in the real-world.”

To learn more and download complimentary copies of the latest Advanced Threat Protection tests, visit https://www.bitdefender.com/blog/businessinsights/bitdefender-tops-the-latest-av-comparatives-advanced-threat-protection-test/.

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
Uncategorized

The Best Antivirus Software for 2023

Linkedin

The Best Antivirus Software for 2023

Without antirivirus, your personal information, your data, and even your bank account are at risk. We’ve tested more than 40 utilities to help you pick the top antivirus software for your needs.

OVERVIEW

The trees are changing color as the cold winds of autumn blow, harbingers of that holiday of ghosts and ghouls, Halloween. It’s all for fun, of course. The kids know monsters aren’t real. All the more shocking, then, when a vampire Trojan sucks personal data from your computer or a ransomware ogre tramples your important files into encrypted rubble. Forget hanging wreaths of garlic and scribing runic wards on your door. Instead, double-check the status of your antivirus. Don’t have protection? Get it now!

But which antivirus should you choose? We’ve reviewed more than 40 antivirus utilities, so you can easily select one that fits your needs. We’ve gathered the top 10 tested antivirus tools here, along with what to look for when selecting the right antivirus for you, which you can find after the listings below.

 

Deeper Dive: Our Top Tested Picks

  • Bitdefender Antivirus Plus

    Bitdefender Antivirus Plus

    Best Overall
    5.0 OUTSTANDING

    Why We Picked It

    You can buy an antivirus utility that does everything an antivirus should, or you can buy one that does more—way more. That would be Bitdefender Antivirus Plus. The Plus, in this case, represents a multitude of features. Ransomware protection, a hardened browser for your financial transactions, VPN protection for your connections, a feature that smacks down ad trackers, automatic detection of missing security patches, a simple password manager…the list goes on. While its name says antivirus, this program’s feature list beats many security suites.

    Not only that, but it’s also a good antivirus. The independent testing labs routinely grant it perfect or near-perfect scores, and it aces many of our hands-on tests. Its ransomware-specific defense system proved itself in testing, too. And its Autopilot feature means that all this happens with minimal bother for you, the user.

    Oh, there are a few minor nits. The password manager doesn’t have all the fanciest features, for example. And if you want unlimited use of the VPN, you must pay a bit extra. But, overall, this is a marvelous choice for antivirus protection.

    Who It’s For

    If you want comprehensive protection with little interaction, just fire up Bitdefender Antivirus Plus and turn on its Autopilot. Now you can sit back and do, well, anything you want!

    • PROS

      • Outstanding scores in independent lab tests and our phishing protection tests
      • Multi-layered ransomware protection
      • Isolated browser for banking safety
      • Active Do Not Track
      • Offers a VPN
      • Many security-centered bonus features

    • CONS

      • Unlimited VPN access requires separate subscription
      • Remarkably slow first full scan

    GET IT NOW

    LEARN MOREBitdefender Antivirus Plus Review
  • ESET NOD32 Antivirus

    ESET NOD32 Antivirus

    Best for Techies
    4.0 EXCELLENT

    Why We Picked It

    When you see ESET’s blue-eyed cyborg mascot gazing serenely from the screen of ESET NOD32 Antivirus, you just know you’ve got some high-tech protection. It hits top scores in some independent lab tests and some of our own tests—we always like to see both. ESET goes beyond many competitors with unusual high-tech features like its UEFI (Unified Extensible Firmware Interface) scan, a cut above the more common boot sector scan. It even looks for intrusions in the WMI (Windows Management Instrumentation) database.

    Yes, you need some technical expertise to understand and make use of these high-tech features. The same is true of the Host Intrusion Prevention System (HIPS), which aims to detect and block attacks that try to leverage vulnerabilities in the operating system or in popular programs. As for the Device Control system, it’s a techie’s dream. You can exert total control on all types of external devices and individual devices. For example, you could ban USB drives so the kids don’t bring home malware with their homework but specifically allow devices you’ve vetted yourself. At the device or type level, you can block all use, force read-only access, or just display a warning.

    Who It’s For

    Some antivirus tools do their best to work in the background with no technical involvement by the user. That’s not ESET NOD32 Antivirus. This antivirus is ideal for those who want to get their hands dirty and take an active role in internet security protection. If you have the knowledge and skills to use them, ESET has the features for you.

    • PROS

      • Some excellent scores from independent labs
      • Some good scores in our hands-on tests
      • HIPS component blocks exploits
      • Comprehensive device control

    • CONS

      • Poor score in our hands-on malware blocking test
      • Device control too complex for most users
      • Ransomware protection not effective in testing

    GET IT NOW

    LEARN MOREESET NOD32 Antivirus Review
  • G Data Antivirus

    G Data Antivirus

    Best Breadth of Features
    4.0 EXCELLENT

    Why We Picked It

    The G Data website states that G Data released the first antivirus program in 1985. Whether or not it was the very first, G Data Antivirus has a long and storied history. Two of the four independent labs we follow typically include this venerable tool in their tests. AV-Test routinely gives it the top possible rating, while its scores in tests by AV-Comparatives range from passing to perfect. G Data scored close to the maximum in our hands-on malware protection and malicious download defense tests.

    Throughout its evolution, this antivirus tool has picked up many bonus security tools. With the regular antivirus disabled, its behavior-based ransomware protection layers detected half the samples we threw at it. An exploit detection component scored better than most competitors in testing. Other bonus features include spam filtering, BankGuard protection for financial transactions, active defense against keyloggers, and fine-grained control over startup programs.

    Who It’s For

    Some folks lean toward the newest, shiniest antivirus protection, while others prefer a mature program that’s had plenty of time to shake out any weaknesses. G Data Antivirus is a full-grown utility with several security bonuses. It’s just the thing for those seeking a well-aged antivirus tool.

    • PROS

      • Excellent score in our hands-on malware protection test
      • Protects against banking Trojans, keyloggers, ransomware, and exploits
      • Includes spam filter

    • CONS

      • Mixed scores in independent lab tests

    GET IT NOW

    LEARN MOREG Data Antivirus Review
  • Malwarebytes Premium

    Malwarebytes Premium

    Best for Speedy Scans
    4.0 EXCELLENT

    Why We Picked It

    For years, the cleanup-only Malwarebytes Free has been the go-to solution when your regular antivirus can’t do the job, but it was always a specialty tool, not for everyday use. On the other hand, Malwarebytes Premium offers all the features you expect in a full-scale antivirus, starting with scanning on demand and schedule, as well as on-file access. Its full scan is speedy and uses various real-time protection techniques, including behavior-based detection, ransomware activity detection, and protection against exploit attacks.

    It’s true that lab results for Malwarebytes are mixed, some great, some so-so. The company contends that its advanced detection techniques aren’t a perfect fit for standardized tests. In our own hands-on tests, it proved highly effective, earning a rare 10 of 10 points for malware protection and excellent scores for defending against malicious and fraudulent web pages.

    Who It’s For

    Anyone who’s used Malwarebytes Free to remedy another antivirus tool’s slip-up will appreciate the full-powered Malwarebytes Premium. Even if you never needed that kind of rescue, this app’s speedy scan and excellent hands-on test results are a big draw.

    • PROS

      • Top score in our hands-on malware protection test
      • Excellent protection against malicious and fraudulent sites
      • Very good scores from independent labs

    • CONS

      • No features beyond basic antivirus

    GET IT NOW

    LEARN MOREMalwarebytes Premium Review
  • McAfee AntiVirus

    McAfee AntiVirus

    Best for One-PC Households
    4.0 EXCELLENT

    Why We Picked It

    McAfee no longer offers the cross-platform antivirus protection of McAfee AntiVirus Plus, but the basic McAfee AntiVirus is a powerful choice for a single Windows PC. Single is an important word here, as you don’t find the usual volume discounts for three, five, or 10 licenses. You must buy the software again for each new device you want to protect.

    The independent labs adore McAfee’s malware-fighting technology. Three of the four labs we follow include McAfee in their analysis, and all three award it their maximum possible score. It earned excellent scores in our hands-on tests, too. And it goes beyond basic antivirus features with a ransomware protection system, a simple firewall, a system to foil cryptojacking, and more.

    Who It’s For

    With the shift from unlimited protection on all platforms to securing a single Windows PC, McAfee AntiVirus appeals to a different audience than its predecessor. But there are people out there who just want to protect that one all-important PC. If you’re one of them, you should give McAfee a look.

    • PROS

      • Perfect lab test scores
      • Excellent scores in our hands-on tests
      • Virus protection pledge

    • CONS

      • Missed one hand-tweaked ransomware sample
      • Windows-only protection with no volume discount
      • Many long-standing features now absent

    GET IT NOW

    LEARN MOREMcAfee AntiVirus Review
  • Norton AntiVirus Plus

    Norton AntiVirus Plus

    Best for Antivirus From a Well-Known Brand
    4.0 EXCELLENT

    Why We Picked It

    Quick, name three antivirus companies. Was one of them Norton? Probably. Norton’s antivirus prowess has developed over decades, and Norton AntiVirus Plus is the pinnacle of that evolution. It gets good scores from the independent labs and aces our hands-on tests, including a test using a dozen real-world ransomware samples.

    There’s more to this program than just antivirus, too. Its firewall protects against outside attacks and betrayal from within without bombarding the unsuspecting user with confusing popup queries. A separate module enhances firewall protection by detecting and blocking exploit attacks. Other bonus features include a backup system that can archive your files locally or in the provided online storage, a spam filter for those who still need such a thing, a software updater tool, and more.

    This antivirus has been a one-device wonder, protecting just a single Windows system. By observation, you can now get a five-device license, which you can use to protect Windows, macOS, Android, and iOS devices. That makes this app even more inviting.

    Who It’s For

    Norton’s technology has been fighting viruses and other malware for ages, dating back to MS-DOS days. If you want protection from a known brand that has established its chops over decades, Norton AntiVirus Plus is just what you need.

    • PROS

      • Excellent scores in independent lab tests and our hands-on tests
      • Data Protector foils ransomware attacks
      • New Software Updater
      • Enhanced My Norton Dashboard
      • Online backup enabled out of the box
      • Includes many bonus security features

    • CONS

      • Expensive
      • No multi-license pricing
      • Rare poor score in phishing test

    GET IT NOW

    LEARN MORENorton AntiVirus Plus Review
  • Sophos Home Premium

    Sophos Home Premium

    Best for Thrifty Users
    4.0 EXCELLENT

    Why We Picked It

    Sophos is a big name in business-level antivirus, with remote management to keep the IT team in charge of security. Sophos Home Premium brings that same remote management to you, the consumer. You can install antivirus protection for your family and friends, whether they’re across town or across the country, and manage all the installations without leaving your lair. Best of all, it’s seriously inexpensive, with a 10-license price that matches what many competitors charge for just three licenses.

    This antivirus only has one recent lab test score, but it’s a good one—AAA certification from SE Labs. In our hands-on malware protection test, it managed 100% detection and scored 9.9 of 10 possible points. It also earned 100% for defending against malware-hosting web pages. But its protection doesn’t stop there. Packed into its tiny local agent program are effective ransomware protection, defense against exploit attacks, an admittedly less-effective parental control content filter, protection for your financial transactions, webcam hijack prevention, and more.

    As noted, you can manage all your installations from a convenient online console. More recently, Sophos has extended that remote control ability to apps for Android and iOS, meaning you can exercise your remote control powers from anywhere.

    Who It’s For

    Are you the default security expert for your extended family or circle of friends? Are you tired of driving across town to rescue your beloved uncle after he clicked something he shouldn’t have? With Sophos Home Premium, you can take good care of your peeps from wherever you happen to be.

    • PROS

      • Excellent scores in some hands-on tests
      • Convenient app for mobile security management
      • Protects against ransomware, keyloggers, exploits
      • Remotely manages up to 10 PCs or Macs
      • Inexpensive

    • CONS

      • Limited results from testing labs
      • Parental control and webcam protection limited
      • So-so phishing test score
      • Advanced features require uncommon tech expertise

    GET IT NOW

    LEARN MORESophos Home Premium Review
  • Webroot AntiVirus

    Webroot AntiVirus

    Best for a Small Footprint
    4.0 EXCELLENT

    Why We Picked It

    Without question, Webroot SecureAnywhere AntiVirus is the smallest antivirus we’ve seen. Back when diskettes were standard, you could fit it on just one. Webroot’s local presence can be tiny because its intelligence is in the cloud. Like most antivirus tools, it wipes out known malware on sight, but unknowns get special treatment. It sends details about any unknown program to the cloud and lets that program run in a bubble, virtualizing any system changes so they don’t become permanent. Cloud analysis can take a little time, but if it determines the program is malicious, Webroot wipes out the program itself and rolls back any system changes.

    However, this delayed-action detection isn’t a good fit for most standardized tests. The labs mostly expect that an antivirus will determine immediately or not at all. Webroot’s presence in lab reports is sporadic, with a wide range of scores. But in our hands-on tests, it routinely earns excellent scores.

    Who It’s For

    Some of Webroot’s advanced features require above-average expertise, so it doesn’t hurt if you’re the security expert for your family or circle of friends. Whether you’re an expert or not, you’re sure to appreciate its tiny size and ultra-fast scans.

    • PROS

      • Fast scan, tiny size
      • Light on system resources
      • Can remediate ransomware damage
      • Advanced features

    • CONS

      • No longer offers remote monitoring and configuration
      • Imperfect protection against hand-modified ransomware
      • Limited lab test results
      • Advanced features require uncommon expertise
      • No volume discount
      • Firewall settings can be confusing

    GET IT NOW

    LEARN MOREWebroot AntiVirus Review
  • Total Defense Essential Anti-Virus

    Total Defense Essential Anti-Virus

    Best for No-Frills Protection
    3.5 GOOD

    Why We Picked It

    Some antivirus apps include so much additional security software they are nearly suites. On the other hand, Total Defense Essential Anti-Virus sticks to the core tasks of an antivirus utility: scanning for malware on demand, on schedule, and on file access. The time for a Total Defense full scan came in about average, but a second scan cut 90% off of that thanks to optimization.

    Total Defense has received top scores from testing lab AV-Comparatives in past years. Its three current scores range from Advanced+ (the best) to standard. That’s still better than the numerous competitors with no lab scores at all. In our hands-on tests, it earned scores from very good to excellent, proving particularly adept at detecting and defending against malicious and fraudulent websites.

    Who It’s For

    Total Defense Essential Anti-Virus is a good option if you want an inexpensive, speedy antivirus tool that does its job without making a fuss.

    • PROS

      • Excellent test scores against malicious and fraudulent websites
      • Very good score in our hands-on malware protection test
      • Virus free guarantee

    • CONS

      • Few test results from independent labs
    GET IT NOW
    LEARN MORETotal Defense Essential Anti-Virus Review
  • Trend Micro Antivirus+ Security

    Trend Micro Antivirus+ Security

    Best for Single-PC Protection
    3.5 GOOD

    Why We Picked It

    Though it originated in Los Angeles, Trend Micro is now a global security corporation based in Japan, and it has acquired many other security businesses over the years. Its collective technology makes Trend Micro Antivirus+ Security more than just an antivirus. Among other components, Trend Micro features Pay Guard to protect your financial transactions; a Firewall Booster; spam filtering with a separate Fraud Buster component; multi-layered ransomware protection; a detector for unauthorized cryptocurrency mining, and markup of dangerous links in search results and social media.

    But does it work? Results vary. AV-Test has frequently honored Trend Micro with a perfect score, though it dipped in the latest report. Past evaluations by SE Labs certified it at the top AAA level. It failed one of three tests from AV-Comparatives, though. And it also failed two admittedly difficult tests by MRG-Effitas. On the plus side, it earned perfect scores in our tests of defense against malicious and fraudulent websites.

    This is a single-device antivirus with no volume discounts. If you want a multi-device license from Trend Micro, you’ll have to opt for one of its suite programs.

    Who It’s For

    Don’t turn to Trend Micro Antivirus+ Security to protect a house full of computing devices. That’s not what it’s for. Instead, install it on that one essential computer on which you spend your work hours and playtime.

    • PROS

      • Perfect score in our antiphishing test
      • Perfect score against malware-hosting pages
      • Layered ransomware protection
      • Multifaceted browser extension
      • Many bonus features

    • CONS

      • Tanked our hands-on malware protection test
      • Some failures in independent lab tests
      • Social network protection choices dated
      • No multi-device volume licensing

    GET IT NOW

    LEARN MORETrend Micro Antivirus+ Security Review

Buying Guide: The Best Antivirus Software for 2023

 

What Are Viruses, Malware, and Ransomware?

We call it antivirus, but in truth, it’s unlikely you’ll get hit with an actual computer virus. Malware these days is about making money, and there’s no easy way to cash in on spreading a virus. Ransomware and data-stealing Trojans are much more common, as are bots that let the bot-herder rent out your computer for nefarious purposes. Modern antivirus utilities handle Trojans, rootkits, spyware, adware, ransomware, and more. As noted, PCMag has reviewed more than 40 different commercial antivirus utilities, not counting the many free antivirus tools we’ve looked at. We’ve named an Editors’ Choice antivirus app out of that extensive field and honored others with four-star or better ratings. One of the utilities listed in this article should address the problem if you have malware.

What About Windows Defender?

These commercial apps offer protection beyond the antivirus built into Windows. However, Microsoft Defender Antivirus is looking better and better lately, with some solid scores from independent testing labs. The combination of good lab scores and a great score in our hands-on malware protection test was enough to bring its rating up to 3.5 stars. As a free, built-in utility, however, we’re not including it in this roundup of commercial antivirus apps.

We Listen to the Antivirus Testing Labs

We take the results reported by independent antivirus testing labs seriously. The simple fact that a company’s antivirus shows up in the results is a vote of confidence, of sorts. It means the lab considered the program significant, and the company felt the cost of testing was worthwhile. Of course, high scores in the tests are also important.

We follow four labs that regularly release detailed reports: SE Labs, AV-Test Institute, MRG-Effitas, and AV-Comparatives. We’ve devised a system for aggregating their results to yield a rating from 0 to 10.

How We Test Malware, Spyware, and Adware Defenses

We also subject every antivirus app to our own hands-on test of malware protection, in part to get a feeling for how the app works. Depending on how thoroughly the antivirus prevents malware installation, it can earn up to 10 points for malware protection.

Our malware protection test necessarily uses the same set of samples for months. To check a program’s handling of brand-new malware, we test each antivirus using a large collection of extremely new malware-hosting URLs supplied by MRG-Effitas, noting what percentage of them it blocked. Apps get equal credit for preventing all access to the malicious URL and for wiping out the malware during download.

Some apps earn stellar ratings from the independent labs yet don’t fare as well in our hands-on tests. In such cases, we defer to the labs, as they bring significantly greater resources to their testing. Want to know more? You can dig in for a detailed description of how we test security software.

What’s the Best Antivirus for Malware Protection?

Antivirus utilities distinguish themselves by going beyond the basics of on-demand scanning and real-time malware protection. Some rate URLs that you visit or that show up in search results using a red-yellow-green color-coding system. Some actively block processes on your system from connecting with known malware-hosting URLs or with fraudulent (phishing) pages.

All software has flaws, and sometimes those flaws affect your security. Prudent users keep Windows and all programs patched, fixing those flaws as soon as possible. The vulnerability scan offered by some antivirus apps can verify all necessary patches are present and even apply any that are missing.

Spyware comes in many forms, from hidden programs that log your every keystroke to Trojans masquerading as valid programs while mining your data. Any antivirus should handle spyware, along with all other types of malware, but some include specialized components devoted to spyware protection.

You expect an antivirus to identify and eliminate bad programs and leave good programs alone. What about unknowns, programs your AV can’t identify as good or bad? Behavior-based detection can, in theory, protect you against malware, so new researchers have never encountered it. However, this isn’t always an unmixed blessing. It’s not uncommon for behavioral detection systems to flag many innocuous behaviors performed by legitimate programs.

Allowlisting is another approach to the problem of unknown programs. This type of security system only allows known good programs to run. Unknowns are banned. This mode doesn’t suit all situations, but it can be useful. Sandboxing lets unknown programs run, but it isolates them from full access to your system so they can’t do permanent harm. These various added layers serve to enhance your protection against malware.

Where Did Kaspersky Go?

Kaspersky Anti-Virus topped the antivirus lab testing charts for many years, garnering perfect or near-perfect scores. It has also held PCMag’s Editors’ Choice honor for countless years. It’s both attractive and effective. And it no longer appears in our list of best antivirus apps. Here’s why.

For years, Kaspersky has faced accusations and censure based on its Russian origins, though none of the allegations have come backed by hard evidence of malicious behavior. We at PCMag focused on the capabilities of the apps, not on the brouhaha around the company. However, the current war in Ukraine has raised the stakes. Governments and third parties have cut ties with Kaspersky. The FCC labeled Kaspersky a national security risk.

After consideration, we can no longer recommend you purchase Kaspersky security programs. We’ve left the reviews in place, with a warning, since they provide useful information. But, at least for now, we’re removing Kaspersky programs from our “Best of” lists.

What’s the Best Antivirus for Ransomware Protection and Firewalls?

Firewalls and spam filtering aren’t common antivirus features, but some of our top picks include them as bonuses. Some of these antivirus programs are even more feature-packed than certain security suites.

Among the other bonus features you’ll find are secure browsers for financial transactions, secure deletion of sensitive files, wiping traces of computer and browsing history, credit monitoring, virtual keyboards to foil keyloggers, cross-platform protection, and more. And, of course, we’ve already mentioned sandboxing, vulnerability scanning, and application allowlisting.

We’re seeing more and more antivirus apps adding modules specifically designed for ransomware protection. Some work by preventing unauthorized changes to protected files. Others keep watch for suspicious behaviors that suggest malware. Some even aim to reverse the damage. Given the growth of this scourge, any added protection is beneficial.

Beyond Antivirus: Install a VPN

Your antivirus utility works in the background to keep out any faint possibility of infestation by malware, but its abilities don’t extend beyond the bounds of your computer. When you connect to the wild and wooly internet, you risk the possibility your data could be compromised in transit. Sticking to HTTPS websites when possible can help, but for full protection of your data in transit, you should install a VPN (virtual private network). This component is important enough that we’re starting to see it as a bonus feature in some antivirus tools.

What Is the Best Antivirus?

Which antivirus should you choose? While you have a wealth of options, one stands out from the rest. Bitdefender Antivirus Plus routinely takes perfect scores from four independent antivirus testing labs, and it has more features than some security suites, among them password management, multi-layered ransomware protection, a hardened browser for online banking, and a secure deletion file shredder. We’ve named Bitdefender Editors’ Choice for commercial antivirus, but it’s not the only antivirus app worth consideration. Read the reviews of our top-rated programs, and then make your own decision.

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
Uncategorized

Elon Musk: Social media platform X, formerly Twitter, could go behind paywall

Linkedin

Elon Musk: Social media platform X, formerly Twitter, could go behind paywall

By James Clayton
North America technology reporter
 

Elon Musk has suggested that all users of X, formerly called Twitter, may have to pay for access to the platform.

In a conversation with Israeli Prime Minister Benjamin Netanyahu, the billionaire said a payment system was the only way to counter bots.

“We’re moving to having a small monthly payment for use of the system,” the Tesla and SpaceX boss said.

The BBC approached X for further details but has not yet received a statement from the company.

 

It is unclear whether this was just an off-the-cuff comment, or a signal of firmer plans that have yet to be announced.

Mr Musk has long said that his solution for getting rid of bots and fake accounts on the social media platform is charging for verification.

 

Since taking over Twitter last year he has looked to incentivise users to pay for an enhanced service, which is now called X Premium.

This has been done by giving paid subscribers more features, like longer posts and increased visibility on the platform.

However, users can currently still use X for free.

Although there is a clear financial interest for the company to charge users, Mr Musk insisted that getting people to pay for the service is aimed at tackling bots.

“A bot costs a fraction of a penny” to make he said. “But if somebody even has to pay a few dollars or something, some minor amount, the effective cost to bots is very high”.

X Premium currently costs $8 (£6.50) a month in the US. The price differs depending on which country a subscriber is in.

 

The world’s richest person said that he was now looking at cheaper options for users.

“We’re actually going to come up with a lower tier pricing. So we just want it to be just a small amount of money,” he said.

“This is a longer discussion, but in my view, this is actually the only defence against vast armies of bots,” Mr Musk added.

However, a risk is that by putting X behind a paywall it may lose a large chunk of its users. That in turn, could drive down advertising revenue, which currently accounts for the vast majority of the company’s income.

Mr Musk’s conversation with the Israeli prime minister also touched on antisemitism on X.

The platform has been accused by the Anti-Defamation League (ADL) campaign group of not doing enough to stop antisemitic content.

 

In a statement, the organisation said that Mr Musk was “engaging with and elevating” antisemites.

Earlier this month, he said that the company would sue the ADL to “clear our platform’s name”.

In the conversation with Mr Netanyahu, Mr Musk reiterated that he was “against antisemitism”.

Mr Netanyahu accepted the balance between free speech and content moderation was a challenge but urged Mr Musk to get the balance right.

“I hope you find within the confines of the First Amendment, the ability to stop not only antisemitism… but any collective hatred of people that antisemitism represents,” he said.

“I know you’re committed to that”, Mr Netanyahu added.

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
Uncategorized

The race against time in ransomware attacks

Ransomware red button on keyboard, 3D rendering
Linkedin

The race against time in ransomware attacks

Most organizations lack strong cyber resilience strategies or data security capabilities to address threats and maintain business continuity, according to BigID.

Despite both the rise in threats and the high percentage of respondents whose organizations suffered recent attacks, there hasn’t been a corresponding uptick in strategic measures to shore up cyber resilience.

In fact, close to four in five survey respondents don’t have complete confidence that their company has a cyber resilience strategy designed to address today’s escalating cyber challenges and threats.

Critical business data at risk due to ransomware

And it’s not just about confidence. Organizations need cyber resilience and data security capabilities in place, too—to recover data and restore business operations and to do so fast.

When asked about the threat of ransomware, 40% of last year’s respondents said “failure to recover data” worried them—even if their data was backed up. This year, 67% lack full confidence their company could recover data and critical business processes in the event of a system-wide cyberattack.

When asked how long, on average, it would take their company to restore data and business processes if a cyberattack occurred:

  • 95% said it would take over 24 hours
  • 71% said it would take over 4 days
  • 41% said it would take over a week

And in a ransomware attack, every minute matters. The longer a business is down and its data is inaccessible, the greater the risk for serious, and often immediate, downstream impacts.

Companies open to paying ransom

When 95% can’t recover data and business processes within 24 hours, not only are organizations vulnerable, but they’re more willing to make choices that may incentivize future industry attacks. Choices that include paying a ransom.

Although paying a ransom is generally considered an action of last resort, 90% of global survey respondents said their organization would—some unequivocally, some depending on the cost consider paying a ransom if it meant they could recover data and business processes, or recover them faster.

With cybercrime predicted to cost the world $8 trillion annually ($10.5 trillion by 2025), more companies are trying to secure financial protection against losses from cyberattacks, data breaches, and other cyber-related incidents. They’re turning to cyber insurance as one of their protection strategies.

According to 87% of respondents, data and cybersecurity vendors must collaborate to provide complete and integrated anti-ransomware solutions. When vendors work towards a common goal of defeating ransomware and creating integrated solutions that support clean recovery efforts, organizations reap the benefits. Greater cyber resilience is better for them, better for the customers they serve, and better for their industries.

A comprehensive approach to data security

“It’s not a surprise that over half of organizations still struggle with securing data in the cloud. The reality is most organization’s data is scattered across different environments and varies by type,” said Tyler Young, CISO of BigID.

“Companies cannot afford to be offline and unable to maintain operations, especially for more than a day. However, the stark reality is that many organizations are vulnerable to leverage from cyber criminals because they are incapable of rapidly recovering their data and business processes when necessary,” said Brian Spanswick, CISO and head of IT, Cohesity. “Therefore, it’s no surprise that 9 in 10 respondents also said their business would consider paying a ransom to maintain continuity.”

When an organization gets hit by ransomware, and data is stolen, wiped, infected, or otherwise compromised, that organization can’t properly function until its data, processes, operations, and applications are restored. Making sure this recovery is clean, and happens fast, is critical to business resilience.

Given this reality, a comprehensive approach to data security and management is the best offense against continuing worldwide threats.

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
Uncategorized

New Vulnerabilities Disclosed in SonicWall and Fortinet Network Security Products

Linkedin

New Vulnerabilities Disclosed in SonicWall and Fortinet Network Security Products

SonicWall on Wednesday urged customers of Global Management System (GMS) firewall management and Analytics network reporting engine software to apply the latest fixes to secure against a set of 15 security flaws that could be exploited by a threat actor to circumvent authentication and access sensitive information.

Of the 15 shortcomings (tracked from CVE-2023-34123 through CVE-2023-34137), four are rated Critical, four are rated High, and seven are rated Medium in severity. The vulnerabilities were disclosed by NCC Group.

The flaws impact on-premise versions of GMS 9.3.2-SP1 and before and Analytics 2.5.0.4-R7 and before. Fixes are available in versions GMS 9.3.3 and Analytics 2.5.2.

“The suite of vulnerabilities allows an attacker to view data that they are not normally able to retrieve,” SonicWall said. “This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.”

The list of critical flaws is as follows –
  • CVE-2023-34124 (CVSS score: 9.4) – Web Service Authentication Bypass
  • CVE-2023-34133 (CVSS score: 9.8) – Multiple Unauthenticated SQL Injection Issues and Security Filter Bypass
  • CVE-2023-34134 (CVSS score: 9.8) – Password Hash Read via Web Service
  • CVE-2023-34137 (CVSS score: 9.4) – Cloud App Security (CAS) Authentication Bypass

The disclosure comes as Fortinet revealed a critical flaw affecting FortiOS and FortiProxy (CVE-2023-33308, CVSS score: 9.8) that could enable an adversary to achieve remote code execution under certain circumstances. It said the issue was resolved in a previous release, without an advisory.

“A stack-based overflow vulnerability [CWE-124] in FortiOS and FortiProxy may allow a remote attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection,” the company said in an advisory.

Impacted products include FortiOS versions 7.2.0 through 7.2.3 and 7.0.0 through 7.0.10 as well as FortiProxy versions 7.2.0 through 7.2.2 and 7.0.0 through 7.0.9. The versions that plug the security hole are listed below –

  • FortiOS version 7.4.0 or above
  • FortiOS version 7.2.4 or above
  • FortiOS version 7.0.11 or above
  • FortiProxy version 7.2.3 or above, and
  • FortiProxy version 7.0.10 or above

It’s worth noting that the flaw does not impact all versions of FortiOS 6.0, FortiOS 6.2, and FortiOS 6.4, and FortiProxy 1.x and FortiProxy 2.x.

For customers who cannot apply the updates immediately, Fortinet is recommending that they disable HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode.

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
Uncategorized

CISA Flags 8 Actively Exploited Flaws in Samsung and D-Link Devices

Linkedin

CISA Flags 8 Actively Exploited Flaws in Samsung and D-Link Devices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed a set of eight flaws to the Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

This includes six shortcomings affecting Samsung smartphones and two vulnerabilities impacting D-Link devices. All the flaws have been patched as of 2021.

  • CVE-2021-25394 (CVSS score: 6.4) – Samsung mobile devices race condition vulnerability
  • CVE-2021-25395 (CVSS score: 6.4) – Samsung mobile devices race condition vulnerability
  • CVE-2021-25371 (CVSS score: 6.7) – An unspecified vulnerability in the DSP driver used in Samsung mobile devices that allows loading of arbitrary ELF libraries
  • CVE-2021-25372 (CVSS score: 6.7) – Samsung mobile devices improper boundary check within the DSP driver in Samsung mobile devices
  • CVE-2021-25487 (CVSS score: 7.8) – Samsung mobile devices out-of-bounds read vulnerability leading to arbitrary code execution
  • CVE-2021-25489 (CVSS score: 5.5) – Samsung Mobile devices improper input validation vulnerability resulting in kernel panic
  • CVE-2019-17621 (CVSS score: 9.8) – An unauthenticated remote code execution vulnerability in D-Link DIR-859 Router
  • CVE-2019-20500 (CVSS score: 7.8) – An authenticated OS command injection vulnerability in D-Link DWL-2600AP

The addition of the two D-Link vulnerabilities follows a report from Palo Alto Networks Unit 42 last month about threat actors associated with a Mirai botnet variant leveraging flaws in several IoT devices to propagate the malware in a series of attacks beginning in March 2023.

However, it’s not immediately clear how the flaws in Samsung devices are being exploited in the wild. But given the nature of the targeting, it’s likely that they may have been put to use by a commercial spyware vendor in highly targeted attacks.

It’s worth noting that Google Project Zero disclosed a set of flaws in November 2022 that it said were weaponized as part of an exploit chain aimed at Samsung handsets.

In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply necessary fixes by July 20, 2023, to secure their networks against potential threats.

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
Uncategorized

The top five cloud cybersecurity threats – and what to do about them

Linkedin

The top five cloud cybersecurity threats – and what to do about them

Cybersecurity threats continue to plague cloud infrastructures, and sadly these threats are still mostly the same from years’ past.

But just because these threats continue doesn’t mean that cloud security, taken as a whole tapestry, isn’t as secure as on-premises equipment. That debate — which seems to have spanned a decade or more — should be put to rest forever. Two things many information technology managers have learned are that data center technology doesn’t age well, and it also accumulates tremendous technical debt, the implied cost of future reworking required when problems need to be fixed or approaches become less useful over time.

Take the case of the Southwire Co. LLC, which makes electrical cabling — ironically, the kind of cabling that is installed in hyperscale cloud facilities. The 70-plus-year-old company has about two-thirds of its infrastructure mostly in Google Cloud, and that proportion continues to increase.

“We are now focused on a cloud-first direction,” Southwire Chief Information Officer Dan Stuart told SiliconANGLE. “We realized that the cloud was more secure in general, and we were able to better segregate and secure our operational technology that we have on our shop floors from our overall IT infrastructure.” Stuart pointed out the intrinsic security controls that Google Cloud Platform uses, supplemented with Palo Alto Networks Inc.’s Prisma Cloud products.

But despite these generalities, securing the cloud is all about the details, and getting these right will take some effort.

In this analysis, we present five broad categories, describe some of the more notable exploits of the recent past, and provide recommendations for how to avoid them in the future. To compile this data, we used several reports, including Wiz Inc.’s State of the Cloud for 2023, based on scans of more than 200,000 cloud customer accounts, the Cloud Security Alliance’s Top Threats to Cloud Computing survey of 700 industry experts in June 2022, and Palo Alto Networks’ Unit42 Cloud Threat Report using data from tens of thousands of sensors across their customers’ networks in April 2023.

Here’s what organizations looking to protect their cloud infrastructure need to consider:

Securing cloud APIs and preventing data leaks can be harder

Cloud providers are constantly adding new cloud services, and with those services come bushels full of new application programming interfaces to connect them together. For example, according to the Wiz report, Amazon Web Services Inc. has added APIs at a steady pace, with about 40 new services and 1,600 new actions per year for the past six years. Moreover, the CSA report notes that “APIs and microservices must be checked for vulnerabilities due to misconfiguration, poor coding practices, a lack of authentication and inappropriate authorization.”

But tracking the way APIs are consumed by applications, configuring them properly and ultimately securing them is hard, as Peloton found out a few years ago when its leaky API exposed private data of its customers. Although it did scan its applications for potential vulnerabilities, it chose to ignore the recommendations of the security firm that found them.

“Leaked credentials are also central to every cloud breach we analyzed,” said Unit 42’s report. Finding and eliminating hard-coded access credentials becomes a lot more difficult when you have dozens of different cloud services and thousands of virtual machine instances to examine.

Why do these hard-coded credentials still exist? Mainly because of lazy DevOps practices, such as providing full access rights to the entire enterprise source code repositories. Unit 42’s report found that more than 80% of their customers used hard-coded credentials in their source control management tools.

The fix

The best way to eliminate hard-coded credentials is to scan code at runtime. There are a number of secret management tools such as HashiCorp Vault and Cloudflare Inc.’s Secrets Store. “In order for developers to build at high velocity and for security administrators to feel at ease, companies need to adopt a highly reliable and secure secrets manager,” said Cloudflare Inc. product manager Dina Kozlov. That is a good first step.

There is also a new service from Trail of Bits called trusted publishing that helps authenticate code being posted to open-source repositories by using more trusted credentials. “Trusted publishing eliminates the need for long-lived API tokens and passwords, reducing the risk of supply chain attacks and credential leaks while also streamlining release workflows. Critical packages on PyPI are already using trusted publishing to make their release processes more secure,” according to its announcement.

In addition, Netskope Inc. has a series of recommendations in its latest threat report that can help stop some of these leaks, such as better inspection of downloaded files to prevent malware intrusions and blocking downloads entirely from untrusted or unused apps and from newly minted domains and risky file types.

SQL injection and cross-site scripting attacks are still happening

I wrote my first story about the perils of SQL injection more than 20 years ago, and even demonstrated how anyone using a simple Google search could pull this off. Sadly, things haven’t changed. Unit42’s report found these two old chestnuts are still ranked in the top three most disclosed types of vulnerabilities in their report.

In this pie chart (adjacent) they show the total universe of disclosed vulnerabilities last year, with the red slices highlighting ones that are relevant to web or API applications. The report points out that the growth of these exploits continues and mentions the now-infamous web-based attacks on SolarWinds that continue to this day: “Even a year after its first disclosure, we still see an increasing trend of exploitation attempts,” the authors wrote.

The fix

Securing against these exploits is easy enough to talk about: Have better input screening, understand your app infrastructure, monitor and firewall network egress traffic, and use better DNS security to block potentially malicious domains, recommendations that Netskope mentioned in its report. However, these basic tactics are notoriously difficult to universally deploy, as the number of SQLi and XSS exploits demonstrate.

Cloud breaches require different tools and methods than on-premises

Securing a cloud estate requires need different tools and techniques than securing on-premises equipment. “Traditional digital forensics and incident response techniques are not designed to handle cloud breaches because the tooling, processes, and data sources necessary for investigating security incidents are very different between on-premises and cloud environments,” said Unit42’s report.

It cites the average time to resolve a security alert across all its customers is about six days, with half of them taking more than four days. “This represents a lengthy window of opportunity for potential adversaries to exploit a newly discovered vulnerability,” the authors wrote.

But six days is even a conservative figure. Consider a recent announcement from Toyota. It announced that data of more than 2 million customers has been available online for more than 10 years because of a misconfigured cloud storage bucket. And Barracuda Networks Inc. has had its own breach since last October and only recently found and fixed it.

The fix

Implementing a fix here isn’t simple. We just need better tools that are designed from the ground up with the cloud assets in mind. Should organizations focus on API and credentials, shared code supply chains, insecure services and containers, exposed databases? Maybe all of the above.

One solution is this cloud-based anomaly detection system using Bytewax and Redpanda for an AWS cloud collection. Another is a new Red Hat Inc. service to improve things called Trusted Software Supply Chain. And though many security teams employ honeynets to help spot and stop intrusions, a better mousetrap could be this interesting development on the use of what is called honey tokens in software supply chains.

Cloud infrastructure protection has a different ownership model

Cloud providers often cite that infrastructure security means understanding the split concerning who owns what between the customer and the provider, as discussed in a post on CSOonline. That is a complete cop-out, and one of the reasons why there are still issues with cloud security.

The problem with a shared-ownership security model is that the lines are blurred for how this sharing takes place, and exploits and disasters result from when there are mistakes in communication and responsibilities. Also, “ensuring each developer understands its company’s assumptions of shared responsibilities with the cloud provider requires education,” as the CSA report illustrates in its discussion of who applies software patches and other mitigations once a vulnerability has been discovered.

Take the 2019 case of a breach of Capital One’s AWS infrastructure by a malicious insider, as examined in detail in this post on Diginomica written by Kurt Marko. Capital One had misconfigured some firewall rules on AWS, but AWS also shares some blame because of how its cloud services setup that made them vulnerable to server-side request forgeries.

The fix

To make the shared-responsibility model work properly, those blurry lines need better resolution and careful delineation. The CSOonline post provides some solid suggestions on how to obtain more clarity. Playbooks on patching and scanning for potential problems should lay out exactly who does what and when, and these roles should be practiced in tabletop security exercises too.

Cloud identity and access has numerous issues that require careful implementation

Finally, there’s perhaps the most vexing issue with cloud security: the numerous ways identity and access management can make or break security. This issue topped the CSA threat list, and numerous analysts have continued to highlight the problem over the years.

Sure, the news will continue to focus on insecure cloud storage buckets, but the real problems run much deeper. For example, how organizations roll out multifactor authentication matters, if it’s even used at all.

Unit 42’s report found that more than half of its customers don’t enforce MFA for users with admin rights on their main web cloud consoles that manage their entire infrastructure. Then there is the issue of which particular MFA tech should be used for the additional factors, such as hardware keys, passkeys and biometrics. Although most experts agree on what organizations need to steer clear of — such as SMS onetime passwords — the devil is in the details.

Certainly the move toward working from home has made identity management more complex, putting more of a burden on the information technology department to verify employees, customers and partners.

The fix

The best step forward toward getting the identity problem under control should be using a cloud-native application protection platform. That post also outlines some specific tactics to improve identity management.

The bottom line: There is a lot more work to do to secure an entire cloud estate. And these are just five broad categories that aren’t necessarily exclusive or exhaustive.

As Chris Vickery, a senior risk assessment specialist at Backblaze Inc., told SiliconANGLE, “There’s a common rule of thumb that has not changed: Any software, with a sufficiently large number of users that can be misconfigured will be misconfigured by some percentage of those users. The legacy cloud platforms have not yet addressed this inescapable reality.”

So how can those threats be reduced? Vickey recommends as one mechanism having better ways for outside researchers to report potential problems to an enterprise’s security team.

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
Uncategorized

Cisco sets a foundation for AI network infrastructure

Linkedin

Cisco sets a foundation for AI network infrastructure

Cisco is taking the wraps off new high-end programmable Silicon One processors aimed at underpinning large-scale Artificial Intelligence (AI)/Machine Learning (ML) infrastructure for enterprises and hyperscalers.

The company has added the 5nm 51.2Tbps Silicon One G200 and 25.6Tbps G202 to its now 13-member Silicon One family that can be customized for routing or switching  from a single chipset, eliminating the need for different silicon architectures for each network function. This is accomplished with a common operating system, P4 programmable forwarding code, and an SDK.

The new devices, positioned at the top of the Silicon One family, bring networking enhancements that make them ideal for demanding AI/ML deployments or other highly distributed applications, according to Rakesh Chopra, a Cisco Fellow in the vendor’s Common Hardware Group.

“We are going through this huge shift in the industry where we used to build these sorts of reasonably small high-performance compute clusters that seemed large at the time but nothing compared to the absolutely huge deployments required for AI/ML,” Chopra said. AI/ML models have grown from needing a few GPUs to needing tens of thousands linked in parallel and in series. “The number of GPUs and the scale of the network is unheard of.”

The new Silcon One enhancements include a P4-programmable parallel-packet processor capable of launching more than 435 billion lookups per second.

“We have a fully shared packet buffer where every port has full access to the packet buffer regardless of what’s going on,” Chopra said. This is in contrast with allocating buffers to individual input and output ports, which means the buffer you get depends on which port the packets go to. “That means that you’re less capable of writing through traffic bursts and more likely to drop a packet, which really decreases AI/ML performance,” he said.

In addition, each Silicon One device can support 512 Ethernet ports letting customers build a 32K 400G GPU AI/ML cluster requiring 40% fewer switches than other silicon devices needed to support that cluster, Chopra said.

Core to the Silicon One system is its support for enhanced Ethernet features such as improved flow control, congestion awareness, and  avoidance.

The system also includes advanced load-balancing capabilities and “packet-spraying” that spreads traffic across multiple GPUs or switches to avoid congestion and improve latency. Hardware-based link-failure recovery also helps ensure the network operates at peak efficiency, the company stated.

Combining these enhanced Ethernet technologies and taking them a step further ultimately lets customers set up what Cisco calls a Scheduled Fabric. 

In a Scheduled Fabric, the physical components—chips, optics, switches—are tied together like one big modular chassis and communicate with each other to provide optimal scheduling behavior, Chopra said. “Ultimately what it translates to is much higher bandwidth throughput, especially for flows like AI/ML, which lets you get much lower job-completion time, which means that your GPUs run much more efficiently.”

With Silicon One devices and software, customers can deploy as many or as few of these features as they need, Chopra said.

Cisco is part of a growing AI networking market that includes Broadcom, Marvell, Arista and others that is expected to hit $10B by 2027, up from the $2B it is worth today, according to a recent blog from the 650 Group.

“AI networks have already been thriving for the past two years. In fact, we have been tracking AI/ML networking for nearly two years and see AI/ML as a massive opportunity for networking and one of the main drivers for data-center networking growth in our forecasts,” the 650 blog stated. “The key to AI/ML’s impact on networking is the tremendous amount of bandwidth AI models need to train, new workloads, and the powerful inference solutions that appear in the market. In addition, many verticals will go through multiple digitization efforts because of AI during the next 10 years.”

The Cisco Silicon One G200 and G202 are being tested by unidentified customers now and are available on a sampled basis, according to Chopra.  

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
news

A ransomware attack is hitting schools, businesses and government agencies. Here’s what you should know

Linkedin

A ransomware attack is hitting schools, businesses and government agencies. Here’s what you should know

A growing number of businesses, universities and government agencies have been targeted in a global cyberattack by Russian cybercriminals and are now working to understand how much data was compromised.

While the scope of the attack is not yet fully known, officials at the US Cybersecurity and Infrastructure Security Agency (CISA) said Thursday that “several federal agencies… have experienced intrusions” and suggested a number of businesses could be impacted as well.

Separately, state agencies said late Thursday that millions of people in Louisiana and Oregon had their data compromised in a security breach. The states did not blame anyone in particular for the hack but federal officials have attributed a broader hacking campaign using the same software vulnerability to a Russian ransomware gang that calls itself Clop.

 

“Nobody knows the full extent of this, and that’s the way these cyber compromises work,” Robert Cattanach, a partner specializing in cybersecurity at the law firm Dorsey & Whitney and a former trial lawyer for the Department of Justice, told CNN Friday. “Once you’re compromised, there begins an arduous process of ‘how far in did they get in?’ and ‘what did they take?’ That’s typically weeks, and sometimes months.”

Here’s what we know so far.

Who has been impacted?

The cyberattack has targeted federal and state agencies.

The Department of Energy said it “took immediate steps” to mitigate the impact of the hack after learning that records from two department “entities” had been compromised. No other federal agencies have confirmed being impacted.

It’s also impacted state governments in Minnesota and Illinois. And on Thursday, state agencies said 3.5 million Oregonians with driver’s licenses or state ID cards had been impacted by a breach as well as anyone with that documentation in Louisiana.

The sprawling attack is hitting private companies, too.

Clop previously claimed credit for a hack that compromised employee data at the BBC and British Airways. The companies have confirmed suffering a cybersecurity incident, which came via a breach of a human resources firm used by both.

According to Brett Callow, threat analyst at cybersecurity firm Emsisoft, the hackers have also listed Aon and The Boston Globe as victims. “By my count, there are now 63 known/confirmed victims plus an unspecified number of USG agencies,” Callow tweeted. (Aon told CNN that it’s investigating an incident impacting its clients. Representatives for The Boston Globe did not immediately respond to a request for comment.)

The hacking campaign has also spread to academia. Johns Hopkins University in Baltimore and the university’s renowned health system said in a statement that “sensitive personal and financial information,” including health billing records may have been stolen in the hack.

Meanwhile, Georgia’s state-wide university system – which spans the 40,000-student University of Georgia along with over a dozen other state colleges and universities – confirmed it was investigating the “scope and severity” of the hack.

What do we know about the group behind cybersecurity attack?

Clop is a Russian ransomware gang known for demanding multimillion dollar payments from victims before publishing data it claims to have hacked.

Clop previously said it has “information on hundreds of companies,” according to a dark web posting seen by CNN, and asked for victims to contact them about paying a ransom. It later began listing more alleged victims from the hack on their extortion site on the dark web.

Some cybersecurity experts have suggested to CNN that the ransomware group’s decision to ask victims to contact it rather than the other way around shows the gang is “overwhelmed” with the sheer number of companies and organizations impacted by its latest cyberattack.

As of Thursday, instead of listing federal agencies on the dark web list, the hackers wrote in all caps, “If you are a government, city or police service do not worry, we erased all your data. You do not need to contact us. We have no interest to expose such information.”

What happened?

The hackers exploited a vulnerability in MOVEit, a software widely used by companies and agencies to transfer data.

Progress Software, the US firm that makes the software, told CNN on Thursday that a new vulnerability in the software had been discovered “that could be exploited by a bad actor.”

Progress has been warning customers for weeks about security flaws discovered in the software. It released a security advisory in early June that said a vulnerability could let hackers obtain unauthorized access to systems.

What can I do about it?

As always, experts say, consumers should maintain the usual cybersecurity precautions: choosing strong passwords, enabling two-factor authentication and keeping an eye on credit scores, account activity and possible phishing efforts.

But much of the responsibility now lies on businesses and federal agencies rather than individuals, according to Cattanach.

“[The hackers] really aren’t in the business of trying to monetize data on individuals,” he said. “Their focus is two things: holding up for ransom, or extortion, the entities that they’ve been able to compromise, and then just frankly casting doubt in the federal government as to the security of its many federal systems.”

CISA ordered all federal civilian agencies to update the MOVEit software in light of the hack last week. Progress, meanwhile, has released two software patches to remedy the issue and published remediation steps for impacted entities.

However, MOVEit’s vulnerability makes it a target for other bad actors looking to wreak havoc — and experts say other groups may now have access to software code needed to conduct attacks.

Allan Liska, a ransomware expert at cybersecurity firm Recorded Future, told CNN last week: “Unfortunately, the sensitive nature of the data often stored on MOVEit servers means there will likely be real consequences stemming from the [data theft] but it will be months before we understand the full fallout from this attack.”

Copyright © 2023 eLinks sarl. All rights reserved.

info@elinksgroup.com

Linkedin
Categories
news

••• News Release Fortinet Global Report Finds 75% of OT Organizations Experienced at Least One Intrusion in the Last Year

John Maddison, EVP of Products and CMO at Fortinet

“Fortinet is uniquely equipped to deliver industry-leading secure networking solutions that are integrated across SD-WAN, SASE, SD-Branch, ZTNA, and beyond. This allows us to support our partners and their customers in their journey to converging networking and security. What this means for our MSSP partners is the creation of new revenue streams and the opportunity to help customers securely and seamlessly reduce complexity, improve digital experience, and maximize ROI.”

News Summary

Fortinet® (NASDAQ: FTNT), the global cybersecurity leader driving the convergence of networking and security, today announced that 11 new managed security service providers (MSSPs) have adopted Fortinet Secure SD-WAN to help drive better business outcomes and experiences for their customers. Kyndryl; 11:11 Systems; Claro Empresas; Globe Business; InfiniVAN, Inc.; KT Corporation; Neurosoft S.A.; Sify Technologies; SPTel; solutions by stc; and Tata Teleservices join a growing list of service providers across the globe utilizing Fortinet Secure SD-WAN as the foundation for new and differentiated connectivity services without compromising on security.

As MSSPs seek new solutions to stay competitive in the rapidly evolving networking market, Fortinet Secure SD-WAN serves as the foundation for organizations to seamlessly adopt advanced networking technologies including Secure Access Service Edge (SASE), SD-Branch, and Zero Trust Network Access (ZTNA).

Fortinet Secure SD-WAN Helps MSSPs Grow Their Business

The managed SD-WAN market is expected to grow to $8.8 billion in 2026, a compound annual growth rate (CAGR) of 20.2 percent, according to Gartner1.

Service providers are turning to Fortinet secure networking solutions to help capitalize on new business opportunities and address customer needs.

Fortinet secure networking solutions converge networking and security capabilities and are built to be easily expanded across SD-WAN, SASE, SD-Branch, and ZTNA. Fortinet is the only vendor that integrates and manages all functions with a single operating system, FortiOS. This integration across solutions is why MSSPs are partnering with Fortinet to deliver leading managed services.

Fortinet has been recognized by customers and third parties alike for its secure networking solutions.

Fortinet was recently named a Leader in the 2022 Gartner® Magic Quadrant™ for SD-WAN2. Fortinet was also named a Gartner Peer Insights™ Customers’ Choice for SD-WAN3 based on user reviews of our Fortinet Secure SD-WAN solution, and was listed as a Representative Vendor in the 2022 Gartner® Market Guide for Single-Vendor SASE4.

Additionally, a recent commissioned study conducted by Forrester Consulting on behalf of Fortinet analyzed the value that Fortinet Secure SD-WAN can provide to large enterprise customers. The independent Total Economic Impact™ study found that organizations that deployed Fortinet Secure SD-WAN achieved a 300% return on investment over three years with payback in eight months and a 65% reduction in the number of network disruptions, among other benefits.

Here’s what MSSPs who have recently launched managed services using Fortinet’s secure networking solutions have to say:

“As a global leader in managing and modernizing mission-critical information systems for enterprises, selecting the best technology services and partners is imperative for Kyndryl to enable our customers to migrate to the next-generation of networks. Kyndryl’s Fortinet-based managed SD-WAN and SASE services provide consistent connectivity and security and an optimized user experience for the hybrid workforce and cloud environments that are top priorities for organizations today. Kyndryl Consult’s end-to-end advisory services allow our customers to seamlessly realize the full benefits of these network and security technologies, including deployment, management, and integration across their entire IT infrastructure.”
– Paul Savill, Global Practice Leader, Network & Edge, Kyndryl (United States)

“Keeping organizations connected to their mission-critical apps and data continues to grow more complicated as the global work-from-anywhere model becomes the norm. 11:11 Systems helps its customers stay connected through a powerful and secure managed connectivity offering that includes Fortinet Secure SD-WAN. We partner with Fortinet to deliver streamlined application routing, secure connectivity, and a lower total cost of ownership to customers.”
– Justin Giardina, Chief Technology Officer, 11:11 Systems (United States)

“At Claro Empresas, we reinforce the commitment to bring companies the best solutions with increasingly simple and reliable services. Fortinet Secure SD-WAN enables us to provide Honduran companies with a comprehensive solution that will allow them to gain availability, versatility, and security while improving their connectivity services.”
– Rolando Padilla, Corporate Market Manager of Claro Empresas (Honduras)

“Globe Business continues to drive innovation with a digital-first mindset through a collaborative partnership with Fortinet, a leader in secure networking. Beyond expanding our SD-WAN portfolio, this partnership builds a strong foundation for innovation that addresses the critical needs of enterprises in the Philippines, by taking a next-generation approach and converged cybersecurity and networking strategy.”
– Chris Cheng, Vice President for Connectivity and Digital Products for Globe Business, Enterprise Group (Philippines)

“In addition to delivering its high-grade fiber internet connectivity to its clients and partners as a growing telecommunications company in the Philippines, InfiniVAN is committed to providing secured accessibility and connectivity for its customers. Fortinet has never failed in supporting InfiniVAN with cybersecurity intelligence for advanced digital services and solutions. With InfiniVAN expanding telco operations, including network advancement, expansion, and implementation, the need for a cybersecurity solution that meets InfiniVAN’s requirements is a crucial need. Fortinet Secure SD-WAN enables InfiniVAN to innovate its evolving telecommunications services and its growing network operations in the Philippines and across ASEAN countries.”
– Shigeki Nakahara, President, InfiniVAN, Inc.& (Philippines)

“KT Corporation and Fortinet have forged a strategic partnership, uniting the strengths of both companies to deliver cutting-edge solutions to the SD-WAN market. Through this collaboration, we integrate Fortinet’s Secure SD-WAN solution with our extensive network coverage to revitalize the domestic data service market and gain a competitive edge. Fortinet’s innovation in combining sophisticated security and connectivity into a single solution makes them an ideal partner to drive our business ventures. As the largest domestic wired and wireless telecommunications provider in South Korea, we recognize the significant value of partnering with a global leader in the security industry. We anticipate that this collaboration will deliver tangible business results and contribute to our sustained growth.”
– Woon-kyung Kang, Team Leader of Data infra DX new business at KT Corporation (South Korea)

“Neurosoft saw impressive results by providing fully managed, state-of-the-art ICT and cyber services with 24×7 support based on Fortinet’s Secure SD-WAN and FortiSASE solutions. Our customers across sectors such as financial services, telecom, transportation, oil and gas, energy, and retail are using our Business Managed Connectivity Service for their digital transformation strategy. Backed by the power of Fortinet’s Secure SD-WAN and SASE solutions, our customers are able to use our connectivity services to move beyond the day-to-day network infrastructure management to focus on broader business goals and transition from CapEx to OpEx.”
– Nodas Paschalidis, CEO at Neurosoft S.A. (Greece)

“Sify’s SD-WAN services are a major draw in the Indian Enterprise market due to a strong suite of services that maximize value for our customers. Being a leader in the managed network services space, Sify benefits from complementary solutions that easily integrate with our ecosystem that also add value to our customers’ digital journeys. Fortinet’s integrated networking and cybersecurity offerings, including Fortinet Secure SD-WAN, combined with common management and analytics platforms across our SD-WAN, switching and wireless portfolio help us offer seamless solutions to our customers”.
– Harsha Ram, Head – Network Business, Sify Technologies (India)

“SPTel is re-imagining cybersecurity by providing virtualized, on-demand, managed security services to enable companies and their decision-makers to react quickly to a changing threat landscape. We are extending cyber-secure networks with the same level of corporate-grade support and security to those working from home, enabled by our partnership with Fortinet. Customers can benefit from the enhanced performance for their business collaboration tools with a business-class digital network that delivers <1ms network (2-way) latency, bandwidth upgrade in minutes, and cybersecurity on demand.”
– Teh Yeok Peng, VP, Managed Services & Customer Solutions, SPTel (Singapore)

“Our SD-WAN solutions were designed to cater to the enterprise sector, including the government, banking, retail, and financial verticals, and we are proud to partner with Fortinet to deploy this service for our customers. Fortinet’s Secure SD-WAN solution has allowed us to combine networking, security, quality of service, and wide area network management capabilities into one efficient service. Following the deployment, we witnessed remarkable growth in revenue and an improved onboarding experience that further reflects the fruitful partnership we have formed with Fortinet.”
– Meshari Al Hamad, General Manager of Sales & Account Management, solutions by stc (Kuwait)

“Tata Tele Business Services (TTBS) has collaborated with Fortinet to empower Indian enterprises with a secure and reliable connectivity solution that delivers exceptional end-user experiences. By incorporating Fortinet Secure SD-WAN into our portfolio of Core Connectivity, Business Communication, Cloud and SaaS, TTBS has strengthened the ability to meet the increasing demand for integrated and automated security solutions. SD-WAN supports enterprises in their digital transformation efforts by offering unmatched flexibility, scalability, and next-generation security features, along with valuable business intelligence capabilities. TTBS is committed to democratizing smart digital solutions by making them accessible at affordable price-points to all businesses, particularly small and medium enterprises (SMEs), and empower them to ‘Do Big’ in their respective business segments.”
– Vishal Rally, Senior Vice-President, Product Commercial and Marketing, Tata Teleservices (India)

Join Fortinet at Fast & Secure Event for MSSPs

Fortinet will be further showcasing the importance of SD-WAN and SASE for MSSP partners at Fast & Secure, the company’s flagship event for service providers. The 16th annual event— taking place from June 7 to 9, 2023, in Madrid, Spain—aims to help service providers remain competitive in a quickly evolving market.

Fortinet’s Filippo Cassini, Global Technical Officer, SVP of Engineering, Head of Pre-Sales, will be discussing how service providers can play a key role in SASE adoption.

Visit the Fast & Secure website to learn more about the cybersecurity threats, trends, and challenges that impact service providers and their customers.

Additional Resources