E-Business

Gartner Reveals Five Styles of Advanced Threat Defense

Published

11 years ago

August 4, 2015

Kindly share this post

The threat of advanced targeted attacks, also known as advanced persistent threats, or APTs, has spawned a wave of innovation in the security market.

According to a document share by Lawrence Orans, Jeremy D’Hoinne, analysts at Gartner, a company that provides security managers with a framework to select and deploy the most-effective threat defense technologies, part of the key findings show that traditional defense-in-depth components are still necessary, but are no longer sufficient in protecting against advanced targeted attacks and advanced malware.

According to Lawrence Orans, Jeremy D’Hoinne, “Today’s threats require an updated layered defense model that utilizes “lean forward” technologies at three levels: network, payload (executables, files and Web objects) and endpoint; combining two or all three layers offers highly effective protection against today’s threat environment and many vendors fit squarely in one style, but also have some characteristics of adjacent styles. The trend will be for vendors to “bleed through” multiple styles as solutions mature”.

Analysis of the Key Findings

Traditional defense tools are failing to protect enterprises from advanced targeted attacks and the broader problem of advanced malware.

In 2013, enterprises will spend more than $13 billion on firewalls, intrusion prevention systems (IPSs), endpoint protection platforms and secure Web gateways (see Note 1).

Yet, advanced targeted attacks (ATAs) and advanced malware continue to plague enterprises. ATAs are considered advanced because of their ability to bypass traditional security mechanisms.

Five Styles of Advanced Threat Defense: Strengths & Weaknesses

Style 1 — Network Traffic Analysis

This style includes a broad range of techniques for Network Traffic Analysis. For example, anomalous DNS traffic patterns are a strong indication of botnet activity.

NetFlow records (and other flow record types) provide the ability to establish baselines of normal traffic patterns and to highlight anomalous patterns that represent a compromised environment.

Some tools combine protocol analysis and content analysis. The sample vendors we list all use internally developed signatureless techniques that have been effective in detecting advanced threats.

The strengths include, real-time detection; includes signatureless and signature-based techniques and endpoint agents are not required.

But the challenges include, it requires careful tuning and knowledgeable staff to avoid false positives; limited ability to block attacks (applies to out-of-band tools) and does not monitor traffic from off-network mobile endpoints.

Style 2 — Network Forensics

Network Forensics tools provide full-packet capture and storage of network traffic, and provide analytics and reporting tools for supporting incident response, investigative and advanced threat analysis need

The ability of these tools to extract and retain metadata differentiates these security-focused solutions from the packet capture tools aimed at the network operations buyer.

The strengths: Can deliver a high ROI (due to reducing incident response time and personnel); can reconstruct and replay flows and events over days or weeks, due to high-capacity storage options (for example, 200TB) and detailed reports can be used to help meet regulatory requirements, such as e-discovery or Payment Card Industry, for in-depth analysis and continuous monitoring of network traffic.

However, the challenges are the tools are complex, and skilled personnel are required to operate them; costs rise with the amount of data and the retention time; reports that analyze large amounts of data are time-intensive and may need to be run off-hours and does not capture traffic from off-network mobile endpoints.

Style 3 — Payload Analysis

Using a sandbox environment, the Payload Analysis technique is used to detect malware and targeted attacks on a near-real-time basis.

Payload Analysis solutions provide detailed reports about malware behavior, but they do not enable a postcompromise ability to track endpoint behavior over a period of days, weeks or months. Enterprises that seek that capability will need to use the incident response features of the solutions in Style 5 (Endpoint Forensics). The sandbox environment can reside on-premises or in the cloud.

Cloud-based Payload Analysis is a valid approach, but it is also a low barrier to entry for vendors.

Off-the-shelf hypervisors and virtualization technology, vendors can easily create sandbox environments and label them as Payload Analysis solutions.

Feedback from Gartner clients indicates that there is a wide range in the ability of these cloud-based Payload Analysis solutions to accurately detect malware.

As per the strengths, it is very effective in detecting malware that successfully bypasses signature-based solution; detailed reports highlight registry changes, API calls, process behavior and other information about the behavior of the malware (these reports are helpful for postcompromise analysis, but are not a substitute for the in-depth tools outlined in Style 2 and Style 5).

Also, there is an optional blocking capability for outbound callback to command and control centers for those on-premises-based (noncloud) solutions that can be placed in the line of traffic.

The challenges abound because behavioral analysis can take several seconds or minutes to complete, previously undetected malware is allowed to pass through, potentially compromising one or more endpoints; some evasion techniques can defeat the behavioral analysis technique.

For example, sleep timers, in which the malware code executes on a delayed basis (hours or days), may result in the malware going undetected during the time it is resident in the sandbox. Some vendors have techniques for detecting and thwarting sleep timer evasions.

It does not provide validation that the malware executed on endpoints. Just because the malware behaved a certain way in a simulated environment does not guarantee that it will behave that way on real endpoints.

Some malware does not install and execute as expected on every endpoint.

Many solutions only support a limited range of payloads. Some support executables (.exe files) only.

Most solutions only support Microsoft Windows, although some cloud-based approaches support Android. At the time of this writing, none support Apple Mac OS X.

Privacy and data protection concerns may prevent some enterprises from implementing cloud-based sandboxes.

Style 4 — Endpoint Behavior Analysis

There is more than one approach to Endpoint Behavior Analysis to defend against targeted attacks.

Several vendors focus on the concept of application containment to protect endpoints by isolating applications and files in virtual containers.

Other innovations in this style include system configuration, memory and process monitoring to block attacks, and techniques to assist with real-time incident response.

An entirely different strategy for ATA defense is to restrict application execution to only known good applications, also known as “whitelisting” (see “How to Successfully Deploy Application Control”).

The application containment approach allows malware to execute, but it does so in a contained environment where it cannot access content and information outside of its container. For example, the containers intercept kernel system calls and block malicious activity such as thread injection attacks.

By isolating Web browsing sessions, this approach protects users from malicious websites, including drive-by download sites and “watering holes.”

These solutions require an agent on every endpoint. (For more information, see “Technology Overview for Virtualization and Containment Solutions for Advanced Targeted Attacks.”).

The strengths are: blocks zero-day attacks and previously unseen malware (applies to application containment solutions); protects systems whether they are on or off the corporate network; provides basic forensic capabilities through analysis of blocked malware.

While the challenges are: deploying and managing endpoint agents can be operationally intensive and creates challenges in bring your own device (BYOD) environments; endpoint agents have varying restrictions for supporting operating systems, file types, applications and browsers and containment solutions utilize additional CPU and memory resources.

The more containers in use, the greater the impact, according to Gartner.

Style 5 — Endpoint Forensics

Endpoint Forensics serves as a tool for incident response teams. Endpoint agents collect data from the hosts they monitor.

These solutions are helpful for pinpointing which computers have been compromised by malware, and highlighting specific behavior of the malware.

Some solutions use various indicators of compromise (IOCs) to detect malicious behavior on the endpoint.

Examples of IOCs include suspicious Microsoft Windows registry key creation, DNS requests or installed binaries.

The strengths are, it helps automate the time-consuming task of incident response; monitors activity on hosts when they are on or off corporate networks; some agents provide limited containment features (for example, preventing previously detected malware from running again or on other endpoints in the company) and limited remediation capabilities.

The challenges include, a lack of ability to block zero-day attacks in real time; deploying and managing endpoint agents can be operationally intensive; at the time of this writing, support for non-Windows endpoints is limited and events are not always prioritized and typically require knowledgeable staff to investigate.

Kindly share this post

E-Business

PwC Reveals AI Scaling Gap Slows Africa’s Digital Transformation

Published

13 hours ago

February 7, 2026

Chike Onwuegbuchi

Kindly share this post

African CEOs continue to trail their global counterparts in deploying artificial intelligence (AI) across business functions, as they remain stuck in experimental AI phases, finding it difficult to scale initiatives into enterprise-wide deployments.

This is one of the key findings of PwC’s 29th Global CEO Survey: Africa perspective. It found that more than 150 CEOs in Africa who participated in the survey demonstrate strong operational resilience and reinvention as they navigate currency fluctuations, political uncertainty, infrastructure constraints and supply chain disruptions.

It highlights a slower pace of digital transformation that could limit long-term competitiveness in Africa. While awareness and early adoption of AI are growing, enterprise-wide deployment remains limited, according to the survey.

The survey was conducted from 30 September to 10 November 2025 and surveyed 4 454 CEOs across 95 countries, including Africa.

Skills shortages, fragmented data governance, underdeveloped cloud infrastructure and risk-averse investment strategies are preventing African organisations from moving beyond pilot projects into full-scale AI-driven transformation, it finds.

“AI adoption in Africa is real, but scaling it across the enterprise remains a challenge,” says Christiaan Nel, AI Africa leader at PwC South Africa. “Caution must be balanced with urgency − those investing modestly today risk falling behind competitors scaling rapidly.”

Finding their way

Despite these challenges, African CEOs demonstrate strong operational resilience. The survey shows that 81% are optimistic about improving economic conditions, well above the global average of 65%, while 47% are confident about revenue growth over the next year.

The survey underscores that AI adoption highlights a broader reinvention gap. Only 41% of CEOs have clear AI roadmaps, and 37% formalised responsible AI processes. Skills availability remains a major barrier, with just 37% confident in sourcing and retaining talent for AI initiatives.

PwC research shows that when AI is implemented effectively, African companies experience tangible benefits: 56% report increased employee productivity, 53% gain executive time, 23% see revenue growth, and 25% achieve cost reductions. This confirms that AI can drive efficiency and transformation, but only if infrastructure, governance and investment keep pace, notes the study.

Vikas Sharma, Africa cyber leader at PwC Mauritius, explains: “The challenge is structural. Fragmented cloud environments, unclear data governance and underdeveloped cyber security make scaling AI difficult. Without these foundations, AI initiatives remain tactical rather than transformational.”

Beyond AI, CEOs are using technology to reinvent products, reach new customers and modernise operations. PwC highlights that cloud, analytics and digital frameworks are essential enablers for enterprise-wide AI, helping leaders move from experimentation to transformation.

Importantly, African organisations are using technology to augment rather than replace employees, maintaining workforce stability while improving productivity, it states.

Ambition versus execution

Although 55% of African CEOs consider innovation critical to strategy, only 13% are willing to take high risks in innovation projects.

Underlying capabilities reveal the challenge: just 16% operate dedicated innovation centres, 25% have processes to stop underperforming research and development, and 29% rapidly test ideas with customers.

Lullu Krugel, chief economist and ESG leader at PwC South Africa, adds: “The leaders who build enduring businesses protect their core while creating the future. Operational strength alone is not enough; transformation must be bolder.”

Investment restraint is evident: 59% of respondents report little to no change in IT spending, and only 8% are willing to make large investments despite geopolitical uncertainty. Confidence in acquisitions is lower than the global average, with 40% planning growth through acquisition, compared to 46% globally.

Yet diversification offers a competitive-edge. Nearly half of African CEOs have entered new sectors through services and product offerings in the past five years, generating 24% of revenue from these ventures. Technology leads planned expansion efforts at 17%, followed by real estate, retail and transport/logistics.

PwC concludes that Africa’s CEOs have the ambition and resilience but must move from operational excellence to strategic reinvention. This requires embracing risk as a catalyst for transformation, strengthening digital infrastructure, investing in change leadership and aligning AI adoption with enterprise-wide strategy.

Hannelie Gilmour, consulting and transformation platform leader at PwC South Africa, concludes: “Africa is uniquely positioned to leapfrog global peers. Tomorrow’s stability comes from today’s innovation. CEOs who act decisively will shape the continent’s next chapter.”

Kindly share this post

E-Business

Firm Reviews the Evolution of Phishing Threats in 2025

Published

2 days ago

February 6, 2026

Chike Onwuegbuchi

Kindly share this post

A new Kaspersky review reveals how cybercriminals revived and refined phishing techniques to target individuals and businesses in 2025, including calendar-based attacks, voice message deceptions and sophisticated multi-factor authentication (MFA) bypass schemes.

The findings emphasise the critical need for user vigilance, employee training and advanced email protection solutions to counter these persistent threats moving forward.

Calendar-based phishing targets office workers

A tactic originally from the late 2010s, calendar-based phishing, has reemerged with a focus on B2B environments. Attackers send emails with calendar event invitations, often containing no body text, hiding malicious links in the event description.

When opened, the event auto-adds to the user’s calendar, with reminders urging them to click links leading to fake login pages, such as those mimicking Microsoft.

Previously aimed at Google Calendar users in mass campaigns, this method now targets office employees. Organisations should conduct regular phishing awareness training, such as simulated attack workshops, to teach employees to verify unexpected calendar invites.

Voice message phishing with CAPTCHA evasion

Phishers are deploying minimalist emails posing as voice message notifications, containing sparse text and a link to a basic landing page. Clicking the link triggers a chain of CAPTCHA verifications to bypass security bots, ultimately directing users to a fraudulent Google login page that validates email addresses and captures credentials.

This multi-layered deception highlights the need for employee training programmes, such as interactive modules on recognising suspicious links and advanced email server protection solutions like Kaspersky SecureMail, which detect and block such covert tactics.

MFA bypass via fake cloud service logins

These sophisticated phishing campaigns are targeting multi-factor authentication (MFA) by mimicking services like pCloud (a cloud storage provider that offers encrypted file storage, sharing and backup services).

These emails, disguised as neutral support follow-ups, lead to fake login pages on lookalike domains (e.g., pcloud.online). The pages interact with the real pCloud service via API, validating emails and prompting for OTP codes and passwords, granting attackers account access upon successful login.

To counter this, organisations should implement mandatory cybersecurity training and deploy email security solutions like Kaspersky Security for Mail Servers, which flags fraudulent domains and API-driven attacks.

“With phishing schemes growing more deceptive, Kaspersky urges users to treat unusual email attachments, like password-protected PDFs or QR codes, with caution and verify website URLs before entering any credentials.

“Organisations should adopt comprehensive training programmes, which includes real-world simulations and best practices for spotting phishing attempts. Additionally, deploying robust email server protection solutions ensures real-time detection and blocking of advanced phishing tactics,” comments Roman Dedenok, Anti-Spam Expert at Kaspersky.

Kindly share this post

E-Business

NDPC Commits to Balancing Data Privacy, Protection Information

Published

3 days ago

February 5, 2026

Ebere Melum-Nwogbo

Kindly share this post

Nigerian Data Protection Commission (NDPC), has expressed its commitment to balance information around data privacy and protection.

NDPC Commits to Balancing Data Privacy, Protection Information

Dr. Vincent Olatunji, national commissioner, NDPC, stated this in Abuja, at the National Data Privacy Summit with the theme, “Privacy in the Era of Emerging Technologies,” organised by the commission.

Olatunji said the NDPC, at the moment, was looking at balancing information around data privacy and protection.

“What we are doing is just to look at how to balance information around privacy and protection, which is really important, because as we are innovating, at the same time, we have to consider issues around privacy and protection,” he stated.

He added that the commission has been very bold in taking risks that would bring about growth.

“Our starting point is growing at a very alarming rate, and we are not afraid of anything. We can take risks. And that is why a lot is happening in Nigeria, and this is the level of clarity,” he explained.

In his address, Dr. Aminu Maida, executive vice chairman (EVC) of the Nigerian Communications Commission (NCC), stated that Internet of Things holds promise for Nigeria’s economy.

The EVC, who was represented by Abraham Oshadami, executive commissioner, Technical Services (ECTS), noted that, “in an era in which digital assets, Internet of Things, future digital computing and other transformative technologies are key, and both a cornerstone of building trust for the adoption and a prerequisite for sustainable progress.

“Emerging technologies hold immense promise for Nigeria’s grand economy, but they also introduce complex risks to personal and individual rights.

“So, balancing innovation through post-ethical safeguards and public trust is the first step to ensuring that global digital advancement benefits all Nigerians without compromising their privacy or their security,” he added.

“As we just heard from the Nigeria Police, telecom operators have a vast amount of sensitive historical information daily, including connectivity apps and collaboration on privacy, security, and number protection, both to their and their inheritors,” he said.

Dr. Bako Shurkuk, commissioner for Science, Technology and Innovation, Plateau State, who represented Caleb Mutfwang, Governor of Plateau State, said, emerging technologies can be harnessed to attain sustainable growth.

Kindly share this post