Connect with us

E-Business

Cybercriminals Wipe Out Logs in Most Attacks –  Sophos

Published

on

Kindly share this post

Sophos, a global leader in innovating and delivering cybersecurity as a service, has released its Active Adversary Report for Security Practitioners, which found that telemetry logs were missing in nearly 42 per cent of the attack cases studied.

Cybercriminals Wipe Out Logs in Most Attacks -  Sophos

In 82 per cent of these cases, cybercriminals disabled or wiped out the telemetry to hide their tracks. The report covers Incident Response (IR) cases that Sophos analysed from January 2022 through the first half of 2023.

Gaps in telemetry decrease much-needed visibility into organisations’ networks and systems, especially since attacker dwell time (the time from initial access to detection) continues to decline, shortening the time defenders have to effectively respond to an incident.

“Time is critical when responding to an active threat; the time between spotting the initial access event and full threat mitigation should be as short as possible. The farther along in the attack chain an attacker makes it, the bigger the headache for responders. Missing telemetry only adds time to remediations that most organisations can’t afford. This is why complete and accurate logging is essential, but we’re seeing that, all too frequently, organisations don’t have the data they need,” said John Shier, field CTO, Sophos.

In the report, Sophos classifies ransomware attacks with a dwell time of less than or equal to five days as “fast attacks,” which accounted for 38 per cent of the cases studied. “Slow” ransomware attacks are those with a dwell time greater than five days, which accounted for 62 per cent of the cases.

However, defenders do need to be aware that fast attacks and the lack of telemetry can hinder fast response times, leading to more destruction.

“Cybercriminals only innovate when they must, and only to the extent that it gets them to their target. Attackers aren’t going to change what’s working, even if they’re moving faster from access to detection. This is good news for organizations because they don’t have to radically change their defensive strategy as attackers speed up their timelines. The same defenses that detect fast attacks will apply to all attacks, regardless of speed. This includes complete telemetry, robust protections across everything, and ubiquitous monitoring,” said Shier.

“The key is increasing friction whenever possible—if you make the attackers’ job harder, then you can add valuable time to respond, stretching out each stage of an attack.

“For example, in the case of a ransomware attack, if you have more friction, then you can delay the time until exfiltration; exfiltration often occurs just before detection and is often the costliest part of the attack. We saw this happen in two incidents of Cuba ransomware. One company (Company A) had continuous monitoring in place with MDR, so we were able to spot the malicious activity and halt the attack within hours to prevent any data from being stolen. Another company (Company B) didn’t have this friction; they didn’t spot the attack until a few weeks after initial access and after Cuba had already successfully exfiltrated 75 gigabytes of sensitive data. They then called in our IR team, and a month later, they were still trying to get back to business as usual.”

The Sophos Active Adversary Report for Security Practitioners is based on 232 Sophos Incident response (IR) cases across 25 sectors from Jan. 1, 2022, to June 30, 2023.

Targeted organizations were located in 34 different countries across six continents. Eighty-three percent of cases came from organizations with fewer than 1,000 employees.

The Sophos Active Adversary Report for Security Practitioners provides actionable intelligence on how security practitioners should best shape their defensive strategy.


Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

E-Business

ISDL Achieves IMS Certification

Published

on

Kindly share this post

Integrated System and Devices Limited (ISDL), a major provider of electronic security solutions, is delighted to announce the successful attainment of ISO 14001:2015 and ISO 45001:2018 certifications following a rigorous audit process conducted by Bureau Veritas Certification Holdings SAS-UK Branch.

ISDL Achieves IMS Certification

In 2021, ISDL bagged the Quality management systems ISO 9001:2015, and now in 2024, with unwavering dedication to customer satisfaction, the occupational Health and Safety system ISO 45001:2018 and the Environmental management system ISO 14001:2015 have been consolidated to form an Integrated Management System.

These certifications, covering ISDL’s headquarters and branches, signify the company’s unwavering commitment to upholding the highest standards of quality management across all facets of its operations.

According to Oluseun Mabogunje, managing director of ISDL, the scope of the certifications encompasses the design, procurement, supply, installation, integration, maintenance, and after-sales support of various electronic security and Extra Low Voltage (ELV) equipment.

Mabogunje expressed his elation at receiving the IMS certifications, emphasizing ISDL’s dedication to delivering exceptional quality and service to its clientele. He emphasized that this achievement underscores the company’s ongoing pursuit of continuous improvement and customer satisfaction.

 

 

 


Kindly share this post
Continue Reading

E-Business

Cybervergent’s Q1 2024 Report Reveals Rising Threat of Remcos RAT Malware in Financial Sector

Published

on

Kindly share this post

Cybervergent, a foremost technology company providing automated cybersecurity solutions, in its Quarterly Brief has revealed a troubling trend in the financial sector that shows a spike in attacks utilising the deceptive Remote Control and Surveillance Access Trojan (Remcos RAT) in Q1, 2024.

The findings affirm a stark forewarning to the financial institutions and organisations in the African continent, urging heightened vigilance and proactive measures to mitigate potential escalating risks.

Previously marketed as a legitimate software, Remcos got co-opted by malicious actors and is now a prevalent tool in cybercrime campaigns. This remote access tool grants attackers hidden entry into victims’ devices, allowing them to seize control, pilfer sensitive data, and even introduce stealth backdoors to compromise entire systems. The capabilities of Remcos are diverse and frightening, ranging from disabling vital security features like User Account Control (UAC) to covertly recording user activities.

“As vigilant cybersecurity gatekeepers, we have observed a significant surge in attacks leveraging the Remcos RAT malware,” said Gbolabo Awelewa, the Chief Solutions Officer, Cybervergent. “Financial institutions are particularly targeted due to the sensitive nature of their data and assets. Organisations must remain diligent and adopt proactive monitoring measures to safeguard against such threats.”

The proactive approach adopted by Cybervergent’s Cyber Operations Centre involves meticulous analysis of attacker tactics, constant updating of threat intelligence, and implementing robust endpoint security solutions. These measures are designed to detect, prevent, and neutralise Remote Access Trojans like Remcos, ensuring the continued security and compliance of organisations in the face of evolving cyber threats.

“Our mission is to fortify our clients’ defenses and ensure the seamless operation of their organisations,” added Gbolabo. “By staying ahead of emerging attack vectors and vulnerabilities, we empower businesses to take proactive measures and protect their valuable assets.”

Looking ahead, Adetokunbo Omotosho, Chief Executive Officer of Cybervergent emphasised the firm’s focus on empowering organisations to navigate the complexities of cybersecurity and compliance with dexterity and confidence.

“Cybervergent’s Assurance and Compliance Team has demonstrated unparalleled leadership in the cybersecurity domain, achieving significant milestones and delivering transformative solutions. Our journey through Q1 reflects a deep commitment to advancing the state of cybersecurity compliance, paving the way for a secure and resilient digital future for organisations in Africa and across the world”, he added.


Kindly share this post
Continue Reading

E-Business

Konga Launches Free Same Day Deliveries on Starlink, Apple & Samsung Nationwide

Published

on

Kindly share this post

Konga, the only authorised shop-in-shop for Starlink Internet kits in Nigeria, is offering its customers free same day delivery across all major cities in the country.

With prices of Starlink Internet kits slashed by 50%, Konga is delivering additional value so that both homes and businesses in urban and remote places can enjoy infinite possibilities with their internet on both their standard and enterprise installations. This offer which is available both online and in its retail stores nationwide is exclusive to new and existing customers this month.

With the improvement in prices on both original standard and enterprise Starlink kits, customers can now enjoy a global warranty and direct installation services by purchasing only on Konga.

Since the launch of the partnership with the Elon Musk owned satellite internet provider, Nigerians have continued to celebrate the uninterrupted supply of fast and efficient cyber network services from the authentic devices available on Konga.

In addition to Starlink, other unique items from leading global companies such as Apple, HP, Lenovo, Samsung, Zinox, Philips, Intel and many more are available at unbeatable discounts in the Konga Tech Month from the 1st and will run till the 31st of May 2024.

The Konga Tech Month was extended from its traditional 7day promotion to 30days to give more people access to exclusive deals throughout the month. To enjoy these mouthwatering offers, visit konga.com or any of its physical outlets today.


Kindly share this post
Continue Reading

Trending