E-Business
Gartner Reveals Five Styles of Advanced Threat Defense
The threat of advanced targeted attacks, also known as advanced persistent threats, or APTs, has spawned a wave of innovation in the security market.
According to a document share by Lawrence Orans, Jeremy D’Hoinne, analysts at Gartner, a company that provides security managers with a framework to select and deploy the most-effective threat defense technologies, part of the key findings show that traditional defense-in-depth components are still necessary, but are no longer sufficient in protecting against advanced targeted attacks and advanced malware.
According to Lawrence Orans, Jeremy D’Hoinne, “Today’s threats require an updated layered defense model that utilizes “lean forward” technologies at three levels: network, payload (executables, files and Web objects) and endpoint; combining two or all three layers offers highly effective protection against today’s threat environment and many vendors fit squarely in one style, but also have some characteristics of adjacent styles. The trend will be for vendors to “bleed through” multiple styles as solutions mature”.
Analysis of the Key Findings
Traditional defense tools are failing to protect enterprises from advanced targeted attacks and the broader problem of advanced malware.
In 2013, enterprises will spend more than $13 billion on firewalls, intrusion prevention systems (IPSs), endpoint protection platforms and secure Web gateways (see Note 1).
Yet, advanced targeted attacks (ATAs) and advanced malware continue to plague enterprises. ATAs are considered advanced because of their ability to bypass traditional security mechanisms.
Five Styles of Advanced Threat Defense: Strengths & Weaknesses
Style 1 — Network Traffic Analysis
This style includes a broad range of techniques for Network Traffic Analysis. For example, anomalous DNS traffic patterns are a strong indication of botnet activity.
NetFlow records (and other flow record types) provide the ability to establish baselines of normal traffic patterns and to highlight anomalous patterns that represent a compromised environment.
Some tools combine protocol analysis and content analysis. The sample vendors we list all use internally developed signatureless techniques that have been effective in detecting advanced threats.
The strengths include, real-time detection; includes signatureless and signature-based techniques and endpoint agents are not required.
But the challenges include, it requires careful tuning and knowledgeable staff to avoid false positives; limited ability to block attacks (applies to out-of-band tools) and does not monitor traffic from off-network mobile endpoints.
Style 2 — Network Forensics
Network Forensics tools provide full-packet capture and storage of network traffic, and provide analytics and reporting tools for supporting incident response, investigative and advanced threat analysis need
The ability of these tools to extract and retain metadata differentiates these security-focused solutions from the packet capture tools aimed at the network operations buyer.
The strengths: Can deliver a high ROI (due to reducing incident response time and personnel); can reconstruct and replay flows and events over days or weeks, due to high-capacity storage options (for example, 200TB) and detailed reports can be used to help meet regulatory requirements, such as e-discovery or Payment Card Industry, for in-depth analysis and continuous monitoring of network traffic.
However, the challenges are the tools are complex, and skilled personnel are required to operate them; costs rise with the amount of data and the retention time; reports that analyze large amounts of data are time-intensive and may need to be run off-hours and does not capture traffic from off-network mobile endpoints.
Style 3 — Payload Analysis
Using a sandbox environment, the Payload Analysis technique is used to detect malware and targeted attacks on a near-real-time basis.
Payload Analysis solutions provide detailed reports about malware behavior, but they do not enable a postcompromise ability to track endpoint behavior over a period of days, weeks or months. Enterprises that seek that capability will need to use the incident response features of the solutions in Style 5 (Endpoint Forensics). The sandbox environment can reside on-premises or in the cloud.
Cloud-based Payload Analysis is a valid approach, but it is also a low barrier to entry for vendors.
Off-the-shelf hypervisors and virtualization technology, vendors can easily create sandbox environments and label them as Payload Analysis solutions.
Feedback from Gartner clients indicates that there is a wide range in the ability of these cloud-based Payload Analysis solutions to accurately detect malware.
As per the strengths, it is very effective in detecting malware that successfully bypasses signature-based solution; detailed reports highlight registry changes, API calls, process behavior and other information about the behavior of the malware (these reports are helpful for postcompromise analysis, but are not a substitute for the in-depth tools outlined in Style 2 and Style 5).
Also, there is an optional blocking capability for outbound callback to command and control centers for those on-premises-based (noncloud) solutions that can be placed in the line of traffic.
The challenges abound because behavioral analysis can take several seconds or minutes to complete, previously undetected malware is allowed to pass through, potentially compromising one or more endpoints; some evasion techniques can defeat the behavioral analysis technique.
For example, sleep timers, in which the malware code executes on a delayed basis (hours or days), may result in the malware going undetected during the time it is resident in the sandbox. Some vendors have techniques for detecting and thwarting sleep timer evasions.
It does not provide validation that the malware executed on endpoints. Just because the malware behaved a certain way in a simulated environment does not guarantee that it will behave that way on real endpoints.
Some malware does not install and execute as expected on every endpoint.
Many solutions only support a limited range of payloads. Some support executables (.exe files) only.
Most solutions only support Microsoft Windows, although some cloud-based approaches support Android. At the time of this writing, none support Apple Mac OS X.
Privacy and data protection concerns may prevent some enterprises from implementing cloud-based sandboxes.
Style 4 — Endpoint Behavior Analysis
There is more than one approach to Endpoint Behavior Analysis to defend against targeted attacks.
Several vendors focus on the concept of application containment to protect endpoints by isolating applications and files in virtual containers.
Other innovations in this style include system configuration, memory and process monitoring to block attacks, and techniques to assist with real-time incident response.
An entirely different strategy for ATA defense is to restrict application execution to only known good applications, also known as “whitelisting” (see “How to Successfully Deploy Application Control”).
The application containment approach allows malware to execute, but it does so in a contained environment where it cannot access content and information outside of its container. For example, the containers intercept kernel system calls and block malicious activity such as thread injection attacks.
By isolating Web browsing sessions, this approach protects users from malicious websites, including drive-by download sites and “watering holes.”
These solutions require an agent on every endpoint. (For more information, see “Technology Overview for Virtualization and Containment Solutions for Advanced Targeted Attacks.”).
The strengths are: blocks zero-day attacks and previously unseen malware (applies to application containment solutions); protects systems whether they are on or off the corporate network; provides basic forensic capabilities through analysis of blocked malware.
While the challenges are: deploying and managing endpoint agents can be operationally intensive and creates challenges in bring your own device (BYOD) environments; endpoint agents have varying restrictions for supporting operating systems, file types, applications and browsers and containment solutions utilize additional CPU and memory resources.
The more containers in use, the greater the impact, according to Gartner.
Style 5 — Endpoint Forensics
Endpoint Forensics serves as a tool for incident response teams. Endpoint agents collect data from the hosts they monitor.
These solutions are helpful for pinpointing which computers have been compromised by malware, and highlighting specific behavior of the malware.
Some solutions use various indicators of compromise (IOCs) to detect malicious behavior on the endpoint.
Examples of IOCs include suspicious Microsoft Windows registry key creation, DNS requests or installed binaries.
The strengths are, it helps automate the time-consuming task of incident response; monitors activity on hosts when they are on or off corporate networks; some agents provide limited containment features (for example, preventing previously detected malware from running again or on other endpoints in the company) and limited remediation capabilities.
The challenges include, a lack of ability to block zero-day attacks in real time; deploying and managing endpoint agents can be operationally intensive; at the time of this writing, support for non-Windows endpoints is limited and events are not always prioritized and typically require knowledgeable staff to investigate.
E-Business
Hydrogen Hosts Catalyst Workshop, Highlights Resilient Business Models for Fintech Startups
As part of its mission to empower African businesses with tools needed to thrive, garner admiration, and foster global acclaim, leading payment solution company, Hydrogen Payment Services Company Limited (Hydrogen), recently partnered with the Co Creation Hub (CcHub), to host the latest edition of the Catalyst workshop in Lagos.
The discourse addressed the potential risks and opportunities for startups and saw experts advise participants on the need to develop resilient business models that would scale across different economic climes.
Moderated by Miracle Ezechi, Digital Marketing Manager, Hydrogen, the panel session addressed dominant issues about the theme: ‘Adapting Fintech Business Models to Economic Climes: Flexibility, Agility and Customer-centricity’.
Mr. Emeka Awagu, Chief Technology Officer, Hydrogen, who spoke as a panellist, addressed the issue of customer-centricity, which according to him, is key to Fintech growth.
He advised startups to listen to customer demands and understand their needs in order to develop the right solutions that will lead to long term market viability.
“Innovation is key for startup growth. However, understanding customers’ needs and change in behaviour will help any startup to innovate better.
“Startups must be flexible and agile to develop solutions with high interoperability and processing speed, and they must be ready to learn from startups that have failed,” Awagu said.
With an estimated 61.07 percent of startups failing, the participants stressed the need for prudence.
“Statistically, a staggering number of startups fail, often due to financial mismanagement. Hence, founders must prioritise understanding and maintaining a healthy the Cost-to-Earnings ratio.
“It is not just a number, but a pivotal indicator of a company’s financial health as well as being a key attractiveness determinant for investors,” Awagu added.
On his part, Ina Alogwu, the Group Director, Digital Transformation, ARM HOLDCO, who also spoke as a panellist at the session, stressed the need for startups to develop sustainable products and solutions that will help them remain competitive in an environment that is faced with harsh economic realities.
“Many startup businesses fail within their first five years, however upcoming startups should not be discouraged, rather develop a culture that will encourage them to understand the reasons for failure and learn from mistakes.
“Startups should not be too rigid with their solutions and should be ready to accept changes that will drive innovation,” Alogwu stated.
Hydrogen will be deepening its economic impact series with a webinar planned for Thursday, April 25, even as businesses across Africa continue to face an array of challenges, ranging from inflation and currency fluctuations to rising operating costs.
Themed ‘Navigating Economic Challenges: Strategies for Sustainable Growth,’ the webinar will delve into key areas critical for businesses to not only survive but thrive in the face of economic adversity. Register using this link – https://bit.ly/Hydrogenwebinar.
Esteemed panellists for this event include Taofik Odukoya, CEO, Vanguard Pharmacy, and Okechukwu Odimgbe, Chief Financial Officer, Hydrogen. The session will be moderated by Nnenna Sam-Obioha, Ecosystem Orchestrator, Hydrogen.
Dexude, a leading edtech platform with operations in Nigeria, has announced that it has been awarded the prestigious Business Finland TEMPO funding.
Charles Emembolu, founder of Dexude,
This significant funding injection marks a pivotal moment in Dexude’s journey towards transforming education through its AI-powered, live-first, expert-led, and community-driven platform.
The Business Finland TEMPO funding is specifically designed to support startups and SMEs aiming for international growth by building their expertise and solutions into international success stories in innovative ways.
Dexude’s commitment to innovation, coupled with its vision to enable a billion learners worldwide, aligns perfectly with the objectives of the TEMPO funding.
Commenting on this milestone achievement, Charles Emembolu, founder of Dexude, remarked, “We are incredibly honored and excited to receive the Business Finland TEMPO funding. This funding is not only a validation of Dexude’s mission to reinvent education but also a testament to the hard work and dedication of our team. With this support, we are poised to accelerate our efforts in democratizing access to quality education and empowering learners across Nigeria and beyond.”
L-r; Kelvin Chikezie, co-founder of Dexude; Kashifu Inuwa Abdullahi, Director-General/CEO of the National Information Technology Development Agency (NITDA); and Charles Emembolu, founder of Dexude
Kelvin Chikezie, co-founder of Dexude, added, “Securing the Business Finland TEMPO funding is a significant milestone for Dexude. It underscores our commitment to leveraging technology and innovation to revolutionize the way people learn and grow. We are grateful to Business Finland for believing in our vision, and we are excited to embark on this next chapter of Dexude’s journey.”
Dexude is on a mission to redefine education by providing learners with access to influential experts and thought leaders, live interactions, and a vibrant community-driven learning experience.
Through its platform, Dexude aims to break down barriers to learning and empower individuals to pursue their passions and unlock their full potential.
SOPHiA GENETICS, a cloud-native software company in the healthcare space and a leader in data-driven medicine, has announced that Nigeria-based Syndicate Bio has signed on to implement MSK-ACCESS® powered with SOPHiA DDM™.
Syndicate Bio is the first lab in Africa to adopt the MSK-ACCESS® assay via the SOPHiA DDM™ Platform, and the first company to make comprehensive genomic profiling and liquid biopsy widely available to patients throughout the entire continent.
The implementation of this new technology will further existing work from SOPHiA GENETICS, Memorial Sloan Kettering Cancer Center (MSK), and Syndicate Bio to advance health equity on a global scale.
There are roughly 1 million new cancer patients each year in Africa and currently, comprehensive genomic profiling and liquid biopsy testing options are not widely available.
This means that patients are forced to forego this testing or travel out of continent for these testing options. Syndicate Bio’s implementation of this new offering will provide cutting-edge liquid biopsy testing to many of these patients and will help progress the company’s goal of advancing genomics and precision medicine in an area of the world that has been historically underserved in these areas.
“Partnering with SOPHiA Genetics to bring MSK-ACCESS® powered with SOPHiA DDM™ to our lab is a monumental step in accelerating the cancer treatment and research landscape across Africa, beginning in Nigeria. Next-generation sequencing technologies in oncology and liquid biopsy, which this collaboration enables, hold the potential for creating a leapfrogging opportunity in the oncology treatment and research landscape in Africa,” said Abasi Ene-Obong, PhD., Founder, Syndicate Bio.
“Through this collaboration, we aim to enable the widespread application of precision medicine in oncology across Africa, and thus contributing to the improvement of patient outcomes across the African continent.
“We believe our scientific expertise, combined with AI-enabled technologies and data-driven solutions enabled by SOPHiA GENETICS, presents a unique opportunity to fundamentally transform the journey of cancer patients through non-invasive cancer analysis, predictive genetic testing, and effective precision medicine.”
Syndicate Bio is driving genomics and precision medicine initiatives across the world’s most diverse regions through large-scale partnerships with governments, industry, and other stakeholders. Through its work, Syndicate Bio is making local impact while accelerating drug discovery and development.
By focusing on Africa, Syndicate Bio is poised to make a significant impact, starting with Nigeria, by introducing its pioneering clinical oncology offerings in an underserved region.
Through this endeavor, Syndicate Bio aims to improve cancer diagnosis and treatment for African patients. This initiative not only facilitates local next-generation sequencing (NGS) testing and liquid biopsy testing but also extends access to clinical trial participation, empowering patients and healthcare providers alike.
MSK-ACCESS® powered with SOPHiA DDM™ is a decentralized version of a highly validated ctDNA test developed by MSK that involves the deep sequencing of 146 key cancer-associated genes, and will augment Syndicate Bio’s tumor profiling capabilities, allowing them to utilize a small blood sample to generate a comprehensive report in an efficient and expedited time frame.
The use of liquid biopsy is less invasive than traditional biopsy, and can help simplify patient monitoring, whilst driving the uptake of precision medicine.
The offering combines the sophisticated analytics, state-of-the-art algorithms, and decentralized, cloud-based offerings of the SOPHiA DDM™ Platform, with the scientific and clinical expertise of MSK in cancer genomics to provide a best-in-class liquid biopsy solution.
“In our mission to democratize data-driven medicine, our decentralized global network and unique set of partnerships enable us to help reach underserved populations, just as those that are served by Syndicate Bio,” said Philippe Menu, MD, PhD., Chief Medical Officer, SOPHiA GENETICS.
“By implementing this solution, Syndicate Bio will make a measurable impact throughout Africa, while also helping to generate an unparalleled and comprehensive dataset and provide invaluable insights and knowledge to shape the future of global healthcare.”
In late 2023, SOPHiA GENETICS and MSK announced they are working in partnership with AstraZeneca to bring the world-class MSK-ACCESS® powered with SOPHiA DDM™ testing solution to countries and regions around the globe, including underserved areas where access to testing remains scarce.
ALTON, ATCON Urge FG to Address Telecoms Industry Challenges
Qualcomm Shortlists Startups for Qualcomm Make in Africa 2024 and Awards 2023 Wireless Reach Social Impact Fund
9mobile Partners Microsoft to Host Impactful Training Session for Journalists
Hydrogen Hosts Catalyst Workshop, Highlights Resilient Business Models for Fintech Startups
Mastercard and CEBIH join forces to bolster cybersecurity in Nigeria
See Full List of Fake Loan Apps Blacklisted By CBN
IFC Invests in New 4DX Ventures Fund to Support Tech Startups in Africa
AXA Mansard Empowers Female SMEs with Financial, Digital Skills
FIRS Files Tax Evasion Charges against Binance
CBN Sacks another 50 Staff, 117 Disengaged in 20 Days
Telecom3 days agoTelcos Record N27Bn Loss from Damaged Fibre Cables
News3 days agoFG to Secure Fresh $2.25Bn World Bank Loan
Telecom3 days agoNCAIR Relaunch: Pantami, Tijani Fight for Credit
News2 days agoNERC Cedes Regulatory Oversight of Enugu Electricity Market to State Government Agency
News2 days agoGPA Raises Alarm, Says Malaria Vaccine Can Cause Meningitis
News2 days agoStudents Loans’ Beneficiaries to Start Repayment 2 Years after Graduation- NELFUND:
E-Business3 days agoForex Volatility will Not End Overnight- CBN Gov
E-Financial2 days agoFormer SEC Leadership Failed to Regulate, Develop Capital Market- ASCSN