The threat of advanced targeted attacks, also known as advanced persistent threats, or APTs, has spawned a wave of innovation in the security market.
According to a document share by Lawrence Orans, Jeremy D’Hoinne, analysts at Gartner, a company that provides security managers with a framework to select and deploy the most-effective threat defense technologies, part of the key findings show that traditional defense-in-depth components are still necessary, but are no longer sufficient in protecting against advanced targeted attacks and advanced malware.
According to Lawrence Orans, Jeremy D’Hoinne, “Today’s threats require an updated layered defense model that utilizes “lean forward” technologies at three levels: network, payload (executables, files and Web objects) and endpoint; combining two or all three layers offers highly effective protection against today’s threat environment and many vendors fit squarely in one style, but also have some characteristics of adjacent styles. The trend will be for vendors to “bleed through” multiple styles as solutions mature”.
Analysis of the Key Findings
Traditional defense tools are failing to protect enterprises from advanced targeted attacks and the broader problem of advanced malware.
In 2013, enterprises will spend more than $13 billion on firewalls, intrusion prevention systems (IPSs), endpoint protection platforms and secure Web gateways (see Note 1).
Yet, advanced targeted attacks (ATAs) and advanced malware continue to plague enterprises. ATAs are considered advanced because of their ability to bypass traditional security mechanisms.
Five Styles of Advanced Threat Defense: Strengths & Weaknesses
Style 1 — Network Traffic Analysis
This style includes a broad range of techniques for Network Traffic Analysis. For example, anomalous DNS traffic patterns are a strong indication of botnet activity.
NetFlow records (and other flow record types) provide the ability to establish baselines of normal traffic patterns and to highlight anomalous patterns that represent a compromised environment.
Some tools combine protocol analysis and content analysis. The sample vendors we list all use internally developed signatureless techniques that have been effective in detecting advanced threats.
The strengths include, real-time detection; includes signatureless and signature-based techniques and endpoint agents are not required.
But the challenges include, it requires careful tuning and knowledgeable staff to avoid false positives; limited ability to block attacks (applies to out-of-band tools) and does not monitor traffic from off-network mobile endpoints.
Style 2 — Network Forensics
Network Forensics tools provide full-packet capture and storage of network traffic, and provide analytics and reporting tools for supporting incident response, investigative and advanced threat analysis need
The ability of these tools to extract and retain metadata differentiates these security-focused solutions from the packet capture tools aimed at the network operations buyer.
The strengths: Can deliver a high ROI (due to reducing incident response time and personnel); can reconstruct and replay flows and events over days or weeks, due to high-capacity storage options (for example, 200TB) and detailed reports can be used to help meet regulatory requirements, such as e-discovery or Payment Card Industry, for in-depth analysis and continuous monitoring of network traffic.
However, the challenges are the tools are complex, and skilled personnel are required to operate them; costs rise with the amount of data and the retention time; reports that analyze large amounts of data are time-intensive and may need to be run off-hours and does not capture traffic from off-network mobile endpoints.
Style 3 — Payload Analysis
Using a sandbox environment, the Payload Analysis technique is used to detect malware and targeted attacks on a near-real-time basis.
Payload Analysis solutions provide detailed reports about malware behavior, but they do not enable a postcompromise ability to track endpoint behavior over a period of days, weeks or months. Enterprises that seek that capability will need to use the incident response features of the solutions in Style 5 (Endpoint Forensics). The sandbox environment can reside on-premises or in the cloud.
Cloud-based Payload Analysis is a valid approach, but it is also a low barrier to entry for vendors.
Off-the-shelf hypervisors and virtualization technology, vendors can easily create sandbox environments and label them as Payload Analysis solutions.
Feedback from Gartner clients indicates that there is a wide range in the ability of these cloud-based Payload Analysis solutions to accurately detect malware.
As per the strengths, it is very effective in detecting malware that successfully bypasses signature-based solution; detailed reports highlight registry changes, API calls, process behavior and other information about the behavior of the malware (these reports are helpful for postcompromise analysis, but are not a substitute for the in-depth tools outlined in Style 2 and Style 5).
Also, there is an optional blocking capability for outbound callback to command and control centers for those on-premises-based (noncloud) solutions that can be placed in the line of traffic.
The challenges abound because behavioral analysis can take several seconds or minutes to complete, previously undetected malware is allowed to pass through, potentially compromising one or more endpoints; some evasion techniques can defeat the behavioral analysis technique.
For example, sleep timers, in which the malware code executes on a delayed basis (hours or days), may result in the malware going undetected during the time it is resident in the sandbox. Some vendors have techniques for detecting and thwarting sleep timer evasions.
It does not provide validation that the malware executed on endpoints. Just because the malware behaved a certain way in a simulated environment does not guarantee that it will behave that way on real endpoints.
Some malware does not install and execute as expected on every endpoint.
Many solutions only support a limited range of payloads. Some support executables (.exe files) only.
Most solutions only support Microsoft Windows, although some cloud-based approaches support Android. At the time of this writing, none support Apple Mac OS X.
Privacy and data protection concerns may prevent some enterprises from implementing cloud-based sandboxes.
Style 4 — Endpoint Behavior Analysis
There is more than one approach to Endpoint Behavior Analysis to defend against targeted attacks.
Several vendors focus on the concept of application containment to protect endpoints by isolating applications and files in virtual containers.
Other innovations in this style include system configuration, memory and process monitoring to block attacks, and techniques to assist with real-time incident response.
An entirely different strategy for ATA defense is to restrict application execution to only known good applications, also known as “whitelisting” (see “How to Successfully Deploy Application Control”).
The application containment approach allows malware to execute, but it does so in a contained environment where it cannot access content and information outside of its container. For example, the containers intercept kernel system calls and block malicious activity such as thread injection attacks.
By isolating Web browsing sessions, this approach protects users from malicious websites, including drive-by download sites and “watering holes.”
These solutions require an agent on every endpoint. (For more information, see “Technology Overview for Virtualization and Containment Solutions for Advanced Targeted Attacks.”).
The strengths are: blocks zero-day attacks and previously unseen malware (applies to application containment solutions); protects systems whether they are on or off the corporate network; provides basic forensic capabilities through analysis of blocked malware.
While the challenges are: deploying and managing endpoint agents can be operationally intensive and creates challenges in bring your own device (BYOD) environments; endpoint agents have varying restrictions for supporting operating systems, file types, applications and browsers and containment solutions utilize additional CPU and memory resources.
The more containers in use, the greater the impact, according to Gartner.
Style 5 — Endpoint Forensics
Endpoint Forensics serves as a tool for incident response teams. Endpoint agents collect data from the hosts they monitor.
These solutions are helpful for pinpointing which computers have been compromised by malware, and highlighting specific behavior of the malware.
Some solutions use various indicators of compromise (IOCs) to detect malicious behavior on the endpoint.
Examples of IOCs include suspicious Microsoft Windows registry key creation, DNS requests or installed binaries.
The strengths are, it helps automate the time-consuming task of incident response; monitors activity on hosts when they are on or off corporate networks; some agents provide limited containment features (for example, preventing previously detected malware from running again or on other endpoints in the company) and limited remediation capabilities.
The challenges include, a lack of ability to block zero-day attacks in real time; deploying and managing endpoint agents can be operationally intensive; at the time of this writing, support for non-Windows endpoints is limited and events are not always prioritized and typically require knowledgeable staff to investigate.
TikTok Picks Oracle to Provide ‘Secure’ Cloud Tech
Enterprise software giant Oracle announced that it has been chosen to become TikTok’s “secure” cloud technology provider.
According to Oracle, this technical decision by TikTok was heavily influenced by Zoom’s recent success in moving a large portion of its video-conferencing capacity to the Oracle Public Cloud.
Oracle’s announcement comes after TikTok parent ByteDance last week said it will not be selling the video-sharing app’s US operations to software giant Microsoft.
This after US president Donald Trump signed an executive order on 6 August, blocking all transactions with ByteDance in an effort to address “national emergency” issues.
On 14 August, the US president issued an order that gave ByteDance 90 days to divest the US operations of TikTok.
Since then, US companies such as Microsoft and Oracle have been lining up as potential buyers for the popular short video app.
As the trade war between the US and China rages on, the US government has accelerated its efforts to purge Chinese apps and technology companies that it deems untrustworthy.
Trump and his administration raised national security issues, alleging the Chinese-owned company will share sensitive user data with the Chinese government.
“TikTok picked Oracle’s new Generation 2 Cloud infrastructure because it’s much faster, more reliable, and more secure than the first generation technology currently offered by all the other major cloud providers,” says Oracle chief technology officer Larry Ellison.
“In the 2020 Industry CloudPath survey that IDC recently released where it surveyed 935 infrastructure-as-a-service (IaaS) customers on their satisfaction with the top IaaS vendors including Oracle, Amazon Web Services, Microsoft, IBM and Google Cloud…Oracle IaaS received the highest satisfaction score.”
“As a part of this agreement, TikTok will run on the Oracle Cloud and Oracle will become a minority investor in TikTok Global,” says Oracle CEO Safra Catz.
“Oracle will quickly deploy, rapidly scale and operate TikTok systems in the Oracle Cloud. We are 100% confident in our ability to deliver a highly secure environment to TikTok and ensure data privacy to TikTok’s American users, and users throughout the world.
“This greatly improved security and guaranteed privacy will enable the continued rapid growth of the TikTok user community to benefit all stakeholders.”
Inq. Acquires Vodacom’s Business in Nigeria, Others
inq. Holdings Limited, artificial intelligence service provider, has acquired Vodacom Business Africa’s operations in Nigeria, Zambia and Cote d’Ivoire.
It plans further acquisition in Cameroon subject to regulatory approvals.
Mr. Valentine Chime, managing director, inq. Holdings Limited, said the 100 per cent acquisition of the Vodacom Business Africa’s operations in the three countries was in pursuit of the company’s dream of building pan-African network that will help in creating better future through digital solutions.
Domiciled in Mauritius, inq. Holdings Limited is a subsidiary of Convergence Partners Communications Infrastructure Fund, a fund dedicated solely to communications infrastructure and related services and technologies across Sub-Saharan Africa (SSA).
Formerly known as Synergy Communications, the latest acquisition has grown inq.’s regional footprint with operations in 12 cities in seven countries across Africa. It has existing operations in Botswana, Malawi and South Africa with an additional investment in Mozambique.
“Under the inq. banner the company will embark on the next phase of building a unified Pan-African cloud and digital service provider, bringing to market a very relevant suite of next generation technology solutions in the fields of Edge AI, SD-WAN/NFV and Cloud,”Chime said.
According to him, with operations in major African cities of Lagos, Abuja, Port Harcourt, Kano, Gaborone, Lusaka, Ndola, Blantyre, Lilongwe, Mzuzu, Abidjan and Johannesburg, the inq. team prides itself on global best practice methodologies customised to local customs in each of the 16 cities, covering different sectors including banking, oil and gas, fast moving consumer goods, mining, health, real estate, information technologies, public sector and logistics.
“Covid-19 has accelerated digital transformation, and inq. is perfectly positioned to deliver intelligent connectivity through seamless delivery of cloud and digital services and technologies to our clients. We are about simpler, seamless solutions,” Chime said.
HP Lauds TD Africa, Says Tech Experience Centre will Unlock New Wave in Nigeria
As Nigeria looks forward to the official launch of the Tech Experience Centre, globally renowned tech giant, Hewlett Packard Inc. (HP) has heaped praises on the management of TD Africa for spearheading the project, noting that the centre will herald a new technological wave in Nigeria.
This was disclosed by Ife Afe, managing director – Nigeria and District Manager – Central Africa (CAF).
Equally important, HP is one of the global Original Equipment Manufacturer (OEM) that will be represented in the Tech Experience Centre located within Yudala Heights at 13 Idowu Martins, Victoria Island, Lagos.
Consequently, Afe has expressed delight with the development, even as she disclosed that the launch of the centre will bridge the gap to complete technology adoption for millions of Nigerians.
She said: ‘‘I do believe Nigerians are early adopters of new and exciting technology. Having a dedicated space where people can view and experience cutting-edge technology across rich and diverse portfolio is an important step towards complete Adoption.
‘‘Technology is about transformation. This tech centre will serve as a bridge, taking people from the imaginative stage to the experiential stage, thereby unlocking a new technological wave.
“I am very glad that TD Africa is taking this bold step and I look forward to the great collaborations that will flow out of this initiative.’’
Furthermore, the HP Senior Management Executive reiterated the strong interest in Nigeria by the tech brand.
‘‘We are strong believers in the Nigerian project and the boundless potential inherent in the population when exposed to cutting-edge technology.
“We also value the foresight and vision of our long-time partner and co-developer – TD Africa. We are proud of this project and are confident of its success and positive impact not just in the sphere of business but also in human capital development,’’ Afe enthused.
On what to expect from HP in the Tech Experience Centre, she revealed that a lot is in store for every visitor.
‘‘HP is in the business of making life better for everyone, everywhere, hence revolutionary innovation in Health care, Security, Gaming and Printing Solutions will be showcased in the Technology Centre. Cutting- edge, sustainable, diverse and relevant innovation in technology.
‘‘This brings technology closer to home. I believe that the ambience of the Tech Centre will cater to a wide spectrum of users: CEO’s, Government officials, entrepreneurs, tech enthusiasts, students, gamers etc. It will be the crucial meeting point of people and technology.
“Our wide spectrum of products and solutions will cater to all demographics – from first time users to specialists, professionals, gamers to moviemakers, work or play,’’ she affirmed.
The revolutionary Tech Experience Centre, the first of its kind in Africa, is set for launch on Thursday, October 1st 2020, incidentally the occasion of Nigeria’s 60th Independence Anniversary by 12noon, with the launch streamed live online for the benefit of tech enthusiasts.
Expected to officially commission the centre is the Minister of Communica99tions and Digital Economy, Dr. Isa Ali Pantami.
The Tech Centre is widely expected to boost Nigeria’s relevance in the global technology race and shore up the country’s march to technology independence.
For the first time, Nigeria will play host to the latest global technologies including those not normally available in Africa, offering all classes of visitors a first-hand experience of new gadgets, solutions and infrastructure that would have previously required a visit abroad, thereby saving corporate organizations, government establishments and individuals money or scarce foreign exchange expended on these trips.
Banks Fingered in $2trn Dirty Money Scam
NCC Moves to Review International Termination Rate for Voice Services
CSCS Sensitizes Financial Market Stakeholders on Cyber-Security
TikTok Picks Oracle to Provide ‘Secure’ Cloud Tech
Muoghalu, Kukah Headline ARCAN Lectures
New Regulatory Agency Coming for Nigeria Postal Sector
Pantami Excited as ICT’s Contribution to Nigeria’s GDP Increases to 17.83%
Chinese Phones with Built-in Malware Sold in Africa
MTN, Unacast Partner to Mitigate Spread of COVID-19 through Turbine Location Processing Engine
NFVCB Blacklists Illegal Film Producers, Distributors
- Telecom1 day ago
Huawei’s Investment in Nigeria Reaches $76m
- E-Financial1 day ago
CBN Investigates 55 Companies over Forex Infractions
- E-Business1 day ago
Mega Deals as Konga Freedom Sales Goes Live Today
- Broadcasting1 day ago
OurTv Secures LaLiga Broadcasting Rights for Nigeria
- Broadcasting1 day ago
Extreme E Partners StarTimes to Broadcast Series across Africa
- Broadcasting1 day ago
NCC, AVCNU Set Agenda for Model IP Policy for Nigerian Universities
- E-Business1 day ago
ICANN Launches Pandemic Internet Access Reimbursement Program Pilot
- Telecom1 day ago
NAVSA: NITDA Changes Existing Reality in Agricultural Sector