Corporate boards widely recognize due diligence as a critically important component of the M&A process, particularly when it comes to vetting financial numbers and legal obligations. The stakes are enormous: The value of worldwide mergers and acquisitions totaled $3.6 trillion in 2017, according to Thomson Reuters. Globally, M&A activity is increasing and could reach record highs in 2018.
Across the conference circuit and the general cybersecurity community this year, Zero Trust – a term originally coined in 2010 – has been perhaps the industry’s hottest buzzword. Move over, blockchain and machine learning. In my previous blog, I outlined what Zero Trust means and what lessons the framework offers for the security community. To recap the challenges of Zero Trust: organizations face hurdles around securing legacy applications/network resources and tools and protocols; regulatory headwinds given that the framework can theoretically conflict with global legislation, including GDPR; and the looming reality that the typical large global enterprise lacks the organization-wide visibility and control necessary for implementation. Here, I’ll outline a framework for a true Zero Trust model that adheres to industry best practices while specifically avoiding the potential for an over-engineered network overhaul, wasted IT budget, and potentially costly organizational disruption.
NTLM (NT LAN Manager) is Microsoft's old authentication protocol that was replaced with Kerberos starting Windows 2000. It was designed and implemented by Microsoft engineers for the purpose of authenticating accounts between Microsoft Windows machines and servers. Even though it has not been the default for Windows deployments for more than 17 years, it is still very much in use, and I have not yet seen a network where it has been completely abandoned. In fact, it also supported by the latest version of Active Directory.
Last week, I was on the road speaking with CISOs across the country. One theme emerged loud and clear: Virtually all of the organizations have invested a lot in security tools and solutions, but despite their investment, they struggle with getting a complete view of user access across platforms. So, with that, I’d like to share how our customers have been able to overcome this common challenge to gain a more holistic view of users and identity within their organizations.
(Note: see part two of our Zero Trust blog posts here)
It’s a common question after a major breach: did you do everything you could have to protect your network? Most of the time the answer is...probably not. Often, we live in a false sense of security. We know it, and most of us are OK with it. But let's talk about what’s practical and what steps can be taken to help you get to a better sense of security.
It’s never been more important for retailers to harden their cybersecurity posture— especially given the documented trend of intensified attacks on retailers during the rapidly-approaching holiday season. We’re excited to attend the 2018 Retail Cyber Intelligence Summit in Denver and look forward to learning from and sharing perspective with the R-CISC community, including some of the top retail companies in the world.
I was recently working with a large US-based company that suffered from repeated breaches to their corporate network. After we deployed the Preempt Platform and started monitoring all traffic, we quickly found several hacked privileged accounts that attackers were using. The interesting thing was that all privileged accounts were protected with password vaults and their passwords were rotated every 24 hours. In that particular case, the attackers compromised a web gateway that some admins logged into each day using a plaintext password. Using this weakness, attackers easily defeated the Privileged Access Management (PAM) solution, they simply had to harvest the password each day and do whatever they wanted with it.
After an organization has been breached, one of the most critical steps to take is to determine the root cause and to take active steps to more proactively protect the business. Recently, Preempt was brought in to help a Fortune 500 company with a critical internal threat situation. A malicious actor was able to move laterally within the company’s environment, threatening its international brand, financials and customer relationships. Capitalizing on lessons learned during and after incident response provides immediate and long-term benefits to prevent future breaches. These takeaways can also provide valuable advice for other companies who are looking to improve their security posture and prevent business critical attacks. Here, we’ll share the story and outline the top three lessons.
Companies today are exposed to many threats and incident response (IR) teams have to respond to both real or suspected breaches. Incidents can include credential compromise, phishing, malware in the network, Denial of Service (DoS) attacks, zero day threats, and unauthorized changes to the network, hardware or software to name a few. Many organizations will also hire a red team, which is specifically hired to try to create actual attack scenarios to expose attack surfaces and test for network vulnerabilities. This all keeps an IR team pretty busy.
A CISO recently told us that despite having an impressive array of cybersecurity solutions during their transition to the cloud, nothing was tying it all together from a threat standpoint. From her perspective, all the security tools at their disposal were great individually, but lacked visibility across all accounts and all platforms. Further, they didn’t have the ability to identify and respond to threats, as well as user access requests, in a consistent manner. It actually made the job harder and less effective. This vulnerable patchwork approach of disparate vendor solutions is all too common.