• April 30, 2024
  • Catagory Data Protection

How XDR Extends Your Security Capabilities

By : Justin Folkerts

Endpoint detection and response (EDR) has evolved: extended detection and response (XDR) takes a more holistic, streamlined approach to threat detection and response.

XDR combines data ingestion, analysis, and prevention and remediation processes across your entire security stack, providing your IT teams with the necessary visibility to detect threats as well as automate workflows.

Eliminate Security Siloes

XDR pulls data from endpoints, cloud workloads, networks and email and then correlates and analyzes it using advanced automation and artificial intelligence (AI), which allows it to prioritize data and deliver insight through a single pane of glass.

Not only does XDR consolidate data from disparate sources, but it also coordinates siloed security tools so that your IT team doesn’t have to spread their attention across different consoles to conduct their security analysis, investigation and remediation.

XDR can help you reduce vendor sprawl while integrating the tools you do have to gain better visibility into your environment, whether it’s a private cloud or hybrid environment, including your public cloud instances. By coupling this integration with automation, XDR helps you respond faster to security incidents and effectively mitigate them to reduce the impact of any attack.

Like many security platforms, XDR can be purchased as a managed service, which opens access to expertise in threat hunting, intelligence, and analytics via a managed services provider.

Combine XDR with SIEM and SOAR

XDR doesn’t replace Security Information and Event Management (SIEM) or security orchestration, automation, and response (SOAR).

SIEM gives you a single, streamlined view of your data along with your operational capabilities and security at activities to you can better detect, investigate, and mitigate threats by ingesting as much data as possible. It gives you the ability to analyze data from network applications and hardware, and cloud and software-as-a-service (SaaS) solutions.

SOAR software manages threats and vulnerabilities, responds to security incidents, and automates security operations. The aim of SOAR is to collect as much data as possible and automate as much as possible by leveraging machine learning technology.

SIEM is primarily a log collection tool intended to support compliance, data storage and analysis –security analytics capabilities tend to be bolted on. SOAR incorporates orchestration, automation, and response capabilities to the SIEM and enables disparate security tools to coordinate with one another, but it doesn’t solve the big data analytics challenge, and it can’t protect data or systems on its own.

XDR fills the gap left by SIEM and SOAR by taking a different approach that’s based on endpoint data and optimization and applying advanced analysis capabilities that allow you to focus on high priority events and respond rapidly.

SIEM and SOAR are complementary and can’t be fully replaced by XDR. SIEM has other uses outside of threat detection, including compliance, log management and non-threat related data analysis and management. XDR can’t replace SOAR’s orchestration capabilities.

Assess, Protect and Respond

Adopting an XDR platform in combination with SIEM and SORA provides better threat visibility, optimizes and automates security operations, and enables your busy IT teams to focus strategic objectives rather than being bogged down by manual security tasks. A managed services provider can help you implement XDR along with SIEM and SOAR so you’re in a better position to assess and protect your data and respond quickly and effectively to cybersecurity threats.

  • April 16, 2024
  • Catagory Data Protection

Top 5 SMB Cybersecurity Threats

By : Justin Folkerts

Small and medium-sized businesses (SMBs) are not much different than larger organizations when it comes to sensitive data or IT infrastructure, which makes them a popular target of cyberattacks.

Often, threat actors use the same methods to attack SMBs as they do enterprise organizations.

Viruses

Viruses and malware remain a popular tool for threat actors who want to hinder an organization’s IT infrastructure. Once a virus finds its way through one endpoint, such as a business workstation, it spreads through email messages or sharing of infected files across the network.

Ransomware

A ransomware attack involves a hacker taking control of computers and servers and then locking authorized users out. Access can only be regained by paying the hackers a ransom. Worse yet, control may not be given back even after the ransom is paid.

Phishing

Phishing attacks are a little subtler than viruses, malware, and ransomware in that they trick users into sharing sensitive information, including credentials, financial information, and valuable intellectual property through social engineering techniques. Your employees are misled by professional looking emails and slick websites that look like the real deal but were designed to deceive and collect sensitive data.

Distributed Denial of Service (DDoS) Attacks

The server that hosts a company’s website gets many requests from other computers that it responds to. Threat actors launch a DDoS attack by sending millions of fake requests which overwhelms the server – all its focus and processing power is trying to respond to each of these phony requests and it becomes unable to provide access to real users.

Your Own Employees

Unfortunately, your own people can present a threat to your cybersecurity, most often through human error. If an employee fails to practice adequate security hygiene by neglecting to properly protect their credentials by connecting remotely via an VPN, threat actors can weasel their way in and gain increasing levels of access to more sensitive areas of your network and key systems.

Sometimes breaches can be physical because someone accidently leaves their device unattended while working on the road or leaving a door open to a server room. Worse yet is when a disgruntled employee decides to misuse their credentials for their own profit and steak intellectual property, customer data or financial information.

Assess, Protect and Respond

SMBs must mirror their larger counterparts if they want to avoid cyberattacks and be proactive. It’s critical that you assess your security posture, implement the capabilities to protect users, customers and data, and be prepared to respond to any threat to mitigate it and reduce the risk to your business operations and your reputation.

  • March 14, 2024
  • Catagory Data Protection

Protect Your Backups from Ransomware Infections

By : Justin Folkerts

Your backups are not immune to ransomware – infected data can be replicated, so it’s important to configure your data protection so that mission critical information isn’t corrupted and clean copies can be easily restored.

Ransomware is sneaky, and it’s cross-platform. It can sit in in your backups – whether it’s an email, PDF, or Zip file, among many others – waiting to go off. And ransomware attacks don’t discriminate, either. Small and medium-sized organizations are just as viable a target for threat actors as large enterprises.

Ransomware starts with one computer, encrypting some or all its valuable data, but it can easily spread across the network, making all users susceptible and all systems potentially unusable. If ransomware corrupts a critical database, it can cripple your organization, which is why you must protect all your backups.

Preventing dangerous duplicates

If your backups are infected by ransomware, they are no more useful than your primary data – your restoration will just ignite a reinfection.

Protecting your backups from ransomware always starts by preventing users from downloading dangerous files that are riddle with malware, viruses, and ransomware. If a nefarious file does get through due to clever phishing and human error, you must make sure infections can’t be transmitted across your network through file sharing and syncing.

Most of all, you must prevent ransomware from accessing your backups at all costs. Although it’s impossible to fully protect your backups from threats, including ransomware, applying the right rules and leveraging smart software can minimize the likelihood of your backups getting infected.

Follow tried-and-true backup rules

The well-established 3-2-1 rule for backups continues be a good strategy for preventing ransomware infection of replicated files – you should have your original copy of a file, a duplicate that is stored on-site on a different medium, and a copy that is stored off-site. It is recommended that your on-site copy be stored on removeable media, such as tape.

Each of your backups requires a different approach – if you use tape, you should do a full backup rather than a differential or incremental backup. Your onsite tapes should be stored in a secure, fireproof location.

Using versioning for your backups can also prevent ransomware from infected all copies of your data – it saves a new version of the file as backup rather than wiping out the previous backup so you can return to an uninfected iteration, allowing you to easily roll back to a clean copy.

Roll backs are where software tools can help prevent your backups from being infected with ransomware as they can help manage versioning. However, your strategy is just as important as the tools. If you do a complete backup to on-site tape daily outside of office hours, you can back up the most current version. Even if ransomware hits the next day when users are likely to trigger it, you only lose that day.

Once the full backup is restored, you can review the offsite incremental backups done throughout the day to restore specific files with the latest and greatest versions.  

Another strategy is to distribute your backups – by having separate backup systems for different types of data you can reduce the likelihood of ransomware spreading between them.

User endpoints are ransomware’s first target

No matter your backup strategy, protecting your endpoints is always your first line of defence when combatting ransomware. Endpoint data protection combined with employee cybersecurity awareness and training will contain ransomware within the first infected machine, reducing the likelihood of it infecting your backups.

  • February 15, 2024
  • Catagory Security

Are you ready to respond to an inevitable security breach?

By : Sanjeev Spolia

Prevention is worth a pound of cure, but when a security breach is inevitable, preparation is just as valuable. A thorough assessment guides your deployment of data protection tools and sets up you up for an effective response that mitigates any impact to your business.

Threat actors are now trying to break down your proverbial door on a regular basis – an attempted security breach is not no longer an unusual, occasional occurrence. Rather than solely focusing on preventing a breach completely, your security strategy should also look at how you can minimize the impact of an incident quickly and effectively.

If you want to bolster your security and build resilience against today’s bad actors, you need a three-pronged approach that assesses, protects, and responds.

Assess your strengths and weaknesses

If you want to thwart any attack you must start where you are. With the help of a managed services provider, you should scan your network, conduct penetration testing, and establish clear IT policies. These essential steps will help you form the foundation of your security strategy so you can protect data and respond to the inevitable attack.

Protect your critical assets

Your assessment will help you prioritize what data needs to be protected – not everything you store is mission critical – and allow you to strike a balance between protection and productivity to ward against viruses, malware, ransomware, insider threats and human error.

Protecting your sensitive data from threat actors who want to sell it or cripple your business operations requires cloud-based Next-Generation Antivirus technology that combines behavioral detection, artificial intelligence, and machine learning algorithms to anticipate and prevents threats. Your firewall provides an essential layer of protection for your network and your endpoints.

Your data protection strategy also provides redundancy – because it’s not a matter of if you but when you experience a data breach or disruption to your operations. Having redundancy, including cloud backups, enables you to quickly restore mission critical data and applications in the event of any incident.

Automate, respond, and mitigate

Your security team can’t keep up with every alert – you need to automate your security if you are to proactively protect your network infrastructure across every endpoint.

Technology such as extended detection and response (XDR) collects threat data from your data protection to provide you with actionable, enriched threat intelligence to help your security teams prioritize, hunt, and eliminate threats quickly and efficiently. A vulnerability management platform, meanwhile, provides complete visibility and automatically discovers your assets as they come online.

Your security response to constant attacks by bad actors is made possible by your initial assessment and the data protection tools you put in place – they set you to effectively respond to any attack, quickly and decisively.

  • January 30, 2024
  • Catagory privacy

Are you Ready for Major Privacy Legislation Changes?

By : Sanjeev Spolia

The Canadian federal government is getting close to passing updated privacy legislation that will impact how you govern the personal information you are storing as well as address the impacts of artificial intelligence (AI).

These changes began more than a year ago and are expected to pass this year or in early 2025, including new privacy legislation that will make significant changes to the Personal Information Protection and Electronic Documents Act (PIPEDA).

Three Key Acts

Bill C-27 lays out a new statutory framework governing personal information practices in the private sector, and includes three new statutes:

Consumer Privacy Protection Act (CPPA): If Bill C-27 passes, this act would repeal and replace the private sector personal information protection framework in PIPEDA. This new privacy legislation would essentially replace PIPEDA with new requirements governing the protection of personal information.
Personal Information and Data Protection Tribunal Act: Under this act, an administrative tribunal would be established to review certain decisions made by the Privacy Commissioner of Canada and impose penalties for contraventions of the CPPA, which is a substantially enhanced enforcement regime when compared with that of PIPEDA.
Artificial Intelligence and Data Act (AIDA): This act would create a risk-based approach to regulating trade and commerce in AI systems.

CPPA would require that organizations implement a privacy management program that includes policies, practices, and procedures to ensure compliance. The act reinforces express consent for the organization to process personal information, although it does outline exceptions under certain circumstances.

Severe Penalties for Non-Compliance

The fines for not complying with CPPA are hefty – as much as $25 million and the amount corresponding to 5% of gross global revenue for the preceding fiscal year. Law firm Osler advises that organizations could also be subjected to administrative monetary penalties of up to the greater of $10 million and the amount corresponding to 3% of gross global revenue for the preceding fiscal year.

Regional Legislation is Also a Factor

If you’re doing business in Quebec, you must also comply with the Quebec Privacy Act, recently reformed by Bill 64, that includes an enforcement regime with potentially severe financial penalties for contraventions that are similar to CPPA.

Quebec’s legislation also requires organizations to create an internal policy suite to address the lifecycle of personal information they store and process.

Navigating data privacy legislation has become another cost of doing business – organizations are responsible for understanding which rules apply to them when operating across Canada and globally.

The many compliance obligations required by government privacy legislation can seem overwhelming, but a managed services provider can help you maintain the necessary IT infrastructure and best practices to secure and protect customer data.

  • December 28, 2023
  • Catagory Security

5 Security Trends to Watch in 2024

By : Justin Folkerts

Artificial intelligence (AI) and geopolitical instability will continue to disrupt businesses in 2024 and put pressure on their cybersecurity strategies to keep pace.

AI is an enemy and an ally

The bad news is that threat actors will continue to use AI, including generative AI, to try to steal your data and compromise your IT infrastructure through smarter social engineering. But even as AI-assisted attacks are expected to increase in 2024, security providers are going to leverage AI to improve cybersecurity tools.

More compliance obligations

You can expect the internet to get more regulated which means you will have more obligations as part of your efforts to secure your data. The UK recently passed its Online Safety Law, and Canada is working on similar legislation. This past year the European Union and the Federal Communications Commission both recommended additional data breach reporting requirements to be introduced in 2024.

Quantum encryption is coming

While it’s several years away, quantum computing will likely be able to thwart today’s encryption, so efforts are already underway to counter the threat through hardware-based protection that will require a transformation of existing IT infrastructure.

Beware nations, not just thieves

Nation states will invest in new technology such as AI and quantum computing to create and distribute malicious tools to not only achieve more scale, but also increase deniability. Expect “ransomware-as-a-service” to be expanded to more attack surfaces. The amount of investment necessary exploit these technologies will also see governments look to assist small and medium-sized businesses with their security investments in 2024 – Australia and the U.S. have already begun.

Get ready to fight on the mobile front

Security strategies in 2024 are poised to be mobile-first as mobile apps have become so dominant. Even with Runtime Application Self Protection (RASP), it’s still easy for threat actors to turn mobile apps into weapons to attack backend systems and APIs. The year ahead will require increased adoption of mobile security.

These aren’t the only things organizations need to worry about going into 2024, so tapping into the expertise of a managed service provider with a focus on security should be your top resolution of the new year.

  • November 29, 2023
  • Catagory Data Protection

How AI and Machine Learning Will Impact Your Cybersecurity in 2024

By : Sanjeev Spolia

There are many ways artificial intelligence (AI) and machine learning already impact cybersecurity. You can expect that trend to continue in 2024 – both as tools for data protection as well as a threat.

Even as you implement AI and machine learning into your cybersecurity strategy through the adoption of tools like Security Orchestration, Automation, and Response (SOAR), Security Information and Event Management (SIEM) and Managed Detection and Response (MDR), so are threat actors. They will continue to update and evolve their own methodologies and tools to compromise their targets by applying AI and machine learning to how they use ransomware, malware and deepfakes.  

With small and medium-sized businesses just much at risk as their large enterprise counterparts, SMBs must take advantage of AI and machine learning as mush possible. AI-directed attacks are expected to rise in 2024 in the form of deepfake technologies that make phishing and impersonation more effective, as well as evolving ransomware and malware.

Deepfake technologies that leverage AI are especially worrisome, as they can create fake content that spurs employees and organizations to work against their best interests. Hackers can use deepfakes to create massive changes with serious financial consequences, including altering stock prices.

Deepfake social engineering techniques will only improve with the use of AI, increasing the likelihood of data breaches through unauthorized access to systems and more authentic looking phishing messages that are more personalized, and hence, more effective.

If hackers are keen on leveraging AI and machine learning to defeat your cybersecurity, you must be ready to combat them in equal measure – just as AI and machine learning will create new challenges in 2024, they can also help you bolster your cybersecurity. While regulations are being developed to foster ethical use of AI, threat actors are not likely to follow them.

AI will also affect your cyber insurance as your providers will use it to assess your resilience against cyberattacks and adjust your premium payments accordingly. AI presents an opportunity for you to improve your cybersecurity to keep those insurance costs under control.

There’s a lot of doom being predicted around the growing use of AI and machine learning. And while it does pose a risk to your organization and its sensitive data, you can use it to bolster your cybersecurity even as threat actors leverage AI to up the ante. A managed service provider with a focus on security can help you use AI and machine learning to protect your organization as we head into 2024.

  • October 26, 2023
  • Catagory Data Protection

Artificial Intelligence Will Bolster Data Security in the Long Term

By : Justin Folkerts

Artificial intelligence (AI) is a threat to your organization’s data security, but it also a critical tool for defending it.

Just as business intelligence has become embedded in software tools and enables you to ride the ups and downs of your industry, AI is getting embedded in cybersecurity solutions to combat increasingly sophisticated threat actors.

This sophistication combined with evolution of connected organizations, including remote work, means attack surfaces are getting larger. Hybrid environments where people are working from home and office via different networks are appetizing targets for hackers. When there are so many devices operating on your network, there’s bound to be some that go unmanaged, and hence are unsecured.

Generative AI is making phishing scams harder to detect, and most data breaches are already due to employees not recognizing fake emails. Even though AI helps threat actors be more deceptive than ever, it can help to automate security so that you can more quickly respond, mitigate, and recover from a data breach.

Detecting patterns has always been a core capability of security solutions, and AI makes this capability more robust so that it can be more preventative – it will advise you of potential breaches, as well as help you set policy and automate tasks to lessen the burden for your IT staff, including the onboarding of new employees and managing their access. AI can even help you set policy as to how your employees are allowed to use AI, including ChatGPT.

If you’re nervous about AI and how will affect your business, including its data security, there’s good news in that it can be a net positive thanks to the many productivity gains. Already it’s become clear that security analysts can’t keep up with every alert and every security threat, so AI and automation are necessary to handle them at scale.  

In the longer term, AI is going to be an essential tool for discerning between legitimate activity and security threats. As generative AI becomes more sophisticated and bad actors exploit it to fool unsuspecting users, AI is also going to be able to detect these attempts and allow for immediate, decisive action to prevent data breaches before they happen.

Organizations will also need to deploy fewer security tools as AI capabilities will be consolidated into interoperable security platforms that will reduce the number of vendors and policies that must be managed.

Even as AI streamlines and fortifies your security, it’s still not going to be your core business. A managed service provider can help you navigate the dynamic changes ahead so you can effectively leverage AI to bolster your data security.

  • August 17, 2023
  • Catagory Identity Management

Implement These Key Technologies to Improve Your Cybersecurity

By : Justin Folkerts

As attack surfaces flourish and put identities and endpoints under increasing threat, there are several key cybersecurity technologies you can’t do without.

The good news is that even though managing security can seem overwhelming in today’s dynamic digital landscape, many of these cybersecurity technologies are being integrated and consolidated to improve management and overall visibility.

Manage and protect your endpoints

With the maturation of the internet of things (IoT) and a hybrid workforce, you must make protecting endpoints a priority. Endpoint detection and response (EDR) enables you to detect and respond to advanced threats by using behavioral analysis to detect attacks in real time. It allowes security analysts to proactively detect and respond to ransomware and other attacks that signature-based antivirus applications tend to miss.

Endpoint protection platforms (EPPs), meanwhile, enable you to integrate your technology stacks so that you can scale and cover your ever-growing number of endpoints, as well as handle newer types of threats, including the latest malware. EEPs are leveraging artificial intelligence and machine learning to anticipate threats before they can gain a foothold within your network.

Unified endpoint security (UES) pulls together various endpoint security tools into a single platform so you can better protect all your endpoints, including servers, PCs, and mobile devices. The unification provided by UES improves overall visibility.

One of the most common endpoints today are mobile devices, which be protected with mobile threat defense (MTD) to thwart real-time zero-day threats, phishing, and other attack techniques that look to steal identities and gain privileged access.

Secure the edge

Because most organizations have seen a proliferation of endpoints, they are likely grappling with the ramifications of edge computing, including the cybersecurity challenges it raises. Coupled with the increase in cloud computing, it’s important to implement a secure access service edge (SASE) framework, which combines software-defined wide area networking (SD-WAN) and Zero Trust security solutions into a unified cloud-based platform.

SASE securely connects users by giving them access based on their identity and devices, securing them no matter where they work. SASE is cloud-native, delivering both infrastructure and security solutions via the cloud, protecting all edges whether it is physical, digital, and logical.

A secure service edge (SSE) protects Software-as-a-Service (SaaS), web, and private applications by integrating a secure web gateway (SWG), cloud access security broker (CASB) and zero-trust network access (ZTNA) into a single cloud platform. SSE is another example of platform that unifies different tools to simplify management, as well as better support remote users.

Confirm identities

Authorized user access must be robust, which is why micro-segmentation is a critical cybersecurity practice. It limits lateral movement during a breach by segmenting workloads by identity, so that even if a threat actor obtains access through compromised credentials, there’s only so many places they can go, thereby mitigating the impact of the attack.

Because critical identity systems are increasingly vulnerable, it’s also critical to implement identity threat detection and response (ITDR) to safeguard your identity infrastructure from sophisticated attacks.

The cybersecurity stack is getting more complex and must scale with the rest of your IT infrastructure and cloud deployments. A managed service provider with a focus on security can help evaluate your immediately requirements for bolstering your cybersecurity as well as implement a long-term strategy that aligns with your business goals.

  • June 29, 2023
  • Catagory cloud backup

Are You Confident in Your Cloud Security?

By : Justin Folkerts

If you don’t feel you’ve put enough effort in cloud security, you’re not alone.

A recent survey released by Telus found that Canadian organizations only set aside 34 per cent of their cybersecurity budgets for cloud security, while nearly all admit that if they had to do it all again, they would have spent more time security when they began their migration to the cloud, especially on threat and risk.

Respondents would have also spent more time on monitoring and detection, as well as threat prevention controls.

All this regret around cloud security may explain why the 511 cybersecurity professionals surveyed by Telus are planning to increase spending by 22 per cent in 2023. Conducted with IDC Canada, the survey spans a wide range of Canadian industries and organizations, with more than half identifying as very knowledgeable about cybersecurity, with the remainder identifying as knowledgeable.

While security knowledge ranks well among respondents, only 37 per cent of the organizations surveyed report having dedicated cloud security professionals, while nearly as many – 33 per cent – are finding that staffing for cloud security skillsets is the most difficult of all cloud specialties to find.

Not many – 14 per cent – are storing their most valuable data in the cloud, which aligns with the confidence in cloud security, as 57 per cent of organizations believe their cloud environments are very or completely secure, but only 38 per cent of respondents said their organizations uses multi-factor authentication (MFA) to secure their cloud environment.

Approximately one third of respondents cited a lack of tools to monitor, detect, and respond to cyber threats was a major gap in their cloud environments, while a whopping 89 per cent said their organization had experienced a cloud security incident. (An incident is defined as an event with the potential to compromise confidentiality, availability, and/or integrity of computer networks, systems, or data.)

On average, the Telus survey found that organizations had experienced four to five cloud security incidents a year, with nearly half of the most damaging incidents spreading to on-premises environments. These incidents could be attributed to misconfigurations, human error, and known vulnerabilities.

Not surprisingly, respondents are using more than one cloud service provider – the average was up to 8.5, with infrastructure-as-a-service providers such as Amazon AWS, Google Cloud Platform and Microsoft Azure being the most used.

The Telus report makes several recommendations for those responsible for security in their organization. Chief among them is to not underestimate the value of frameworks like NIST, ISO/IEC 27001 or others. Others include:

  • Provide IT / security staff with comprehensive cloud security awareness training
  • Enable and configure any included security controls offered by your cloud service provider
  • Conduct regular security audits and assessments
  • Deploy MFA

Given all the cloud providers organizations use as well as the challenges in finding security specialists, you might consider seeking out a managed service provider who can help you bolster your cloud security, improve your overall posture and help you adhere to the Telus survey recommendations.