Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Do we need XDR? | Ka ...

 Business

Lately, it has become more commonplace to advise large organizations to choose XDR solutions to protect their infrastructure. However, a lot of people dont completely understand what XDR is and what it really does. In this post, I will answer some basic questions about XDR to help you to figure out if your   show more ...  

organization would benefit from implementing it. Whats wrong with the traditional protection? Traditionally, it was the endpoints — servers and workstations — that were protected first from cyberthreats, and ultimately this became a fundamental step when it came to combating complex cyberattacks. Organizations also used basic network protection or installed advanced protection tools to close just one potential attack vector — for example, on just the endpoints (EDR solution) or the network (NTA solution), etc. But todays cybercriminals are increasingly taking a multivector approach to staging their attacks, while using multiple entry points to the infrastructure, lateral movement through the network, a variety of attack tactics and techniques, and social engineering. All these factors broaden the attack surface and make it harder to investigate and respond. And to combat these kinds of cyberattacks, organizations needed a new tool with a comprehensive approach to building defense. What is XDR? XDR stands for Extended Detection and Response. Extended means that threats are detected and remediated not just at the endpoint level (PCs, laptops and servers), but also beyond. In other words, an Endpoint Detection and Response (EDR) solution that is responsible for detecting and countering threats at the endpoints level — the core element of XDR technology — is supplemented with different information security tools from the same vendor. In addition, these tools are closely integrated with one another and add additional scenarios that strengthen the process of combating complex cyberthreats. What does XDR include? The type and quantity of tools that are connected to an XDR solution depend directly on how many tools a given vendors portfolio contains and how integrated they are with one another. These could be, for example, products designed to protect mail, web, the network, cloud infrastructure, identity and so on. XDR also may be integrated with threat Intelligence tools — for example, threat data feeds and the platform to manage this data (Threat Intelligence Platform). XDR may also include the portal with  search capabilities for cyberthreatss details and dependencies lookup. It gives the IT-security expert additional context, which is important to have when investigating cyberincidents. In general, today the XDR concept is the embodiment of the modern economic trend in information security — ecosystems. Does implementing XDR mean all our previous security efforts were in vain? Not necessarily. There are two types of XDR solutions on the market: native and hybrid. Native solutions are a good choice if you are creating your protection from scratch or continuing to scale up products that come from a single vendor. Hybrid solutions allow for integration with information security solutions from third-party providers, so whatever money you spent before wont go out the window. Isnt XDR just yet another marketing trick invented by analysts? No — its just the opposite: leading analyst research companies recognized the concept and name XDR after this category of solutions had been created on the market. The concept appeared as information security products and market needs evolved. These days, customers need more than a unified set of infosec tools by the same vendor. They also expect other benefits from this unification — for example, in the form of cross-product scenarios, process automation, resource saving and liabilities reduction. An XDR solution encompasses all these features. What is the value of XDR for businesses? First, amid a global shortage of information security experts, XDR provides holistic protection for an expanding, changing IT infrastructure against a rapidly evolving cyberthreat landscape. Second, XDR simplifies the jobs of valuable, scarce resources such as IT-security specialists and engages them in the process of working with incidents. Third, XDR helps minimize the mean time to detect and mean time to response (MTTD and MTTR). This is crucial for combating complex threats and targeted attacks, where quick actions taken by the IT-security experts reduce the attackers chances of achieving their goal and inflicting financial or reputational damage to an organization. So even if you have limited expert resources, you can protect your organization from complex cyberattacks because XDR offers: Increased automation; The use of a single console; A single data lake environment; Close interaction between the iIT-security tools as a part of XDR and joint scenarios; A coherent picture of what is happening in the infrastructure; Built-in enrichment with trustworthy, relevant threat intelligence data; Superior prioritization of incidents; Fewer false positive alerts. Do you have an XDR solution? Our enterprise-level security solutions working in conjunction provide XDR capabilities to your companys cybersecurity experts. Thanks to seamless interoperability our products allow your organization to control all key entry points to your infrastructure, increase visibility and provide centralized defense. If you want to learn more please visit Kaspersky Expert Security web page.

 Malware and Vulnerabilities

A never-before-seen Micropsia malware variant is making rounds on the Internet. Discovered by Deep Instinct’s Threat Research team, the malware is named Arid Gopher and is attributed to Arid Viper (APT-C-23) threat actor group. 

 Emerging Threats

EDoS attacks exploit the elasticity of clouds, particularly auto-scaling capabilities, to inflate the billing of a cloud user until the account reaches bankruptcy or large-scale service withdrawal.

 Trends, Reports, Analysis

Experts point out that the open-source method only works because we trust each other. When that trust is broken, no matter for what cause, then open-source's fundamental framework is broken.

 Govt., Critical Infrastructure

Attending the meeting in Washington DC were Merrick Garland, the attorney general of the United States, and his Canadian counterpart, David Lametti, Canada’s attorney general and minister of justice.

 Trends, Reports, Analysis

The number of complaints received by the FBI IC3 in 2021 (847,376) has surpassed that of complaints in 2020 (791,790), and the total monetary loss suffered by victims ($6.9 Billion) has far outstripped losses suffered in 2020 ($4.2 Billion).

 Threat Actors

The Lapsus$ group, also tracked as DEV-0537, deploys the RedLine password stealer to get access to session tokens and passwords. It buys session tokens and credentials from underground forums. These credentials are used to access VPN, RDP, and VDI systems.

 Malware and Vulnerabilities

According to Trustwave, the email campaign distributing Vidar is not very sophisticated. The email contains a generic subject line and an attachment, "request.doc," which is actually a .iso disk image.

 Feed

Ubuntu Security Notice 5347-1 - It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use this issue to bypass authentication using incomplete credentials.

 Feed

Red Hat Security Advisory 2022-0992-01 - Twisted is a networking engine written in Python, supporting numerous protocols. It contains a web server, numerous chat clients, chat servers, mail servers and more. Issues addressed include a denial of service vulnerability.

 Feed

Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. This is the source code release.

 Feed

Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. Nick Gregory discovered that the Linux kernel incorrectly handled network offload   show more ...  

functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5346-1 - It was discovered that the ICMPv6 implementation in the Linux kernel did not properly deallocate memory in certain situations. A remote attacker could possibly use this to cause a denial of service.

 Feed

Red Hat Security Advisory 2022-0996-01 - OpenStack Networking is a virtual network service for OpenStack. Just as OpenStack Compute provides an API to dynamically request and configure virtual servers, OpenStack Networking provides an API to dynamically request and configure virtual networks. These networks connect   show more ...  

'interfaces' from other OpenStack services. The OpenStack Networking API supports extensions to provide advanced network capabilities. Issues addressed include a memory leak vulnerability.

 Feed

Red Hat Security Advisory 2022-0999-01 - OpenStack Compute is open source software designed to provision and manage large networks of virtual machines,creating a redundant and scalable cloud computing platform. It gives you the software, control panels, and APIs required to orchestrate a cloud, including running   show more ...  

instances, managing networks, and controlling access through users and projects.OpenStack Compute strives to be both hardware and hypervisor agnostic, currently supporting a variety of standard hardware configurations and seven major hypervisors. Issues addressed include an open redirection vulnerability.

 Feed

Red Hat Security Advisory 2022-1039-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Issues addressed include privilege escalation and traversal vulnerabilities.

 Feed

Ubuntu Security Notice 5345-1 - Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, obtain sensitive information, cause   show more ...  

undefined behaviour, spoof the browser UI, or execute arbitrary code. It was discovered that extensions of a particular type could auto-update themselves and bypass the prompt that requests permissions. If a user were tricked into installing a specially crafted extension, an attacker could potentially exploit this to bypass security restrictions.

 Feed

Red Hat Security Advisory 2022-1040-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Issues addressed include privilege escalation and traversal vulnerabilities.

 Feed

Red Hat Security Advisory 2022-1041-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Issues addressed include privilege escalation and traversal vulnerabilities.

 Feed

Red Hat Security Advisory 2022-1042-01 - Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Issues addressed include privilege escalation and traversal vulnerabilities.

 Feed

A new large scale supply chain attack has been observed targeting Azure developers with no less than 218 malicious NPM packages with the goal of stealing personal identifiable information. "After manually inspecting some of these packages, it became apparent that this was a targeted attack against the entire @azure NPM scope, by an attacker that employed an automatic script to create accounts

 Feed

VMware on Wednesday released software updates to plug two critical security vulnerabilities affecting its Carbon Black App Control platform that could be abused by a malicious actor to execute arbitrary code on affected installations in Windows systems. Tracked as CVE-2022-22951 and CVE-2022-22952, both the flaws are rated 9.1 out of a maximum of 10 on the CVSS vulnerability scoring system.

 Feed

Authentication services provider Okta on Wednesday named Sitel as the third-party linked to a security incident experienced by the company in late January that allowed the LAPSUS$ extortion gang to remotely take over an internal account belonging to a customer support engineer. The company added that 366 corporate customers, or about 2.5% of its customer base, may have been impacted by the "

 Feed

A 23-year-old Russian national has been indicted in the U.S. and added to the Federal Bureau of Investigation's (FBI) Cyber Most Wanted List for his alleged role as the administrator of Marketplace A, a cyber crime forum that sold stolen login credentials, personal information, and credit card data. Igor Dekhtyarchuk, who first appeared in hacker forums in 2013 under the alias "floraby," has

 Feed

A Chinese-speaking advanced persistent threat (APT) has been linked to a new campaign targeting gambling-related companies in South East Asia, particularly Taiwan, the Philippines, and Hong Kong. Cybersecurity firm Avast dubbed the campaign Operation Dragon Castling, describing its malware arsenal as a "robust and modular toolset." The ultimate motives of the threat actor are not immediately

 Feed

Before hunting malware, every researcher needs to find a system where to analyze it. There are several ways to do it: build your own environment or use third-party solutions. Today we will walk through all the steps of creating a custom malware sandbox where you can perform a proper analysis without infecting your computer. And then compare it with a ready-made service. Why do you need a malware

 Apple

A Russian bank tells its customers to stop installing security updates, an Apple employee ends up in hot water, and learn our tips to avoid being virtually kidnapped. All this and much more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Anna Brading.

2022-03
Aggregator history
Thursday, March 24
TUE
WED
THU
FRI
SAT
SUN
MON
MarchAprilMay