Unveiling the Financial Fortitude and Strategic Directions of Palo Alto Networks Inc (PANW)

Decoding Palo Alto Networks Inc (PANW): A Strategic SWOT Insight

Palo Alto’s announcement strategy shift to platformization is a move that will accelerate the firewall and cybersecurity wars.

Palo Alto Fires Firewall Shot Heard ‘Round The World

Get the most recent info and news about PALO ALTO NETWORKS INC on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

Palo Alto Networks, Inc. provides security platform solutions worldwide. The company provides firewall appliances and software; Panorama, a security management solution for the control of appliances deployed on an end-customer's network as a virtual or a physical appliance; and Virtual System Upgrades, which are available as extensions to the virtual system capacity that ships with physical appliances. It also offers subscription services covering the areas of threat prevention, uniform resource locator filtering, malware and persistent threat, laptop and mobile device protection, and firewall, as well as cyber-attack, threat intelligence, and content control. In addition, the company provides support services; and professional services, including architecture design and planning, configuration, and firewall migration, as well as online and classroom-style education training services. Palo Alto Networks, Inc. sells its products and services through its channel partners, as well as directly to medium to large enterprises, service providers, and government entities operating in various industries, including education, energy, financial services, government entities, healthcare, Internet and media, manufacturing, public sector, and telecommunications. The company was founded in 2005 and is headquartered in Santa Clara, California.

PALO ALTO NETWORKS INC

Where to start with the rapid growth of the tech industry? Many have debated that the roof of the technology sector has been reached in the last few years. With the visible continued development and growth, investors can all see that the technology revolution is only starting. The leading companies in the tech industry aim to evolve by updating different sectors of the industry. While AI is the focal talk point at the moment, other leaders in green energy and the Internet of Things are taking great leaps to improve and excel within their realm. Many starting investors stated that they have missed the opportunity to gain financially from the rapid growth. This, however, is not true. The leading companies within the industry have announced that the growing sector of technology is only at the starting phase. The Growth and Development in the Last Year There have been doubts about the industry and whether or not they will grow as much as they have over the years. The massive layoffs that many companies have seen created doubts among specialists in the technology sector. The layoffs have been, according to a specialist, due to the pandemic. Covid caused a lot of companies to have expenses such as extra working computers, wifi routers, and other office necessities that were sent to all staff working from home. With light at the end of the tunnel, tech companies have realized that they have the opportunity to grow the industry at a rapid pace, which will create the same job opportunities that once were available within the industry. With the use of and many other online platforms, tech companies can grow sectors within the industry by improving their online usage. virtual events There has been a massive dollar investment from outside sources into technology development. And according to the , the occupation within the technology sector will grow another 15% by 2021. U.S. Bureau of Labor Statistics The key factor to consider is that this sector consists of more than just AI or the social media platforms we use daily. The Four Leading Tech Companies There are a few industry leaders that small investors can focus on. These companies are leading the technology revolutions and working to create a stronger and better future for all. These four giants are not all solely honed in on AI but focus on cybersecurity, cloud development, green energy, and the Internet of Things. Microsoft (MSFT: NASDAQ) is well known for its resilience and 40 years of running. Microsoft revenue has been up by 12%, reporting an increase of $51.9 billion. The company focuses on more than just building computers. 70% of organizations use their cloud service provider. Microsoft Microsoft takes pride in its ability to increase and enhance the use of digital technology. The organization offers multiple software solutions. These solutions are targeted to businesses to improve the way companies enhance their companies. Brookfield Renewable Corp. (BEPC: NYSE) is a company that strives to produce green energy that will change the way the world thinks. The organization makes use of hydroelectric, wind, and solar power plans to produce clean energy. Brookfield Renewable Brookfield Renewable Corp is actively functioning on five continents. The team takes pride in its ability to generate and produce approximately 25 400 megawatts. The compy aims to develop stations that will increase their production to 110 000 megawatts of renewable energy. It is safe to say that the organization is not yet where they want to be; this, however, is a great sight for investors. The business is bound to grow as the technology sector enhances its capacity. Nvidia Corporation (NVDA: NASDAQ) is well-known in the computer industry. The company developed and created the very first graphics card named GPU. The organization is growing at a rapid pace. This allows the business to diversify its expertise, such as video games and the use of AI to create self-driving cars. Nvidia The company is moving forward by focusing on the potential that technology offers to not only businesses but to the individual that enjoy technology at home. The company had many failures in the past but showed its resilience by increasing not only its profit value but its stock value as well. Palo Alto Networks Inc (PANW) is a cybersecurity provider which enables enterprises, service providers, and government entities to have a secure platform. The platform will keep all data, applications, networks, and devices linked to it safe from cybercrime. Palto As technology grows, the opportunity for crime and theft grows. The organization aims to reduce cybercrime and ensure that all data is safe with them. With the technology revolutions on the rise and all industry leaders taking charge, this organization is prioritizing safety. This will allow all consumers to enjoy the developments at a safe pace. The company is not stopping anytime soon and is looking into multiple avenues to improve and grow its business. Final Thoughts The technology industry can be seen as one of the most saturated markets in the U.S. This should not prevent investors from investing in technology. The industry is growing at a rapid pace, and the leading companies are taking charge. The technology revolution is on us, and we can either shy away from the opportunities or indulge in the future that can be developed by technology. Industry leaders are proving that the best way forward is to indulge in the possibilities that technology brings to the table.

Where to Start with the Rapid Growth of the Tech Industry?

Today, announced a $6M Series A financing, led by Costanoa Venture Capital, with participation from existing investor Rally Ventures. As part of our investment, I have also joined Bugcrowd’s board of directors. Bugcrowd . In the short time since then, a number of large-scale breaches have occurred, including and . The problem continues to get worse, and companies are scrambling to protect themselves with the latest and greatest technologies. This problem has produced several notable startup successes including Palo Alto Networks, Splunk, and FireEye. However, despite their increased vigilance and spending on , there is one problem that chief information security officers (CISOs) can’t buy their way out of: talent. There are more than . I wrote about our interest in security in October the famous ‘Sony Hack’ a massive online bank robbery security technology 200,000 unfilled cybersecurity jobs and open job postings have increased by 74% over the past five years Pioneered by Netscape, and refined by large web companies like Google and Facebook, bug bounty programs have emerged as a way for security teams to leverage talent outside of their companies, and continue to gain mainstream adoption. By offering financial rewards to security researchers who discover vulnerabilities in their systems, organizations are able to harness the power of crowdsourcing to have more security experts, working on their behalf, exactly when they’re needed. While these programs have been in existence amongst large web companies for some time, running such a program has been very difficult for “the other 99%” of companies until very recently. Bug bounty programs not only require a unique software platform, but also the resources and expertise to review and process the high volume of submissions that a well-run program will generate. This is why Costanoa is absolutely thrilled to be partnering with Casey, Chris, and the rest of Bugcrowd team. Already counting Pinterest, Blackphone, Western Union and Aruba Networks among its customers, Bugcrowd gives companies of any size the ability to run bug bounty programs, and access to their globally distributed team of 15,000+ researchers. They have built a unique, end-to-end platform offering a turnkey solution for running and managing bug bounty programs, while also curating a diverse community of security researchers that are intelligently matched with companies based on their specific expertise. We are very excited about the profound impact that Bugcrowd is having on the security industry, and look forward to building a great company together. If your company is interested in getting started with a bug bounty program, learn more and get started . here For more information, read the press release . here By: Neill Occhiogrosso and Bucky Moore

Our Investment in Bugcrowd

First FireEye, then SUNBURST, and after that, SUPERNOVA. Here's why the SUNBURST incident is more alarming than the FireEye’s hack. A security company that got hack is like a doctor who got sick. While everyone is talking about the , “SUNBURST" (or “Solargate”) is more dangerous, which is a cyberattack that required patience, skills, and new thinking. And in all that, it FireEye incident created a wound that we previously overlooked. After discovering the SUNBURST malware, was revealed by security researchers as another backdoor found in SolarWinds software. This malware is a web shell that SUPERNOVA allowed attackers to run arbitrary code on machines running the software's trojanized version. It is already on the news but mostly for technical people. I want to make a more friendly explanation to understand why it is alarming and, more importantly, how to prepare for the next attack. First, they are related. (and SUPERNOVA) is an advanced malware that compromised the Orion® Platform of SolarWinds, an IT monitoring software company, according to a . SUNBURST blog post released 13 Dec 2020 FireEye Wait, why FireEye was the one who released the information, not SolarWinds? In short, you can think of Solarwinds as the “upstream” of the attacks, while When FireEye Inc a well-known cybersecurity company, their investigators immediately try to figure out how attackers got past their defenses. FireEye is one of the “downstream.” ., discovered that they were hacked this month , It is believed that the discovery is by accident. The investigator realized that it wasn’t just FireEye who got attacked but also discovered a vulnerability in a product made by one of its software providers, SolarWinds Corp. Technical Background (Simple Version) According to deep-dive reports published last week by multiple security companies: FireEye Palo Alto Networks Fortinet Microsoft McAfee Symantec Kaspersky US Cybersecurity and Infrastructure Security Agency ( ); CISA On infected systems, hackers compromised SolarWinds’s Orion IT monitoring and management software with a trojanized version of “ SolarWinds.Orion.Core.BusinessLayer.dll.” These embed the SUNBURST malware. Hiding in was then downloaded by booby-trapped updates legitimate software via official update channels over 18,000 computers. Infected machines would collect information about the infected company’s network, then wait 12 to 14 days, and then send it to a remote (C&C). command and control server SUNBURST would when infected for validation: execute the following steps Machine domain name validation. It checks the domain name of the compromised machine to ensure: - It doesn’t contain certain strings. - It is not a SolarWinds domain. - It doesn’t contain the string ‘test’. It validates that no analysis tools, such as WireShark, are running. It also checks to ensure that unwanted security software is not running. As you can see, SUNBURST is malware with intelligence to . If all of the validations are completed, it calls “home” to the attacker and sends information to identify the breached organization. check if it could successfully bypass security measures There are victims across different sectors, such as cybersecurity firms such as FireEye and And the worst part is, the list is still growing. local governments, schools, hospitals, banks, and telecom companies. Like and , big tech companies also confirmed installing the trojanized updates on their internal networks. Fortunately, they also specified that they did not find any evidence of escalation from the attackers. VMware Microsoft From the quality of the threat design, the range of techniques used, and its victims’ nature, this was a for sure. The malware was thoroughly crafted and secretly embedded in upstream suppliers’ legitimate software to finally hack the high-value assets downstream. nation-state scale attack Implications I read reports after reports. These are, from a security design perspective, beautiful attacks. It requires dedications of years of studying of the targets (probably with someone working with/from inside), with patience to find a way to bypass the monitoring of security analysts and skills to hide the code from the developers. Conceivably the most alerting character of the SUNBURST attack was how it propagated itself by This is the perfect storm much more influential by today's security policy's . installing itself as part of SolarWinds’ regular distribution and update operation. automation and fast patching practices The problem of trust again, but in a different thinking Knowing what companies are the SUNBURST victims won’t help explain the extent of the damage done. As the scale of attacks are so extensive and involves too many heterogeneous IT infrastructures from various supply-chains. It does, however, highlight . the fundamental problem of trust Supply-chain attacks rely on trust between suppliers and customers. There is no defense customers can implement against a compromised vendor or supply-chain that transfers legitimate code or services that are, in fact, jeopardized. Regular measures, such as only work if the reference (upstream) isn’t ravaged. If you consider , it is solely a special case of that concept of a chain of trust (signing is built on trust). Though, is more resilient in its community's proportion and interest . checksums and hashes, signed code open-source software but still not immune to such attacks The Mitigations You and your colleagues are probably preparing for the holiday, security professionals should know that this will not be the last one, and hackers will not take Annual leaves. What is more important is to To achieve that, it is a good time for me to re-introduce the Security Mindset when talking about mitigation. learn from it and prepare not to be the next Solarwinds or FireEye. Technology Pillar medium.com Integrating Security Mindset with PPT Framework Reintroduction of The 3 Pillars of Security Concept FireEye released on Github that can identify the SUNBURST malware last week, including the Security Vendors are catching up, and most of them had already released counter-measures for SUNBURST. countermeasures Indicators of Compromise (IOCs) and MITRE ATT&CK Techniques. , with collaboration with GoDaddy and Microsoft, released information about a killswitch: In the statement from FireEye As part of FireEye’s analysis of SUNBURST, we that would prevent SUNBURST from continuing to operate. identified a killswitch This killswitch will affect new and previous SUNBURST infections by that are still beaconing to avsvmcloud[.]com. However, in the intrusions FireEye has seen, this actor moved quickly to establish additional persistent mechanisms to access to victim networks beyond the SUNBURST backdoor. disabling SUNBURST deployments To detect malware as such, we may need a dynamic analysis tool like sandboxing in dedicated isolation. But hackers also know about it and developed malware with sandbox-aware validations. It then becomes between offense and defense. a cat-and-mouse game The first and second stages of impacts could be reduced soon with the joined efforts from the communities. Yet, relying on tools and advanced technology is only effective DURING the incident. While I am in line with most security vendors, we need to develop more innovative PDC solutions ; But “Adapt” cannot be put out of the picture. (Prevent — Detect — -Correct) Adaptation helps us respond better next time. In Technology Pillar, as this time, software defects are already presented, the fixes can only be applied to the last attack. How to adapt to a more approving response to the next war is more valuable. That’s why we should shift our focus to the other two pillars. Process Pillar Hackers would try to get Vendors and Partners become the possible targets and as a new way to penetrate. Attacks related to the , reported by access to your company using the already established highways. supply-chain rose 38% since the start of the pandemic Bitdefender (A Security Vendor) . This, in fact, is a wake-up call for security professionals to see what is missing in the past truly. All update processes from vendors should be reviewed, and consider monitoring is in place. Trust between vendors should not be taken for granted. Automation and patching were originally incorporated in the best practice of security operations; efficiency becomes the weapon. Therefore, implementing into security designs become necessary. the concept of “Zero-Trust” it clearly: Palo Alto Networks presented The Zero Trust model recognizes that trust is a vulnerability . Once on the network, users — including threat actors and malicious insiders — are free to move laterally and access or exfiltrate whatever data they are not limited to. Remember, the point of infiltration of an attack is often not the target location. with the development for testing updates and patches should become the norm. Implementing change control in update channels for live files to maintain a higher resilience against external sources. Segmentation from a production network While is resource-demanding, no one will underestimate the importance of that after the SUNBURST. With careful selection of data collection points by focusing on trust, building a tracking system could not be as resource-hungry as traditional log collection methodology. keeping a tap on the trusted processes It is worth considering to reach out to the company’s ecosystem It is as essential as internal procedures to reassess key partners’ risk. to ensure both internal and partners are still meeting all compliance requirements. People Pillar The hackers understand well the IT infrastructures of enterprises and As mentioned in Technology Pillar, the SUNBURST malware was splendidly obfuscated, fastidious in its use of steganography and diversion layers. the psychology of developers and operators. It is why it can bypass layers of security defense in SolarWinds, from hiding from developers' code review to not triggering alerts in behavior analysis of the security operation team. As a result, SUNBURST will produce another round in . No one is immune does not mean we are hopeless. It just likes what we are how we handle the COVID-19. the arms race between hackers and cybersecurity researchers Giving you a pill to cure Covid may not help you prevent the variants, as the virus is mutating. To prevent infections are still the best way to minimize the impact. We thus introduce the concepts of social distancing, frequent hand-washing. We keep washing our hands over the fear of the deadly viral pandemic yet fail to do basic things to our cyber self like security updates and use strong passwords. Regarding cybersecurity, what we need is a new way of thinking and the introduction of “Cyber-Hygiene. Cyber-Hygiene Bringing up the awareness of the importance of cyber hygiene goes a long way. Until you get the security basics right, all the fancy and most advanced technology in the world cannot protect us from cyber-attacks. is no surprise to experienced security professionals. Keeping the attack vector at minimal, continuing education, full visibility to the system, and patching and updating… these are all the basics. This fundamentals-first strategy Meanwhile, we relied heavily on advanced threat detection tools, AI-assisted SOC indicating the usefulness of those techniques, but do not help remove the cybersecurity risks. To put it in simple terms, good Cybersecurity hygiene should be the real “Silver Bullet” that can dramatically reduce the risk of the weakness link in the picture (the people pillar) . Final words Before that, there were attacks such as . SolarWinds Orion infected software updates are only the most current examples of software supply chain attacks. NotPetya and Havex Adversaries and ransomware groups will not wait too long in mounting as they have many vendor targets to choose from. their own software supply-chain attacks Absolutely we need to that bring up security issues in the dynamic and conflicting cybersecurity environment. We need to rethink the reconsider the growth of automated, continual distribution and patch practices balance between friction-less continuous deployment and layered security with verification in mind. Not just in how to fight this war, but in . How to processes with a security mindset, from internal to the vendor and in the complete supply chain. designing for resilience model the chain of trust and verification To cheer you up at the end of this story, we all know that we have had to adapt and grow to overcome the new security problems at every stage in our evolution with self-correction capabilities. The best aspect of SUNBURST, or the latest SUPERNOVA incidents, which will become old news like the others over time, is a highly evolved real tragedy of substantial impact. As a cybersecurity professional, on the side of good guys, we have to evolve ourselves by learning from this cyber-attack campaign, which is well-planned with years of effort; we must devote similar resources to our defenses. Thank you for reading — Happy reading and preparing well not to be the next Solarwinds. To know more about SUNBURST, please refer to and . the official statement CISA Alert (AA20–352A)

Why the SUNBURST Incident is More Alarming than the FireEye’s Hack

(This article is a collection of best practices and tips regarding securing containerized environments. And there is a previously published article about the K8S hardening.) https://hackernoon.com/how-to-harden-k8s-based-on-the-recent-updated-nsas-kubernetes-hardening-guide And Understanding How Containers Present Unique Security Challenges We all know that running cloud-based containers includes the flexibility of spinning applications up and down for users — or what we call “ ” and better integration with DevOps. They also provide cost-saving infrastructure compared with monolithic applications running on servers or virtual machines. WORA (write once, run everywhere) Different companies, big or small, are looking into how to run their business applications with this technology. As a result, the adoption of containerized applications is at an all-time high. According to the survey from the : Cloud Native Computing Foundation (CNCF) Kubernetes adoption among the ever-expanding cloud-native community is approaching 100%, meaning those investing in cloud-native are strongly bought in and excited for the future. The Container’s Threat Landscape When we look into the 243,469 K8S clusters are Kubernetes clusters also exposed port 10250, used by the kubelet as a default setting. As a result, recent data revealed by Shodan, publicly exposed. Furthermore, these attackers could scan the internet and find those clusters with minimum effort. Once the cluster is found, attackers could use the kubelet API as an entry point in targeting Kubernetes clusters to More impactful actions are possible, such as lateral movement to other internal resources, privilege escalation, and finally, jumping into the jewel💎 — the confidential data. mine for cryptocurrency. With more and more data in containers, so does the interest in cyberattacks targeting such applications. According to VMware’s “ 2022”, State of Kubernetes survey 97% of organizations have concerns about Kubernetes security. Redhat also provides similar data with their “ ”, saying that in their Kubernetes and container environments during the last 12 months. 2022 state of Kubernetes security report 94% of the respondents have experienced a security incident Akamai’s security researcher Larry Cashdollar launched an by setting up a standalone Docker as honeypot Dock to see how frequent and what kind of attacks would be recorded. The result is scary. He specifically configured the honeypot simply to look like a vulnerable cloud instance. exciting but alarming experiment In only 24 hours, the honeypot was leveraged by FOUR different cybercriminal campaigns! Containers and Kubernetes attacks are common, and organizations have difficulties protecting themselves. Meanwhile, the businesses are transforming, and even though there are security concerns, they are putting more and more data into them. 3 Main Security Concerns in Containers Although different, a container can still be compromised in many ways, just like traditional infrastructure. Therefore, I will highlight the most common container risk factor here. 1# Misconfiguration Based on the prediction of from their analysis, by 2025, 99% of cloud security failures will be the mistakes of customers. As you can imagine, containers are often deployed in very dynamic environments. Therefore, any misconfiguration, no matter access, networking, or other related settings, can lead to a stealthy security hole for users but not to cybercriminals. Gartner which are far less secure than customized, hardened settings. Attackers can find a problem in the default settings faster than understanding a new one. Smaller companies are generally using default configurations than large organizations. Basic misconfiguration accepts the default settings in the production environment, Such small mistakes can lead to expensive problems. When we look back into Sep 2021, published by the is the first known windows container malware and heavily obfuscated malware targeting K8S. According to the same research team, the primary purpose of Siloscape is to open a backdoor from poorly configured K8S clusters. As a result, the malware can further run malicious containers. Palo Alto Networks, Siloscape malware 2# Vulnerable Container Images Container images are static files with executable code that can be used to create a new container on a computing platform. Images are available via open-source repositories that are widely accessible online for easy download and deployment. What if someone uploads the pre-installed malware into images and plants it into the public repository? When someone deployed those images, the malware would be running on day-0 without any action from the attackers. It’s a specific type of supply chain attack. In 2020, a bug was found ( ) in the Containerd runtime software for complete container lifecycle management. By the time they obtain the token, they can disguise themselves as the author and take hostage of a cloud project. CVE-2020–15157 Adversaries could exploit it by creating specially-crafted container images to steal the host’s token, which they were pulled into a project. Another example of how attackers leverage malicious container images is illustrated by Team Nautilus, a threat research team from . They found Aqua Security five container images on Docker Hub used for mining cryptocurrency and as part of a supply chain attack specifically targeting cloud-native environments. 3# Zero-Day Vulnerabilities (+ Known CVEs) Perhaps zero-day vulnerabilities are a big problem for all software — and containers are no exception. Although cloud providers invest heavily in securing their platforms, it’s unavoidable that zero-day vulnerability can exist and put customers at risk. The most alarming example of this category is ,” found by Palo Alto Networks. Similar to Siloscape, Azurescpe is the first known vulnerability that could allow a user of a public cloud service to “escape” the environment (Microsoft Azure). “Azurescape This container escape is just an example of what known or zero-day vulnerabilities can impact a container environment. One public-facing hole could lead to a chain of exploits. When combined with a few misconfigurations, it would become a container takeover or even infiltrate other customers’ instances. about cloud-native and security usage found that report also stressed that some respondents stated they are prepared to take these risks to move faster and release applications quicker. A report in February by Sysdig 75% of containers contain high severity vulnerabilities. However, the Best Practices for Container Security Containerized environments can introduce distinctive challenges for visibility and application of security controls, but following a layered-security approach can significantly reduce the attack surface. The traditional approach of having a list of ‘bad’ things to look for won’t work in a container-based environment. Given the scalability and agility of these environments, organizations must be able to analyze the operational data in real-time and look for abnormal behaviors in runtime. 0# Continuous Improvement The first thing for container security is implementing security practices in the CI/CD pipeline and the entire build, store and deploy process of container images that include: Static Application Security Testing (SAST); Securely storing the container images, Vulnerability scanning for container images and; Enforce image content trust. Defense-in-Depth (DiD) in Containers The container security best practices don’t just include the delivered applications and then securing the container’s image itself, but the entire stack for building, distributing and executing the container. A layered approach should be followed. For starters, this includes: Cloud platform configuration The computing host (physical or virtual) The Operating System K8S cluster The container runtime Namespace The application code Each layer would have its own security controls. For example, keeping the cluster infrastructure up to date is always important. But for the purpose of this guide, I would skip the part that is outside the K8S cluster. 1# Role-Based Access Control (RBAC) RBAC is the frontline of defense in Kubernetes. It lets the user control who can access the API and their permissions. Official Kubernetes document provides detailed descriptions for . Although RBAC is enabled by default, simply having RBAC enabled is not sufficient. Authorization policies should be handled carefully and properly applied. Role-based Access Control (RBAC) Tips: Always use RBAC with the least privilege principle. As a baseline, we need to make sure That means using the RBAC policy to limit users and groups to only the actions and tasks they need. Also, confirm that the Kubernetes service and other user accounts have minimal privileges granted. not to give cluster-wide permissions and not give anyone cluster-admin privileges unless necessary. 2# Benchmarking and Remediation As stated above, Thus, to spot those misconfigurations, we need something to compare with. The Center for Internet Security (CIS) is the de-facto standard among various sources of best practices, benchmarks, and hardening guides, misconfiguration is the primary source of container-related attacks. the is the de-facto standard. Center for Internet Security (CIS) https://www.cisecurity.org/benchmark/kubernetes Whether it is a physical server where the Linux is installed as a platform for containers, a virtual machine provisioned on a cloud service provider, or an on-prem box, it may contain insecure out-of-the-box settings that no one knows. After all, we cannot assume that a cluster provisioned by a cloud provider is perfectly secured. Apart from K8S benchmarking, which is the most complex for cybersecurity professionals to review, CIS also provides similar checking for physical servers, especially Linux. and one specifically for Debian, Centos, Red Hat, and many other distributions. CIS has a benchmark for Distribution Independent Linux https://www.cisecurity.org/benchmark/distribution_independent_linux/ 3# Cloud Security Posture Management Benchmarking can be extended to cloud provider accounts, too. Developers may not have access to those settings, but it is equally crucial for the overall security of a containerized environment. It is different from the other settings as this part belongs to the management plane. A separate security control defined by Gartner for this area is called Initially, CSPM supported you in discovering and visualizing the IaaS and PaaS asset inventory. But it may be extended to help you save time and minimize risk across your entire cloud/container security stack. According to , CSPM should include the capabilities of: . “Cloud Security Posture Management” (CSPM) Gartner Continuous visualization of configurations Assets discovery, classification, and risk assessment Standard misconfiguration remediation and logging Compliance reports with security frameworks (e.g., PCI DSS, HIPAA, SOC 2…) 4# IaC Scanning IaC stands for Infrastructure-as-code, which refers to the technology and processes used to manage and provision infrastructure using code. Although IaC is not directly related to containers, it usually comes with DevOps. IaC simplifies DevOps processes such as peer reviews, version control, automation, and CI/CD delivery. IaC comprises resource declarations, input and output variables, configurations, and parameters. IaC is usually JSON, YAML, or HCL based, and a single file can contain all resources and configurations required to spin up a whole infrastructure, including: compute, storage, networking, identity access management, security, and more. Apart from its operational efficiencies, IaC can be employed to automate security processes and integrate them with DevOps as part of the transition to DevSecOps. However, IaC is a two-way sword. By provisioning cloud resources across environments with a unified, standard language, developers and operations can better readily remain on the same page and work together to secure cloud-native applications. However, it also creates hidden traps inside the code without review. IaC scanning software can parse standard cloud-native format templates. Then, they can set controls based on security best practices, providing developers or administrators with the knowledge of where they should apply further hardening to improve the security of the declared IaC environments. These tools can separate security problems such as: a Docker image initiated to run as the root user, a Kubernetes manifest that requests a node’s privileged access to the file system, or an Ansible/ Terraform script that configures an open access S3 bucket. As a result, adding security checks to IaC can isolate security vulnerabilities into a dedicated build and release pipeline. Likewise, IaC security simplifies workflows by embedding them into developer workflows to support cloud insight in both build and runtime. Final Words Although cloud-native technologies and containers are still a novice, the core security challenge remains; Organizations must consider how to accelerate development while retaining robust security controls, no matter it is a monolithic application or a containerized environment. These two objectives are still competing for equal attention in the container space. Although having containers in the picture fostered scalability and agility, they also increased the overall complexity. Securing containers needs a comprehensive approach. First, we must ensure that we address all teams’ needs within your organization. Next, make sure we can automate the procedure to fit the DevSecOps processes and that we also can meet deadlines and launch applications fast while protecting all of them. Security can no longer be an enforcer at the last minute with demands to change your workflow. Instead, it needs to build trusted security controls and automated processes from the start to address security concerns and make it easier to bridge the gap between each team. Thank you for reading. May InfoSec be with you🖖.

Incomplete Guide for Securing Containerized Environment

LightCyber was acquired by Palo Alto Networks. This is my version of the story. Ten years ago, I had a conversation with a mentor of mine, who was at that time Israel’s top . It was a cold day in September, the 2nd Lebanon war had recently ended and I had just returned from a long reserve duty and was looking for career advice. The seasoned investor who’s seen it all, told me about “growth-stage investment”, a term I knew little about at the time (and have been dealing with ever since). He was bullish about the tech segment in Israel and had two clear messages: venture capitalist growth 1. Unlike early stage VC investments — growth investing is about numbers, not people. 2. Don’t sell quickly. You invest to build a mammoth! (they didn’t call them unicorns back then…), we want an Israeli Nokia! (we all know how that went). He gave me his third and last piece of advice, when I already had one foot out the door: “most importantly!” he said, “don’t pay too much attention to other people’s advice… go with your gut!” Ten years have passed and over the past weeks I’ve been thinking about that conversation a lot, in the context of LightCyber’s acquisition by Palo Alto Networks. My relation to the deal is that I led LightCyber ‘s last financing round in the summer of 2016 and served on its board since. It is common knowledge that early-stage investments are “all about the people”. You meet a couple of wide-eyed entrepreneurs with a PowerPoint presentation and you need to make a decision. Growth investments require a much more data driven decision process, as the target companies already have substantial metrics, historical revenues, P&L profile and a sizeable team in place. But once in a while, even in later stage investments, you come across an investment decision which is largely driven by “the people” element. For me, the investment in LightCyber was exactly that. Yesterday Yesterday, Palo Alto Networks announced it has acquired LightCyber. Palo Alto is one of the world’s leading cyber security companies. It was a successful deal for the founders, employees and investors. And it is just the beginning, because now LightCyber’s team has even better chances to make the world a safer place, protecting companies and organizations from malicious hackers. 20 years ago… What most people don’t know is that the LightCyber story began over 20 years ago, at Boyar high-school in Jerusalem. Giora Engel, Michael Mumcuoglu and I met in 10th grade for the first time. Being much smarter than me (and to this day two of the brightest people I know), they both majored in Physics (I — in Geography). Despite being much smarter, they were still nice to me — and the three of us, together with a group of kids from our high school class actually founded our first company at the age of 15. Our company (creatively named Boyar Inc.) didn’t go public or get bought, but we won some prizes and came out with roughly $100 USD profit each, roughly 500X our capital invested, which is (still) my best investment ROI to date. Years passed and Michael & Giora (M&G) started another company together (MeterLive — audience measurement for outdoor advertising). They didn’t invite me to join them that time, but were kind enough to come and talk to me about it every now and then. I even introduced them to one of the best VCs I knew — Battery Ventures (BV). BV didn’t invest in MeterLive, but a couple of years later, BV became the largest shareholder in M&G’s newest venture — LightCyber… and BV’s Itzik Parnafes joined its board of directors. The call When it was time for another investment round at LightCyber, Itzik called me. By coincidence, when that call came, I had just walked out of a meeting with Israel’s “Mister Cyber”, CheckPoint’s co-founder Shlomo Kramer. At that time, Kramer had just recently joined LightCyber’s board of directors and told me about his long relationship with Gonen Fink, LightCyber’s CEO. Gonen was one of the first employees at CheckPoint and spent years as a part of their senior management team. He was recruited by M&G and Glilot (LightCyber’s first VC investor) as a professional CEO to take the company to its next phase. I had met Gonen several times before and highly appreciated his leadership style and his strategic thinking. And so, even before the due diligence started I had already made my decision regarding LightCyber. During the DD phase, my colleague Tomer Babai and I analyzed the market, competitive and strategic landscape. We consulted with subject matter experts and spoke to almost every player in the space. We met and spoke to many LightCyber’s customers who explained to us how superior the product was compared with any other network-based detection tool they had tested, specifically LightCyber’s ability to provide real threat detection with minimal amounts of false positives. The company already had real revenues and customers and we had a clear thesis on why it will be a good investment — but even with all that, at the end, the decision was based on the quality of people, whom I knew for many years. The night is dark and full of horrors Every Startup’s journey, even at growth stage, is a struggle. It is a rough trip through the snow desert north of the Westerose Wall and not a carefree tour of Disneyland. While the trip behind the wall can be difficult, dark and full of horrors, I knew that with Michael & Giora, Itzik & Shlomo and Gonen at the helm, it would be exciting to go for the scary & challenging journey, and I was willing to join them — frankly, anytime. So we (ClalTech) led the company’s last investment round and as an added bonus, I was joined by one of my favorite investors — Vertex’s Aviad Ariel. It has been an intense but short journey… Claltech led LightCyber’s last investment round in July 2016, and today, roughly seven months later, we are parting ways. Sale or Scale? This brings me back to my old mentor’s second piece of advice — not to invest with an eye to a quick exit but rather with the aim to build a large company. That was indeed our intention when we invested, though we always knew that one of the leading security vendors could proactively approach the company in the near term with the intent to buy it for its great product and people. Before investing — we all knew that the area north of the wall is dangerous. It is full of wildlings and giants and if you are not careful you can run into White-Walkers. But neither the competition nor the need to educate the market scared us. We were more than willing to continue to trudge through the snow and to fight and support the company through the next steps of its journey. But then came Palo Alto Networks- the mother of dragons… and we quickly realized it was the leader we wanted to align with, the true heir to the Iron Throne… Palo Alto Networks, led by the Israeli Nir Zuk, is a $14B market cap emerging leader in the cyber security world; with technology, vision and growth that are second to none. Under Palo Alto’s dragon wings the amazing LightCyber team will be able to move onwards and upwards faster and stronger than before, fighting harder to make the world safer against cyber villains. To avoid any misunderstanding, my old mentor was right: when you invest in more mature companies the metrics become critical. He was also right in saying that you should never invest in a company just looking for a quick exit. But sometimes a unique opportunity comes, which is fantastic for all parties — providing a promising future for the company’s employees and vision, a great outcome for all stakeholders. When that happens, my rule is to follow the entrepreneurs and join them in whichever direction they choose. At the end of the day — the keys to the company’s future are in their hands. When a great company wants you to join forces with it — it’s a badge of honor and a reason to be proud, and by no means is it a thing to apologize for. Should we build multi-billion companies in Israel? YES, of course. But it is NOT the only way to go. Once the founders and management communicated their view to the board — we gave them our full support and rolled up our sleeves to execute the best deal we could. The North remembers… A big thank you to my old friends for including me in this journey north of the wall. Good luck, and always looking forward to joining you again for another adventure. — — — — — — — — — — — — - is a common greeting in Braavos, meaning “all men must serve” in High Valyrian. It is the common response to the greeting (“all men must die”) — meant in the sense of “all men must (eventually) die,” sooner or later, somewhat like the Latin saying “memento mori”. This has absolutely nothing to do with my story, but I always wanted to use it as a headline, because I think it’s cool. Valar Dohaeris Valar Morghulis

Valar Dohaeris*

Breaches and cyber attacks dominate headlines today. Hardly a week goes by without news of another massive data leak or ransomware attack bringing a company to its knees. In fact, studies show that the of organizations have experienced cyberattacks. As threats proliferate, organizations invest heavily in security tools and staff. large majority The average enterprise uses a ridiculous and technologies. More tools mean more alerts and more alerts lead to alert fatigue. Unsurprisingly, a found that too many tools decrease effectiveness, hindering cybersecurity efforts. Exhausted security teams struggle to separate signal from noise, leading to missed threats and breaches. 45 different security solutions survey This rising tide of alerts threatens to drown security teams. A found that security analysts can’t deal with 67% of the daily alerts they receive. Most alerts are false positives and not worth the time. study by Vectra AI New cybersecurity vendors like Kivera are pioneering preventative approaches to cloud security. Rather than just detecting threats, before they happen to reduce the number of alerts in the first place. This prevents issues upfront rather than reacting after the fact. Kivera stops misconfigurations The Root Cause of Most Cloud Breaches The root cause behind most cloud breaches is misconfigured resources and permissions. Research suggests will result from customer misconfigurations by 2025. Cloud environments are incredibly complex, with thousands of services and configuration options. Just one mistake can leave an opening for attackers to exploit. 99% of cloud security failures All those misconfigured cloud resources trigger floods of policy violation alerts. But detecting problems after they occur is too late. The damage is already done. Attackers move quickly to take advantage of any slip-up. By the time an alert is triggered, sensitive data may have already been stolen. That's why forward-thinking organizations are shifting to preventative security controls. The traditional reactive model of detect-alert-respond is simply unsustainable. Prevention stops mistakes and policy violations before they ever happen. The Limitations of Detection-Focused Tools Cloud-native security tools on the market today focus heavily on detection and response. These tools are valuable layers of defense but come with inherent limitations: Cloud security posture management (CSPM) solutions from vendors such as Wiz and Orca continuously monitor cloud configurations and permissions. They identify resources that violate security policies or best practices. But again, problems are only detected after misconfigurations occur. The latest evolution in cloud security is cloud-native application protection platforms (CNAPP). Companies like Sysdig and Palo Alto Networks provide CNAPPs that combine security tools such as CSPM and CWPP with code scanning for cloud security. While these platforms embed security in code and templates, they face limitations in infrastructure-as-code scanning, restricted to specific programming languages. Kivera overcomes this by operating at the API level, offering a more universal and adaptable security solution.\ However, CNAPPs still rely heavily on threat detection and response. They aim to identify anomalies in cloud applications and resources. However, gaps that allow the attacks in the first place are not directly addressed. The Preventative Security Model The limitations of these detection-focused tools highlight the need for a preventative approach to cloud security. The ideal security model employs a mix of preventative and detective controls, commonly referred to as the “layered security model.” Preventative controls stop policy violations and misconfigurations before they happen. Rather than reacting to events, preventative controls proactively enforce security requirements within systems. Prevention provides a first line of defense to maintain a strong security posture. Detective controls then provide a second line of defense to identify threats that make it past the preventative line. Detective controls are still vital for monitoring, investigation, and incident response. Historically, implementing detective controls in a preventive manner has been challenging, but new tools provide an effective solution to enforce these common detective controls preventively, enhancing overall security posture. Why We Need Preventative Cloud Security This is where preventative approaches to cloud security become essential. Adopting such methods involves deploying inline security measures between users and the cloud. As deployment requests are made, these security systems analyze them against configured security policies. Any requests that violate these policies are immediately blocked, ensuring that only compliant resources are created. This approach emphasizes prevention over detection, eliminating the flood of policy violation alerts by avoiding misconfigurations in the first place. Security teams can then concentrate on real incidents rather than addressing misconfiguration. Vendors like are at the forefront in this area of cloud security. Kivera's solution allows customers to define flexible guardrails and policies tailored to their organization's needs. It then enforces these policies in real-time as users interact with the cloud, preventing misconfigurations at their source and avoiding reactionary measures after the fact. Kivera Best practices for implementing a prevent-first strategy include phasing in prevention by starting with the highest-risk misconfiguration threats and then incrementally expanding policies. Prevention should also be combined with detection tools for layered defenses to catch novel threats while tuning alerting to focus only on critical issues not prevented outright. Processes and training must align with prevention, emphasizing configuring policies over correcting violations. And any violations that still occur should be regularly reviewed to identify and address gaps in coverage. The Future of Cloud Security Today's cloud-first world demands a new approach to security. The volume and pace of threats have rendered traditional reactive models ineffective. Organizations need to prevent threats upfront before damage occurs. The future of security is prevention combined with detection. Organizations still need layered defenses to catch evolving threats. But prevention must come first to establish a robust security posture.

The Missing Piece in Cybersecurity: Tools that Go Beyond Issue Detection

What Is CloudMapper? CloudMapper serves as an indispensable tool for anyone navigating the complexities of Amazon Web Services (AWS). This open-source utility provides a detailed analysis of an AWS account's architecture and security posture, making it ideal for security analysts, developers, and system architects seeking to gain insights into their cloud resources. Originally developed to graphically represent network architecture within AWS, CloudMapper has grown in functionality, now offering resources inventory, security assessment of IAM policies, visualization of public and private resources, and much more. The genesis of CloudMapper was rooted in the need to simplify security audits and risk assessments within expanding cloud infrastructures. As a comprehensive response to these challenges, it evolved to assess security configurations and identify potential vulnerabilities across AWS regions. Its ability to map out AWS landscapes with precision has made it a favorite among organizations for maintaining robust security measures and ensuring the integrity of its cloud infrastructure. In an ecosystem where comprehensive cloud-native application protection platforms (CNAPP), cloud security posture management (CSPM), and cloud workload protection platforms (CWPP) are increasingly common, CloudMapper offers a no-cost alternative that might be just enough to bridge the gap for many users. While these full-featured platforms provide extensive capabilities, they often come with a hefty price tag and complexity that not all organizations require. For teams that need a straightforward, focused approach to cloud environment analysis and security, CloudMapper stands as a capable and cost-effective tool, delivering essential features that are more than sufficient for maintaining a strong security posture and optimized resource use in AWS. Why CloudMapper (You Get What You Pay For, Or Do You?) CloudMapper enters the cloud management arena as a compelling alternative to paid tools with its robust set of features that offer detailed visibility into AWS environments. For organizations wary of the substantial investment required for premium cloud analysis services, CloudMapper presents an opportunity to perform in-depth reviews of account status, resource inventories, and security configurations without the associated costs. This open-source tool is particularly valuable for small to medium-sized enterprises or startups that require comprehensive cloud oversight but must adhere to strict budgetary constraints. It might be possible to augment, or in some limited situations, replace paid solutions like those from Ermetic (now ), , , , and others. Tenable Aqua Lacework Palo Alto Networks The utility of CloudMapper extends beyond cost-saving; it's an essential instrument for a variety of use cases. It can be instrumental for security engineers conducting audits or companies looking to optimize their cloud resource utilization. For instance, during migration phases, CloudMapper can identify over-provisioned resources, helping to trim excess and avoid unnecessary expenses. Security teams can utilize CloudMapper's detailed IAM and security group analysis to enhance their security posture, ensuring that only necessary permissions are granted and that potential vulnerabilities are addressed. Whether it’s for strategic planning, compliance adherence, or security hardening, CloudMapper provides the insights needed to navigate AWS's cloud complexities with precision and confidence. Key Features of CloudMapper CloudMapper is equipped with a suite of functionalities tailored to the diverse needs of cloud infrastructure management. Its primary use cases include generating detailed resource inventories across multiple AWS regions, enabling a granular view of service usage and deployments. This feature is particularly helpful for cost management and identifying redundant resources. CloudMapper also specializes in visualizing complex network topologies, giving users the ability to see interconnections between services and assess their security exposure. For security audits, the tool meticulously examines IAM configurations, highlighting both active and inactive resources, and it scrutinizes public assets like EC2 instances and RDS databases to pinpoint potential security gaps. A lesser-known but highly valuable feature of CloudMapper is its ability to simulate network traffic to test the impact of route table and security group changes before they are implemented. This predictive capability allows engineers to proactively assess the potential consequences of network updates, thereby preventing disruptions and security breaches. This preemptive analysis tool can serve as a safeguard against inadvertent misconfigurations that could lead to costly downtime or security incidents, proving CloudMapper’s utility not just in analysis and visualization, but also in proactive infrastructure management. Wrap It Up CloudMapper stands out as an essential toolkit for any team working with AWS, offering a powerful yet cost-effective solution for cloud environment analysis. Its ability to provide deep insights and visualizations empowers users to manage and secure their AWS resources with unprecedented clarity. As we've explored its various use cases and the unique features it brings to the table, it's clear that CloudMapper is more than just a tool—it's a strategic asset for cloud management. But is it to provide all the insight and depth required to confidently secure a cloud environment? enough Stay tuned for Part 2 of our exploration into CloudMapper, where we'll dive into a hands-on, step-by-step setup guide. Whether you're new to AWS or looking to enhance your current infrastructure, our upcoming guide will equip you with the knowledge to deploy CloudMapper efficiently, unlocking its full potential to streamline your cloud operations. Don't miss this practical walkthrough to elevate your AWS experience with CloudMapper's dynamic capabilities.

Navigating AWS Landscapes: A Deep Dive Into CloudMapper Capabilities

Evolved Cloud Phishing Techniques Explained and Lessons Learned From Recent Dropbox & Uber Hack Cloud Computing gives phishers a new playground to harvest and grow their business. But not only that, the impacts are much broader and more dangerous. No organization, small or big, is invulnerable to phishing attacks. Therefore, it’s critical to learn how you might be targeted and what you can do to prevent it. SaaS-based phishing is already familiar. For example, over , from stolen credentials to malicious URLs. Also, according to a report from , researchers have seen a massive increase in this abuse, with the data collected by the firm showing an enormous expansion of 1,100% from June 2021 to June 2022. 90% of all data breaches are due to phishing Palo Alto Networks Unit 42 With more advancements in technology, not only can defenders leverage more sophisticated tools and techniques to detect and block phishing emails, links, and messages, but attackers are also improving on their side of the cat-and-mouse game. While most social engineering attacks are delivered by email, increased social engineering delivered via other communication platforms in 2022. one-third of IT professionals reported : These include attacks delivered via Video conferencing platforms (44%), Workforce messaging platforms (40%), Cloud-based file-sharing platforms (40%), and SMS (36%). Moreover, phishing on social media is increasingly common, and in Q1 2022, . According to report, employees at 74% of organizations have been sent fraudulent text messages (smishing), and the same percentage have been targeted on social media. LinkedIn users were targeted in 52% of all phishing attacks globally Proofpoint’s 2022 State of the Phish A Hard-to-Detect New Phishing Technique — SaaS-to-SaaS All these could happen without the attacker touching the victim’s on-prem computers/ network. Since it all happened SaaS-to-SaaS, all the existing security measures, such as Anti-Spam gateway, sandboxing, and URL filtering, will not inspect. Thus, no alert will be generated. Furthermore, with the rise of cloud office productivity and multi-user collaboration technologies, it is now possible for an attacker to of these reputable domains while remaining undetected. host and share malicious documents, files, and even malware on the cloud infrastructure Since , we saw the trend of using this “multi-stages” SaaS-to-SaaS phishing attack. the Check Point Research findings in 2020 The first stage of a phishing attack is This document can be downloaded; however, it is essential to note that to facilitate use, these cloud services open the PDF for viewing, allowing it to load in the web browser without restriction or warning. frequently a fake invoice or secure document PDF hosted on cloud services. It is hard to detect because it didn’t necessarily hit the protection deployed. As we saw on the news, as AWS Cloud Phishing attempts in , if phishing detection is implemented in the entrance and exit of emails, it will never see it happening. August All actions occurred in the Cloud (or multiple clouds); when the detection/ scanning took place, all things seemed legit and encrypted. Most likely, the phishing email will hit the victims’ machine, and all the magic will happen in the browser. Multi-stage Cloud Phishing Early this year, that prey upon those who don’t use multifactor authentication. Microsoft warned of new phishing leveraging Azure ADs This attack is thriving now but not before because attackers take advantage of via the capability of device registration using newly stolen credentials, and cloud authentication is accessible anytime, anywhere. the concept of BYOD (Bring-Your-Own-Device) Nothing out of the ordinary, it is a novel attack technique that combines traditional phishing with second-phase or even third-phase actions. The first stage steals an employee’s email like regular phishing attacks. Yet, instead of attacking the victim, the a new Office 365 account on a rogue device in the victim’s name. Once established on the new computer, the victim’s user account (and or this case, its Azure Ad) is used to send (disguised as the victim) within the company or to customers using the legitimate email account. second stage establishes internal phishing attacks If they want to gain more control or find a better “host,” they These multi-stage attacks appear legitimate and can even deploy malware on the company’s OneDrive or SharePoint systems. can find it via the first victim and then compromise the second account by internal phishing. ChatGPT (or Other AI) According to , phishing accounts for nearly 90% of malware attacks. But ChatGPT could make the whole situation even worse. Such intelligent 🧠 AI Chatbot can be . So the victim may not even know they are interacting with an AI. HP Wolf Security research a way to gather information through a human-like friendly chat https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away/?embedable=true demonstrating . Multiple scripts can be generated quickly, with variations. Complex attack processes can also be automated, using the LLMs APIs to generate other malicious artifacts. Check Point Research recently published an interesting article how AI models could create a full infection flow, from spear-phishing to reverse shell Another risk is more prominent. AI technology like ChatGPT will enable attackers to . For example, say generic phishing attacks send out millions of spam in the form of emails, SMS (in the case of smashing), and social media posts. But these are easy to spot, resulting in low yield. blend the volume of massive phishing with a targeted attack (or spear-phishing) With the addition of an AI Chatbot, millions of spear phishing messages could be generated in seconds. Thus, the attackers can have the best of both worlds. Therefore in 2023, we will probably see . It would be a tremendous challenge for security teams. some large-scale phishing that sends millions of unique messages generated within minutes Other Novel Phishing Techniques QRishing Attackers are now trying to deliver which makes them difficult to detect for most email security solutions. QRishing combines the words: “QR Codes” + “Phishing.” This indicates the attack is in the form of a QR code. It can potentially direct victims into connecting to an unsecured WiFi network while someone can easily capture what you are typing. malware links via QR codes embedded in emails, Some adversaries even stick malicious QR codes in restaurants or other public locations. Since the pandemic limits physical contact, QR codes are a popular tool for threat actors. We use it to access menus, check in for vaccines, and get public information. In addition, social engineering tactic is inserting fake QR codes into a phishing text (SMishing + QRishing) or social media platform. Upon scanning the malicious code, users are redirected to phishing sites, where the victim may be prompted to log in and steal their credentials. SMishing That means it is one kind of phishing sent across your mobile network in the form of text messages. Although the name uses SMS, this attack can happen on other messenger platforms, such as Facebook Messenger or WhatsApp. Common Smishing attempts to focus on everyday necessities. Missed deliveries, late payments, bank notifications, fines, and urgent notices are examples of smishing attacks. SMishing combines the words “phishing” and “SMS.” With so many people staying at home and so many daily online purchases, we’re awash in cardboard. It’s very challenging to keep track of everything coming into the house. Combining well-known delivery services with is the best recipe for a successful Smishing. fake “delivery fee” notifications Crown Jewel = Developer Accounts Why are threat actors trying to compromise developer accounts? And what can go wrong if they are stolen? Depending on the developer’s position, attackers gain access to nearly everything: SSH keys, API keys, Source Code, Production infrastructure, Access to CI/CD pipelines and, i.e., the works. Assuming a compromise with the “best scenario,” a junior engineer’s account might be stolen. At the very least, this engineer has “commit” access to the source code. On the other hand, suppose the organization does not follow the best practices of software engineering, such as code reviews and restricting who can commit to the main branch. In that case, the attacker can modify the organization’s source code to alter and infect the final product. In the worst-case scenario, which is also the most likely, the attacker will gain access to a senior developer with more permissions. This account could manually bypass some code checks, which will also have access to valuable resources (source code, SSH keys, secrets, credentials, API keys, CI/CD pipelines, and more). This scenario, where this kind of account is compromised, would be devastating for an organization. Developer accounts usually come with GitHub or other code repository access. Dropbox & Uber In September, Later, we discovered that the hack was related to Uber disclosed that hackers had stolen the personal information of about 57 million customers and drivers . obtained by a “ ” a hard-coded credential remote social engineering attack. In November, due to a phishing attack against its developers. They were lured into by a phishing email into a fake website, What makes these incidents scary is that this wasn’t just a random user from a business function; it was developers with privileged access to many Dropbox and Uber data. Dropbox had a security incident filling in their Github credentials despite multifactor authentication (MFA) in place. MFA Fatigue Both cases from these two giant tech companies implemented multifactor authentication. Still, hackers find a way to bypass or work around this measure that can prevent most credential theft. In the case of Uber, the hacker (allegedly a 17-year-old) was creative and came up with a low-tech but very effective method — The attacker attempts to log in repeatedly, sending a flood of push requests to users asking the victim to confirm a sign-in. Once the victim stopped clicking “no” on their phone, followed by an “authorized login,” thus, MFA failed. an “ ” MFA-fatigue attack. For the Dropbox case, which is much simpler. The phishing email purported to . Then the realistic-looking phishing site tricked the developer into typing the credential and the one-time password. Thus, MFA also failed. originate from the code integration and delivery platform, CircleCI Code Repo and More As we saw in these incidents, With the proper permissions, attackers can obtain intellectual property, source codes, and other sensitive data. GitHub and other platforms in the continuous integration/ continuous deployment (CI/ CD) pipeline space are the new “crown jewels” for many companies. But it doesn’t stop there, as GitHub often integrates with other platforms, which lets the allowed “users” go even further. In addition, developers’ accounts are usually granted access to the deepest level, as maintaining and developing the core application may be part of their job responsibility. That makes the developer account a crown jewel for attackers. How to Improve Your Phishing Defenses According to , the average organization receives dozens of phishing emails per day, with financial losses compounding as losses from malware and ransomware attacks drive up the average cost of landed phishing attacks year over year. Facing all the threats highlighted requires extra effort, and while you can’t eliminate the risk of phishing attacks, you can learn from observed trends and incidents to better manage them. industry statistics For example, here are the recommendations from : the recent Zscaler report Understand the risks to inform policy and technology decisions better Leverage automated tools and actionable intel to reduce phishing incidents Implement zero-trust architectures to limit the blast radius of successful attacks Deliver timely training to build security awareness and promote user reporting Simulate phishing attacks to identify gaps in your program Apart from the five basic mitigations of phishing attacks, we can do more. Therefore, I will end this article with tips you can bring along. , having a greater extent of cyber-resilience would be an excellent way to begin. Knowing that phishers will eventually find a way to get to you Tips #1: Multi-layered phishing defenses approach Typical email security against phishing often relies exclusively on a single guard point, such as email gateways and endpoint/ mobile agents. Everything passing through that gate would depend on users being able to spot phishing messages. Not to mention attackers are now sharpening their weapons with multi-stage phishing. Conversely, Moreover, there would be multiple chances to detect and catch a phishing email. a layered defense approach could improve cyber-resilience without disrupting business productivity. Reach — Prevent the email from reaching the user’s inbox. This can be achieved by introducing anti-phishing security software such as spam filters. In addition, anti-spoofing controls should be implemented, such as; DMARC, DKIM, and SPF records. Identify — Most data breaches are initiated through a phishing email due to human error. Therefore, staff should have regular training in identifying the latest potential phishing emails. This will enable them to follow the company process when an incident does occur, which should include reporting the incident to the relevant team. Protect — Protections should be in place for when incidents do occur. These protections include but are not limited to; enforcing multifactor authentication (MFA), password managers, regular IT health checks, and endpoint defenses. Response — Staff should be able to report phishing incidents to the relevant team. A dedicated security logging and the alarming system should be in place, as well as an Incident Response Plan. Even though some attacks get through, this approach will help with incident response and minimize the impact. Tips #2: Just-in-time (JIT) Access Approach Privilege access entails a significant danger, claims . The risk posed by users with standing privileges persists even with PAM tools, and it is considerable. They suggest just-in-time (JIT) solutions be used by identity and access management (IAM) leaders to finally achieve a posture of no standing privileges. Gartner also provided a solution to counter it — The Just-in-Time approach. For example, when developers use these credentials to set up or modify production resources, granting them the appropriate permissions is crucial, with only the capabilities required to complete specified tasks. Gartner The JIT approach, which deals with information security, only gives users access to privileged resources while working. This reduces the attack surface and eliminates the risk brought on by persistently held-over privileges. Tips #3: Review Mailbox Forwarding Threat actors use compromised accounts not only to steal internal data but also, for example: Read users’ emails, Distribute malware, Spamming, Learn about the user and to further launch second-stage phishing, and Forwarding emails to external recipients. Attackers may set up email rules to conceal their malicious activities from the user to hide incoming emails in the compromised user mailbox. They may also create rules in the compromised user mailbox to delete emails, move them to a less visible folder, such as an RSS folder, or forward emails to an external account. Emails can be manually or automatically forwarded using forwarding rules. Automatic forwarding can be accomplished in various ways, including While manual forwarding requires users to take direct action, they may need to be aware of all auto-forwarded emails. Inbox Rules, Exchange Transport Rules (ETR), and SMTP Forwarding. It would be wise to schedule a review of all email forwarding rules to external addresses and check that it is not an unusual IP address and corresponds to the user’s usual activities. Final Words as long as the human factor is in the formula. As a result, the best we can do for the long term is It would be a much more granular design of the multi-layered defense approach. The reality is that no one can stop phishing entirely to adopt Zero Trust Architecture for email security. A Zero Trust approach to email can assist organizations in defending against email impersonation attacks by — ensuring that emails entering the corporate environment or landing in end users’ inboxes are from legitimate individuals, brands, and domains. focusing on Authentication (Verifying User/ Device Trust) https://hackernoon.com/introduction-to-the-zero-trust-security-architecture-a-concept-not-a-product?embedable=true A privileged position exists for software developers in every technical organization. They are the lynch-pin in any modern company because of their upstream access to the products distributed to clients and their access to production systems and infrastructure. The security organization would fail if developers weren’t protected, leading to catastrophe. If you, unfortunately, fall for a phishing attack, please do the followings: Contact the IT department and let them know the situation Reset password for related applications Please don’t use a repeated password. Instead, reset the account with the same password as the applications above. Monitor the account with care for 30 days Finally, NIST developed a method to help the security team to see why users click on the phishing email: https://www.nist.gov/news-events/news/2020/09/phish-scale-nist-developed-method-helps-it-staff-see-why-users-click?embedable=true Thank you for reading. May InfoSec be with you🖖.

PALO ALTO NETWORKS INC

paloaltonetworks.com

5K-10K employees

Since 2005

COMPANY RANKING

PALO ALTO NETWORKS INC

EVERGREEN INDEX #7807

Representing this company? Click here to claim and customize this page!

PALO ALTO NETWORKS INC WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

PALO ALTO NETWORKS INC

paloaltonetworks.com

5K-10K employees

Since 2005

COMPANY RANKING

PALO ALTO NETWORKS INC

EVERGREEN INDEX #7807

RELATED COMPANIESRANK

STORIES ABOUT PALO ALTO NETWORKS INC

Representing this company? Click here to claim and customize this page!

PALO ALTO NETWORKS INC WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!