Tag: Insider Threat Prevention

DNS Insights by NS1 improves reliability, real-time analysis, and cost control by collecting DNS and network metrics at the edge to empower networking professionals as they troubleshoot and optimize infrastructure at scale. 

DNS Insights arrives at a critical juncture in network observability. According to a recent survey of network professionals conducted by EMA and NS1, 43.3% of respondents reported that DNS logs have become more important to collect — but more than 20% of respondents report that their observability solutions suffer from a lack of insights, poor scalability, and high costs. 

Shannon Weyrick, VP of research, NS1 “Modern networks need to provide flawless and secure connected interactions to billions of users and tens of billions of devices. To do this, it is essential that networking professionals have the ability to observe and dynamically adjust for constantly changing conditions. 

DNS Insights makes it easier for network teams to troubleshoot misconfigurations, detect DDoS attacks, and identify potential areas of optimization.” 

Network professionals are under more pressure to maintain and secure their environments as the number of devices and applications rises. 

While other DNS service providers only provide customers with raw DNS log data or a cursory analysis of DNS data, NS1’s DNS Insights inspects each DNS interaction with its platform to gather and analyze more than 50 DNS and network metrics. 

The solution uses open-source Orb network observability project technology to deliver real-time results as a curated data feed without the expense or time typically associated with gathering, storing, and analyzing enormous amounts of data. 

Customers can integrate OpenTelemetry with both new and pre-existing observability stacks thanks to support from the company. Users have the option of isolating data from specific edge agents or viewing high-level information about the top domains, error and response codes, query types, and much more. 

Additionally, NS1 provides Grafana users with a secondary dashboard template that is intended to highlight metrics for DDoS attack detection. 

PagerDuty customers can use Status Pages to communicate status updates to their customers while also keeping internal technical teams and customer service teams informed. The new add-on feature is fully integrated into the PagerDuty platform, minimizing friction, and eliminating context switching while teams work to both resolve an incident and inform customers of its status. It is intuitive, easy to use, and can be set up in minutes. The PagerDuty Operations Cloud’s capabilities are being expanded with this release. 

sean Scott, PagerDuty Chief Product Development Officer commented, “In 2023, customer retention will be one of the biggest factors determining whether a business can survive – let alone thrive. 

With Status Pages, PagerDuty customers can now communicate status updates directly with their customers to keep them informed, engaged, and happy with your brand. Status Pages were one of our most requested features from our customers in the past year. By making this our first newly available feature in 2023, we continue to demonstrate how the PagerDuty Operations Cloud delivers solutions that meet their biggest business needs.” 

According to Salesforce’s 2022 State of Service Report, nearly half of customers will switch brands for better customer service when something goes wrong, and they value open communication as a key factor in how they rate the quality of customer service. While customers understand that even the most resilient digital systems can fail, a lack of information and transparency when problems arise frequently results in a loss of brand loyalty. 

PagerDuty Status Pages offer illustrative, real-time insights into the workings of an organization and the progress of incident resolutiion. 

Users of PagerDuty can proactively and securely update customers on operational updates in real-time from the PagerDuty platform, removing the need to switch contexts to other tools and making PagerDuty the only source of truth for users. 

PagerDuty Status Pages enhance customer satisfaction, lessen the workload for support teams, and do away with the need to maintain separate status page infrastructure, allowing businesses to consolidate their tools while enhancing customer service. 

Cloudflare, a leading provider of internet security services, has recently announced a new suite of tools aimed at enhancing email security and data protection for businesses. The new tools include email authentication, email encryption, and data loss prevention capabilities, which are designed to help companies better protect their sensitive data and communications from cyber threats. 

One of the new tools is Cloudflare’s email authentication service, which uses advanced machine learning algorithms to identify and block malicious emails before they reach a user’s inbox. The service also includes a real-time reputation system that continuously monitors the reputation of email senders and can automatically block or quarantine emails from known malicious actors. This feature helps businesses to protect themselves from phishing and other types of cyberattacks that use email as a vector of attack. 

Another new tool is the email encryption service, which allows businesses to secure their communications with end-to-end encryption. This service uses the industry-standard Transport Layer Security (TLS) protocol to encrypt email messages in transit, ensuring that only the intended recipient can read the contents of the email. This feature helps businesses to protect their confidential communications from eavesdropping and other types of cyberattacks. 

Cloudflare has also introduced a data loss prevention (DLP) capability, which automatically identifies and blocks sensitive information from being sent via email, such as credit card numbers and social security numbers. This feature allows businesses to comply with data privacy regulations and prevent sensitive information from falling into the wrong hands. This feature helps businesses to avoid data breaches and other types of incidents that can compromise the confidentiality of their data. 

Matthew Prince, CEO of Cloudflare commented, “You can’t have a complete Zero Trust solution without securing email, given that a huge proportion of all cyber-attacks begin with phishing. 

In 2022, Cloudflare Area 1 identified and kept almost 2.3 billion unwanted messages out of customer inboxes. Today we’re filling a void in the marketplace that has been underinvested in for the last ten years, with the first set of deeply integrated solutions that bring together Cloudflare Area 1 email security and our Zero Trust platform.” 

Cloudflare’s new email security and data protection tools are designed to be easy to use and manage, with a simple and intuitive interface that allows businesses to configure and manage their security settings quickly and easily. The company also offers 24/7 customer support to help businesses with any questions or issues that may arise. 

Cloudflare’s new suite of email security and data protection tools are a valuable addition to the company’s existing portfolio of internet security services. They help businesses to protect their sensitive data and communications from cyber threats, comply with data privacy regulations, and ensure the confidentiality of their communications. These new tools will help businesses to secure their email communications and protect their sensitive data from cyberattacks, thereby reducing their risk of data breaches and other types of incidents. 

Cloudflare has introduced Magic WAN Connector, a solution that enables organizations to improve operational agility by improving the performance and security of their wide area network (WAN) connections. Companies can connect their branches and remote locations to their central data center or cloud resources more efficiently and securely with Magic WAN Connector. 

One of the primary advantages of Magic WAN Connector is that it makes use of Cloudflare’s global network, which is one of the world’s largest and most advanced networks. This network is intended to improve internet connection performance by lowering latency, increasing throughput, and increasing reliability. Magic WAN Connector, by leveraging Cloudflare’s network, enables organizations to access critical business applications and data more quickly and reliably. 

Another key feature of Magic WAN Connector is that it provides advanced security features to help protect organizations from internet-based threats. This includes features like DDoS protection, which helps to defend against large-scale distributed denial-of-service (DDoS) attacks, and advanced firewall capabilities, which can help to protect against a wide range of malicious traffic. 

In addition, Magic WAN Connector is easy to deploy and manage, making it a great choice for organizations of all sizes. It can be deployed in just a few minutes and requires minimal configuration, allowing organizations to improve the performance and security of their WAN connections quickly and easily. 

Matthew Prince, CEO of Cloudflare commented, “The future of work requires flexible IT infrastructure. When I speak to CIOs working to support evolving workforces, they want one vendor to work with that can offer them everything they need. Whether that means securely connecting remote employees, offices, data centers, or even multi-cloud deployments, IT teams shouldn’t have to sacrifice speed or security to keep their business productive. With the addition of Magic WAN Connector to Cloudflare One, we now offer one of the most comprehensive SASE solutions available today.” 

Magic WAN Connector also gives the flexibility to organizations to directly connect their branch to Cloudflare Global network, where the network will act as an accelerator, improving the performance of their critical business application, by reducing the internet latency. 

Furthermore, Magic WAN Connector gives organizations the ability to connect to multi-cloud environments, so that they can take advantage of the different capabilities and features offered by different cloud providers. This helps organizations to build highly available, hybrid cloud environments that can scale to meet their specific needs. 

Cloudflare Magic WAN Connector is a powerful solution that helps organizations to increase their operational agility by improving the performance and security of their wide area network connections. With its advanced security features, easy deployment, and support for multi-cloud environments, Magic WAN Connector is an ideal solution for organizations of all sizes looking to optimize their internet connectivity and protect their data and applications. 

Waterfall Security Solutions, a leading provider of industrial cybersecurity solutions, has announced a partnership with Yokogawa, a major player in the industrial automation and control systems market. The partnership aims to improve the security of industrial control systems (ICS) and operational technology (OT) networks, which are critical to the operation of many industrial and infrastructure facilities. 

The partnership will see Waterfall’s “unidirectional security gateways” integrated into Yokogawa’s control systems. These gateways allow data to flow only in one direction, from the control system to a secure network, preventing malicious actors from accessing and manipulating the control system. This is a crucial measure for protecting against cyberattacks, which can have disastrous consequences on industrial operations. 

According to Waterfall, their unidirectional security gateways will provide an additional layer of security to Yokogawa’s control systems, ensuring that unauthorized access to the control system is prevented and that any cyberattacks are detected and blocked. Yokogawa’s control systems are used in a wide range of industries, including power, oil and gas, chemical, and water and wastewater. 

Yokogawa is a major player in the industrial automation and control systems market, with a strong reputation for providing reliable and secure control systems. The partnership with Waterfall is in line with Yokogawa’s commitment to ensuring the security of its control systems and improving the overall security of industrial operations. 

This collaboration between the two companies is expected to enable customers to reduce the risk of cyber-attacks that can cause data breaches, service disruptions and ultimately disrupt the critical infrastructure. It also allows for a more safe and secure environment for the organization which in turn helps a better protection for the people working at the facility, nearby communities, and the environment. 

Iijima Katsunori, GM of Cyber Security Management at Yokogawa Electric stated, “Operational and technical reliability is a key focus at Yokogawa. Our collaboration with Waterfall will improve the security posture of Yokogawa customers and will enable better protection of critical industrial infrastructures from targeted ransomware and nation-state attacks. 

Yokogawa is proud and excited to support this initiative with Waterfall to better serve the security needs of our joint customers.” 

The partnership between Waterfall Security Solutions and Yokogawa is a major step forward in the effort to improve the security of industrial control systems and operational technology networks. As the number of cyberattacks on these systems continues to increase, it is essential that companies take proactive measures to protect their industrial operations from these threats. 

Lior Frenkel, CEO and Co-Founder at Waterfall commented, “Our global collaboration with Yokogawa is driven by a shared commitment to secure critical infrastructures around the world. Waterfall and Yokogawa have been aligned globally for many years. Together, we bring to our mutual customers strong unidirectional protections to meet modern cybersecurity challenges. We look forward to continuing our close cooperation in the years ahead.” 

LogRhythm has introduced a range of new capabilities and integrations for its security operations platform, LogRhythm Axon, designed to help analysts detect and respond to potential threats more efficiently. These updates include analytics and visualizations that provide greater visibility into potential security risks, as well as custom and pre-designed analytics rules specifically for MITRE ATT&CK detections.  

LogRhythm has also made improvements to its SIEM, UEBA, and NDR solutions, such as enhanced audit logging and new detection models for Windows systems, as well as improved blind spot detection and endpoint visibility. The goal of these updates is to simplify the work of security analysts and enable them to detect threats more quickly through improved visibility, data collection, and a more intuitive experience. 

Chris O’Malley, CEO of LogRhythm stated, “On a daily basis, we strive to empower lean and overburdened security teams with the most intuitive experience and contextual analytics. 

By continuously working to fulfill that mission and deliver innovation that matters to customers every quarter, we are delivering on our promise of helping customers quickly reduce noise and secure their environment so that they can concentrate on safely competing in the digital age where fast beats slow.” 

The improvements made this quarter cover the entire range of LogRhythm’s products, allowing SOC teams to detect and address threats more quickly while increasing analyst productivity and effectiveness. 

In addition, this quarterly rollout includes improvements and integrations with LogRhythm’s Axon, SIEM, NDR, and UEBA solutions. 

LogRhythm Axon 

• Custom and pre-defined analytics rules, including MITRE ATT&CK detection rules 

• The Markdown and Histogram widgets save time spent searching for data.  

• The Observation Workflow makes it simple to log observations raised by analytics. 

LogRhythm SIEM 

• A more efficient administrative workflow for collection reduces the time required to configure, deploy, and manage log sources that require Open Collector. 

• Improved audit logging makes it easier to monitor suspicious activity and identify when users make critical changes. 

• Updated and expanded LogRhythm’s supported log source library 

LogRhythm UEBA 

• New detection models for Windows systems to quickly uncover difficult-to-detect threats 

LogRhythm NDR 

• Integration with Microsoft EDR improved blind spot detection and endpoint visibility in LogRhythm NDR. 

• New configuration page makes it simple to import data from VirusTotal  

• Improved analyst experience through expanded UI enhancements 

Kish Dill, Chief Product and Customer Officer of LogRhythm commented, “This quarter, we are especially excited about the number of groundbreaking and enhanced capabilities coming to our market-leading solutions. 

“These enhancements and integrations have been curated with the goal of simplifying the lives of security analysts and enabling them to detect threats faster through seamless visibility, enhanced collection, and an intuitive analyst experience.” 

NetFlow offers a high-level view of network traffic and other information, while continuous packet capture provides detail and granularity of that data. Together, the technologies deliver the information required for faster, definitive incident response and resolution. 

Endace is an organization that helps manage critical data networks launched EndaceFlow, a high-performance NetFlow Generator that supports end-to-end visibility for cybersecurity and network performance monitoring. While continuous packet capture enables detail and granularity of that data, NetFlow provides a high-level view of network traffic and additional information. The technologies work together to give the data needed for an incident response and resolution that is swift and accurate. 

EndaceVisionTM and EndaceProbeTM Analytics Platform integration allow EndaceFlow to provide customers with advantages such as an accurate full-stream performance on even the fastest networks, generating 1:1 unsampled NetFlow from 40Gbps of network traffic; removing the complex task of generating NetFlow from switches, routers, and firewalls and avoids jeopardizing the effectiveness and core functions of these appliances; a 100% accurate summary of every conversation or flow on your network; Compatible with leading NetFlow collectors, such as Plixer ScrutinizerTM, Progress Flowmon®, Cisco Secure Network Analytics® (previously Cisco Stealthwatch®), and others. Secure, with optional TLS-encrypted NetFlow creation. 

Cary Wright, Endace VP of the product stated, “Teams need to see both the network summary and the transaction details when responding to incidents. Combining 1:1 unsampled NetFlow with the granular data of continuous packet capture empowers SecOps and NetOps teams to more quickly and accurately uncover network or performance trends, and identify and respond to threats and network issues.  

“Being able to quickly identify, and then go directly to the packets of interest, gives teams an advantage against network attacks.”, Wright continued. 

NetSPI has announced the launch of its new all-inclusive blockchain penetration testing solution. By combining decades of penetration testing knowledge with an awareness of the architecture’s unique security challenges, the company will give enterprises a comprehensive, full-spectrum review of blockchain-based deployments. 

Travis Hoyt, Chief Technology Officer at NetSPI commented, “As adoption skyrockets, technology and security teams will need to quickly develop their blockchain acumen to support and protect these solutions – this begins with identifying and addressing people, process, and technology gaps. Our new blockchain penetration testing service line demonstrates NetSPI’s commitment to be relentlessly future-focused, so our customers can be too.” 

Its blockchain penetration testing services can assess all deployment models, including private, permissioned, consortium, and public, as well as numerous distributed ledger technologies like as ConsenSys Codefi, R3 Corda, Hyperledger Fabric, custodial platforms, and public chains, among others. Enterprises that are actively utilizing or assessing the potential of blockchain can collaborate with NetSPI to improve the security of their deployments. 

The Forbes Blockchain 50 2022 stated, “Blockchain’s biggest innovations are below the surface. The world’s largest organizations are now using distributed ledger technology to manage daily operations, from verifying insurance claims to tracking auto parts in the supply chain. Organizations are recognizing the scalability, competitive advantages, and revenue opportunities it presents.” 

Insight Enterprises announced the expansion of its managed security service with new extended detection and response (XDR) capabilities to help enterprises modernize and strengthen their security posture without adding overhead for internal IT teams. 

Stephen Moss, senior vice president of managed services at Insight stated, “There’s no doubt that finding the right skills in security — like many other technology disciplines — is incredibly difficult today. Our clients are seeing a dramatic decrease in security fatigue and burnout through the automation that this service provides — building correlations in the background eliminates manual interventions and transforms reaction time drastically. Our clients are consuming a service that’s outcome-based while leaning on a full-spectrum security provider they can trust. This not only spans managed service but consulting and project services for an end-to-end experience.” 

The Insight Managed XDR service is part of managed IT services offered by Insight that simplify asset management, quicken issue resolution, cut down on operational costs, and free up in-house IT staff to concentrate on strategic initiatives. This allows CISOs and CIOs to source all their technology requirements from a single partner and extends Insight’s security architecture and overall IT modernization services. 

By giving 24/7 visibility into the entire IT environment and covering the entire digital estate, including endpoints, cloud, and data center infrastructure. Insight Managed XDR both lowers risk and streamlines security management by removing simple fixes for every attack surface. Utilizing analytics powered by AI and machine learning to identify threats and reducing the months-long process of discovering a security breach attempt to hours or even minutes. Providing automated orchestration and built-in orchestration for quick incident response and remediation.