Organizations manage risk in three ways: they accept it, they take out insurance against it, or they take active measures to diminish its potential impact. These active measures commonly include deploying or enhancing (or removing) technology, updating policies and procedures, instituting training and awareness programs, revising their third-party agreements, and in some cases, modifying their organizational structure.

When organizations are deciding which mitigation techniques to apply, they look at relative costs. Note that this does not require a detailed risk quantification effort – those tend to go off the rails quickly. For estimates as uncertain as cyber risk, it is prudent to be generally correct than precisely wrong. Cyber insurance is among the proactive measures that can be taken as part of a holistic information security risk remediation program.

Growth of Cyber Insurance

There are two separate trends driving this growth. First, the number of organizations purchasing cyber insurance is growing. Second, the premiums for a given amount of coverage are increasing. However, demonstrating a strong information security program can help organizations negotiate a reduced rate.

According to Marsh’s Global Insurance Market Index Q4 2016, the cyber insurance market in the U.S. continues to see moderate increases in premiums. In 2015, rates increased by 12 to 15 percent, while in 2016 rate increases dropped to single digits, ending the year at 1.2 percent. The survey notes that cyber insurance purchases increase in the aftermath of a noisy, expensive incident. Recent events – the Verizon AWS leak, the waves of ransomware, and such – will drive buying.

Another consequence of more organizations electing to purchase cyber insurance is that the dollar volume of insurance premiums is growing. According to the May 2017 Cyber Insurance Market Watch Survey, from the Council of Insurance Agents & Brokers, 44% of respondents (insurance brokers) report that their clients are increasing their coverage, while none report any client decreasing coverage. The average policy covers about $6 million, up from $3 million in last fall’s survey. Growth is fastest among small-to-medium enterprises, as they become increasingly aware of the real cyber threat. Three brokers noted that they each had clients seeking $600 million limits. The largest reported last fall was $500 million.

The Financial Times reports global premiums amount to $2.5 billion in 2016. Allianz, an insurer based in Munich, Germany, expects that to exceed $20 billion by 2020. Third-party risk and business interruption coverage, along with ransomware and hacking risk are driving that growth.

Getting the best coverage for your buck

Once an organization decides to purchase cyber insurance, it can lower the premium significantly by having a strong information security program, which reduces the potential exposure to the insurer. The following elements will make a difference.

Cyber insurance is an effective supplement to a robust information security program. To help negotiate the best premium for your organization, check out Trend Micro’s Control Manager. The layered, centralized visibility and robust reporting can be used to demonstrate effective security management procedures to cyber insurance providers.

The moniker of fake news has been utilized in numerous circles recently, including within government, press and cybersecurity, but this concept actually dates back far beyond the past year. Intentionally misleading propaganda materials have been a linchpin of communication for years, particularly during times of political or economic turmoil. And as technology continues to advance, so too do the strategies in which malicious actors utilize to spread this type of misinformation.

But how, exactly, as these pursuits supported within the current technological environment? And what kinds of risks does fake news present to individuals and businesses at large? Now that this concept has garnered so much attention across the globe, it's time to take a closer look at the inner workings of fake news.

Fake News before Facebook

When one thinks of "fake news," the first images that may spring to mind include social media posts and links to articles designed to incite a specific point of view, and spark conversation among users – whether the information included there is true or not. However, as Trend Micro noted in its Forward-Looking Threat Research Paper, "The Fake News Machine: How Propagandists Abuse the Internet and Manipulate the Public," publications created to mislead the public were being circulated long before social media.

"The internet is only the latest communications technology used to spread propaganda," Trend Micro researchers noted. "It allows a small number of individuals to influence and manipulate the opinions of a larger audience. In addition, the targeting and crowd dynamics created by social media allows for ideas – true or otherwise – to spread faster than ever before."

Supporting Fake News: The Triangle

Fake news succeeds via three core pillars.

However, social media is only one piece of the puzzle here. Overall, in order for fake news to successfully reach its audience and shift the general opinion in the desired way, it requires three parts:

• Motivation: Fake news is created with a specific purpose in mind – to sway the minds of readers in specific direction that aligns with the publishing party's objective. As Trend Micro pointed out, this pursuit is typically supported by information and claims that go beyond simply being biased – including details that are often completely non-existent, fabricated in a way that will attract a reader's attention.
• Dissemination services: While social media has become a preferred way to spread misinformation, it isn't the only strategy being employed. Social media can fall short in several areas, creating a need for more legitimate advertising support. Gray market services have sprung up to fill this gap, enabling fake news to be better promoted and reach a wider audience. As researchers explain, these services often charge a specific amount in exchange for a set number of actions or manipulations via social media. Some even have the ability to guarantee engagement among human users as opposed to bots. Besides just circulation, certain services also include the creation of the fake stories themselves, as well as manipulation of the comments section following the story. In this way, the misinformation extends beyond just the details of the fake news – readers are being swayed in the subsequent discussion of the "news" as well.
• Social media: These social sites provide the foundation for fake news, enabling publishers to quickly and easily connect with a large number of readers. As Trend Micro pointed out, the above described dissemination services hinge upon social media access to spread fake news to readers.

"[I]n the context of social media and the internet [fake news] campaigns rely on three different components to be successful," Trend Micro noted. "We'll call this concept the fake news triangle. The absence of any one of the three factors will make the spread of fake news more difficult, if not impossible."

A Closer Look: Driving Motivations

Before online services can be used to spread fake news via social media and other attention-garnering platforms, publishers must have a specific motivation in mind for their efforts. What types of factors can encourage fake news? Let's take a look:

• Political: In this current landscape, political motivations reign supreme as a driving force behind today's fake news. These pieces are created specifically to incite a change in an individual's political opinion, and align with a certain political agenda which may or not be controversial.
• Financial: Fake news can also be financially motivated, and such is often the case with advertising to spur traffic to a misinformation-spreading site. One clear example here is Infowars.com, a website known for publishing details about conspiracy theories. Because the site has nearly the same presence as the Chicago Tribune thanks to a high number of pageviews and overall visits, Infowars.com profits significantly from on-site advertisements.
• Data leaks for character assassination: Fake news can also be used to skew the public opinion of a well-known individual or political figure. These types of fake news initiatives can also overlap with political motivations, as was the case with the Democratic National Committee email leak of 2016. As Trend Micro noted, leaked data was so severe, that several party members subsequently resigned.

"The popular perception of politicians as dishonest people makes leaking emails and other sensitive documents from politicians quite effective," Trend Micro stated.

Fake News in the Real World: A Financial Market Case Study

The reach of fake news in the current landscape is considerable. While best known in political circles, misinformation can impact nearly every industry vertical, as demonstrated by a recent case in the financial service industry.

Business Insider contributor Chris Versace reported that in one instance, a single writer utilized several pseudonyms to publish articles on stock market insights website. While the site itself uses a network of contributors to research and report on selected stocks, there is the potential for misuse and misinformation which could have far-reaching effects in the marketplace.

"The inherent risk, however, is contributors are out there looking for opportunities to make money for themselves or for their clients by buying or shorting stocks," Versace pointed out.

Lessening the Impact of Fake News

Overall, misinformation published and circulated with the expressed goal of swaying readers can have damaging effects for organizations in every circle. Thankfully, though, governing groups and other officials are taking steps to help reduce the power of this misleading content. Social networking and other sites like Google are working to include features to help readers better fact check.

This responsibility isn't just up to the platforms where news is published, however. Individual readers should also take steps to identify fake news, including looking out for characteristics like clickbait headlines, suspicious domain names, a lack of publication time or date, and a lack of cited sources.

Fake news has created considerable problems for readers and businesses, but it doesn't have to. To find out more, check out Trend Micro's forward-looking Threat research paper.

There's no question that ransomware is one of the most formidable threats to a business. With so much riding on digitized data, important applications and other systems, any interruption to access of these crucial assets can quickly spell disaster for an organization.

Despite efforts on the part of enterprises to educate staff and enhance their ability to prevent infection, ransomware attacks still persist. At this juncture, it's important that businesses not only work reactively according to current threats, but look toward future protection as well.

Ransomware: A brief history

According to a research paper from Trend Micro, "Ransomware: Past, Present and Future," the first ransomware samples emerged in the mid-2000s, helping to cement extortion as a staple in the cybercrime community. Many of these initial ransomware families work similarly to new samples being discovered today – after infiltrating the victim's system, important files and data are encrypted, preventing access to anyone except the hacker holding the decryption key. Attackers will then demand a ransom – typically in untraceable Bitcoin – for the safe return of files.

Results of an attack can vary: Some organizations have paid the ransom and have seen the decryption and returned access of their files. Other victims haven't been so lucky, and are never able to reclaim stolen data, despite payment of the ransom.

Initially, ransomware was centered around victims in Russia in 2005 and 2006. Infections were then observed in other European countries by 2012. Even then, attackers were careful to cover their tracks, demanding ransom through payment methods like paysafecard and MoneyPak to conceal their malicious activity.

According to Trend Micro, some early ransomware attacks were nothing more than hoaxes, leveraging convincing yet fake alerts to encourage users to pay the ransom. Other samples did use screen locks to prevent users from going beyond the notification window.

Ransomware has seen a meteoric rise.

2013 saw the emergence of "crypto-ransomware" samples, including the now infamous CryptoLocker. These infections became increasingly dangerous, as not only was data encrypted and access blocked, these samples also had the ability to delete encrypted files after a certain time period if the ransom wasn't paid.

Ransomware infections reached a peak in 2016, earning it the moniker, "The year of ransomware." Where 2015 saw the discovery of 29 different ransomware families, this number shot to 247 families in 2016, representing a staggering 752 percent increase. Overall, attackers generated significant profits from ransomware infections that year, with hackers raking in a reported $1 billion. Much of this was the result of attacking large businesses without data backups, making ransom demands more successful for cybercriminals.

Ransomware in 2017

These attacks are on track to reach another milestone this year. According to a report from Kaspersky Lab, ransomware attacks rose 250 percent during the first few months of 2017, with many infections centered around the U.S.

Much of this increase stems from the discovery of new ransomware like WannaCry in April, and Petya, which is currently impacting businesses, government organizations and utility providers in Europe. In addition, The Verge reported in late June 2017 that another new ransomware – initially thought to be a variant of Petya – was impacting users leveraging the same EternalBlue exploit utilized in WannaCry infections. This new strain is currently being called "NotPetya."

Future predictions: Where will ransomware go from here?

Besides newly emerging ransomware samples, experts have made a few other significant predictions about what the future of ransomware will hold.

Trend Micro predicted that there will be an evolution in ransomware strategy in the near future, including increased ransomware attacks on IoT systems. 

In addition, IDC's Worldwide Healthcare Predictions Report noted that by 2018, the number of ransomware attacks seen in the healthcare industry are on pace to double. This comes as a result of hackers focusing more on healthcare providers and others within the industry with access to sensitive patient and other valuable data. What's more, the current interest in this industry among hackers is reaching a fever pitch. 

"The report describes the increased menace and maturity of ransomware techniques as creating a 'gold-rush mentality' amongst the cyber attack community as growing numbers seek to cash in," wrote Converge contributor Shelly Kramer.

Imperva contributor Elad Erez predicted a sharp increase in ransomware attacks that pinpoint a victim's most important databases. These attacks may also utilize other forms of data corruption in addition to encryption, including completely wiping out files, dropping database tables or changing database records.

As ransomware continues to become more advanced, law enforcement efforts are quickly catching up. Law enforcement is collaborating with other organizations like the Cyber Threat Alliance and No More Ransomware to help improve its ability to pinpoint the sources of powerful ransomware families and prevent further attacks.

Overall, ransomware attacks aren't poised to slow anytime soon.

"In terms of potential, [ransomware samples] can evolve into malware that disable entire infrastructure (critical not only to a business's operations but also a city's or even a nation's) until the ransom is paid," Trend Micro stated.

Protection in the Age of Ransomware 

Even as ransomware attacks continue to increase in severity and complexity, there are a few important strategies businesses should leverage to better protect their sensitive data assets. This includes:

• Educating employees about the risks of ransomware, how an infection can be delivered, and what to do when suspicious activity is suspected.
• Ensuring all security patches are put in place as quickly as possible, minimizing any vulnerabilities.
• Limiting access to sensitive data.
• Following a robust backup schedule that includes three copies of sensitive data in at least two different formats, one of which is housed outside the company's internal network.

It's also imperative to have the right security technologies in place.

"Security solutions that incorporate a cross-generational technology approach that combines reputation-based analysis with other anti-ransomware capabilities like whitelisting and application control, behavioral analysis, network monitoring, vulnerability shielding, and high-fidelity machine learning can better protect companies while minimizing the impact on their computing resources," Trend Micro noted.

To find out more about the future of ransomware and how you can protect your business, contact the experts at Trend Micro today.

CopyKittens is a cyberespionage group that ClearSky has been reporting on since 2015, tracking their attacks on government-related bodies around the world. Trend Micro has supported this research at several points, including for their latest report released today on the group’s vast espionage campaigns. This research highlights new malware, exploitation, delivery, and command and control (C&C) infrastructure being used by the group. This is Trend Micro’s second collaborative effort with Clearsky, a paper on similarly named Rocket Kittens in 2015.

CopyKittens at Work

The main countries targeted by CopyKittens are Israel, Saudi Arabia, Turkey, the U.S., Jordan and Germany. Within these countries, the targets vary – with government institutions, defense companies, sub-contractors and large IT companies among the most targeted organizations.

Victims are targeted via several methods, including spear phishing emails, watering hole attacks, fake social media profiles and targeting exposed webmail accounts. The group uses a combination of these methods to persistently target the same victim over multiple platforms until they succeed in establishing an initial beachhead of infection – before pivoting to higher value targets on the network.

To do this the group leverages their own custom malware tools in combination with existing, commercial tools, such as Cobalt Strike and Metasploit. This report is the first time some of these custom tools have been publicly discussed. Details are given on how each component is used during initial infection and later lateral movement on the victims network.

Protection Techniques

Security measures for these attack types are well known – and Trend Micro’s solutions like Trend Micro Deep Discovery can mitigate these risks on multiple levels. One particular attack vector does merit an extra mention however – webmail. As stated in our recent Pawn Storm report, we strongly recommend two factor authentication be implemented to protect webmail accounts from being compromised. Webmail accounts can be a treasure trove of information for an attacker, and an extremely strong initial beachhead for pivoting into other targets e.g. replying to existing threads with malicious attachments or links.

You can find further information on this attack campaign in our collaborative paper “Operation Wilted Tulip: Exposing a Cyberespionage Apparatus.”

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days.

Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back each Friday for highlights of the goings-on each week! 

Black Hat and DEF CON Have Evolved over the Last 20 Years

If you had to select one symbol of cybersecurity industry, you’d be hard pressed to find a better choice than the pair of conferences, Black Hat Briefings (Black Hat) and DEF CON. The duo is known affectionately as Hacker Summer Camp by many conference goers.  

Petya Ransomware Victims Can Now Recover Their Files for Free

Petya is a ransomware program that first appeared in March 2016. Internet users who have fallen victims to the aggressive ransomware attacks over the past year are in luck. There is now a free tool that will allow them to decrypt their files if they hang onto them since then. 

U.S. and Japan Are Ramping up Cybersecurity Coordination

The U.S. and Japan promised to strengthen cybersecurity cooperation and cyberthreat information-sharing in a joint statement issued July 24 at the conclusion of the fifth bilateral meeting on the subject. The two countries pledged to collaborate on critical infrastructure protection and other issues. 

China Arrests Hackers Behind One of the World’s Largest Malware Infections

At least nine of the ring of hackers that developed the “Fireball” malware have been arrested by Chinese authorities, according to state-run news outlets. Fireball’s reach was one of the world’s most extensive. News of it emerged a month ago, and it’s been estimated to have infected 250 million computers. 

Fake News Is Being Utilized in Numerous Circles

Intentionally misleading propaganda materials have been a linchpin of communication for years, particularly during times of political or economic turmoil. And as technology continues to advance, so too do the strategies in which malicious actors utilize to spread this type of misinformation. 

300,000 Records Breached in Ransomware Attack on Pennsylvania Health System

The Women’s Health Care Group of Pennsylvania has notified 300,000 of its patients that a ransomware attack has put their personal health information at risk. The health system discovered a server and workstation at one of its practices was infected by ransomware on May 16. 

Manage Rising Cyber Insurance Rates

When organizations are deciding which mitigation techniques to apply, they look at relative costs. Note that this does not require a detailed risk quantification effort – those tend to go off the rails quickly. For estimates as uncertain as cyber risk, it is prudent to be generally correct than precisely wrong. 

Turkish Android App Store Is Spreading Malware

A Turkish alternative app store, CepKutusu.com, has been spreading malware under the guise of nearly every offered Android app. Victims will download an app from the store only to find the app in no way resembles what the user was expecting, but instead is an app disguised as a Flash Player. 

It’s Time to Plan for Ransomware

There’s no question that ransomware is one of the most formidable threats to a business. With so much riding on digitized data, important applications and other systems, any interruption to access of these crucial assets can quickly spell disaster for an organization. 

Facebook Backs $1 Million Security Prizes and Anti-Election Hacking Group

Alex Stamos, Facebook’s chief security officer, announced Wednesday that the company would bankroll a new anti election-hacking group during a keynote address at the Black Hat hacking conference in Las Vegas.  The project is part of the Belfer Center for Science and International Affairs. 

CopyKittens Exposed by ClearSky and Trend Micro

CopyKittens is a cyberespionage group that ClearSky has been reporting on since 2015, tracking their attacks on government-related bodies around the world. Trend Micro has supported this research at several points, including for their latest report released today on the group’s vast espionage campaigns. 

Microsoft launches Windows bug bounty program with rewards ranging from $500 to $250,000

Microsoft announced the Windows Bounty Program. Rewards starting at a minimum of $500 and can go up to as high as $250,000. The Windows Bounty Program encompasses Windows 10 and even the Windows Insider Preview, the company’s program for testing Windows 10 preview builds.

Please add your thoughts in the comments below or follow me on Twitter; @JonLClay.

This week, I attended the Black Hat conference in Las Vegas, Nevada. 2017 marked the 20^th anniversary of the Black Hat conference. A lot has certainly changed since I started attending back in 2002. I’m sure that many will have their opinions on the central themes that they saw at the conference (artificial intelligence was one message I saw on many booth graphics), but the theme that was dominant in my discussions with various security organizations was integration.

“How can our solutions work with yours?” “Can we set up an API so our solutions can talk to each other?”

Integration isn’t new to us. We’ve made it a point to work with other solutions that customers have in their networks, even products from companies I’d consider “frenemies.” In the end, the ultimate goal is visibility and being able to compile threat intelligence from multiple sources and make sense of it all. For those using TippingPoint solutions from Trend Micro, you can see how SMS Threat Insights can help you prioritize what you need to focus on first and make you the hero of your network. Learn more about SMS Threat Insights from this short video:

Zero-Day Filters

There are 18 new zero-day filters covering five vendors in this week’s Digital Vaccine (DV) package. A number of existing filters in this week’s DV package were modified to update the filter description, update specific filter deployment recommendation, increase filter accuracy and/or optimize performance. You can browse the list of published advisories and upcoming advisories on the Zero Day Initiative website.

Cisco (6)

Hewlett Packard Enterprise (4)

Microsoft (3)

Schneider Electric (1)

Trend Micro (4)

Missed Last Week’s News?

Catch up on last week’s news in my weekly recap.

As a managed service provider, your customers have entrusted you to manage their IT infrastructure and their security so it’s important that you are making the right choices to secure their environments and keep cyber criminals at bay.

In my years of working with our Managed Service Provider partners, I’ve seen a number of mistakes made by MSPs that I wanted to share with you in the hopes that you can avoid them and keep your customers safe.

You believe that AV is just AV

Let me start by sharing a story you’re familiar with, and may have personally experienced like me, regarding the details of a now infamous credit card breach.

In 2013 Target was the victim of a carefully planned and executed cyber attack that resulted in 110 million credit card credentials and other customer information getting stolen. I won’t bore you with all the details, but the ensuing investigation revealed three interesting pieces of information I want to highlight:

Cybercriminals have become increasingly more sophisticated in recent years which demands more feature-rich and intelligent security solutions backed by global threat feeds and big-data analysis capabilities. It’s naïve to think that AV vendors just sell AV products. The fact is, if any vendor just focused on anti-virus today, they would be out of business. AV vendors today have a broad set of techniques to protect against old and new threats like ransomware, malware, bots, rootkits, viruses, spyware, etc. Don’t fall in to the trap of thinking AV vendors aren’t constantly innovating and developing new protection techniques like machine learning to combat new types of threats beyond just AV.

You’re letting the customer dictate which security solution to use

Most, if not all of you, probably have a diverse set of customers you work with including doctors, lawyers, accountants, pet stores, dentists, coffee shops, and so on. These customers are likely very good at their respective professions, they aren’t experts in security though. That’s where you come in. Your customers trust and rely on your expertise to keep them secure so they can focus on doing what they do best, whatever that may be.

Often times the customer may already own a security solution or let you know which solution they would prefer. By letting your customers choose their own vendor, not only will you incur additional costs by having to support and train your technicians on many different products, but you also create a dangerously inconsistent security posture across your customer base. You wouldn’t tell your dentist which tools to use for a root canal, so why would you let your customers tell you which security solution you should be using to protect their environment?

Don’t pick a security solution based solely on price

I took a marketing class in college and while I don’t remember much about that class specifically, one case study stuck with me throughout my career. It was about a company that made smoke detectors. Smoke detectors aren’t terribly exciting, but we all have them, we are all familiar with what they do and we understand their importance in keeping us and our families safe and secure in the event of a fire. The short version of the case study was that the company decided that in order to increase sales, they would lower the price of their smoke detectors. If you have even a basic knowledge of supply and demand, you would expect a decrease in price to result in an increase in sales. Strangely, that wasn’t what happened – sales actually decreased. When all was said and done, it turns out that when it comes to personal safety and protecting your family, people perceived a lower priced smoke detector to be of lower quality which wasn’t a risk people were willing to take. In other words, people were willing to pay a premium to protect what they perceived as valuable. In this case it was themselves and their families, in your customers’ case it’s their data, intellectual property and business assets.

When the security you’re offering your customers is chosen based on price not only are you putting your customers at risk due to reduced feature sets, but you may also be incurring costs that aren’t factored in to the price of the product such as having to purchase bulk licenses up-front, committing to terms that may not align with your business model, spending money on additional products to supplement missing features, and any costs associated with having to handle renewals, such as tracking expiration dates, co-terming licenses, chasing down missed renewals, etc.

You’re not leveraging the cloud.

Many of you have likely been in business for a long time with established customers and processes in place. One of which is probably renewing and managing legacy on-premise security products for your customers because they either “just work” or you’d rather not incur the costs of migrating your clients to a cloud-based equivalent, which is likely a non-billable activity. It’s easy to overlook the hidden costs of on-premise security solutions, such as patching and upgrading, as well as difficult to justify the cost of out-of-date remote or roaming employee machines increasing the risk of infection and burdening your bottom line.

Many MSPs I talk to view SaaS and cloud applications as a threat to their legacy, and out-of-date, business model that was heavily dependent on hardware margins and setting up and maintaining servers.  The reality is, while SaaS eliminates hardware and server maintenance, there’s still value in providing your expertise, setup, configuration, and management skills to customers utilizing SaaS applications.

You’re missing out on these opportunities.

Customers and their employees have never had it easier to do their jobs. With a plethora of smartphones and mobile devices to choose from and an ever-increasing number of SaaS applications like Office365, workers can do their jobs anytime, anywhere and on any device. Of course, these devices and SaaS applications are often neglected from a security perspective either out of stubbornness, ignorance or oversight.

Some interesting data points to share about these often neglected platforms:

As a managed service provider, you should be educating your customers about the need to protect these platforms and it’s an opportunity to build additional recurring revenue streams for your business. 

The good news is whether you are making one or all of these mistakes, it’s not too late to turn things around. Here’s a short-list of things you should consider when choosing a security vendor to partner with for your managed services business:

Are you making any of these mistakes? If so, it might be time to make the best switch for you and your customers.

At Trend Micro we always strive to be a responsible corporate citizen. Right from the beginning the company has devoted significant time and resources to a variety of projects: from house building in the Philippines, to our Give and Match programs around the world designed to support vital community projects. However, a special focus has always been on supporting, educating and engaging with young people just beginning to live their digital lives.

That’s why our Canada team is teaming up with local organization CyberLaunch Academy on a new video competition designed to raise awareness of online safety among school-age children. Winners will receive fantastic annual scholarships at the academy worth up to CA$500.

Working for a safer future

Security has, of course, been in our DNA right from day one. But the best products in the world can’t help us if tomorrow’s netizens don’t have a good understanding of the risks facing them online. So, it made sense early on to find innovative new ways to get the online safety message across to kids.

We host Summer Seminars for Japanese elementary school children, work with universities in Taiwan to develop local student talent, and run a popular international video competition – What’s Your Story? – to encourage more kids to take a lead on internet education. Our flagship Internet Safety for Kids and Families program has been delivering free tools to PTO/PTAs across the US for several years, and our Internet Safety Night in partnership with PTO Today has reached more than 5,000 schools since its inception.

We even developed Art Against Cybercrime; a German school project designed to encourage students to share their thoughts on the darker side of the internet.

But the truth is, we’re just getting started.

Time to Cyber Launch!

The latest project to come out of our Canadian office is a fantastic new video competition open to 7-17-year-olds from the province of New Brunswick. For the pilot launch this year, we’re asking entrants to submit videos of between 30 seconds and two minutes (and no more than 100MB) on the topics of cyberbullying, internet safety and online privacy.

Be as creative as you like. The most thought-provoking, persuasive and original entries could be in line to win one of these amazing prizes:

The CyberLaunch Academy is a wonderful New Brunswick organization with a vision to improve elementary, middle, and high school students’ interest in science and tech, while decreasing gender imbalance in IT education. Its extra-curriculum courses teach everything from web design to personal online security, computer animation to coding – and much more besides.

This competition is a fantastic opportunity to get your child enthused about ICT, whatever their age or background, as we all work towards building a safer internet for future generations.

The deadline for entries is 20 August 2017. Please read the official rules for lots more details.

Good luck!

Healthcare organizations (HCOs) are not immune to large-scale cyberattacks, as evident by the most recent attacks WannaCry and Petya. In fact, HCOs are an attractive target for hackers because of the immense amount of personally identifiable information housed in their systems. The industry is widely known for having a broad spectrum of cybersecurity maturity, from the advanced to weak or poor maturity.  Given the integrated nature of data and networks across the care continuum, it makes the cyber maturity of an organization’s your business partners equally as important to that of their own.

It is no wonder why cybersecurity issues is a growing concern for HCOs.

In order to combat the cyber maturity challenges the industry faces, Trend Micro has partnered with HITRUST to expand the CTX to include the HITRUST Cyber Threat Management and Response Center. This is a virtual center that encompasses many labs and resources both at Trend Micro and at HITRUST.

The CTX platform is the most widely adopted and active cyber threat information sharing organization for the healthcare industry. This partnership represents a significant advancement for healthcare organizations of all levels of cyber security maturity in defending against the increasing volume, speed and damage of today’s cyber threats.

We are thrilled to be part of a program that is making a positive difference in improving cyber defenses for organizations of all sizes and our overall nation’s cybersecurity posture.

To advance cybersecurity measures for HCO’s this partnership will enable:

For more information on the partnership please visit here.

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days.

Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back each Friday for highlights of the goings-on each week! 

Cerber Ransomware Evolves Again and Now Steals from Bitcoin Wallets

Cerber ransomware has acquired the reputation of being one of the most rapidly evolving ransomware families to date. Just in May, we pointed out how it had gone through six separate versions with various differences in its routines. Several months later and it seems to have evolved again. 

Healthcare Organizations Are Not Immune to Large-Scale Cyberattacks

HCOs are an attractive target for hackers because of the immense amount of personally identifiable information housed in their systems. The industry is widely known for having a broad spectrum of cybersecurity maturity, from the advanced to weak or poor maturity.  

New WannaCry-Mimicking SLocker Abuses QQ Services

Trend Micro researchers detected a new SLocker variant that mimics the GUI of the WannaCry crypto-ransomware. Detected as ANDROIDOS_SLOCKER.OPSCB, this new SLocker mobile ransomware variant features new routines utilizing features of the Chinese social network QQ. 

HBO Cyberattack is “Seven Times Worse” Than the Sony Hack

 The latest HBO hacking scandal is shaping up to be much, much worse than a few leaked Game of Thrones episodes. The cyberattack that occurred earlier this week compromised around 1.5 terabytes of data, which, it turns out, is seven times the amount of data that was leaked during the 2014 Sony hack.  

Nuance Says Majority of Clients Back Online After Petya Cyberattack

Nuance Communication was one of the U.S. companies hit the hardest by the June 27 Petya/NotPetya malware attacks, which were masked as a ransomware. Last Friday, the major voice and tool provider announced it has restored functionality for 75 percent of its eScription LH platform clients. 

JS_POWMET Is a Completely Fileless Malware

Fileless malware, such as the recent SOREBRECT ransomware, is becoming a more common attack method. However, many of these malware are fileless only while entering a user’s system, as they eventually reveal themselves when they execute their payload. 

 Hackers at DefCon Conference Exploit Vulnerabilities in Voting Machines

The Voting Machine Hacking Village event at the 25th annual DefCon conference wanted to educate the computer security community about potential weaknesses of the voting systems in U.S. elections. It took less than a day for attendees to find and exploit vulnerabilities in five different voting machine types. 

British Hacker Known As ‘Spiderman’ Sentenced Over Cyberattack

A German court handed down a suspended sentence Friday, of one year and eight months, to a 29-year-old British hacker who confessed to committing a cyberattack last November that temporarily took down Internet access for nearly 1 million German consumers. 

You Are Probably Making Mistakes with Your Managed Services Business

As a managed service provider, your customers have entrusted you to manage their IT infrastructure and their security so it’s important that you are making the right choices to secure their environments and keep cyber criminals at bay. 

Trend Micro Is Launching Video Contest for Local Kids in Canada

Trend Micro’s Canada team is teaming up with local organization CyberLaunch Academy on a new video competition designed to raise awareness of online safety among school-age children. Winners will receive annual scholarships at the academy worth up to CA$500. 

Senate Panel Advances Bill to Boost Federal Cyber Scholarships

A Senate committee on Wednesday advanced legislation that would update and expand an existing federal cybersecurity scholarship program for students pursuing degrees in cyber fields. The program is run by the National Science Foundation in an effort to bolster the nation’s cybersecurity workforce. 

Please add your thoughts in the comments below or follow me on Twitter; @JonLClay.

During the DefCon Conference last week, a Windows SMB vulnerability was revealed late last week by researchers from RiskSense. The 20-year-old bug can be found in Windows 2000 up to Windows 10. Microsoft has indicated that it will not be issuing a patch for the vulnerability as it doesn’t meet their bar for servicing in a security update. Earlier this week, we released DVToolkit CSW file SMBLoris.csw to customers using TippingPoint solutions. This custom filter detects an attempt to exploit a denial-of-service vulnerability in Windows SMB and Unix/Linux Samba servers. The vulnerability is triggered by sending a specially crafted NBSS packet resulting in a denial-of-service. SMBLoris is categorized as a memory exhaustion vulnerability.

Customers should note that this filter should only be enabled for suspected denial-of-service attacks in conjunction with IPS thresholding and a tuned number of occurrences in order to eliminate false positives on legitimate requests. The proper setting for number of hits on this filter should be customized for the customer’s environment. For more details, visit https://smbloris.com.

Customers who have questions or need technical assistance on any Trend Micro TippingPoint product can contact the Trend Micro TippingPoint Technical Assistance Center (TAC).

Zero-Day Filters

There is one new zero-day filter covering one vendor in this week’s Digital Vaccine (DV) package. A number of existing filters in this week’s DV package were modified to update the filter description, update specific filter deployment recommendation, increase filter accuracy and/or optimize performance. You can browse the list of published advisories and upcoming advisories on the Zero Day Initiative website.

Apple (1)

Missed Last Week’s News?

Catch up on last week’s news in my weekly recap.

Over the years Trend Micro has collaborated with and learned from a variety of MSPs. Today’s threat landscape is continuously evolving, becoming more complex and sophisticated than it was even a year ago. For MSPs to rely on a single solution is not practical or in the best interest of their customers.

To maximize customers’ protection, we recommend focusing on these four areas:

1. Endpoint security – The core component of a managed security solution. Every customer has endpoints that need protection.

What to consider when selecting an endpoint security solution:

2. Mobile/Roaming security – The ability for workers to connect online when they’re offsite provides tremendous benefits to businesses. However, this disrupts the old security paradigm where businesses were responsible for protecting customers only inside the walls of their offices. Yes, some endpoint security solutions include protection for mobile devices. However, these commonly revolve around basic security or mobile device management functionality.

What to consider when selecting a complementary solution:

3. Email security – On a daily basis, billions of emails are sent and received around the world, making this form of communication yet another vector for threats and annoyances to infect users. Even if a small percentage of them are malicious, customers are still vulnerable to a high volume of threats.

Features to consider for an email security solution:

4. Cloud Applications – More and more customers are migrating their line of business applications to the cloud thanks in large part to companies like Microsoft, Google, and Dropbox. While these companies may provide some baseline level of security for their applications, they are not security experts.

Some things to consider when it comes to protecting cloud applications

At Black Hat in Las Vegas last week, Trend Micro’s Kevin Simzer spoke about the global, dire need for cybersecurity talent. The number of open jobs in cybersecurity continues to increase dramatically. A report from Cisco stated that there were over one million unfilled positions globally in 2016. Symantec’s CEO said the shortfall will rise to 1.5 million by 2019. A study by ISC2 projects 1.8 million open positions by 2022.

Enterprises need information security talent for a set of tasks. The US Department of Commerce established NICE (the National Initiative for Cybersecurity Education, see https://www.nist.gov/nice for details) to support training in cybersecurity. This initiative, documented in NIST SP 800-181, lists seven workforce categories:

Solutions

The scale and urgency of the issue exceeds the response time of conventional market mechanisms. In the US, National Institute of Standards and Technology (NIST) has partnered with CompTIA (the Computing Technology Industry Association) and Burning Glass (a consultancy) to produce a heat map showing open jobs by region within the US. See http://cyberseek.org/ for details.

Professional certification can open doors for job seekers. As of this writing, CyberSeek shows 108,874 people in the US holding CISSP (from ISC2, see https://www.isc2.org/Certifications/CISSP), CISA, or CISM (both from ISACA, see http://www.isaca.org/certification/cisa-certified-information-systems-auditor/pages/default.aspx) designations, while there are 140,855 open jobs requiring one of these.

Open competitions such as Capture-the-Flag can excite and reward new cybersecurity talent. Trend Micro runs an annual competition, described at http://www.trendmicro.com/tmctf, designed to “target young professionals in the cybersecurity industry to enhance their practical skills in areas such as cybercrimes, targeted attacks, Internet of Things (IoT) and Industrial Control Systems (ICS).”

Beyond conventional state-sponsored and higher-level education, enterprises can ramp up training programs to meet their individual requirements. During the 1970’s many industries rapidly automated conventional back-office processes, creating demand for skilled programmers. Since there were few degree-granting programs in computer science or software engineering then, certain leading firms trained programmers themselves. This business process created three unforeseen benefits.

As of this writing (Aug 2, 2017), Amazon has 89 open cyber security jobs in the US. IBM has 98. Trend Micro trains skilled individuals in many geographies globally. In the first half of 2017, 50 people completed the training program. Nine have joined Trend Micro, and the rest have joined partner firms in their regions. There is no cost. Students receive a small stipend during the seven-week program. That program will scale up to meet some of Trend Micro’s global cybersecurity skill requirements in parallel with conventional experienced hiring. While some organizations (or consortiums) may not be able to justify a training program, those that do will reap substantial benefits for themselves and their communities.

Chat platforms have become a cornerstone for businesses and their customers alike. These important tools make it possible for employees to communicate and collaborate from nearly any location, and enable consumers to reach out to companies in accordance with their preferences.

This fondness for chat communication is supported by statistics gathered by Inc., revealing 42 percent of customers prefer live chat over other communication methods, and 92 percent feel satisfied after using a business's live chat feature. What's more, employees are increasingly depending on chat capabilities – according to VentureBeat, popular chat platform Slack surpassed 3 million active daily users last year, demonstrating the important role chat currently plays for business workers.

However, as chat technologies continue to attract enterprise and consumer use alike, they also garner the attention of malicious actors.

Trend Micro research shows potential for abuse

Recently, Trend Micro researchers turned their attention to popular chat solutions to find out how these could be leveraged by hackers.

"[C]hat platforms allow their users to integrate their apps onto the platforms themselves through the use of their APIs," Trend Micro researchers explained. "But one thing must be asked, especially with regard to that kind of feature: Can it be abused by cybercriminals? After all, we have seen many instances where legitimate services and applications are used to facilitate malicious cybercriminal efforts in one way or another."

Chat solutions like Slack and Discord enable integrations to allow for increased access to other third-party apps without the need for users to leave the chat platform. In this way, users can view a calendar notification or track reports while still maintaining communication connections. As researchers found out, though, this helpful capability can also open an organization up for potential infiltration and security compromise.

Successful attempt: Turning chat into C&C

Trend Micro used monitoring, background knowledge and proof-of-concept code to test the possible vulnerabilities of popular chat platforms like Discord, Slack and Telegram. Through their efforts, researchers were successfully able to show the process hackers could use to turn a top-used chat platform into a malicious command&control (C&C) server. The creation of this kind of cybercriminal system would allow hackers to connect with compromised systems within an enterprise's infrastructure, offering opportunities for harmful activity.

Hackers are already at work

Researchers didn't just discover that this malicious capability was hypothetically possible, however. Trend Micro observed that hackers are already exploiting this key vulnerability.

"Our extensive monitoring of the chat platforms has also revealed that cybercriminals are already abusing these chat platforms for malicious purposes," Trend Micro researchers noted.

Just a few of the cybercriminal activities going on within chat platforms include:

• Discord: Hackers are utilizing this platform to host malware with a range of dangerous capabilities, including samples capable of mining Bitcoin from infected systems, as well as those that can inject subsequent malicious files.
• Telegram: Researchers discovered this platform is being used to spread ransomware including TeleCrypt.

The problem with chat security

What is so worrisome about these discoveries isn't just the fact that malicious activity is taking place. The true Achilles' heel here is the fact that, at this time, it simply isn't possible to secure these platforms without impacting their functionality. In other words, security efforts would  inhibit users' ability to use chat platforms for their intended purpose.

"Blocking the APIs of these chat platforms means rendering them useless, while monitoring network traffic for suspicious Discord/Slack/Telegram connections is practically futile as there is no discernible difference between those initiated by malware and those initiated by the user," Trend Micro researchers explained.

Balancing risk with safe use

This situation creates a dilemma for today's businesses, as decision-makers must decide if the use of these platforms is worth the potential security risk. According to Trend Micro, the answer depends on the organization's current security posture.

"If the network/endpoint security of a business using a chat platform is up to date, and the employees within that business keep to safe usage practices, then perhaps the potential risk may be worth the convenience and efficiency," Trend Micro researchers stated.

Other security best practices to employ here include:

• Educate users on safe use practices: Users should know not to click on suspicious links or files, even if they are sent by a familiar contact. In addition, the chat platform should only be used for work purposes, and all communications and credentials should be kept confidential.
• Support education with usage guidelines: In order to ensure safe usage habits, companies should create guidelines that underscore the information employees learn during the above-described education process.
• Consider discontinuing use: It's also important to consider whether or not a chat platform is really critical, and worth the potential security risk. Some smaller businesses, or those with other communication methods at their disposal, may decide that chat isn't mission-critical for daily use, and may discontinue using it as opposed to dealing with the potential vulnerability.

Chat platforms can pose a risk to security, but when balanced with safe use practices, this risk can be addressed. To find out more about how hackers are utilizing chat platforms for C&C capabilities and how this could impact your business, check out Trend Micro's research paper, "How Cybercriminals Can Abuse Chat Program APIs as Command-and-Control Infrastructures."

In a world where mobile users flock to  Android or iOS devices, news of an emerging threat impacting either one of these platforms is certainly enough to garner attention. According to recent statistics, there were more than 2 billion active Android users across the globe in May 2017, and many of these endpoints are leveraged by users for work purposes. In this type of landscape, it's imperative that individual users and business leaders alike remain in the know about newly discovered threats, as well as the best practices that can be used to better safeguard Android devices.

Android Security Bulletin: Addressing Continuing Threats

A security bulletin issued by Android is nothing new. At the same time, these notifications aren't something that Android users – particularly those who utilize their devices to access sensitive corporate assets – should ignore.

Toward the beginning of July, Google released its monthly security bulletin, which included two patches aimed at addressing continuing vulnerabilities spotted a few months earlier. According to Trend Micro Technical Communications Researcher Giannina Escueta, this particular bulletin comes as a result of Mediaserver issues that have plagued Android devices since March. These problems include vulnerabilities that can be exploited for memory corruption, as well as to execute remote code.

The bulletin also sought to pinpoint and resolve vulnerabilities within the Media framework, Broadcom, Qualcomm components, as well as 55 high-rated Qualcomm closed-source component issues. Although these problems pose a considerable threat to Android users – including the potential for a hacker to execute arbitrary code within a privileged process context, according to the Android Open Source Project – it appears Google was able to release patches before these exploits were harnessed by malicious actors.

"We have had no reports of active customer exploitation or abuse of these newly reported issues," Android Open Source Project reported.

Android Judy Malware Impacts Millions of Users

The above-described situation – wherein a patch was created before a vulnerability could be used for active infection – isn't always the case with mobile malware, however. Earlier this year, an Android malware sample dubbed "Judy" reportedly impacted a significant number of users, to the tune of 36.5 million victims, according to BGR contributor Yoni Heisler.

The malware sample, discovered by Check Point researchers in mid-May, was found to enable revenue-generating malicious activity, and was supported by more than 40 infected apps within the Google Play store.

"Notably, some of the offending apps have been available for download for years, though at this point it remains unclear if the malware was always present or perhaps inserted later on via [sic] a software update," Heisler wrote.

Once downloaded by a victim, a Judy-infected app establishes a connection with a Command&Control server, which sends the malicious JavaScript payload. The malware then opens a URL that is redirected to another site. From here, the sample is able to locate and click on Google ad banners, generating revenue for the malware author from the website developer paying for "legitimate" website traffic, researchers explained.

Israeli Hospital Attacks: Android Malware Discovered

Judy wasn't the only particularly harmful Android threat emerging recently. According to Trend Micro researchers, an attack campaign impacting Israeli hospitals this year also exposed a dangerous Android malware capable of taking over victim devices. The threat, detected by Trend Micro researchers in July, has been named GhostCtrl, and hinges on the ability to leverage several device functionalities.

Making GhostCtrl even more of a formidable threat is the fact that there are currently three versions of the Android malware – one designed to steal information and control certain baseline device functions, a second created to support even more control over victim device capabilities, and a third iteration combining the malicious activity enabled by the first two versions.

"Based on the techniques each employed, we can only expect it to further evolve," Trend Micro researchers noted.

Supporting BYOD: Safeguarding Android Devices Used for Work

As threats continue to emerge in connection with Android devices, it's imperative that IT leaders and other corporate stakeholders understand what they can do to support their organization's mobile security posture. There are a few best practices that businesses can employ to improve their protection against mobile malware, including:

• Ensure patches are applied as quickly as possible: Whenever an update is released, it's important that employees are urged to install these with as little delay as possible. As with Android's July security bulletin, patches can be created before hackers have a chance to exploit them. However, these are only effective when devices are updated in a timely manner.
• Restrict access when possible: Because mobile devices can open up opportunities for hackers to access sensitive business data, it's important that the company has specialized permissions set up for certain users. Not everyone needs access to all of the company's data and systems. Creating user permission tiers that align with an employee's access level can help reduce the chances of data leaks.
• Have a strong mobile device management policy: This policy will help direct acceptable use within the organization, including how sensitive data is accessed via BYOD mobile devices. A strong policy can considerably reduce security risks.
• Leverage an app reputation system: Trend Micro noted this system should be able to identify malicious or suspicious apps that could provide an opening for hacker activity.
• Safeguard data with encryption: This security measure ensures that even if a malicious actor is able to infect a device, he or she will be unable to leverage sensitive data stored on the endpoint.

To find out more about how to safeguard Android devices and strengthen your company's mobile security posture, contact the experts at Trend Micro today.

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days.

Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back each Friday for highlights of the goings-on each week!

Backdoor-Carrying Emails Set Sights on Russian-Speaking Businesses

A malicious email campaign against Russian-speaking enterprises is employing a combination of exploits and Windows components to deliver a new backdoor that allows attackers to take over the affected system.  

Online Dating Apps Can be Used to Target Your Company

People are increasingly taking to online dating to find relationships. However, the kind (and amount) of information divulged—about the users themselves, the places they work, visit or live—are useful to attackers who leverage this information to gain a foothold into your organization. 

Hackers Leverage Chat for Command & Control

As chat technologies continue to attract enterprise and consumer use alike, they also garner the attention of malicious actors. Trend Micro researchers turned their attention to popular chat solutions to find out how these could be leveraged by hackers. 

WannaCry ‘Hero’ Pays $30,000 for Bail and Pleads Not Guilty to Kronos Trojan Charges

Earlier this year, Marcus Hutchins was dubbed a hero for finding the WannaCry ransomware kill switch. However, Hutchins was arrested Aug. 2 for allegedly creating the banking trojan Kronos. He was released on bail on Monday and will face a six-count federal indictment; it alleges he created and sold Kronos. 

OnionDog Is a Cyber Drill, Not a Targeted Attack

First reported on in 2016, OnionDog has been known as an attack against South Korean infrastructure. Trend Micro’s latest research shows that it was, in fact, a cyber-drill instead of an active attack. Based on samples they determined that this drill used live malware to test susceptibility of a targeted attack. 

 Android Malware Continues to be a Consistent Threat

According to recent statistics, there were more than 2 billion active Android users across the globe in May 2017, and many of these endpoints are leveraged by users for work purposes. In this type of landscape, it’s imperative that all Android users remain in the know about newly discovered threats. 

UK Organizations Could Face Huge Fines for Cybersecurity Failures

British government proposes penalties as ‘last resort’ for those failing to adequately assess cyber risks and prevent damage. Organizations could face fines of up to four percent of global turnover, if they fail to take measures to prevent cyber-attacks that could result in major disruption to public services. 

Sony Wants to Digitize Education Records Using the Blockchain

Sony is teaming up with IBM to use blockchain to create a secure academic platform for storing records. The Japanese firm wants to use its platform as a way for schools to store educational information, such as degrees, diplomas, tests and more, as a kind of ‘digital transcript. 

US Army Nixes Use of DJI Drones Over Cybersecurity Concerns

Due to increased awareness of cyber vulnerabilities associated with DJI products, the U.S. Army will immediately stop using drones made by the world’s largest manufacturer, DJI of China, and has ordered that batteries and storage media be removed and applications uninstalled. 

Cybersecurity Jobs Are in High Demand

A report from Cisco stated that there were over one million unfilled cybersecurity positions globally in 2016. Enterprises need information security talent. However, the scale and urgency of the issues exceeds the response time of conventional market mechanisms. 

World’s Biggest Student-Led Cybersecurity Games Expand to Israel

Founded 14 years ago, the world’s biggest student-run cyber security event will get even bigger this year: Cyber Security Awareness Week (CSAW) announced it will expand to Israel, which will become the fifth country to host the final rounds of competitions that test the skills of future cyber sleuths and protectors. 

Please add your thoughts in the comments below or follow me on Twitter; @JonLClay.

Earlier this month, a blog post from Blue Frost Security was released stating that they were giving away tickets to the upcoming Ekoparty Security Conference in Argentina. But there was a catch: in order to get the tickets (and free whiskey), entrants had to complete an exploitation challenge and send them the solution. Blue Frost provided a 64-bit PE binary with a simple stack-based buffer overflow with the objective to run ‘calc.exe’ on Windows 7, Windows 8.1, or Windows 10.

Our very own Jasiel Spelman (@WanderingGlitch) from the Zero Day Initiative decided to take a little break from work and work on the challenge. While it may seem that this challenge was set up to hack something for fun (and drinks), what it really shows is how poorly-written applications can easily be exploited. You can check out Jasiel’s blog, which includes video of his demo, here.

Microsoft Update

This week’s Digital Vaccine (DV) package includes coverage for Microsoft updates released on or before July 11, 2017. Microsoft released 48 security patches for August covering Windows, Internet Explorer (IE), Edge, the subsystem for Linux, Kernel, SharePoint, SQL Server, and Hyper-V. 25 are listed as Critical, 21 are rated Important, and two are Moderate in severity. The following table maps Digital Vaccine filters to the Microsoft updates. Filters marked with an asterisk (*) shipped prior to this DV package, providing preemptive zero-day protection for customers. You can get more detailed information on this month’s security updates from Dustin Childs’ August 2017 Security Update Review from the Zero Day Initiative:

Zero-Day Filters

There is one new zero-day filter covering one vendor in this week’s Digital Vaccine (DV) package. A number of existing filters in this week’s DV package were modified to update the filter description, update specific filter deployment recommendation, increase filter accuracy and/or optimize performance. You can browse the list of published advisories and upcoming advisories on the Zero Day Initiative website.

Cisco (1)

Missed Last Week’s News?

Catch up on last week’s news in my weekly recap.

We are proud to be included in this year’s Gartner Market Guide for Cloud Workload Protection Platforms report, which recognizes 24 security leaders in Cloud Workload Protection solutions. Trend Micro was identified with 16 out of 21 capabilities listed by Gartner.

This recognition is partially credited to our delivery of unique server workload protection capabilities and support for a broad range of operating systems, including Windows, Linux and Unix. Additionally, seamless integration with VMware, AWS, Azure is offered, along with native application control, visibility and protection for containers.

A key recommendation Gartner makes in the report is for security and risk leaders to “require vendors to support the visibility and control of workloads that span physical and virtual machines, containers and multiple public cloud IaaS, all from a single policy management framework and console.”

Trend Micro’s Hybrid Cloud Security solution, powered by XGen™ security, meets this requirement by delivering a blend of cross-generational threat defense techniques that have been optimized to protect physical, virtual and cloud workloads, featuring Trend Micro Deep Security™.

We would like to think we know cloud security better than anyone else. Our 2.5+ billion hours racked up protecting cloud workload is a high mark to beat.

To learn more about Trend Micro Hybrid Cloud Solutions, please click here.

For a number of years, we’ve worked with and supported our Managed Service Provider (MSP) partners at Trend Micro and I’ve seen and heard a lot in that time.

Over time, we’ve noticed a few trends when it comes to MSPs choosing a security vendor to partner with, and in an effort to save you some trouble and heartache, have decided to share some insights below.

Coincidentally, it is interesting to note that there is a strong correlation between business maturity and the likelihood of choosing a particular option in this list. For example, we tend to see that less experienced MSPs usually follow the first few options, whereas more mature MSPs take on the last few approaches. In other words, MSPs tend to progress through these options during the life of their business.

The “I just let my customers handle it” approach

This is usually the first tactic when beginning the new MSP security journey. Starting an MSP business can be overwhelming. With several factors to consider, such as choosing Professional Service Automation (PSA) and Remote Management and Monitoring (RMM) tools, defining your offerings, researching and validating technical solutions, creating marketing plans and finding customers. Security is just one small, albeit important, part of an MSP offering. For that reason, many MSPs will simply leave sleeping dogs lie when it comes to security, which ultimately means leaving existing solutions and licenses in place, to deal with them at a later point in time.

Why I think this is a bad option:

The “I’ll just manage whatever the customer has” approach

This tends to be the second evolution an MSP goes through as they are growing their business. At this point, business has settled down, processes have been implemented and the machine is humming along nicely. Similar to how lightning finds the shortest path to ground when it strikes, this is the shortest path for an MSP to “offer” security without going through the effort of testing, vetting, choosing, training and implementing a consistent security solution.

Why I think this is a bad option:

The “I don’t want to put all my eggs in one basket” approach

This one is a bit of a variation on the previous method. Essentially this is when MSPs intentionally choose to manage multiple security solutions across their customer base in the event that one solution fails, the MSP can reduce the potential impact to all its customers.

Why I think this is a bad option:

Picking the cheapest option

In our experience in talking to partners throughout the years, this is generally one of the most common paths chosen by MSPs for obvious reasons. While it could be argued that the whole premise behind the MSP business model is to blame here, that still doesn’t make it a good choice.

Why I think this is a bad option:

Picking the integrated option

This is probably the most common approach we see these days as RMM vendors have partnered up with one or more of the lower cost and reduced functionality security products. On paper, this sounds like a great idea but is actually fraught with many issues.

However, the main takeaways and why I think this is a bad option include:

Having a security solution deployed across your entire customer base that is independent of the RMM vendor insulates you from changes outside of your control and protects your bottom line.

Learn more about Trend Micro’s MSP Program at http://www.trendmicro.com/msp

Amazon S3 stores trillions of objects and regularly peaks at millions of requests per second. By any metric, it’s massive. With unparalleled durability and availability, it’s the backbone of AWS’ data services.

This morning at the AWS Summit in New York City, AWS launched a new service: Amazon Macie. Trend Micro is proud to support this exciting new service at launch.

Amazon Macie provides automated insights into the usage of your Amazon S3 data.

Amazon S3 is secure by default and has always provided a strong set of security controls but it has been challenging to effectively monitoring the usage of the service. AWS CloudTrail and AWS Config let you examine the usage of your data while AWS Config Rules–another service Trend Micro supported at launch—lets you react to configuration changes. But these solutions have required some legwork in order to pull the signal from the noise.

Now, Amazon Macie presents that signal to you automatically. This provides much needed insight into your business uses as well as your security.

What is Amazon S3?

As a quick recap, Amazon S3 works with two simple objects: buckets and keys. A bucket is essentially a root folder where you data will be stored. A key is a data object.

These basics structures allow you to store your data in any way that makes sense for your application. From a security perspective, the service provides a number of tools to help you configure access to your data:

An Amazon S3 bucket is private by default (only the user who created it has access) and these methods give you the tools you need to provide access to the users or roles that require it.

Up until now, you had to comb through Amazon S3 logs in order to determine who was accessing your data and what the normal patterns of that access was.

What is Amazon Macie?

Amazon Macie leverages machine learning in order to automatically profile your Amazon S3 usage using a number of indicators like: content-types, file extensions, managed regex patterns, and managed data themes.

Once Amazon Macie establishes a baseline, it then continuously monitors the usage of your data and provides actionable alerts based on the risk posed to your data.

You might think of Amazon Macie as your own personal data security assistant. It sits tirelessly monitoring every access to your Amazon S3 data. It learns about patterns and profiles that determine what’s “typical” for your application. Anytime anything out of the ordinary happens, it raises an alert.

You can then react to these alerts by changing your Amazon S3 settings, adjust the configuration of you application, or change other security controls in your deployment.

Jeff Barr has a fantastic post up about the inner workings of Amazon Macie and how to get started with the service over on the AWS blog.

Combined Defences

At Trend Micro, we’ve built the Deep Security platform in order to help you fulfill your responsibilities in shared responsibility model. It helps you lock down your Amazon EC2 instances and Amazon ECS workloads and ensure that your application is doing what it’s supposed to…and only what it’s supposed to.

Deep Security applies it’s protections based on policy. The platform can automatically create and apply a policy for your workloads based on what’s running. This automation makes it easy to keep your security settings up to date.

The challenge comes downstream. Amazon S3 is an abstract service which means that you have very little day-to-day responsibility for it’s operations. The (slight) down side of that is that you don’t get the quite as granular insights you would expect from running a data backend—nor the cost, headache, or pain-in-the-you-know-what.

Amazon Macie provides those insights. With the alerts generated by Amazon Macie, you can make better decisions about security policies within Deep Security. You can make smarter security choices for the Amazon EC2 instances and containers running in Amazon ECS that access that data in Amazon S3.

We will shortly have a simple AWS Lambda workflow available on GitHub to demonstrate how Amazon Macie and Deep Security can work together. Here’s a quick look at the high level design:

The goal with this simple integration is to strengthen your applications security posture in order to better protect your data. With Amazon Macie providing insights on the backend and Trend Micro’s Deep Security protecting the frontend, you’ll get a much smarter security policy tailored to your AWS workflow.

What do you think of Amazon Macie? What are you going to use it’s automated insights for? Let me know on Twitter where I’m @marknca.