Security IT Summit | Forum Events Ltd Security IT Summit | Forum Events Ltd Security IT Summit | Forum Events Ltd Security IT Summit | Forum Events Ltd Security IT Summit | Forum Events Ltd

Posts By :

Guest Post

Progress your career with a funded Cyber Security Apprenticeship

960 640 Guest Post

This funded Degree Apprenticeship programme from De Montfort University (DMU) is a great opportunity to work towards becoming a fully-competent cyber security professional.

Businesses often find their workforce has gaps in the specific digital skills needed to protect them from cyber security threats. The Cyber Security Technical Professional Integrated Degree Apprenticeship provides the essential skills and knowledge to ensure individuals can become independent cyber security professionals who can operate within business, technology or engineering functions across a range of industry sectors. Apprentices will develop skills which enable them to lead teams that research, analyse, model and assess cyber risks, design, develop, justify, manage and operate secure solutions, and detect and respond to incidents.

The great news is that if your organisation is a Levy payer, this apprenticeship allows you to utilise the funds within that Apprenticeship Levy. If your organisation does not pay the levy, up to 95% of the apprenticeship can be funded by the Government Apprenticeship Service. With this service you have the opportunity to reserve funds up to three months in advance of the start date for the programme. From now until autumn, up to 15,000 apprenticeships are available via this route.  

The teaching on this programme is underpinned by the work of academics from DMU’s Cyber Technology Institute (CTI). The CTI is a recognised NCSC Academic Centre of Excellence in Cyber Security Research as well as an Airbus Centre of Excellence in SCADA Forensics. This research and industry expertise provides the perfect environment for apprentices to develop the skills they need to respond to real-world cyber security challenges.

Key elements of the apprenticeship include; Risk modelling, analysis and assessment strategies, Cyber Incident Response tools and techniques, Secure software development, Malware Analysis, and understanding of the applicable laws, regulations, standards and ethics.

During this 42 month programme apprentices can expect to attend DMU for week-long blocks of teaching for each module, learning alongside peers from industry to encourage broad scope thinking. Integrating workplace training with academic learning provides apprentices with an increased understanding of their organisation’s unique business needs.

This apprenticeship is suitable for professionals employed by an organisation who will support their participation in the entire programme. This includes regular meetings with a work place mentor to support development of the professional skills they need to complete the programme successfully.

DMU works with organisations such as IBM, Siemens and BT delivering apprenticeships, where learning and skills are embedded back into the business from day one, adding real value and transferring fresh and innovative ideas.

The programme is based on the Level 6 Cyber Security Technical Professional (Integrated Degree) apprenticeship standard and is allocated Funding Band 27 (£24,000) by the Institute for Apprenticeships (IfA).

To find out more, click here.

Digital Transformation and Cloud Migration Initiatives Shouldn’t Leave Security Behind

960 640 Guest Post

Digital transformation can be a nebulous term, but for FireMon customers, it typically means shifting workloads to the cloud and streamlining business processes. 

This transformation should emanate from the inside out and is not simply adding transformational technology at the edge or remotely. Strategic initiatives around digital transformation should contribute to as many of the below areas as possible:   

  • Corporate cost savings 
  • People efficiency 
  • Customer satisfaction 
  • Infrastructure security posture 
  • Driver for meaningful innovation 

Most enterprises are on the journey now, albeit at different places. The destination is a cloud-first, more profitable, responsive, efficient and customer-centric organization. But the road ahead has obstacles. To avoid these, enterprises need complete visibility into the infrastructure they are transforming so they don’t replicate and automate inefficient processes. Empowering their people to be more productive should be top of mind.  

All this must be done with security at the forefront and not as an afterthought. Proper configuration of cloud deployments and automation of security policy management can move digital transformation efforts forward. 

Digital transformation needs a map 

If enterprises are to fully benefit from a cloud-first strategy, they not only need complete visibility into the IT they’re adding, but also their existing environments.  

Without a clear picture of what you already have, you risk lifting and shifting outdated processes and non-compliant security to the cloud. And you’re not necessarily going to move everything, so your digital transformation should move you toward a complete view of your infrastructure. 

At FireMon, we have been driving innovation that allows customers see their cloud deployments the same way they see their on-premise infrastructures, even though security configurations can differ widely. Digital transformation is an opportunity to create a dashboard that can travel with you down the road far into the future, even as the horizon changes — in this case, it’s wherever you decide to put workloads and digital assets. 

Clean before you automate 

Before you can embrace automation, there’s one key step you need to take in your digital transformation journey: ingesting and aggregating information to improve security posture. 

Visibility through FireMon Lumeta enables to you to see all the devices and endpoints in your existing environment, including what you’ve already put in the cloud, and every rule that’s attached to them. Before you decide what to automate, make sure it’s worth automating. Digital transformation is an opportunity to look at what you’re already doing and a chance to clean up or fix broken processes.  

Make sure your security controls go with you; you should have the same level of confidence in the cloud as you did on premise, and the same visibility, if not better. It’s also an opportunity to align teams responsible for security, especially if on-premise and cloud security duties are divided. Better still, bridge that gap and unify your team as so security is better positioned as part of your overall design process.  

Once you can see everything you have and have shored up your security policy, you can automate what should be automated and replicate the appropriate on-premise controls in your cloud environment. It’s a chance to discard redundant firewall rules and processes, just as you would have a garage sale before moving a new house — why take unnecessary junk with you? 

Digital transformation is more than making the business more efficient through cloud-first strategies; it’s a cultural shift for the entire organization. It means not doing things the same way just because they’ve always been done that way, but it also empowers people to take on new responsibilities by freeing them up through smart automation.  

And remember, there’s no point embarking on the digital transformation journey unless you take security with you.   

Find out more at

Taking online networking back to basics in IT

960 640 Guest Post

IT professionals are struggling to get value from online networking, knowledge-sharing and content driven platforms. Too many recruitment requests, questionable connections, and far too much time spent wading through promotional messages to reach the right content. Individuals need less noise, more relevance. Max Kurton, Editor in Chief, EM360 explains why it’s time for online networking to get back to basics...

Noisy and Confusing

It may be hard to remember but online networking platforms started with a simple model: to provide professionals within a specific market – such as IT – the chance to network and interact with like-minded individuals, sharing content relevant to each individual’s interests, background and preferences. That doesn’t sound anything like today’s experience. Over the past decade that simple but highly effective premise has been completely lost. While still essential for day to day networking and collaboration, the deluge of irrelevant content and connections online platforms serve up second by second is adding to workplace stress rather than supporting any effective or timely knowledge sharing and collaboration.

Just consider how much time everyone spends each day sifting through irrelevant and intrusive recruitment messaging, ignoring sales pitches or checking the credentials of people asking to connect. And that is before trying to locate content relevant to your business or interests. The need for trusted information and effective collaboration has never been greater – but current online networking platforms are no longer providing the quality or relevance required.

Relevant and Like Minded

It is time to take the concept of online networking back to basics and deliver the focused, timely content and collaboration that can truly leverage shared knowledge, experience and objectives. The first step is to create a true community of like-minded individuals. The next step is to leverage Artificial Intelligence (AI) to further refine the experience by ensuring individuals are only presented with truly relevant content – whether that is business continuity, security, data management, unified communications or AI.

It is also essential to avoid overt selling by ensuring content is focused on thought leadership and education. A strong editorial team creating a raft of white papers, podcasts and articles will reinforce both the quality and tone of content, enabling individuals to quickly and confidently access high quality, informative information. Members posting content must also conform to these quality standards, following a simple but effective posting guideline to guarantee that the educational essence of the online networking platform is retained.

Critically, people need to be able to gain fast but trusted access to like-minded individuals – whether that is a technology area such as data science or a market such as financial services. Combining a model that rigorously qualifies those signing up to ensure their identity with simple ways to make connections, network members can engage with new connections with confidence. 

Trusted Experience

In an online world awash with vast amounts of, often questionable, information every business professional needs to find a safe, trusted source of informative and educational content. If that high quality resource can be combined with an online networking platform that ensures the credentials of members, like-minded individuals can rediscover the value of fast, relevant information sharing and collaboration.

By eradicating the noise and removing the extraneous activity, online networking can get back to basics, enabling IT professionals to experience once again the value of focused, relevant and effective information sources, connections and collaboration. 

Who keeps the keys to the smart cities?

960 640 Guest Post

By Sean Wray, VP NA Government Programs, Certes Networks

Smart cities seem inevitable. According to IDC, Smart City initiatives attracted technology investments of more than $81 billion globally in 2018, and spending is estimated to grow to $158 billion in 2022. Similarly, in 2018, the number of major metropolitan cities relying on or developing a comprehensive smart city plan – as opposed to implementing a few innovative projects without an overall smart plan – dramatically increased. 

In the US, for example cities like Philadelphia, Newark and Chicago all have goals to upgrade and to become leading ‘SMART’ cities, while UK innovation is being spearheaded by major conurbations such as Bristol, London and Manchester.

A significant investment is being made by cities in data connectivity providing a number of new technologies such as Wi-Fi 6, smart grid, and IoT sensor devices, all promising to enhance overall visibility and security. However, as we extend the reach of technology and connectivity, there will increasingly be cyber-risks to take into account. As part of their transformation, smart cities serve as a technology hub and gateway to major institutions such as banks, hospitals, universities, law enforcement agencies, and utilities. This means the storage and transmission of customer data such as social security numbers, addresses, credit card information, and other sensitive data, is a potential goldmine for malicious actors. Not to mention an increasing number of projects monitoring roads, traffic, traffic light and metro services, all of which must be kept secure from threats at all times…

Click here to read the full article on sister-site Total Security Briefing.

Make the Most of Your People with the Benefits of Automation

960 640 Guest Post

By Ofer Elzam, Vice President & GM, FireMon GPC

Gone are the days when IT leaders fretted that the benefits of automation would shove people out of jobs. If anything, it’s the opposite: 74% of cybersecurity professionals say that a skills shortage has affected their organizations, continuing a trend of concern over the past few years, according to the report “The Life and Times of Cybersecurity Professionals 2018.”

While the story around the labor shortage is more complex than it may appear, the current narrative around the advantages of automation has shifted away from labor concerns. But in a way, that erstwhile concern is a direct link to the underlying current of all the benefits of automation: the human factor.

Heightened productivity, consistency and keeping up with increasingly complex security needs are solid advantages of automation, but there’s more to the story. Here’s how all of those benefits of automation (and more) ladder up to protecting your company’s most precious resource—your people.

Ready to use automation to protect your team? Request a demo of FireMon Automation today.

Automation Allows People to Do What People Do Best

Machines can be rapid, agile and comprehensive. What they can’t be: creative. When security processes are automated, the flesh-and-blood members of your team are freed up to deploy their creativity to solve problems and build more robust security measures.

The current state of security operations (SecOps) teams doesn’t allow that creativity to thrive. FireMon’s 2019 State of the Firewall report revealed that 30.9% of survey respondents had an ad hoc or manual change management process. This exposes two critical issues: an underutilization of humans’ unique abilities and the inevitability of human error.

One of the top benefits of automation is that it gives your team members more time to focus on other security issues. At the same time, it’s an opportunity for your team to map out the very processes that enable successful automation. For example, in most companies automation works best when the processes behind them are strategically planned beforehandThis is the work that humans can do better than algorithms, as it requires judgment, creativity and insight.

As automation enables human capital to thrive, it also eliminates human risk. Through 2023, 99% of firewall breaches will be caused by misconfigurations, not firewall flaws, according to Gartner—something automation helps prevent. Human error also throws a wrench when integrating security systems. A comprehensive approach like FireMon Automation offers persistent security across networks while minimizing the potential for human error.

Learn more about FireMon Automation.

Automation Allows Your People to Work Better Together

IT teams frequently work in silos, leading to redundancy and opportunistic, one-off approaches to security. With a comprehensive system, companies can depart from the “hero culture” of employees writing automation scripts to solve an issue without looking at the holistic picture.

Amid worries that automation inhibits agility and innovation, decision makers sometimes hedge on implementing automation. But one of the benefits of automation in the workplace is how it organically supports both development operations and security operations, eliminating the friction that can exist between the needs of these groups. Planning for automation requires both teams to work together and understand the priorities of the other, leading to better communication—for the automation plan and beyond.

Automation Supports Your Company’s Ability to Work With—and Against—Third Parties

“Hackers today—they’re not even hacking, they’re using automation tools,” said FireMon’s Tim Woods, vice president of technology alliances, in the talk “Automation: One Giant Leap for Security.”

When criminals are exploiting the benefits of automation, security teams have an obligation to outpace them. Using automated systems frees up SecOps teams to anticipate and proactively develop rules to protect against hackers—again, leveraging the human creativity and critical thinking that successful crime prevention entails.

On the flip side, automation allows your team to work with the people who have your customers’ best interests at heart. Compliance regulations are changing quicker than you can say “GDPR,” and with the California Consumer Privacy Act coming into play January 1, 2020, security rules continue to be in flux.

Only 13.8% of survey respondents in FireMon’s State of the Firewall report say they’re 90% to 100% prepared for a compliance audit. Confidence is even lower among key decision-makers: Just 45.3% of C-level respondents said they felt 60% to 80% ready for an audit. In other words, one of the benefits of building an automation system is building faith among your company’s C-suite—consider it another form of security.


Ofer Elzam is responsible for the continued development of FireMon GPC, the industry’s first and only solution to deliver persistent policy enforcement for complex, hybrid network environments. Before joining FireMon, Elzam was VP of product at Dome9 Security. Under his headship, Dome9 became the leader in securing multi-cloud deployments, which led to its acquisition by Check Point Software. Prior to Dome9, Elzam was the director of Sophos’ network security product line, where he led the company’s transition to the next-generation XG Firewall platform. Earlier, Elzam worked at Cisco serving as both a strategic architect of security technologies and executive director of product management, where he led ScanSafe, which was acquired by Cisco in December 2009. Elzam also spent 10 years serving in a variety of product leadership positions, including as CTO at Gemalto.

Most Urgent CISO Skills 2020: Reporting, Avoiding Burnout, More collaboration

960 640 Guest Post

By Jake Olcott, VP of Government Affairs, BitSight

Since the creation of the first CISO role about 25 years ago, the job has changed dramatically. What was once an uncommon position has quickly become standard, with the majority of companies including a cybersecurity-specific role in their C-suites.

As cybersecurity has gone from niche issue to mainstream business concern, the CISO has become more important. And, although many CISOs come from purely technical backgrounds, new challenges have forced them to take on the responsibilities of business leaders.

As a result, the most important CISO skills are not necessarily technical in nature. Business skills like collaboration, communication, and management are just as critical for CISOs as they aim to reduce cyber risk in an increasingly fraught threat landscape.

Here are some of the most important CISO skills for 2020:


Cybersecurity is collaborative. The most efficient team of SOC analysts in the world can’t prevent incidents if employees in other parts of the organisation aren’t trained on good security hygiene. CISOs can’t give their teams the resources they need if their Board and fellow executives don’t understand security challenges and allocate the necessary budget.

Shockingly, however, only 22% of companies say their organisation’s security function is integrated with other business functions.

CISOs in 2020 and beyond will need to build collaboration skills in order to act as ambassadors for the cybersecurity program. Communicating security priorities to other departments and across lines of business or distributed workplaces is a challenge but gaining their buy-in is essential to maintaining effective security.

Avoiding burnout

CISOs don’t have it easy. 91% of CISOs say they suffer from moderate or high stress, and 27.5% of CISOs say stress affects their ability to do their jobs. CISO burnout is real, and it can create new security risks as well as personal challenges.

Strange as it might seem, one of the most important skills for CISOs is making sure they don’t become victims of burnout themselves.

One aspect of avoiding burnout is stress management. Exercise, meditation, and other stress-reducing activities can be very helpful. However, personal stress management isn’t going to be enough to stem the burnout crisis. CISOs can also consider advocating for policies in their organisations that reduce the likelihood of job stress, such as workplace wellness programs or limiting after-hours email notifications.

Increasing employee engagement 

CISOs aren’t the only cybersecurity professionals at risk of burning out. 65% of SOC professionals say stress has caused them to think about quitting.

As the cybersecurity skills shortage drags on, the most effective CISOs will be the ones who make sure their best employees stay on long-term.

With a 0% industry unemployment rate, the market pressure is on the employer to keep employees happy, not the other way around. That means security leaders must hone their people management skills and keep a finger on the pulse of employee engagement.

There are many techniques for increasing employee engagement, and each CISO will need to figure out what will work best in their own organisation. Some effective techniques include:

  • Increasing the frequency of employee/manager meetings
  • Giving employees several avenues for giving feedback, including anonymous suggestions
  • Adding more social time to the schedule, or hosting company-sponsored parties or group activities
  • Recognising high-performers with awards and prizes

Communication and reporting 

When reporting to the Board, other executives, or even third-party auditors, CISOs need to make sure they get the messaging right.

One of the most important CISO skills is being able to translate complicated technical concepts into easy-to-understand language. When others can actually wrap their minds around the challenges of the cybersecurity program, they’re more likely to buy in and provide support.

On a basic level, CISOs can improve their communications by avoiding information-dumping and scare tactics. Turning in a 100-page report full of metrics the Board doesn’t understand isn’t useful. Similarly, warning of worst-case-scenarios can backfire when it creates a reactionary approach to security.

Further, CISOs should take a risk-based approach to cybersecurity reporting. In practice, that means making sure KPIs contain context about the actual risk posed to the organisation. In addition, CISOs should understand each data point’s impact on larger business KPIs and objectives.

Following a risk-based approach to reporting can help CISOs demonstrate the effectiveness of their programs, advocate for new initiatives, and improve overall security.

Four Steps to Security Automation Success

960 640 Guest Post

By Ofer Elzam, VP and GM, FireMon Cloud & Automation Solutions

Security automation projects are making headlines, with everyone looking to automate at least some portion of the policy management process. Usually, the goal is to save time and money by automating firewall administration and policy management.

However, these two categories have grown exponentially in scope and complexity in recent years, so automation projects often become much larger and time-consuming than originally intended and produce varied results.  In some less-than-stellar cases, they even collapse all together, and people revert to the original manual processes they were seeking to automate.

How can this situation be avoided? There are four steps security organizations can take to dramatically increase the likelihood of success in security automation projects, we’ll cover the first two now:

  1. Have a clear goal. Almost everyone automates to save money and improve efficiency.  But you must define more functional requirements than that – after all, there are many approaches for saving money. Focusing on a clearly defined operational goal is the key to determining the right approach, which, in turn, defines how much and where you will realize cost savings and efficiency gains. 

    What if you defined your goal to achieve a standard security process to meet a service level agreement (SLA) of 24 hours instead of the week or so it takes now? You could do this by analyzing the existing process and mitigating inefficiencies through the surgical application of automation, or even simply improving on existing manual processes.  

    Other projects like micro-segmentation, Zero Trust implementations, on-prem-to-cloud migrations, will necessitate their own functional requirements and SLAs. It is important to set goals for these projects that are realistic, while also delivering substantial cost and efficiency improvements. 
  2. Don’t try to automate everything.  Automation projects succeed when there is a clear set of success criteria and a clearly defined and achievable scope. They often fail when trying to implement a process that will work in every scenario. A good example of this is in the change-request workflow. There are two places where time and resources can be saved in a change-request workflow: better requirements (less refinement of inputs) and reducing the wait time between individuals. Better requirements are generally achieved by focused training and more intuitive system design for a select group of users. 

    User and requirement creep tends to happen when relatively infrequent processes are folded into the project. This puts security organizations in a position where they spend significant time, effort and budget on automating processes that may only be encountered once or twice a month. This can delay the overall automation project and reduce ROI once it is complete, since significant resources will be invested for only marginal gains.

    Consuming project time to customize the workflow or software for a task that takes 10 minutes twice a month not only delays the overall project, but also causes stakeholders to question the overall value of the project. 

Let’s be honest: You’re almost certainly exploring automation to save money and time. Follow our next blog, for the last two steps to build your security policy automation roadmap. 

Barracuda: Growing confidence and emerging gaps in cloud security

960 640 Guest Post

For modern organisations, digital transformation is increasingly the only game in town. CIOs are turning to multiple cloud providers in droves for new app-based models, driving enhanced business agility to meet ever-changing market demands.

Yet security remains a constant challenge. Web applications themselves remain a major target for data theft and DDoS. A Verizon report from earlier this year claimed that a quarter of the breaches it analysed stemmed from web application attacks.

So, what are organisations doing about it? Chris Hill, RVP Public Cloud and Strategic Alliance International at Barracuda Networks reveals some interesting findings from its latest research…

Cloud maturity grows

The survey of over 850 security professionals from around the world reveals a growing confidence in public cloud deployments. Over two-fifths (44 percent) now believe public cloud environments to be as secure as on-premises environments, while 21 percent claim they are even more secure. What’s more, 60 percent say they are “fairly” or “very” confident that their organisation’s use of cloud technology is secure.

This makes sense. After all, cloud providers are capable of running more modern, secure infrastructure than many organisations could in-house. That means customers benefit from the latest technology, accredited to the highest security standards, versus heterogeneous, legacy-heavy in-house environments. As long as they pick the right third-party security partners and understand the concept of shared responsibility in the cloud, cyber risk can be mitigated effectively. The cloud even offers more options for backup and redundancy to further minimise risk.

Yet this isn’t the whole picture. Respondents to the study are still reluctant about hosting highly sensitive data in the cloud, with customer information (53 percent) and internal financial data (55 percent) topping the list. They complain of cybersecurity skills shortages (47 percent) and a lack of visibility (42 percent) as hampering cloud security efforts. And over half (56 percent) aren’t confident that their cloud set-up is compliant.

Could some of these concerns be linked to web application threats?

Websites under attack

The truth is that web apps are a ubiquitous but often poorly understood part of the modern cloud-centric organisation. As a business-critical method of delivering experiences to customers and productivity-enhancing capabilities to employees, web applications are a major target for cyber-criminals looking to steal sensitive data and interrupt key business processes. A Forrester study from 2018 found that the leading cause of successful breaches was external attacks — the most common of which focused on web applications (36 percent).

Fortunately, Barracuda Networks’ survey finds more than half (59 percent) of global firms have web app firewalls (WAFs) in place to mitigate these threats. The most popular option is sourcing a WAF from a third-party provider (32 percent), which makes sense, as long as they can protect customers from the automated bot-driven traffic that dominates the threat landscape. Not all can.

Patching and configuring

However, a greater concern is the fact that many organisations don’t appear to be taking the threat of web application vulnerabilities seriously. The Barracuda study found that 13 percent of respondents claim they haven’t patched their web application frameworks or servers at all over the past 12 months. Of those that did, it takes over a third (38 percent) of them between seven and 30 days to do so. For a fifth (21 percent), it takes over a month.

This is the kind of approach that landed Equifax in a heap of trouble when it failed to promptly patch an Apache Struts 2 flaw, leading to a mega-breach that has so far cost has over $1.4 billion. It’s an extreme example, but it is one that highlights the potential risks for businesses.

Another potential area of risk with web application environments is human error. A massive breach at Capital One earlier this year affected around 100 million customers and applicants, and it was blamed on a misconfiguration of an open source WAF.

Some 39 percent of respondents told Barracuda Networks they don’t have a WAF because they don’t process any sensitive information via their applications. But attacks aren’t just focused on stealing data. They can also impede mission-critical services. WAFs are certainly not a silver bullet. But as part of a layered approach to cybersecurity, they’re an important tool in the ongoing fight against business risk.


Growing cloud confidence is enabling digital transformations across organisations of every shape and size. However, that confidence comes with a cautionary tale. Attackers are also zeroing in on vulnerabilities and weaknesses that may have been ignored in the past, and many organisations are unaware of how these multi-layered attacks can unfold from a single access point. Web application security and cloud security posture are the key weapons customers need to deploy in order to continue their digital transformations safely in the cloud.

To ensure you are secure in the cloud, here are some tips:

• Ensure you have WAFs protecting all your apps. Don’t assume that just because an app doesn’t appear to have outside visitor engagement that it can’t be used as an attack vector. Once any vulnerabilities are discovered, attackers will exploit them, and it may help them gain access to your network and more valuable resources.
• Don’t leave application security in the hands of your development team. They aren’t security experts, nor do you pay them to be — you pay them to build great products.
• Deploy a cloud security posture management solution. Not only will this eliminate many security risks and failures, along with providing your development team with necessary guardrails to “build secure,” it greatly simplifies remediation and speeds investigations when issues do arise.

GUEST BLOG: The Growing DDoS Landscape

960 640 Guest Post

By Anthony Webb, EMEA Vice President at A10 Networks

A new wave of DDoS attacks on South Africa’s internet service provider has highlighted that these attacks continue to grow in frequency, intensity and sophistication.

A10 Networks’ recent report on the Q2 2019: The State of DDoS Weapons has shed more light on the loud, distributed nature of DDoS attacks and the key trends that enterprises can learn from in adopting a successful defence.

IoT: A Hotbed for DDoS Botnets

A10 Networks has previously written that IoT devices and DDoS attacks are a perfect match. With the explosion of the Internet of Things (growing at a rate of 127 connected devices per second and accelerating), attackers target vulnerable connected devices and have even begun to develop a new strain of malware named Silex- a strain just for IoT devices. Silex affected 1650 devices in over an hour and wiped the firmware of IoT devices in attacks reminiscent of the old BrickerBot malware that destroyed millions of devices back in 2017.

The report has highlighted the top-three IoT binary dropped by malware families – two of the three belonged to Mirai – with the Netherlands, UK, USA, Germany and Russia being the top five hosting malware droppers.

The New IoT Threat

A new threat has emerged due to industry-wide adoption of technology with weak security: the UDP implementation of the Constrained Application Protocol (CoAP). This new threat does not have anything to do with Mirai or malware, but its impact has enabled millions of IoT devices to become weaponised as reflected amplification cannons. CoAP is a machine-to-machine (M2M) management protocol, deployed on IoT devices supporting applications such as smart energy and building automation. CoAP is a protocol implemented for both TCP and UDP and does not require authentication to reply with a large response to a small request. A10 identified over 500,000 vulnerable IoT devices with an average response size of 749 bytes. The report also highlights that 98% of CoAP threats originate from China and Russia, with the capability to amplify by 35x.

On the Horizon: 5G

Ericsson recently predicted that the number of IoT devices with cellular connection will reach 4.1 billion by 2024. 5G, with its higher data speeds and lower latency, will be the primary driver behind this rapid expansion. Whilst this is great news in an open dynamic world, the downside is that we will also see an increase in the DDoS weaponry available to attackers.

We have seen mobile carriers hosting DDoS weapons skyrocket over the last six months. Companies such as T-Mobile, Guangdong Mobile and China Mobile have been guilty of amplifying attacks. With 5G, intelligent automation aided by machine learning and AI will become essential to detecting and mitigating threats. IoT devices by Linux are already the target of a new strain of malware which is predominantly dedicated to running DDoS attacks.

Amplified Attack

Amplified reflection attacks exploit the connectionless nature of the UDP protocol with spoofed requests to misconfigured open servers on the internet. Attackers send volumes of small requests with the spoofed victim’s IP address to exposed servers, which are targeted because they’re configured with services that can amplify the attack. These attacks have resulted in record-breaking volumetric attacks, such as the 1.3 Tbps Memcached-based GitHub attack in 2018, and account for many DDoS attacks.

Battling the landscape

Every quarter, the findings of our DDoS attack research point to one thing: the need for increased security. Sophisticated DDoS weapons intelligence, combined with real-time threat detection and automated signature extraction, will allow organisations to defend against even the most massive multi-vector DDoS attacks, no matter where they originate. Actionable DDoS weapons intelligence enables a proactive approach to DDoS defences by creating blacklists based on current and accurate feeds of IP addresses of DDoS botnets and available vulnerable servers commonly used for DDoS attacks. With DDoS attacks not going away, it’s time for organisations to match their attackers’ sophistication with a stronger defence, especially as new technology like IoT and 5G gains momentum.

VIDEO – Top tips to spot phishing attacks

960 640 Guest Post

By Falanx

Phishing, viruses and ransomware are some of the most common attacks aimed at organisations of all sizes, with phishing emails proving the most successful.

With this October being Cyber Security Awareness month, empower your staff to recognise and defend against these attacks.

Here are some of the signs to look out for >