Cloud

9/22/2017
10:05 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Attivo Networks Tackles Cloud Threat Detection Gaps

Expands ThreatDefend Cloud Data Center offerings for Azure, AWS, and OpenStack.

Fremont, CA – Attivo Networks, the award-winning leader in deception technology for cybersecurity defense, today announced that it has expanded its ThreatDefend Deception and Response Platform cloud data center detection support to include Azure deployment capability in addition to existing support for Amazon Web Services (AWS) and OpenStack. Additionally, the company announced its ThreatDirect solution, which is designed for remote and branch offices (ROBOs) and can be used for microsegmented networks. The technology removes the need for a local BOTsink deception server, reducing cost and eliminating the necessity for skilled local resources. These solutions are specifically designed to address the growing challenges associated with lateral movement threat detection within cloud data centers and the often inconsistent security controls within ROBO environments.

Azure Catching Up to AWS and OpenStack

Gartner recently reported that the worldwide public cloud services market will grow 18.5% to $260.2 billion in 2017, up from $220B in 2016. While AWS still dominates the public cloud market, Azure is quickly catching up and seeing tremendous revenue growth. In Microsoft’s Q4 2017 earnings report, Azure grew 97% in revenue year over year – and analysts expect the market will only continue to explode.

Organizations are increasingly turning to cloud data centers and cloud applications for the benefits of on-demand, scalable infrastructure. However, widespread public cloud adoption presents a unique set of security challenges that IT teams have yet to address. On top of “traditional” security threats that cloud infrastructures face, they are also particularly attractive targets for attackers since organizations store an exhaustive amount of data in the cloud. Mounting security threats and the lack of cybersecurity skills needed to address those threats are why 49% of businesses are delaying cloud deployment.

Security challenges stem from shared security models, unknown security controls, and complexity associated with high volumes of traffic. To address these concerns, the ThreatDefend platform provides highly efficient deception decoys and lures that deceive an attacker into engaging rather than attempting to monitor or analyze all traffic, which is typically cost and operationally prohibitive. Once an attacker engages, the deception environment captures and records the lateral movement of threats within the datacenter, provides evidence-based alerts and the forensic reporting required to promptly shut threats down.

ThreatDirect Closes the Backdoor on Cyber Attacks

In addition to cloud data center security threats, organizations often face attacks on remote ROBOs, which are often less protected and can act as backdoors to the central networks. Enhancing these threats are the rapidly growing adoption of cloud applications at ROBOs, along with the widespread use of BYOD devices.

To address these increasing security concerns and close the detection deficit, Attivo Networks provides deployment capabilities that allow organizations to deploy deception in their ROBO environment without the need to install a local BOTsink deception server. The ThreatDirect solution forwards suspicious activity to a central BOTsink deception server for attack threat analysis. This saves dramatically on deployment costs and removes the need for local skilled resources. The ThreatDirect virtual scaling solution can also be deployed in an environment where a full BOTsink deployment is not feasible. For example, the ThreatDirect system can be deployed to implement deception in all the subnets of a heavily segmented network.

"In addition to increased responsibility and workload, security teams are challenged by the industry-wide cybersecurity skills shortage," said Tushar Kothari, CEO of Attivo Networks. "To address this, we have put an emphasis on building efficient solutions that provide accurate detection and extensive visibility into the lateral movement of threats within the evolving cloud attack surface. This will close the detection gap for remote locations, which often have limited facilities and lack the skilled resources required to manage security controls."

By adding these new solutions organizations are able to decrease the detection deficit by scaling deception in their cloud environment, as well as remote/branch offices. By doing so, security teams will detect threats faster and in areas of the network that they previously had limited visibility, thus minimizing the risk of a breach. More information can be found in the Azure or the ThreatDirect solution briefs.

 

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.