Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

9/22/2017
10:05 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Attivo Networks Tackles Cloud Threat Detection Gaps

Expands ThreatDefend Cloud Data Center offerings for Azure, AWS, and OpenStack.

Fremont, CA – Attivo Networks, the award-winning leader in deception technology for cybersecurity defense, today announced that it has expanded its ThreatDefend Deception and Response Platform cloud data center detection support to include Azure deployment capability in addition to existing support for Amazon Web Services (AWS) and OpenStack. Additionally, the company announced its ThreatDirect solution, which is designed for remote and branch offices (ROBOs) and can be used for microsegmented networks. The technology removes the need for a local BOTsink deception server, reducing cost and eliminating the necessity for skilled local resources. These solutions are specifically designed to address the growing challenges associated with lateral movement threat detection within cloud data centers and the often inconsistent security controls within ROBO environments.

Azure Catching Up to AWS and OpenStack

Gartner recently reported that the worldwide public cloud services market will grow 18.5% to $260.2 billion in 2017, up from $220B in 2016. While AWS still dominates the public cloud market, Azure is quickly catching up and seeing tremendous revenue growth. In Microsoft’s Q4 2017 earnings report, Azure grew 97% in revenue year over year – and analysts expect the market will only continue to explode.

Organizations are increasingly turning to cloud data centers and cloud applications for the benefits of on-demand, scalable infrastructure. However, widespread public cloud adoption presents a unique set of security challenges that IT teams have yet to address. On top of “traditional” security threats that cloud infrastructures face, they are also particularly attractive targets for attackers since organizations store an exhaustive amount of data in the cloud. Mounting security threats and the lack of cybersecurity skills needed to address those threats are why 49% of businesses are delaying cloud deployment.

Security challenges stem from shared security models, unknown security controls, and complexity associated with high volumes of traffic. To address these concerns, the ThreatDefend platform provides highly efficient deception decoys and lures that deceive an attacker into engaging rather than attempting to monitor or analyze all traffic, which is typically cost and operationally prohibitive. Once an attacker engages, the deception environment captures and records the lateral movement of threats within the datacenter, provides evidence-based alerts and the forensic reporting required to promptly shut threats down.

ThreatDirect Closes the Backdoor on Cyber Attacks

In addition to cloud data center security threats, organizations often face attacks on remote ROBOs, which are often less protected and can act as backdoors to the central networks. Enhancing these threats are the rapidly growing adoption of cloud applications at ROBOs, along with the widespread use of BYOD devices.

To address these increasing security concerns and close the detection deficit, Attivo Networks provides deployment capabilities that allow organizations to deploy deception in their ROBO environment without the need to install a local BOTsink deception server. The ThreatDirect solution forwards suspicious activity to a central BOTsink deception server for attack threat analysis. This saves dramatically on deployment costs and removes the need for local skilled resources. The ThreatDirect virtual scaling solution can also be deployed in an environment where a full BOTsink deployment is not feasible. For example, the ThreatDirect system can be deployed to implement deception in all the subnets of a heavily segmented network.

"In addition to increased responsibility and workload, security teams are challenged by the industry-wide cybersecurity skills shortage," said Tushar Kothari, CEO of Attivo Networks. "To address this, we have put an emphasis on building efficient solutions that provide accurate detection and extensive visibility into the lateral movement of threats within the evolving cloud attack surface. This will close the detection gap for remote locations, which often have limited facilities and lack the skilled resources required to manage security controls."

By adding these new solutions organizations are able to decrease the detection deficit by scaling deception in their cloud environment, as well as remote/branch offices. By doing so, security teams will detect threats faster and in areas of the network that they previously had limited visibility, thus minimizing the risk of a breach. More information can be found in the Azure or the ThreatDirect solution briefs.

 

 

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19642
PUBLISHED: 2019-12-08
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareNa...
CVE-2019-19637
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19638
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
CVE-2019-19635
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19636
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.