Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

9/22/2017
10:05 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Attivo Networks Tackles Cloud Threat Detection Gaps

Expands ThreatDefend Cloud Data Center offerings for Azure, AWS, and OpenStack.

Fremont, CA – Attivo Networks, the award-winning leader in deception technology for cybersecurity defense, today announced that it has expanded its ThreatDefend Deception and Response Platform cloud data center detection support to include Azure deployment capability in addition to existing support for Amazon Web Services (AWS) and OpenStack. Additionally, the company announced its ThreatDirect solution, which is designed for remote and branch offices (ROBOs) and can be used for microsegmented networks. The technology removes the need for a local BOTsink deception server, reducing cost and eliminating the necessity for skilled local resources. These solutions are specifically designed to address the growing challenges associated with lateral movement threat detection within cloud data centers and the often inconsistent security controls within ROBO environments.

Azure Catching Up to AWS and OpenStack

Gartner recently reported that the worldwide public cloud services market will grow 18.5% to $260.2 billion in 2017, up from $220B in 2016. While AWS still dominates the public cloud market, Azure is quickly catching up and seeing tremendous revenue growth. In Microsoft’s Q4 2017 earnings report, Azure grew 97% in revenue year over year – and analysts expect the market will only continue to explode.

Organizations are increasingly turning to cloud data centers and cloud applications for the benefits of on-demand, scalable infrastructure. However, widespread public cloud adoption presents a unique set of security challenges that IT teams have yet to address. On top of “traditional” security threats that cloud infrastructures face, they are also particularly attractive targets for attackers since organizations store an exhaustive amount of data in the cloud. Mounting security threats and the lack of cybersecurity skills needed to address those threats are why 49% of businesses are delaying cloud deployment.

Security challenges stem from shared security models, unknown security controls, and complexity associated with high volumes of traffic. To address these concerns, the ThreatDefend platform provides highly efficient deception decoys and lures that deceive an attacker into engaging rather than attempting to monitor or analyze all traffic, which is typically cost and operationally prohibitive. Once an attacker engages, the deception environment captures and records the lateral movement of threats within the datacenter, provides evidence-based alerts and the forensic reporting required to promptly shut threats down.

ThreatDirect Closes the Backdoor on Cyber Attacks

In addition to cloud data center security threats, organizations often face attacks on remote ROBOs, which are often less protected and can act as backdoors to the central networks. Enhancing these threats are the rapidly growing adoption of cloud applications at ROBOs, along with the widespread use of BYOD devices.

To address these increasing security concerns and close the detection deficit, Attivo Networks provides deployment capabilities that allow organizations to deploy deception in their ROBO environment without the need to install a local BOTsink deception server. The ThreatDirect solution forwards suspicious activity to a central BOTsink deception server for attack threat analysis. This saves dramatically on deployment costs and removes the need for local skilled resources. The ThreatDirect virtual scaling solution can also be deployed in an environment where a full BOTsink deployment is not feasible. For example, the ThreatDirect system can be deployed to implement deception in all the subnets of a heavily segmented network.

"In addition to increased responsibility and workload, security teams are challenged by the industry-wide cybersecurity skills shortage," said Tushar Kothari, CEO of Attivo Networks. "To address this, we have put an emphasis on building efficient solutions that provide accurate detection and extensive visibility into the lateral movement of threats within the evolving cloud attack surface. This will close the detection gap for remote locations, which often have limited facilities and lack the skilled resources required to manage security controls."

By adding these new solutions organizations are able to decrease the detection deficit by scaling deception in their cloud environment, as well as remote/branch offices. By doing so, security teams will detect threats faster and in areas of the network that they previously had limited visibility, thus minimizing the risk of a breach. More information can be found in the Azure or the ThreatDirect solution briefs.

 

 

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37759
PUBLISHED: 2021-07-31
A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
CVE-2021-37760
PUBLISHED: 2021-07-31
A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
CVE-2020-26564
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey['importFil...
CVE-2020-26565
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.
CVE-2020-26806
PUBLISHED: 2021-07-31
admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in remote code execution, because filePath can have directory traversal and fileContent can be valid JSP code.