Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

9/22/2017
10:05 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Attivo Networks Tackles Cloud Threat Detection Gaps

Expands ThreatDefend Cloud Data Center offerings for Azure, AWS, and OpenStack.

Fremont, CA – Attivo Networks, the award-winning leader in deception technology for cybersecurity defense, today announced that it has expanded its ThreatDefend Deception and Response Platform cloud data center detection support to include Azure deployment capability in addition to existing support for Amazon Web Services (AWS) and OpenStack. Additionally, the company announced its ThreatDirect solution, which is designed for remote and branch offices (ROBOs) and can be used for microsegmented networks. The technology removes the need for a local BOTsink deception server, reducing cost and eliminating the necessity for skilled local resources. These solutions are specifically designed to address the growing challenges associated with lateral movement threat detection within cloud data centers and the often inconsistent security controls within ROBO environments.

Azure Catching Up to AWS and OpenStack

Gartner recently reported that the worldwide public cloud services market will grow 18.5% to $260.2 billion in 2017, up from $220B in 2016. While AWS still dominates the public cloud market, Azure is quickly catching up and seeing tremendous revenue growth. In Microsoft’s Q4 2017 earnings report, Azure grew 97% in revenue year over year – and analysts expect the market will only continue to explode.

Organizations are increasingly turning to cloud data centers and cloud applications for the benefits of on-demand, scalable infrastructure. However, widespread public cloud adoption presents a unique set of security challenges that IT teams have yet to address. On top of “traditional” security threats that cloud infrastructures face, they are also particularly attractive targets for attackers since organizations store an exhaustive amount of data in the cloud. Mounting security threats and the lack of cybersecurity skills needed to address those threats are why 49% of businesses are delaying cloud deployment.

Security challenges stem from shared security models, unknown security controls, and complexity associated with high volumes of traffic. To address these concerns, the ThreatDefend platform provides highly efficient deception decoys and lures that deceive an attacker into engaging rather than attempting to monitor or analyze all traffic, which is typically cost and operationally prohibitive. Once an attacker engages, the deception environment captures and records the lateral movement of threats within the datacenter, provides evidence-based alerts and the forensic reporting required to promptly shut threats down.

ThreatDirect Closes the Backdoor on Cyber Attacks

In addition to cloud data center security threats, organizations often face attacks on remote ROBOs, which are often less protected and can act as backdoors to the central networks. Enhancing these threats are the rapidly growing adoption of cloud applications at ROBOs, along with the widespread use of BYOD devices.

To address these increasing security concerns and close the detection deficit, Attivo Networks provides deployment capabilities that allow organizations to deploy deception in their ROBO environment without the need to install a local BOTsink deception server. The ThreatDirect solution forwards suspicious activity to a central BOTsink deception server for attack threat analysis. This saves dramatically on deployment costs and removes the need for local skilled resources. The ThreatDirect virtual scaling solution can also be deployed in an environment where a full BOTsink deployment is not feasible. For example, the ThreatDirect system can be deployed to implement deception in all the subnets of a heavily segmented network.

"In addition to increased responsibility and workload, security teams are challenged by the industry-wide cybersecurity skills shortage," said Tushar Kothari, CEO of Attivo Networks. "To address this, we have put an emphasis on building efficient solutions that provide accurate detection and extensive visibility into the lateral movement of threats within the evolving cloud attack surface. This will close the detection gap for remote locations, which often have limited facilities and lack the skilled resources required to manage security controls."

By adding these new solutions organizations are able to decrease the detection deficit by scaling deception in their cloud environment, as well as remote/branch offices. By doing so, security teams will detect threats faster and in areas of the network that they previously had limited visibility, thus minimizing the risk of a breach. More information can be found in the Azure or the ThreatDirect solution briefs.

 

 

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15224
PUBLISHED: 2019-08-19
The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
CVE-2019-15225
PUBLISHED: 2019-08-19
In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.
CVE-2019-15223
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.
CVE-2019-15211
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.
CVE-2019-15212
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.