New offering goes beyond industry requirements to help maximize the value of SIEM investments.

**P****LANO, Texas, Nov. 1, 2022 /PRNewswire/ —** Critical Start, a leading provider of Managed Detection and Response (MDR) cybersecurity solutions, today announced the launch of its new managed service for Security Information & Event Management (SIEM). Available to new and existing customers, the new service is an add-on to Critical Start's existing MDR for SIEM offering and supports Microsoft Sentinel™ and Splunk Cloud®. It simplifies the architecture and deployment of SIEM solutions to help organizations derive the maximum value from their SIEM investments for risk management, compliance and threat detection use cases, and holistically improve their security posture.

According to Gartner, "Managed SIEM has a compelling adoption rate as SIEM technologies are becoming more accessible and more mid-security-maturity buyers are entering the market having accelerated their security needs and maturity by adopting cloud-based IT."1

"SIEM solutions provide important security benefits but are often complex in nature and challenging to deploy, tune, manage and maintain. As a result, security leaders may be prevented from deploying or enhancing SIEM technologies, greatly limiting the improvement of their cybersecurity maturity," said Chris Carlson, SVP Product at Critical Start. "Our new managed service works cohesively with customers' SIEM products to handle the heavy lifting associated with implementation and customization, including recommendations for log source tuning to lower SIEM ingestion costs while maintaining robust threat detection visibility."

In addition to delivering all the requirements and optional features outlined in the 2022 Gartner _Market Guide for Managed SIEM Services__,_ Critical Start Managed SIEM experts help identify and continuously analyze log sources to ensure they are of high fidelity and provide the following value-added services:

*   Configuration and Customization – includes custom development for customer-specific dashboards, reports, and log sources to support security, risk, compliance and audit use cases.
*   Quarterly Service Reviews – provides visibility into how the SIEM is performing to help customers control costs and increase security outcomes.
*   Ingest Cost Analysis for Microsoft Sentinel - analyzes billing vs. ingest for specific Microsoft data sources recommending the appropriate commitment tiers over the length of the contract to maximize log ingest cost savings. This service is unique to Critical Start.
*   Data Source Health Monitoring – offers log source performance, availability and capacity monitoring to identify potential issues with log ingestion.
*   Risk Reduction Reviews – analyzes adding log sources and detection content to deliver the most coverage under the industry-standard NIST CSF and MITRE ATT&CK® Matrix Frameworks.
*   Ease of Upgrade – Managed SIEM is a service add-on to Critical Start's industry-leading MDR for SIEM offering. Customers can add Managed SIEM when they purchase the MDR service or anytime during the MDR contract term.

For additional details on this new service offering, visit Critical Start's Managed SIEM page.

1Gartner, _Market Guide for Managed SIEM Services_, Al Price, John Collins, Andrew Davies, Mitchell Schneider, Angel Berrios, August 17, 2022. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

**About Critical Start  
**Today's enterprise faces radical, ever-growing, and ever-sophisticated multi-vector cyber-attacks. Facing this situation is hard, but it doesn't have to be. Critical Start simplifies breach prevention by delivering the most effective managed detection and incident response services powered by the Zero Trust Analytics Platform™ (ZTAP™) with the industry's only Trusted Behavior Registry™ (TBR) and MOBILE**SOC**®. With 24x7x365 expert security analysts, and Cyber Research Unit (CRU), we monitor, investigate and remediate alerts swiftly and effectively, via contractual Service Level Agreements (SLAs) for Time to Detection (TTD) and Median Time to Resolution (MTTR), and 100% transparency into our service. For more information, visit criticalstart.com. Follow Critical Start on LinkedIn, Twitter, Facebook, Instagram.

Critical Start® Launches New Managed SIEM Service

FitStack offers a SaaS-based platform — supporting both cloud native and on-prem environments — to take risk and vulnerability out of application development.

**MADISON, Wis., Nov. 1, 2022 /PRNewswire/ —** Today Varsity Venture Studio – a collaborative venture studio between the University of Wisconsin-Madison, the Wisconsin Alumni Research Foundation (WARF) and venture builder High Alpha Innovation – announced the public launch of FitStack (www.fitstack.dev), a proactive risk management solution for application development teams to address the ongoing challenges in managing software supply chain security.

To address these issues, co-founders Roger Cummings (CEO) and Dr. Mohannad Alhanahnah, Ph.D. (CTO) are positioning FitStack to streamline the overall DevSecOps process. Unlike passive tools that merely identify code and container vulnerability and configuration issues, the FitStack platform proactively addresses them, shows developers the changes that have been made, and ensures that modified applications will execute at runtime.

"In today's environment, it's essential for development teams to gain control, limit exposure, and reduce overall risk," explains Cummings. "FitStack is proactively driving security best practices into the earliest stages of the application development lifecycle. We are building FitStack to make sure our solution can fit into everyone's CICD pipeline in the most efficient manner. By reducing application attack surfaces, exposing application vulnerabilities, and generating compliance reports, we are protecting organizations from malicious events and delivering the insight they need to run their business."  

Cummings and Alhanahnah bring decades of leadership experience in the data, cloud, networking, and infrastructure computing industries. Cummings is a serial entrepreneur who has led five early-stage companies to successful acquisitions, assisted in raising over $1B in funding while scaling organizations worldwide. He previously served as CEO of Evidence IQ, an evidence-based data intelligence company. Alhanahnah has extensive experience in software security research with a focus on leveraging static analysis, dynamic analysis, and formal methods for securing application and machine learning. He recently completed post-doctoral research in the lab of Dr. Somesh Jha, a professor in the Department of Computer Sciences at UW-Madison and a co-founding advisor to FitStack. They have co-authored several papers on improving application safety, security and privacy.

WARF not only helped launch the company as a partner in Varsity Venture Studio, but also licensed the technology to FitStack. Greg Keenan, Senior Director of WARF Ventures, notes, "Helping campus innovators like Drs. Jha and Alhanahnah bring their patented technology to market delivers on our mission to support the commercialization of UW-Madison research for both commercial and societal impact. We are really excited about the market opportunity the company is addressing and look forward to seeing what the FitStack team accomplishes from here."

"Development teams who aren't addressing risk management are already behind the curve, but they can't do it alone," concludes Elliott Parker, CEO of High Alpha Innovation. "Roger and Mohannad's solution to such a pressing problem is the perfect fit for building a startup via Varsity Venture Studio."

**About Varsity Venture Studio**

Varsity Venture Studio, a University of Wisconsin-Madison-wide venture studio, turns ideas into funded software businesses. Varsity Venture Studio is a collaboration between the University of Wisconsin-Madison, Wisconsin Alumni Research Foundation (WARF) and venture builder High Alpha Innovation, and is the first university venture studio of its kind. Learn more about Varsity Venture Studio at varsityventurestudio.com, High Alpha Innovation at highalphainno.com, and about WARF at warf.org.

FitStack, a New Solution For Code and Container Risk Management, Launches With Support From Varsity Venture Studio

Nudge Security releases new research conducted in consultation with leading psychologists at Duke University linking employee security behavior with attitudes and emotions.

**AUSTIN, Texas, Nov. 1, 2022 /PRNewswire/ —** What cybersecurity practitioners have long suspected is true: **67%** of employees would try to circumvent security controls that block access to unsanctioned SaaS applications at work. However, the reason why might come as a surprise. According to new research from Nudge Security, undesirable security behaviors may have less to do with lack of awareness and more to do with basic human emotions.

Key finding: 67% of employees would try to work around security controls that block access to unsanctioned SaaS apps.

Released today, "Debunking the 'stupid user' myth in security," is a new report from Nudge Security that explores how workers' attitudes and emotions influence security behaviors. Based on research conducted in consultation with leading psychologists at Duke University, it confirms that workers are more likely to comply with security controls if they find the experience to be positive and reasonable.

"We now have evidence to suggest that improving the employee experience of security can actually lead to better security outcomes," said Russell Spitler, CEO and co-founder of Nudge Security.

The research took 900 participants through a common scenario: needing to access a SaaS application for work. Participants were randomly assigned to one of three "security interventions" that either blocked access to the application, revoked access punitively, or nudged participants to justify access. Participants were asked to rate how reasonable they found the intervention, how positively or negatively they felt about it, and how likely they were to comply with it. Overall, participants' attitudes and emotions strongly correlated with their likelihood of compliance.

**Key Findings**

*   **67%** of participants said they would not comply with the blocking intervention. Instead, they would look for a workaround.
*   Participants perceived nudging as the most positive and reasonable intervention. They were **3X** more likely to feel negatively about blocking and punitive interventions.
*   **78%** of participants would comply with a nudge, **2X** the compliance rate of the blocking intervention.

Dr. Aaron Kay, PhD, J Rex Fuqua Professor of Management and Professor of Psychology & Neuroscience at Duke University and Nudge Security advisor, consulted on the development of the research.

"This research underscores basic tenets of human psychology and demonstrates that, even in cybersecurity, attitudes and emotions are strong predictors of behavior," said Kay. "Security leaders are setting themselves up for failure when they implement security controls with the assumption that employees will comply mechanically, regardless of their own self interests."

Kay and Spitler will discuss the research during an upcoming webcast. Register here. Download the full report at www.nudgesecurity.com.

**About Nudge Security**

Nudge Security is transforming the human element of cybersecurity by nudging employees towards secure SaaS adoption. Founded in 2021 by Jaime Blasco and Russell Spitler, the company secured funding from Ballistic Ventures in 2022. A fully remote company, Nudge Security has outposts in Austin, Texas and Jackson, Wyoming. Learn more at www.nudgesecurity.com and follow on Twitter and LinkedIn.

Can You Nudge Employees Toward Better Cybersecurity? New Research Says Yes

Announces technology partnership with Verve Industrial.

**CHARLOTTESVILLE, Va., Nov. 1, 2022 /PRNewswire/ —** Mission Secure, a leader in OT and ICS cybersecurity, today announced the release of its Sentinel 5.0 platform, a milestone in enabling Zero Trust security architectures for critical infrastructure. The Sentinel 5.0 platform provides dynamic, context-aware cybersecurity policy monitoring and enforcement for operational technology systems.

"Zero Trust architectures are the most powerful and practical way to increase safety and reduce risk for industrial cyber-physical processes," says Jens Meggers, Executive Chairman of Mission Secure. "With Sentinel 5.0, we are launching a game changer that allows granular implementation of access policies from the physical signal all the way to the cloud. It is whitelisting on steroids: industrial strength, context-driven, intrusion prevention and mitigation."

**Why Zero Trust?**

Zero Trust is a well-established IT cybersecurity principle that has yet to be widely adopted in industrial OT. It eliminates implicit trust in the network perimeter by validating every stage of digital interaction continuously. In the absence of Zero Trust architectures, industrial operators often rely on disjointed collections of tools, such as firewalls, intrusion detection systems, and endpoint vulnerability scanning, without fully gaining the ability to manage and secure industrial operating environments.

**A Powerful Policy Engine**

With Sentinel 5.0, Mission Secure launches a platform that allows operators to define and enforce granular policies based on a wide range of inputs, including network traffic, attempted remote access, asset firmware versions and vulnerabilities, and the actual digital or analog signal generated by physical devices.

While the Sentinel 5.0 platform includes standard capabilities such as passive monitoring, asset discovery, and alerting, the platform's core component is a fine-grained policy engine that enables highly sophisticated, OT-specific workflows:

*   Creating access control policies to define the conditions under which users or applications can send commands to an industrial device.
*   Identifying firmware state and vulnerabilities, as well as limiting access to only fully-patched systems.
*   Alerting and acting on anomalies in physical signals, and isolating systems that show abnormal behavior.
*   Supporting root cause analysis by correlating network events with sensor outputs.

Mission Secure also announced a technology partnership with Verve Industrial, the leading provider of IT-OT asset inventory and vulnerability management solutions. "Going beyond perimeter detection to protect the most vulnerable and critical OT assets at the endpoint level is a significant step forward toward securing the cyber-physical process," said John Livingston, CEO of Verve.

"Zero Trust is a long journey for industrial operators," said Chet Mroz, President of Mission Secure. "Sentinel 5.0 marks a bold step into the future for our customers as they start their journey."

**About Verve Industrial**

Verve Industrial Protection has ensured reliable and secure industrial control systems for over 25 years. Its principal offering, the Verve Security Center, is a unique, vendor-agnostic OT endpoint management platform that provides IT-OT asset inventory, vulnerability management, and the ability to remediate threats and vulnerabilities from its orchestration platform. Verve Industrial's Design-4-Defense professional services support clients in ensuring their OT environments are designed and operated in a secure manner. To learn more about Verve Industrial, please visit www.verveindustrial.com.

**About Mission Secure**

Mission Secure is a leader in cybersecurity for operational technology and industrial control systems, helping customers gain visibility and control over their critical assets. With unmatched threat detection and policy enforcement capabilities, Mission Secure enables effective Zero Trust architectures for customers in manufacturing, maritime, oil and gas, and other industries. Learn more at www.missionsecure.com.

Mission Secure Releases Sentinel 5.0 Platform, Enabling Context-Aware, Zero Trust Security for Critical Infrastructure OT

Renowned information security expert to lead Kodiak's cyber and data security team, further reinforcing Commitment Kodiak's to cybersecurity.

**MOUNTAIN VIEW, Calif., Nov. 1, 2022 /PRNewswire/ —** Kodiak Robotics, Inc., a leading self-driving trucking company, today announced that it has hired Google's former Chief Information Security Officer (CISO) and Vice President of Security and Privacy Engineering Gerhard Eschelbeck to the position of Chief Information Security Officer. Eschelbeck will draw on more than 25 years of experience to guide Kodiak's cybersecurity and data security strategy and team. Most recently, as CISO for Aurora, Eschelbeck established the cyber security organization and developed the security program and architecture for their autonomous vehicles.

"Safety and security are the primary building blocks upon which Kodiak was founded and bringing Gerhard onboard will keep us at the bleeding edge," said Don Burnette, Founder and CEO, Kodiak Robotics. "Gerhard's incredible experience and leadership at some of the world's leading companies, including Google and Deutsche Bank, make him an indispensable addition to the Kodiak team."

Eschelbeck has built a distinguished cyber- and data-security career by creating and championing foundational new technologies. As Kodiak's CISO, he will focus on further enhancing the security of the company's cloud and on-premises systems as well as its growing fleet of autonomous trucks. In addition, he will lead the deployment of new protocols for the company's broader data security team.

"Throughout my career I've always been attracted to companies doing transformational, remarkable and exciting things in clever ways," said Eschelbeck. "Kodiak has taken a safety-first approach to bringing autonomous trucks from concept to market. Ensuring the security of critical systems like Kodiak's is vital, and I couldn't pass up an opportunity to be part of the team that makes it happen."

Eschelbeck has built high-performance multi-national teams in the U.S., Europe and Asia that have launched transformative security technologies. He is widely regarded as one of the world's foremost experts on network and system security. Prior to Eschelbeck's roles with Aurora Innovation and Google, he held several Chief Technology Officer and executive engineering roles for companies including Sophos, Webroot and Qualys. He also served as Digital and Technology Advisor to the International Olympic Committee for the Tokyo 2020 Olympics and as a member of the supervisory board for Deutsche Bank.

Eschelbeck holds a doctorate and master's degree in computer science from the University of Linz, Austria.

**About Kodiak Robotics, Inc.**

Kodiak Robotics, Inc. was founded in 2018 to develop autonomous technology that carries freight forward — so people, partners, and the planet thrive. The company is developing an industry-leading technology stack purpose-built specifically for long-haul trucks, making the freight industry safer and more efficient. Kodiak's unique modular hardware approach integrates sensors into a streamlined sensor-pod structure that optimizes for perception, scalability, and maintainability. The company delivers freight daily for its customers across the South, operating autonomously on the highway portions of the routes. Learn more about Kodiak on the web at kodiak.ai, and on LinkedIn and Twitter. You can find the company press kit HERE.

Kodiak Robotics Hires Former Google Chief Information Security Officer Gerhard Eschelbeck

Major partnership program aims to break down barriers and empower underrepresented groups in cybersecurity across the globe.

**ALEXANDRIA, Va., Nov. 1, 2022 /PRNewswire/ —** (ISC)² – the world's largest nonprofit association of certified cybersecurity professionals – today announced five key global partnerships in support of its diversity, equity and inclusion (DEI) initiative. The partners include the Australian Women in Security Network (AWSN), Cyversity, Blacks United in Leading Technology International (BUiLT), Women4Cyber and Chartered Institute of Information Security (CIISec).

Each partnership has unique objectives and will include support from (ISC)² in areas such as partnership promotion, co-branded and DEI-focused webinars, (ISC)² Certified in Cybersecurity promotion, grants for education and exams, along with co-branded toolkits and guides to assist both leaders, organizations and professionals on their DEI journeys and career development.

"It's no secret that the cybersecurity industry isn't nearly as diverse as it should be," said Dwan Jones, director of Diversity, Equity and Inclusion at (ISC)². "Our mission at (ISC)² is to not only enable individuals from all backgrounds to enter the cybersecurity industry but also to empower and equip them to excel in their positions and continuously grow in their careers. These five organizations have unique expertise and perspectives that will empower us to accomplish that mission and open new and diverse pathways for professionals looking to join the industry globally. Kicking off our DEI partnership program with this group of dedicated organizations is an exceptional opportunity to work together to transform this industry."

**Australian Women in Security Network**

The AWSN is a not-for-profit association and network of people aimed at increasing the number of women in the security community. Founded in 2015, it connects women, who often felt isolated in organizations and tertiary education institutions with like-minded individuals.

"(ISC)² is just the type of organization the cybersecurity industry needs today," said Jacqui Loustau, the founder and executive director of the AWSN. "At the AWSN, we believe partnering with membership organizations is a fundamental way to not only reach women we haven't been able to reach yet but also to introduce them to other women with similar interests, goals and aspirations. That shared passion is what's going to keep women in the field and make them want to share that passion with the next generation."

**Blacks United in Leading Technology International**

BUiLT is the largest community and nonprofit professional organization that focuses on black people in the technology industry. BUiLT is dedicated, with its allies, to increasing the representation and participation of black people in the technology industry by fostering the connection, development, and employment of its members.

"Diversity continues to lag in the tech and cyber industries – and in order to meet the workforce gap head on, we need to create racial equity by helping the black community explore new career possibilities within these fields," said Peter Beasley, executive director and chairman of the board, BUiLT. "Partnering with (ISC)² enables our members to explore new opportunities. It encourages a shift we need – to convert, train and educate adults already in the workforce to meet the open roles in the tech and cyber industries."

**Chartered Institute of Information Security**

CIISec is committed to raising the standard of professionalism in information and cybersecurity. CIISec provides a universally accepted focal point for the information cybersecurity profession. It is an independent not-for-profit body representing between 20,000-30,000 individuals in the information and cybersecurity industry. Governed by its members, it ensures standards of professionalism for training, qualifications, operating practices and individuals.

"Without diversity and inclusion, the industry will stagnate and be left unable to keep up with complex cyber threats," said Amanda Finch, CEO of CIISec. "To attract a pool of diverse professionals into cyber security, the industry needs to highlight the variety of roles available. From forensics to threat intelligence to researchers, there are opportunities out there for everyone. Cyber security can no longer be viewed as a 'boys-only club' where technical skills are valued above all. We need to move away from this and keep creating a culture where everyone can thrive, feel valued and be accepted.**"**

**Cyversity**

Cyversity is a diverse community of cybersecurity professionals whose mission is to achieve the consistent representation of women and underrepresented minorities in the cybersecurity industry through programs designed to diversify, educate, and empower. Cyversity tackles the 'great cyber divide' with scholarship opportunities, diverse workforce development, innovative outreach, and mentoring programs.

**Women4Cyber**

Women4Cyber is an initiative that aims to address the gender gap among cybersecurity professionals in Europe. In pursuing this objective, its main goal is to encourage and promote the skilling, up-skilling, and re-skilling of girls and women toward cybersecurity education and professions.

"These partnerships broaden our reach and open the doors to more women and underrepresented groups who are interested in pursuing a career in cybersecurity," said Clar Rosso, CEO at (ISC)². "We've been making huge strides as an organization in expanding cybersecurity training and education to more diverse groups. These partnerships help further that mission, ultimately addressing the global workforce talent gap we are facing today as an industry. There's only more to come."

In August, Rosso announced (ISC)²'s One Million Certified in Cybersecurity initiative at the Cyber Workforce and Education Summit at the White House. The initiative is a multi-year commitment to deliver free exams and educational resources to one million people looking to enter a career in cybersecurity. Of the one million pledged, 500,000 certifications will go to underrepresented groups, furthering the association's efforts to reduce the global cybersecurity skills gap through greater diversity and inclusion.

To learn more about (ISC)²'s diversity, equity and inclusion initiatives and access available resources, please visit https://www.isc2.org/DEI.

**About (ISC)²**  
(ISC)² is an international nonprofit membership association focused on inspiring a safe and secure cyber world. Best known for the acclaimed Certified Information Systems Security Professional (CISSP®) certification, (ISC)² offers a portfolio of credentials that are part of a holistic, pragmatic approach to security. Our association of candidates, associates and members, more than 235,000 strong, is made up of certified cyber, information, software and infrastructure security professionals who are making a difference and helping to advance the industry. Our vision is supported by our commitment to educate and reach the general public through our charitable foundation – The Center for Cyber Safety and Education™. For more information on (ISC)², visit www.isc2.org, follow us on Twitter or connect with us on Facebook and LinkedIn.

(ISC)² Expands DEI Initiative with International Partnership Agreements

Grant will be used to design reliable method of reducing cybersecurity gaps that lead to data breaches and develop a training course.

**DOBBS FERRY, N.Y., Oct. 31, 2022 /PRNewswire-PRWeb/ —** Mercy College has received a two-year $465,398 grant from the National Centers of Academic Excellence in Cybersecurity (NCAE-C), an arm of the National Security Agency (NSA). The grant will be used by College faculty and staff to design a reliable method of reducing cybersecurity gaps that lead to data breaches and to develop a training course at Mercy College for delivering the technology.

The grant stems from the NCAE-C's mission to create a collaborative cybersecurity educational program to engage experts in the field in solving the rising problem of data breaches. Mercy College has been tasked with addressing the human component in security breaches, especially those involving individuals, such as hackers or former employees, who break through security systems to access sensitive data.

Usman Rauf, Ph.D., assistant professor of cybersecurity, will serve as principal investigator (PI) on the grant. He will be assisted by co-PI, Zhixiong Chen, Ph.D., director of the Cyber Education Center at Mercy College, which has been designated by the NSA and the Department of Homeland Security as a Center of Academic Excellence on Cybersecurity Defense Education.

According to a recent data report from Verizon, up to two-thirds of breaches are not discovered until a year or more after the incident. "By then the damage is done, well before strategies for detection and deterrence are in place," said Rauf, whose 2021 paper on the subject was published in the journal Future Generation Computer Systems. "We propose to develop a system of detecting irregular or unexpected behavior that should be flagged as a threat." Once identified, an automated process will alert the system administrator and other authorities, enabling earlier intervention and minimizing the damage caused by the breach.

In a second phase, the team will design a novel master's level course, Cyber Threat Analytics, that will offer training in observation, analysis, and application. In the pilot program, Mercy College students will use state-of-the-art techniques and pipelines to learn how to detect and manage insider threats in a variety of scenarios. The team also expects to research and publish papers on multiple aspects of cyber threat analytics. "We are confident that the outcomes of this project will be of great benefit to industry and academia," Chen said.

"Mercy is proud to have been awarded a grant from the National Security Administration and for the opportunity to contribute to the advancement of the country's cybersecurity," said Mercy College President Tim Hall. "Through this grant, Mercy also looks forward to giving students the ability to learn in-demand industry skills that will benefit them upon graduation."

**About Mercy College**

  
Founded in 1950 by the Sisters of Mercy, Mercy College is an independent, coeducational college that offers more than 100 undergraduate and graduate degree and certificate programs within five schools: Business, Education, Health and Natural Sciences, Liberal Arts and Social and Behavioral Sciences. The vibrancy of the College culture is sustained by a diverse student body from around the region. The College offers campuses in Dobbs Ferry, the Bronx and Manhattan as well as online offerings.

Mercy College Awarded NSA Research Grant to Develop Cybersecurity Technology

A critical security vulnerability gives attackers a way to compromise thousands of systems at ConnectWise's managed service provider (MSP) customer locations and their downstream clients.

ConnectWise has patched a critical remote code execution (RCE) vulnerability in its ConnectWise Recover and R1Soft server backup manager technologies that could give attackers a way to compromise thousands of the company's managed service provider (MSP) customers — and, in turn, their downstream clients.

In an alert Friday, ConnectWise said it had pushed out an automatic update to both the cloud and client instances of ConnectWise Server Backup Manager (SBM), and it urged customers of the R1Soft server backup manager to upgrade immediately to the new SBM v6.16.4 it released on Friday.

**Severe Bug**

"We have informed our \[customers\] of the fix and encouraged those with on-premises instances of the impacted product to install the patch as soon as possible," Patrick Beggs, CISO of ConnectWise, says in comments sent to Dark Reading. For most organizations using ConnectWise Recover, no further action is required at this point to protect against the vulnerability, but "R1Soft is self-managed; we encourage these \[customers\] to apply the patch quickly," he says.

ConnectWise said it discovered the bug after security vendor Huntress informed the company about the issue and showed proof-of-concept code demonstrating how attackers could exploit the vulnerability to take complete control of affected systems. The company described the bug as one involving "improper neutralization of special elements in output used by a downstream component." The vulnerability exists in ConnectWise Recover v2.9.7 and earlier versions and R1Sof SBM v6.16.3 and earlier versions.

In an Oct. 31 blog post, researchers from Huntress described the issue as tied to an authentication bypass vulnerability (CVE-2022-36537) in a previous version of the ZK Java library, bundled with ConnectWise's server backup manager technology. A researcher from Germany-based security vendor Code White GmbH was the first to discover the vulnerability in the ZK library and report it to the maintainers of the framework in May 2022. Another researcher from the same company discovered that ConnectWise's R1Soft SBM technology was using the vulnerable version of the ZK library and reported the issue to ConnectWise, Huntress said in its blog post. When the company did not respond in 90 days, the researcher teased a few details on how the flaw could be exploited, on Twitter.

Huntress' researchers used the information in the tweet to replicate the vulnerability and refine the proof-of-concept. They found they could leverage the vulnerability to leak server private keys, software license information, system configuration files and eventually gain remote code execution in the context of a system superuser. 

Huntresses' researchers found they would gain code execution not just on vulnerable ConnectWise systems at MSP locations but all on all downstream registered endpoints. A Shodan scan showed more than 5,000 exposed ConnectWise server backup manager instances that were vulnerable to exploits. Considering that most of these systems were at MSP locations, the actual number of affected organizations is likely significantly higher, Huntress said.

**Classic Software Supply Chain Threat**

Caleb Stewart, security researcher at Huntress, says that the exploit chain that he and a trio of other researchers developed and reported to ConnectWise involved three main components: the original authentication bypass in the ZK library, RCE on the SBM, and RCE on connected clients. 

According to Stewart, the researchers spent about three days on replicating the original vulnerability, and then reverse engineering the R1Soft application so it could be abused for a malicious purpose. Exploiting the vulnerability was complicated, Stewart says. "But \[it was\] feasible for someone to find and exploit in a matter of days if they knew what they were looking for."

The vulnerability is another example of why developers and end customers need to be aware of security advisories for all software in their environment, Stewart says. "This is fundamentally a supply chain vulnerability — customer buys R1Soft SBM, which bundles ZK, which is vulnerable," he says. "Once the severity was evident, I think ConnectWise did a great job at getting a patch out quickly."

John Hammond, senior security researcher at Huntress and part of the team that analyzed the flaw, says the weaponized attack chain they developed could have a wide impact. "From an authentication bypass to full compromise, across not just one endpoint but a mass multiple, this is truly a 'point-and-shoot' exploit with the potential for widespread effects," he says.

Beggs from ConnectWise did not directly respond to a Dark Reading question about why the company did not respond to the original disclosure of the flaw by the researcher at Code White. But one issue could have been the fact that the researcher did not disclose it via the company's usual channel for submitting bug disclosures and security concerns.

"We have long vouched for our Trust Center as the most effective channel to submit security concerns," he says, Queries submitted through other channels do not always get the attention they deserve, Beggs notes.

"In this case," he adds, "Huntress did an admirable job of demonstrating just how dangerous this potential vulnerability could have been, treated the issue responsibly by showing it to us directly, and gave us time to update our products."

Patch Now: Dangerous RCE Bug Lays Open ConnectWise Server Backup Managers

On-chip solutions aim to prevent breaches by separating the computing element and keeping data in the secure vault at all times.

Top chip makers Nvidia, Intel, ARM, and AMD are providing the hardware hooks for an emerging security concept called confidential computing, which provides layers of trust through hardware and software so customers can be confident that their data is secure.

Chip makers are adding protective vaults and encryption layers to secure data when it is stored, in transit, or being processed. The goal is to prevent hackers from launching hardware attacks to steal data.

The chip offerings are trickling down to cloud providers, with Microsoft (Azure) and Google (Cloud) offering security-focused virtual machines in which data in secure vaults can be unlocked by only authorized parties. Attestation verifies the source and integrity of the program entering the secure vault to access the data. Once authorized, the processing happens inside the vault, and the code doesn't leave the secure vault.

Confidential computing is not a part of everyday computing yet, but it may become necessary to protect sensitive applications and data from sophisticated attacks, says Jim McGregor, principal analyst at Tirias Research.

The chip makers are focusing on hardware protections because "software is easy to hack," McGregor says.

**Nvidia's Morpheus Uses AI to Analyze Behavior**

There are multiple dimensions to confidential computing. On-chip confidential computing aims to prevent breaches like the 2018 Meltdown and Spectre vulnerabilities by separating the computing element and keeping data in the secure vault at all times.

"Everybody wants to continue to reduce the attack surface of data," says Justin Boitano, vice president and general manager of Nvidia's enterprise and edge computing operations. "Up to this point, it is obviously encrypted in transit and at rest. Confidential computing solves the encrypted in-use at the infrastructure level."

Nvidia is taking a divergent approach to confidential computing with Morpheus, which uses artificial intelligence (AI) to keep computer systems secure. For example, Morpheus identifies suspicious user behavior by using AI techniques to inspect network packets for sensitive data.

"Security analysts can go and fix the security policies before it becomes a problem," Boitano says. "From there, we also realize the big challenges — you have to kind of assume that people are already in your network, so you have also got to look at the behavior of users and machines on the network."

Nvidia is also using Morpheus to establish security priorities for analysts tracking system threats. The AI system breaks down login information to identify abnormal user behavior on a network and machines that may have been compromised by phishing, social engineering, or other techniques. That analysis helps the company's security team prioritize their actions.

"You're trying to look at everything and then use AI to determine what you need to keep and act on versus what might just be noise that you can drop," Boitano says.

**Intel Rolls Out Project Amber**

Confidential computing will also help enterprises build a new class of applications where third-party data sets can mingle with proprietary data sets in a secure area to create better learning models, says Anil Rao, vice president and general manager for systems architecture and engineering at Intel's office of the chief technology officer.

Companies are eager to bring diverse data sets into proprietary data to make internal AI systems more accurate, Rao says. Confidential computing makes sure only authorized data is fed into AI and learning models, and that the data is not pilfered or stolen.

"If you have data coming in from credit card companies, you have data coming in from insurance companies, and you have data coming in from other locations, what you can do is say, 'I'm going to process all of these pieces of data inside of a \[secure\] enclave,'" Rao says.

Intel already had a secure enclave called SGX (Secure Guard Extension), but it recently added Project Amber, a cloud-based service that uses hardware and software techniques to attest and certify the trustworthiness of data.

On its upcoming 4th Generation Xeon Scalable processor, Intel's Project Amber uses instructions called Trust Domain Execution (TDX) to unlock secure enclaves. An Amber engine on one chip generates a numerical code for the secure enclave. If the code provided by the data or program seeking access matches, it is allowed to enter the secure enclave; if not, entry is denied.

**ARM Teams Up With AWS**

At the recent online ARM DevSummit, ARM — whose chip designs are being used by AWS on its Graviton cloud chip — announced it was focusing confidential computing on dynamic "realms" that will order programs and data in separate computational environments.

ARM's latest confidential computing architecture will deepen secure "wells" and make it harder for hackers to pull out data. The company is releasing confidential computing software stacks and guides for implementation in processors coming out over the next two years.

"We're already investing to ensure that you have the tools and software to see the ecosystem for early development," said Gary Campbell, executive vice president for central engineering at ARM, during a keynote at the event.

**AMD and Microsoft Go Open Source**

During a presentation at the AI Hardware Summit in August, Mark Russinovich, Microsoft Azure's chief technology officer, gave an example of how Royal Bank of Canada was using AMD's SEV-SNP confidential computing technology in Azure. The bank's AI model mixed proprietary data sets with information from merchants, consumers, and banks in real time, which helped provide more targeted advertising offerings to its customers.

Confidential computing features such as attestation ensured only the authorized data was mingling with its proprietary data set and not compromising it, Russinovich said.

Nvidia, Microsoft, Google, and AMD are collaborating on Caliptra, an open source specification for chip makers to build confidential computing security blocks into chips and systems.

How Chip Makers Are Implementing Confidential Computing

Dozens of international delegations meet for the second year to share intel, with a goal of stopping ransomware attacks on critical infrastructure.

U.S. officials will meet this week with delegations from more than 36 countries to share intelligence and strategize about how to push back against crippling and costly ransomware attacks against critical infrastructure.

The second-annual ransomware summit will include briefings from intelligence officials on the more than 4,000 cyberattacks that have occurred just over the past 18 months, Biden administration officials told reporters.

In addition to public sector experts, Microsoft and SAP will also contribute their data and analysis as part of their participation in the summit.

Russia, which is the country of origin of many ransomware operations, is not represented at the meetings.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Source

DARKReading