Before investing, venture capitalists should consider a trio of business characteristics that seem to correlate with commercial success, based on meetings with over 2,000 cybersecurity startups.

Few aspects of the cybersecurity industry evoke more polarizing reactions than the use of venture capital to fund startups.

On the one hand, startup founders seek the attention of investors with the ferocity of authors searching for publishers. Without investment capital, new companies cannot grow properly, especially if their technology requires a period of long stealth development in advance of any customer revenue.

On the other hand, security practitioners tend to exhibit lukewarm, even hostile, emotions toward investors. This should not be surprising when one considers that venture capitalists might be viewed as growing rich by betting on technologies required to protect citizens and business from attacks.

One fact that everyone agrees on, however, is the staggering growth of the aggregate investment being made in this segment. According to Statista, the size of the venture capital market for cybersecurity grew to over $21 billion USD, up from roughly $9 billion just one year before.

Another fact everyone agrees on is the common interest held by investors, founders, and practitioners: Investments eventually lead to good solutions. Technologies being funded range from methods to rid the world of passwords to machine learning that predicts where the next threats will occur. Everyone benefits if these investments succeed because the risks of attack are increasing on a daily basis.

The ongoing conflict in Ukraine, for example, introduces nation-state offensive cyber campaigns directed at business and civilian groups around the world — perhaps to target enemies, perhaps to just create chaos. New commercial security products and services will be necessary to mitigate this potentially hazardous and growing risk.

My team has met with over 2,000 cybersecurity startups during the past few years, many of which are supported by venture capital. In the course of our work, we've come to recognize three primary factors that seem to correlate with commercial success in the cybersecurity marketplace. When I share my observations with venture capital teams, however, they often do not match up well with the typical investment evaluation formula. Most venture capital teams tend to obsess on factors such as aggregate market size for a given company, the problem being solved, the types of competitors that exist, and so on. While these are important issues, I do not think they are the primary drivers of success.

Accordingly, below is a summary of the three factors that my team and I use in our work to advise security practitioners on which startups are worth considering for long-term partnership.

**Factor 1: Belief System  
**When we ask a founding team what they believe and why they started their business, their answer is often wrapped in some muddled description of what they do. This vacuous and circular reasoning of starting a company "to stop threat X because the world needs to stop threat X" is insufficient to connect with customers at a visceral level.

In contrast, consider the belief system of retired Army general Keith Alexander, co-founder of IronNet Cybersecurity, which recently completed a successful SPAC. If you ask founders such as Gen. Alexander why they started the company, they will point to their lifelong commitment to protecting their country, whether in uniform, on the physical battlefield, or across virtual networks.

Such personal belief systems connect with buyers. In fact, a useful exercise for founders is to explain why they started their company without ever mentioning their product. It is a delightfully painful experience because it exposes the real purpose behind their company. Good luck to the startup that can only cite making money as its reason for being.

**Factor 2: Attention to Design  
**When we ask a startup to describe their company, we usually see one of two approaches. On the one hand, a team will lead us into PowerPoint hell with chart after chart of buzzwords, disjointed clip art, and meaningless quotes. The platform diagrams in these presentations are usually haphazardly cut-and-pasted from the engineers, as if the technology is some afterthought.

On the other hand, we sometimes find a startup that understands the value of design. In such cases, we see a carefully crafted story, developed from top to bottom with the combined inputs of the platform developers, marketing team, and leadership group. When done right, the only word that comes to mind is elegance. And it is not just the elegance of the technology but also of the overall story.

Take SentinelOne, for example. When we first met this now-public company, we were struck by their attention to detail in explaining their behavioral analytics. This technique involves establishing which behaviors are considered normal and then sounding an alarm when something looks unusual. It was obvious to us that considerable time and effort had gone into developing their crisp messaging.

And just like quality, design elegance in any solution (think Apple) is hard to define — but you certainly know it when you see it.

**Factor 3: Domain Knowledge  
**Finally, we always ask founders to share their experience in the domain their new company addresses. The worst responses come from serial entrepreneurs hopping aboard the security bandwagon from some unrelated area. Cybersecurity is a complex arena, and poor domain knowledge will eventually catch up with inexperienced founding teams.

The best responses come from startup leaders who have committed their lives to their chosen discipline. A favorite question we like to ask is whether a founder would continue doing what they are doing for free. Only a select group of founders can honestly answer yes to this question — and these are the ones to bet on.

Consider Sanjay Beri, founder of Netskope; Nir Zuk, founder of Palo Alto Networks; and Ken Xie, founder of Fortinet. Each of these successful entrepreneurs would certainly continue doing exactly what they do now, even if they never earned another penny. Buyers connect with this type of domain passion, and investors should take this essential factor into full account.

3 Predictors of Cybersecurity Startup Success

Enhancements to the program include unique packages, faster response time for invoicing, and dedicated training for new solutions.

MOUNTAIN VIEW, Calif., May 12, 2022 /PRNewswire-PRWeb/ -- Egnyte, a leader in cloud content security and governance, has enriched its partner program based on feedback from active partners to better serve its channel and their customers. Announced today at Egnyte's annual Managed Service Provider (MSP) Summit, this follows the program's accelerated growth in 2021. Enhancements to the program include unique packages, faster response time for invoicing, and dedicated training for new solutions.

"Egnyte recognizes the importance of MSPs as the conduit for delivering IT services to businesses regardless of size or industry," said Charles Bieler, Director, Sales - MSP at Egnyte. "The Egnyte Partner Program is designed to provide support to our channel community of more than 1,000 partners as they look to bring their clients the most advanced security, governance, and collaboration capabilities to meet their needs."

**Key benefits of Egnyte's Partner Program include:**

\-- Dedicated pricing and packages for partners. With two plans designed exclusively for MSPs, partners can now provide a profitable replacement for on-premise file servers with the added benefit of secure collaboration through ransomware detection and recovery from any device, anywhere.

\-- A designated team of experts. Egnyte offers a dedicated team, including solutions engineers, marketing support, account managers, and professional services. These team members help MSPs select security, governance, and industry solutions to serve their customers.

\-- Expanded partner portal and enablement solutions. The Egnyte Partner Program offers marketing services and sales enablement tools, including co-branded marketing materials, sales playbooks, training tracks, professional services support, and billing capabilities.  

"Egnyte offers a true collaborative partnership that makes it easy to conduct business," said Paul Hampson, Director at Advoco Solutions. "With the attention to detail from our dedicated Egnyte team members, recent partner portal enhancements, and monthly enablement sessions, we feel very fortunate to work with a company that gives us both support and an amazing, secure cloud solution to provide for our clients."

Egnyte was awarded Best Channel Program at SMB TechFest last month, and recognized with other recent honors, including Best in Cloud at SMB TechFest and Best Add-on Product at ChannelPro. In addition, Eric Anthony, Egnyte's Channel Community and Enablement Director, was recently named to CRN's 2022 Channel Chiefs list.

Learn more about Egnyte's MSP Partner Program and how to join on our website.

**About Egnyte**  
Egnyte provides a unified content security and governance solution for collaboration, data security, compliance, and threat detection for multicloud businesses. More than 16,000 organizations trust Egnyte to reduce risks and IT complexity, prevent ransomware and IP theft, and boost employee productivity on any app, any cloud, anywhere. Investors include GV (formerly Google Ventures), Kleiner Perkins, Caufield & Byers and Goldman Sachs. For more information, visit http://www.egnyte.com.

Egnyte Enhances Program for Managed Service Providers

Round co-led by Sapphire Ventures and Costanoa Ventures to accelerate product leadership and market growth.

DENVER, Colo. - May 12, 2022 - StackHawk, the company making application security testing part of software delivery, has secured $20.7 million in capital co-led by Sapphire Ventures and Costanoa Ventures with participation from Foundry Group and other high-value investors. With this funding, StackHawk will invest in product development to maintain its market leading position in developer-first application and API security testing and to continue its rapid growth. This latest financing brings StackHawk’s total funding raised to $35.3 million.

Every modern software development organization has shifted from quarterly releases to daily or hourly releases, incorporating Continuous Integration and Continuous Delivery (CI/CD). In the modern world of FinTech, HealthTech, cloud analytics and AI platforms, customers are entrusting their most critical data to software providers. Periodic manual security testing by an external team is simply too risky. Because of this, modern software development organizations are extending CI/CD to encompass Continuous Application and API Security Testing. This way security vulnerabilities are detected while the developer is actively working on the code.

“In the current world we live in, security is more important than ever. Our prospects know they have a gap in how they approach security and recognize the need for what we do even before we speak with them.” said Joni Klippert, Co-Founder and CEO. “As the leader in this advanced approach to dynamic security testing, the market pull drove the funding round. We will use the funds to continue to invest in our product to maintain leadership and significantly increase funding for marketing, sales and partnerships. Our recently announced Snyk integration, which is already driving value with joint customers, is a great example of this.”

Forrester research reported that web application and API exploits are the most common form of external attack affecting organizations today. To better protect from these threats, 43% of global security decision makers are looking to implement dynamic application security testing during software development. As a result, Gartner expects worldwide application security testing (AST) end-user spending to exceed $3.1 billion in 2022.

To learn more about the funding round and StackHawk’s approach to developer-first application and API security testing, visit stackhawk.com.

**About StackHawk**

StackHawk is making application security testing part of software delivery. The StackHawk platform empowers engineers to easily find and fix application security bugs at any stage of software development. With a strong founding team that has deep experience in security and DevOps, and some of the best venture investors in the business, StackHawk is putting application security testing into the hands of engineers. Learn more and sign up for a free trial at www.stackhawk.com.

StackHawk Raises $20.7 Million in Series B Funding for Developer-First Application and API Security Testing

Cloud competitor found liable for breaking into Appian back-end systems to steal company secrets.

Appian has been awarded $2.3 billion in its lawsuit against cloud computing competitor Pegasystems for the cyber theft of its trade secrets. 

The Fairfax county court found Pegasystems used a variety of means to steal Appian data, including paying a government contractor to provide back-end access to Appian systems, over a period of eight years. A former Pegasystems employee alerted Appian to the insider threat scheme in 2020, Appian CEO Matt Calkins told Virginia Business.

According to the evidence presented at the trial, the government contractor who helped Pegasystems, Youyong Zou, passed trade secret information via video recordings of Appian’s development environments. Appian also said during the trial that Pegasystems employees used false identities to get access to trial versions of Appian’s software.

The court awarded Appian $5,000 in damages against Zou. Pegasystems also has to pay an additional $1 for violating the Virginia Computer Crimes Act.

Pegasystems has said it will appeal the ruling. 

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Cloud Firm Appian Awarded $2B in Trade Secret Cyber-Theft Lawsuit

One year after it was issued, has President Biden's Cyber Executive Order had an impact?

When it was signed a year ago today, Executive Order 14028, Improving the Nation's Cybersecurity, was a measured response to an urgent problem. Just days prior, the Colonial Pipeline was shut down by a ransomware attack, thrusting the issue of cyber-risk to critical US infrastructure into the spotlight. One year later, what progress has been made? Here's a scorecard to help you keep track.

**Section 1: Policy  
**Last October, the president signed the K-12 Cybersecurity Act into law, providing resources for school districts to combat cyberattacks. In March, he signed the Strengthening American Cybersecurity Act of 2022. Still, huge swaths of US critical infrastructure are in private hands, and questions remain about how to improve private sector cybersecurity and resilience.

**Grade:** B

**What would earn an "A"?** To really put a dent in cyberattacks against the US, the federal government, new laws, and regulations need to set a high bar and impose high costs on firms for failing to clear that bar.

**Section 2: Removing Barriers to Sharing Threat Information  
**Under the direction of Director Jen Easterly, the Cybersecurity and Infrastructure Security Agency (CISA) has conducted many successful efforts to promote sharing of threat intelligence. These include coordinated responses to threats, like the Shields Up initiative, in response to Log4j. The Strengthening American Cybersecurity Act also contains substantive new requirements for federal agencies for information sharing.

**Grade:** B+

**What would earn an "A"?** Information sharing within critical industry sectors is still a patchwork effort and often limited to the largest and wealthiest organizations. CISA needs to improve threat intelligence sharing in sectors where it's not the norm and draw in smaller organizations that are often left out of the loop due to operational immaturities.

**Section 3: Modernizing Federal Government Cybersecurity  
**Section 3 of the Executive Order lays out requirements for the federal government to address cyber-risk by promoting movement to cloud-based services and adoption of zero-trust architectures. A year after the EO was signed, we see some progress on that. CISA published a Cloud Security Technical Reference and guidance for building zero-trust architectures. Government and defense organizations are adopting cloud-native security solutions and building cloud-first approaches.

**Grade:** B

**What would earn an "A"?** Incremental approaches to modernization aren't enough. An April 2021 report by Government Accountability Office found that the US government spends substantial portions of its $100 billion IT budget to operate and maintain legacy systems. Breaking that cycle and grasping the holy grail of zero trust requires a "whole of government" approach.

**Section 4: Enhanced Software Supply Chain  
**Not much has been done here. As we noted in February, NIST published Version 1.1 of the Secure Software Development Framework (SSDF) but punted on guidance for software bills of materials (SBOMs). Also, the guidance exempted software development organizations working within the federal government.

**Grade:** C

**What would earn an "A"?** Development organizations within the federal government should be bound by the same rules and standards as third parties who sell to Uncle Sam. Guidance on the use of SBOMs also needs to be clarified and enforced.

**Section 5: Establishing the Cyber Safety Review Board  
**This is one of the more concrete elements of the EO and, so far, the federal government has complied with the EO's requirement. The Department of Homeland Security launched the Cyber Safety Review Board in February 2022. As part of the launch, CSRB said its first review will focus on the Log4j vulnerabilities, but a report on that is not due out until the summer.

**Grade:** A

**Section 6: Standardize Federal Playbooks for Incident Response (IR) and Vulnerability Management  
**This is another concrete deliverable in the Executive Order. CISA published the playbooks in November 2021. The question is whether they are being put to use, and that is hard to know without a mechanism that can anonymize and share an aggregate MRT (mean time to response) per industry.

**Grade:** B+

**What would earn an "A"?** With playbooks in hand, the question is how to operationalize them across the federal government (and its contractors and partners). Keeping close tabs on agencies' use of the playbooks and progress on IR and vulnerability management is a good start.

**Section 7: Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Networks  
**Section 7 of the EO exhorts federal agencies to improve their vulnerability and threat detection capabilities. The goal is to empower federal agencies to engage in cyber hunt, detection, and response. News of successful attacks on federal IT infrastructure suggest that there is still much work to be done, however.

**Grade:** C

**What would earn an "A"?** The private sector has embraced automation and new tooling. At the federal level, there is scant evidence that such efforts are underway. The federal government should mount an effort to deploy more tools like Sigma, Suricata, and YARA rules to improve IR.

**Section 8: Improve Federal Government Investigative & Remediation Capabilities  
**This part of the EO directs federal agencies to improve logging and data retention to facilitate investigations, but the government's investigative and remediation capabilities are little improved from a year ago, with no modern frameworks deployed (to the best of my knowledge).

**Grade:** D

**What would earn an "A"?** The federal government needs to leverage automation and modern threat intelligence and IR frameworks, taking a "whole of government" approach to threat hunting.

**Section 9: National Security Systems  
**This section requires the secretary of defense and the director of national intelligence (DNI) to implement requirements for national security systems that are equivalent to or exceed the requirements in the EO. Much of this work is classified, but I see a strategic shift to adopt CTO leadership philosophies and build agile approaches to decentralizing risks.

**Grade:** B

**What would earn an "A"?** With Avril Haines recently sworn in as the DNI, we expect there to be progress for improved execution, although the breadth and focus of the Ukraine-Russia conflict might take precedence before real results are evident.

Needs Improvement: Scoring Biden's Cyber Executive Order

By understanding how FaaS works and following best practices to prevent it, your business can protect its customers, revenue, and brand reputation.

The pandemic pivot to digital banking, shopping, and other services was an important health measure, but it created opportunities for organized fraudsters to grow their "business" and expand their offerings to include fraud-as-a-service (FaaS). FaaS takes several forms, all with the goal of making it easier for both experienced and novice criminals to commit fraud. Here's what merchants need to know about this trend and how to prevent FaaS attacks.  

**How Fraud-as-a-Service Works  
**There are two main components to FaaS: bots and brand impersonation. Neither tactic is entirely new. Fraudsters have been using bots for card-testing attacks for years, and brand impersonation is a classic scheme for phishing credentials and payment data.

Now, though, fraud "service providers" are going farther. Criminals can rent bot networks inexpensively to launch large-scale fraud campaigns against websites and to phish victims. However, two-factor authentication (2FA) can prevent thieves from breaking into accounts even with stolen data. SIM-swapping is one option for getting around 2FA, but it's time consuming and requires planning. So, criminals now offer OTP (one-time password) bot services. Fraudsters can plug in victims' names and financial institutions or favorite stores, and the bot handles the rest – phishing the victim for their one-time password so fraudsters can take over the related account – all for as little as 15 cents per bot call.  

**Detecting and Preventing Fraud-as-a-Service Attacks  
**The best practices that protect businesses from fraud are more important than ever . This is a good time to make sure your organization's anti-fraud program includes these elements:

**1\. Limit data entry attempts and velocity:** One of the telltale signs of a bot attack is the speed at which it moves. Bots can load up carts, check out, and place orders much faster than humans can. They can also repeatedly enter different passwords and one-time codes until they hit a match.

If your website allows customers to make unlimited attempts to enter their data correctly, setting a limit on the number of attempts before they're locked out can protect your store from bots. Likewise, flagging orders for velocity can help to separate busy shoppers who are reordering familiar items from botnets that are programmed to scoop up as many items as they can, as fast as possible.

**2\. Screen every order:** Because there are billions of compromised credentials available to fraudsters now, because FaaS scams are harvesting more credentials, and because FaaS bots can use those credentials to crack accounts at scale, businesses can no longer assume that returning customers are who they appear to be.

That means it's no longer safe to automatically approve orders from known customers. Every order needs to be screened for payment data as well as for device, geolocation, and behavioral biometrics to help validate the customer or flag the order as possible account takeover fraud.

**3\. Run batch analyses to detect fraud at scale:** Bot rental and compromised credentials allow fraudsters to get creative with their attacks on businesses. For example, a gang can target an online store with a spate of orders that appear to come from different customers using different payment methods. Each of these orders may pass muster with the fraud screening solution and get approved.

However, if the merchant also selects random orders for analysis as a group, the fraud solution may find patterns that indicate criminal activity. Maybe that burst of orders from different customers were all shipping to the same address. Or perhaps all of the cards they used to pay had the same bank identification number, indicating that the customers might be synthetic identities. Batch analysis can reveal these issues so that fraudulent orders can be canceled before items ship.

**4\. Avoid automatic declines:** Stopping fraud can only save a company money if it doesn't also stop good customers from completing their orders and coming back for repeat purchases. Automatic declines may seem like a way to save money and time on order decisioning, but this approach typically generates a high rate of false declines. A recent ClearSale five-country survey of online shoppers found that 40% won't ever go back to a website that declines their order. That represents a lot of lost customer lifetime value.

**5\. Use manual review:** The alternative to automatic declines is manual review by fraud specialists, who can distinguish between fraud and unusual but valid customer behavior. Manual review of flagged orders costs more than auto-declines up front, but the ROI includes more approved orders and less customer churn due to false declines.

**6\. Continuously train your ML:** Manual review results can and should feed the automated fraud solution's machine learning algorithms. This helps the AI get better at detecting sophisticated fraud and customer behavior that's not completely normal but also isn't fraudulent. This can result in fewer flagged orders and reduce the need for manual review over the long term.

**7\. Monitor brand mentions:** FaaS schemes often impersonate brands to trick consumers into sharing their credentials and even authentication codes. Every business should keep an eye out for social media accounts, websites, email campaigns, and even SMS campaigns that impersonate their brand. Depending on the channel, a company can report imposters to the platform, Web host, or Federal Communications Commission and alert their customers there's a scam operating under the company's brand.

FaaS shows how fraud continues to evolve, and how the technologies that make life more convenient for customers also make fraud easier for criminals. By understanding how FaaS works and following best practices to prevent it, your business can help protect your customers, your revenue, and your brand reputation.

How Can Your Business Defend Itself Against Fraud-as-a-Service?

Researcher shares how he unearthed newer bugs in Apple's operating system by closer scrutiny of previous research, including vulnerabilities that came out of the Pwn2Own competition.

Sometimes all it takes to root out a new software vulnerability is to study and analyze previous bug reports. That's how researcher Csaba Fitzl says he sniffed out some new Apple macOS vulnerabilities, one of which was a mirror image of a logic flaw that a group of researchers competing in the 2020 Pwn2Own contest found and executed there.

Fitzl, a content developer for Offensive Security, says he reread and studied the winning six-exploit chain that the researchers used to hack macOS. One of the exploits in that chain weaponized a privilege escalation bug, which Apple later fixed. But there still was a hole, and he found it: "Although Apple fixed it properly, but still there was an extra function ... that basically opened up another vulnerability to be utilized a bit differently than the original one," Fitzl explains.

Apple's original fix for the flaw allowed an attacker to change ownership of a directory in macOS. But Fitzl discovered that he could create a new directory on the targeted system, which could allow an attacker to escalate their privileges on macOS. "Although you had to use different techniques to get through to the system, but because you could create an arbitrary directory anywhere on the system, you could elevate your privileges to root," he says.

It was basically the same logic flaw but in a different piece of the code. Apple has since patched the vulnerability Fitzl found as well.

This week at Black Hat Singapore, Fitzl will share technical details of this and two other vulns he found while drilling down on previous vuln research on macOS during a session entitled "macOS Vulnerabilities Hiding in Plain Sight."

Apple had not responded to a request for comment as of this posting.

**'Something Is Not Right'  
**Fitzl says he didn't actually spot traces of the new flaws linked to previous research until after he reread the research papers. "At some point it hit me that there is something not right. It turned out that there is a vulnerability not like the one initially documented," he explains of his findings. "That eventually led to me to find or identify new vulnerabilities."

The other two flaws he found include one that built upon research from Mickey Jin, who discovered a bypass for an Apple patch for the so-called XCSSET malware that targeted Apple's built-in Transparency, Consent, and Control (TCC) privacy and security framework. XCSSET pilfers sensitive user and developer information from applications on a Mac machine.

Fitzl says he noticed an underlying weakness in the TCC framework that would allow an attacker to bypass TCC. He consulted with fellow researcher Wojciech Regula, head of mobile security and principal security consultant at SecuRing, on the issue.

"We found that we can still generically bypass TCC because there was an inherent vulnerability" that came out of the previous research, he says. It was a flaw in TCC that could allow an attacker to bypass the macOS privacy and security framework.

While macOS relies heavily on code-signing and verification of code-signing, Fitzl explains, TCC was not verifying a process that was running but rather verifying binary code on the disk. "This allowed all these abuses by malware," he says. "So we just replaced the binary on the disk and that's it: We could bypass TCC again."

Apple has since fixed the issue, he says.

The third macOS vuln Fitzl found builds off a flaw used in a 2017 Pwn2Own macOS exploit chain: another privilege escalation flaw that Apple later patched in its disk arbitration framework to elevate to root access. Then Fitzl found that the new version of Apple's disk arbitration source code included the "exact same" logic bug that could lead to privilege escalation. "You could use the same logic bug to escape the \[macOS\] sandbox" that keeps applications from getting access to other parts of the machine they don't need, he says.

For example, an attacker could abuse the vulnerability to escape Safari's sandbox and gain broader access across the victim's machine.

**Protecting macOS  
**Fitzl recommends that organizations religiously update their Macs with the latest versions of macOS to keep their endpoints protected from attacks such as these. They should also run anti-malware and endpoint detection and response on their machines.

Known macOS Vulnerabilities Led Researcher to Root Out New Flaws

WannaCry continues to be a reminder of the challenges that organizations face dealing with the ransomware threat.

The ransomware landscape has evolved considerably since WannaCry dramatically drove home the potential severity of the threat five years ago on May 12. What has changed somewhat less over the same period is enterprise preparedness in the face of ransomware attacks. 

Ransomware emerged and has remained entrenched as one of the most difficult security issues for organizations across sectors in the past few years. WannaCry itself, while nowhere near as widespread as it was initially, remains a potent threat and even figured in some vendor lists of top malware threats as recently as last November.

By most accounts, enterprise organizations have gotten better at remediating vulnerabilities and updating obsolete and outdated software. Even so, the vulnerable version of the Server Message Block (SMB) protocol that WannaCry used to spread like wildfire remains in widespread use across organizations and regions. Most attacks against the SMB protocol still attempt to exploit EternalBlue, the exploit that was used in the WannaCry attacks. Patching and vulnerability management programs continue to pose challenges, as do practices such as threat detection, remediation, and response.

Meanwhile, ransomware and the manner in which it is used has changed. Many ransomware attacks these days are highly targeted and involve hands-on tactics for maximum effectiveness. Tools are increasingly becoming multiplatform, meaning they can be used to attack different operating systems. Examples of these tools include Conti, BlackCat, and Deadbolt. 

And the proliferation of ransomware-as-a-service offerings has lowered the barrier to entry for common cybercriminals, even as it has fostered increasingly businesslike hierarchies and processes within the criminal industry. A high percentage of ransomware attacks these days also involve data theft and denial-of-service attacks as additional forms of extortion.

**Alive and Kicking  
**"WannaCry, though not nearly as prevalent of a threat as it once was, is still alive and kicking," says Tessa Mishoe, senior threat analyst at LogicHub. Over the time between its first attacks and now, the ransomware industry has learned from WannaCry's efforts and the responses to it — whether it be new tactics such as auctioning data and blackmailing customers or new techniques like more complex virtual machine escapes and persistence. "Ransomware's increase in market share should be a good indicator of how WannaCry launched more intrigue into ransomware," Mishoe says.

WannaCry surfaced on May 12, 2017, and in a matter of days spread to some 300,000 computers worldwide. Though many have described it as ransomware, one of its main functions was to wipe data clean from infected systems. 

Numerous organizations were affected in the outbreak, including FedEx, Nissan, and, perhaps most notably, the United Kingdom's National Health Service. The US Department of Justice and numerous others have attributed the malware and the attacks to North Korea's Lazarus Group. Over the years, researchers have estimated damages associated with the malware to be more than $1 billion dollars.

The malware spread via a publicly leaked, US National Security Agency (NSA)-developed exploit called EternalBlue that targeted a critical remote code execution vulnerability (MS17-010) in Microsoft's Server Message Block 1.0 (SMBv1) file-sharing protocol. Once installed on a system, WannaCry quickly spread to other devices running a vulnerable SMB version. Most of these were older Windows systems, such as those running on Windows Vista, Windows 7, and Windows 8.1. 

Though Microsoft had issued a patch for the SMB flaw more than a month before WannaCry, millions of computers were unpatched against the problem when the malware hit.

**A Continuing Threat  
**Five years later, attackers are continuing to use the EternalBlue exploit to deploy WannaCry and other malware on enterprise systems.

A recent analysis conducted by Barracuda Networks of attacks over a three-month period shows a staggering 92% of all attacks on SMB port 445 involve attempts to use the EternalBlue exploit. 

"There are still machines out there that have never been patched against these sorts of exploits and likely won't ever be," says Jonathan Tanner, senior security researcher at Barracuda. "So, it's not a lot of work on the attackers' part to try to find and exploit these systems."

Much of this also is due to continued delays in organizations updating their infrastructures. A survey of 500 IT decision-makers by vendor ExtraHop found 68% of respondents admitting to still running SMBv1, even though newer, more secure versions of the file-sharing protocol have been around for years. The company will be discussing the obstacles that companies face in hardening themselves for ransomware attacks at the upcoming RSA Conference (RSAC), in a session aptly entitled, "What Will It Take to Stop Ransomware?"

SMBv1 has been deprecated since 2014, notes Jeff Costlow, ExtraHop's CISO. "I wish it was surprising that 68% of organizations are still running SMBv1, but I see example after example of organizations running outdated, insecure, or unencrypted protocols — either knowingly or unknowingly," he says. The risk is huge, he adds. "SMBv1 doesn’t need to be installed on every device in the environment to be used to launch a catastrophic attack. It only needs to be on one."

Brian Donahue, principal information security specialist at Red Canary, says that, for the most part, organizations are less vulnerable to WannaCry now than they were before. Even so, many organizations still have not updated to MS17-010 and their SMB installations remain susceptible to the EternalBlue exploit, he says. 

"More generally, enterprise patch-adoption lags behind vendor updates, and organizations will always struggle to keep up to date with new software releases," he notes.

Organizations also need to keep on top of cybercriminal innovation. To that end, Red Canary's Katie Nickels, also a SANS Institute director, will be part of a panel during June's RSAC entitled "The 5 Most Most Dangerous New Attack Techniques," which is aimed at highlighting emerging threat vectors for ransomware (and other cyberattacks). 

**A Dominant and Evolving Threat  
**Donahue says ransomware was one of the most dominant threats in 2017 and remains a major threat in 2022. Worm-like ransomware threats have transitioned from being an emergent threat to the de facto standard for ransomware campaigns. Even more than that, the adoption of exfiltration techniques to perform double extortion was uncommon in 2017, but it's extremely common now.

The ransomware industry has evolved in other ways as well since the WannaCry outbreak. Researchers at Bishop Fox who analyzed the threat space recently spotted a trend toward the use of ransomware as a decoy in state-sponsored attacks, cyber warfare, and criminal activity. They noted how WannaCry, NotPetya, and WhisperGate were disk wipers disguised as ransomware that tricked victims into believing they could get their data back if they paid a ransom. 

In the same manner, attackers are using ransomware to distract victims from an attacker's true motives, according to Bishop Fox.

Today's ransomware attacks are also a lot more tailored and customized compared to WannaCry, which spread indiscriminately in automated fashion, says Trevin Edgeworth, red-team practice director at Bishop Fox. He points to DarkSide, the ransomware that hit Colonial Pipeline, as an example of ransomware that is being largely human-deployed and aimed at specific organizations. 

"Whether it is patient information that a healthcare provider maintains, or the continued operation of systems critical to a manufacturing company, today's attacks are tailored and customized to each targeted organization and what is critical to them," he says.

In a report this week, Kaspersky said it had identified recent instances of ransomware groups taking sides in geopolitical conflicts — such as that involving Russia's war in Ukraine. Groups behind the Conti ransomware family, for instance, have allied themselves with Russian interests, while others such as the IT Army of Ukraine are on the opposite side. That alignment could have an impact on targeted organizations.

WannaCry was a wake-up call for many organizations around their patching practices, and it did foster stronger vulnerability management programs. However, many organizations continue to prioritize operating system patching over patching key applications such as Java, Office, and Adobe products that are installed ubiquitously throughout their environment, Edgeworth says.

"Ransomware preparedness starts first with excelling at basic security hygiene, such as secure network architecture, reducing unnecessary attack surfaces, and enforcing least privilege around Active Directory and 'crown jewels' systems," Edgeworth says. "Organizations must have a plan in advance on how to respond to a ransomware attack."

5 Years That Altered the Ransomware Landscape

This year's Black Hat Asia is hybrid, with some sessions broadcast on the virtual platform and others live on stage in Singapore. News Desk is available on-demand with prerecorded interviews.

May 11, 2022 — Like many things since 2020, Dark Reading News Desk has had to adapt. Instead of broadcasting live interviews with security researchers presenting at Black Hat, News Desk shifted to prerecorded interviews with the speakers. 

For Black Hat Asia 2022, Dark Reading News Desk is staying virtual, even as the conference goes hybrid. Black Hat attendees have the option to tune in virtually or attend in person at the Marina Bay Sands in Singapore. Dark Reading News Desk is keeping its virtual format.

News Desk interviewed some speakers presenting at Black Hat Asia 2022 about their sessions. These interviews will be available on-demand at Black Hat Virtual (under the show's "Dark Reading News Desk" tab) and right here on Dark Reading:

**DAY 1: Thursday, May 12**

Speakers from Binarly, Immune GmbH, and Red Hat discuss the complexity of the firmware ecosystem and the challenges of identifying and fixing flaws in hardware devices in "The Firmware Supply-Chain Security Is Broken: Can We Fix It?"

Watch the speakers try to distill the challenges in less than 15 minutes in this News Desk segment:  

No Black Hat is complete without at least one dissection of a cyber espionage operation. SideWinder (also known as RattleSnake and T-APT-04) is an aggressive threat actor that has been active since at least 2012. Details on the techniques and methods used by this advanced cyber espionage team will be part of "SideWinder Uncoils to Strike." Dark Reading editor-in-chief Kelly Jackson Higgins offers a sneak peak in this preview. 

Check out the News Desk segment:  

****DAY 2: Friday, May 13****

Trend Micro researchers discuss their discovery of a botnet infrastructure masquerading as an SMS phone-verified account service in "SMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets."

Watch the News Desk segment on this mobile threat:  

With the Russian invasion of Ukraine in February, the world has had a front-row seat to information warfare. A security expert with experience in security intelligence, policy, and Ukraine dissects what is happening in "The Virtual Battlefield in 2022: Russia-Ukraine War & Its Policy Implications."

Watch this News Desk segment with Very Good Security’s Kenneth Geers:  

It's a fact that every operating system has vulnerabilities, but it still takes many by surprise when there are "macOS Vulnerabilities Hiding in Plain Sight."

Watch Offensive Security's Csaba Fitzl describe what he found:  

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

On the Air With Dark Reading News Desk at Black Hat Asia 2022

Platform powered by policy-based access control (PBAC).

**TEL AVIV and NEW YORK, May 10, 2022 –** PlainID, the Authorization Company™, announces today the production readiness of its highly anticipated “Authorization-as-a-Service,” SaaS-enabled Authorization Platform. Additionally, PlainID introduces its pre-built, third-party “Authorizers,” which allow authorization policies to enforce vital access points across a distributed computing environment, including authorization for API gateways, microservices, and data.

Designed to solve the broad enterprise challenges associated with advanced access control, PlainID’s Authorization-as-a-Service Platform has been architected for scale and the performance demands of the largest global companies.

PlainID helps businesses advance and modernize by simply and securely connecting people with the digital assets they need to do their jobs, accomplish tasks at scale and conduct digital commerce. By making authorization decisions simple, smart, granular, and dynamic, PlainID helps enterprises control who can access what, when and how on whose authority.

“As market adoption for authorization is driven by the convergence of traditional identity and access management and cybersecurity requirements, PlainID has enjoyed tremendous year-over-year growth,” said Gal Helemski, chief technology officer, chief product officer, and co-founder, PlainID. “In the future, we believe that PlainID will be behind every connection between an identity and a digital service: monitoring, securing, and validating it. Authorization is the foundation of security: it’s the last mile that governs what people actually can _do_.”

Powered by policy-based access control (PBAC), leading-edge features include PlainID’s Centralized Management Dashboard, which provides users the ability to create and manage enterprise-wide authorization policies from a central point while maintaining distributed enforcement capabilities. The ready-to-use Authorizers™ included in this preview launch address common authorization patterns for API gateways, microservices, data, and applications.

Today’s organizations are challenged with balancing the demands of secure access controls, frictionless user journeys and data privacy requirements. This product announcement marks a key milestone in PlainID’s growth and documents the relevance of authorization in the modern business.

To learn more, or to become an Early Access program member for PlainID’s Authorization-as-a-Service Platform, contact PlainID or meet with them during the European Cloud and Identity Conference in Berlin, May 10-13, 2022, or Gartner Identity & Access Management Summit in London, May 12-13.

**About PlainID**

PlainID Inc., The Authorization Company™, is the recognized leader of Policy-Based Access Control (PBAC). PlainID’s simple, straightforward solution to authorization management enables organizations to govern, administer and control who can access assets across their digital landscape. PlainID recognizes the frustrations of businesses struggling to understand, incorporate, and best implement Identity and Access Management, and is using Policy-Based Access Control (PBAC) to solve it. The PlainID Authorization Platform enables rapid business growth by connecting new and legacy technologies with the latest and most advanced authorization features.

Source

DARKReading