CrowdStrike Asset Graph provides unprecedented visibility of assets in an IT environment to optimize cyber defense strategies and manage risk.

**AUSTIN, Texas and RSA Conference 2022, SAN FRANCISCO – June 6, 2022 –** CrowdStrike (Nasdaq: CRWD), a leader in cloud-delivered protection of endpoints, cloud workloads, identity and data, today introduced CrowdStrike Asset Graph, a new graph database powered by the CrowdStrike Security Cloud that provides IT and security leaders with a 360-degree view into all assets (both managed and unmanaged) alongside unprecedented visibility into their attack surface across devices, users, accounts, applications, cloud workloads, operational technology (OT) and more to simplify IT operations and stop breaches.

As organizations accelerate their digital transformation, they are expanding their attack surface exponentially. This has dramatically increased their risk exposure to adversaries who are discovering and exploiting these soft targets and vulnerabilities faster than IT and security teams can discover them. Visibility is one of the foundational principles of cybersecurity because you cannot secure and defend the assets you don’t know exist. This, in turn, creates a race between adversaries and companies’ IT and security teams to find these blind spots. According to a 2022 report from Enterprise Strategy Group (ESG), “69% of organizations have experienced a cyberattack in which the attack itself started through the exploit of an unknown, unmanaged, or poorly managed internet-facing asset.”

CrowdStrike Asset Graph solves this problem by dynamically monitoring and tracking the complex interactions between assets, providing a single holistic view of the risks those assets pose. While other solutions simply provide a list of assets without context, Asset Graph provides graphic visualizations of the relationships between all assets such as devices, users, accounts, applications, cloud workloads and OT, along with the rich context necessary for proper security hygiene and proactive security posture management to reduce risk in their organizations.

“Digital transformation has led to an equal and pronounced acceleration of security transformation in the modern enterprise. For companies furthest along on this journey, IT operations and security teams – once distinct silos – are converging, creating a far more proactive posture when it comes to security and risk management,” said Amol Kulkarni, chief product and engineering officer at CrowdStrike. “Built specifically to address this new dynamic, CrowdStrike Asset Graph lets organizations see the assets they have and how they interact with each other, helping them make informed, risk-based decisions – from security to IT performance, utilization, capacity, license management and more – to proactively protect and manage their IT environment.”

**Bridging the gap between IT operations and security**  
The CrowdStrike Falcon platform was purpose-built with a cloud-native architecture to harness vast amounts of high-fidelity security and enterprise data, and deliver solutions through a single, lightweight agent to keep customers ahead of today’s sophisticated adversaries.

CrowdStrike’s groundbreaking graph technologies, which started with the company’s renowned Threat Graph, form a powerful, seamless and distributed data fabric, interconnected into a single cloud – the Security Cloud – that powers the Falcon platform and CrowdStrike’s industry-leading solutions. Using a combination of AI and behavioral pattern-matching techniques to correlate and contextualize information in the vast data fabric, CrowdStrike’s graphs create a “collect data once, reuse it multiple times” approach to solving the biggest problems that customers face. With the introduction of Asset Graph, CrowdStrike is applying this same approach to solving customers’ hardest, unmet challenges with an eye to proactive security, as well as unprecedented IT visibility and risk management.

The three highly-advanced graph technologies underpinning the Falcon platform now include:

*   **Threat Graph:** CrowdStrike’s industry-defining Threat Graph takes trillions of security data points from millions of sensors, enriched by threat intelligence data and third-party sources, to identify and link threat activity together to provide full visibility of attacks and automatically prevent threats in real-time across CrowdStrike’s global customer base.
*   **Intel Graph:** By analyzing and correlating massive amounts of data on adversaries, their victims and their tools, Intel Graph provides unrivaled insights on the shifts in tactics and techniques, powering CrowdStrike’s adversary-focused approach with world-class threat intelligence.
*   **Asset Graph:** With this release, CrowdStrike is solving one of the most complex customer problems today: identifying assets, identities and configurations accurately across all systems including cloud, on-premises, mobile, Internet of Things (IoT) and more, and connecting them together in a graph form. Unifying and contextualizing this information will lead to powerful new solutions that transform how organizations enforce security hygiene and dynamically manage their security posture.

  
CrowdStrike Asset Graph will enable new Falcon modules and features built on top of it to define, monitor and explore the relationships between assets within an organization. The first Falcon module to use Asset Graph is Falcon Discover (Security Hygiene), which includes the following enhancements:

*   **Newly enhanced dashboards, highly customizable filters and sharing options:** IT teams can tailor their experience of Asset Graph’s map visualization and powerful search capabilities, all presented conveniently within the Falcon Discover console.
*   **New third-party data integration with ServiceNow:** Combining this integration with Asset Graph and Falcon Discover, IT teams gain another layer of asset visibility around devices in a single console, providing enhanced monitoring over unmanaged and unsupported assets.

  
“It’s a cliche for a reason. You can’t protect what you can’t see. The first step in wrangling shadow IT or shining a light on blind spots is understanding what assets you have to secure and how those are interacting with unforeseen insecure assets,” said Juan Jose Chang, CISO at Bladex. “We believe that Falcon Discover combined with CrowdStrike Asset Graph will be the difference between using a flashlight versus a row of street lamps to see where you’re going.”

**Additional Resources**

*   For more information on CrowdStrike Asset Graph and enhancements to Falcon Discover, please visit our blog.

  
**About CrowdStrike**  
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with one of the world’s most advanced cloud-native platforms for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.

Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.

Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.

CrowdStrike Introduces CrowdStrike Asset Graph to Help Organizations Proactively Identify and Eliminate Blind Spots

New CrowdXDR Alliance partners include Menlo Security, Ping Identity, and Vectra AI.

**AUSTIN, Texas and RSA Conference 2022, SAN FRANCISCO – June 6, 2022 –** CrowdStrike (Nasdaq: CRWD), a leader in cloud-delivered protection of endpoints, cloud workloads, identity and data, today announced it has expanded the CrowdXDR Alliance to include key strategic partners across web and email security (Menlo Security), identity and access management (Ping Identity) and network detection and response (Vectra AI). CrowdStrike also introduced new capabilities for the Falcon XDR (Extended Detection and Response) module to speed up detections for security teams, including an integration with ServiceNow, an existing CrowdXDR Alliance partner, to dramatically simplify security operations workflows with automated ticket creation.

Falcon XDR’s new capabilities include:

*   **Falcon Fusion workflows based on XDR detections:** Natively integrated with Falcon XDR, Falcon Fusion (CrowdStrike’s SOAR framework) now automates numerous workflows directly from a Falcon XDR detection including:
    *   Ticket creation through ServiceNow, a CrowdXDR Alliance partner.
    *   Notifications through email, Slack or webhook.
    *   Incident details from status changes to team assignments and comments.
*   **XDR detections event timeline:** Speed triage and investigation with a timeline view that displays key events of a detection in chronological order to easily understand how activity progressed.
*   **Graph visualization of custom XDR detections:** Create custom XDR detections from queries written to hunt for threats in the environment. Falcon XDR graph explorer visualizes how the events and entities in a custom XDR detection are related, enabling security analysts to rapidly orient and explore connections in cross-domain data.

  
“CrowdStrike continues to bring together the best of both open and native approaches to XDR,” said Michael Sentonas, chief technology officer at CrowdStrike. “For organizations seeking an open approach, we continue to expand third-party support for the CrowdXDR Alliance, which is delivering a standardized schema for data sharing to enrich XDR detections. We welcome Menlo Security, Ping Identity and Vectra AI to the CrowdXDR Alliance and look forward to partnering with them to deliver third-party integrations. For organizations seeking a native approach, we continue to bolster Falcon XDR with new capabilities that speed up threat detection and response efforts across data sources and environments. Ultimately, we are offering a solution that allows customers to choose an XDR approach that best fits their needs.”

**Partner Quotes**

*   **Poornima DeBolle, Menlo Security co-founder and chief product officer:** “The Internet should be safe, seamless, and effective for all workers. However, cybercriminals are making this difficult by deploying increasingly sophisticated malware, including ransomware fueled by Highly Evasive Adaptive Threats. We need to stop such malware and zero-day exploits from ever getting to endpoints. Menlo Security is excited to join CrowdStrike’s CrowdXDR Alliance. Our integration with CrowdStrike Falcon XDR will enable organizations to offer a safe online experience, without having to sacrifice productivity for security.”

*   **Loren Russon, vice president of product management at Ping Identity:** “We are excited to join CrowdStrike’s CrowdXDR Alliance and continue to expand our joint solutions. Customers are demanding expansive partner ecosystems through easy-to-deploy integrations, and this partnership delivers that through enterprise-proven identity security along with comprehensive visibility and protection against threats.”
*   **Michael Porat, senior vice president, corporate and business development at Vectra AI:** “As the scale and intensity of cyberattacks continue to proliferate, it reminds us that prevention alone cannot protect organizations from today’s cultivated attacks. To successfully mitigate modern security threats, organizations must implement more advanced threat detection and response mechanisms that accurately pinpoint attacker behavior and stop attackers from navigating through hybrid clouds. We are excited to join CrowdStrike’s CrowdXDR Alliance and look forward to sharing our threat detection and response expertise with other esteemed security vendors as we all work together with one common goal – detecting and stopping malicious actors.”

  
**Additional Resources**

*   For more information on the CrowdXDR Alliance and Falcon XDR, please visit our blog.
*   CrowdStrike was named a Strong Performer in The Forrester New Wave for Extended Detection and Response (XDR) Providers, Q4 2021.1

  
**About CrowdStrike**  
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with one of the world’s most advanced cloud-native platforms for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.

Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.

Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.

1 The Forrester New Wave: Extended Detection and Response (XDR) Providers, Q4 2021

CrowdStrike Adds Strategic Partners to CrowdXDR Alliance and Expands Falcon XDR Capabilities

The commission argues that legislative action is needed to ensure a well-functioning market for AI systems that balances benefits and risks.

The European Commission (EC) is currently debating new rules and actions for trust and accountability in artificial intelligence (AI) technology through a legal framework called the EU AI Act. Its aim is to promote the development and uptake of AI while addressing potential risks some AI systems can pose to safety and fundamental rights.

While most AI systems will pose low to no risk, the EU says, some create dangers that must be addressed. For example, the opacity of many algorithms may create uncertainty and hamper effective enforcement of existing safety and rights laws.

The EC argues that legislative action is needed to ensure a well-functioning internal market for AI systems where both benefits and risks are adequately addressed.

"The EU AI Act aims to be a human centric legal-ethical framework that intends to safeguard and protect human rights and fundamental freedoms from violations of these rights and freedoms by algorithms and smart machines," says Mauritz Kop, Transatlantic Technology Law Forum Fellow at Stanford Law School and strategic intellectual property lawyer at AIRecht.

The right to know whether you are dealing with a human or a machine — which is becoming increasingly more difficult as AI becomes more sophisticated — is part of that vision, he explains.

Kop notes that AI is now mostly unregulated, except for a few sector-specific rules. The act aims to address the legal gaps and loopholes by introducing a product safety regime for AI.

"The risks are too high for nonbinding self-regulation by companies alone," he says.

**Effects on AI Innovation**

Kop admits that regulatory conformity and legal compliance will be a burden, especially for early AI startups developing high-risk AI systems. Empirical research that shows the GDPR – while preserving privacy and data protection and data security – had a negative effect on innovation, he notes.

Risk classification for AI is based on the intended purpose of the system, in line with existing EU product safety legislation. Classification depends on the function the AI system performs and on the specific purpose and modalities for which the system is used.

"The legal uncertainty surrounding \[regulation\] and the lack of budget to hire specialized lawyers or multidisciplinary teams still are significant barriers for a flourishing AI startup and scale-up ecosystem," Kop says. "The question remains whether the AI Act will improve or worsen the startup climate in the EU."

The EC will determine which AI gets classified as "high risk" using criteria that are still under debate, creating a list of examples of high-risk systems to help guide judgment.

"It will be a dynamic list that contains various types of AI applications used in certain high-risk industries, which means the rules get stricter for riskier AI in healthcare and defense than they are for AI apps in tourism," Kop says. "For instance, medical AI is \[classified as\] high risk to prevent direct harm to patients due to AI errors."

He notes there is still controversy about the criteria and definition of AI that the draft uses. Some commentators argue it should be more technology-specific, aimed at certain riskier types of machine learning, such as deep unsupervised learning or deep reinforcement learning.

"Others focus more on the intent of the system, such as social credit scoring, instead of potential harmful results, such as neuro-influencing," Kop added. "A more detailed classification of what 'risk' entails would thus be welcome in the final version of the act."

**Facial Recognition as a High-Risk Technology**

Joseph Carson, chief security scientist and advisory CISO at Delinea, participated in several of the talks around the act, including as a subject matter expert in the use of AI in law enforcement and articulating the concerns around security and privacy.

The EU AI Act, he says, will mainly affect those organizations that already collect and process personal identifiable information. Therefore, it will impact how they use advanced algorithms in processing the data.

"It is important to understand the risks if no regulation or act is in place and what the possible impact \[is\] if organizations abuse the combination of sensitive data and algorithms," Carson says. "The future of the Internet is a scary place, and the enforcement of the EU AI Act allows us to embrace the future of the Internet using AI with both responsibility and accountability."

Regarding facial recognition, he says the technology should be regulated and controlled.

"It has many amazing uses in society, but it must be something you opt in and agree to use; citizens must have a choice," he says. "If no act is in place, we will see a significant increase in deepfakes that will spiral out of control."

Malin Strandell-Jansson, senior knowledge expert at McKinsey & Co, says facial recognition is one of the most debated issues in the draft act, and the final outcome is not yet clear.

In its draft format, the AI Act strictly prohibits the use of real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, as it poses particular risks for fundamental rights – notably human dignity, respect for private and family life, protection of personal data, and nondiscrimination.

Strandell-Jansson points out a few exceptions, including use for law enforcement purposes for the targeted search for specific potential victims of crime, including missing children; the response to the imminent threat of a terror attack; or the detection and identification of perpetrators of serious crimes.

"Regarding private businesses, the AI Act considers all emotion recognition and biometric categorization systems to be high-risk applications if they fall under the use cases identified as such — for example, in the areas of employment, education, law enforcement, migration, and border control," she explains.

As such, potential providers would have to subject such AI systems to transparency and conformity obligations before putting them on the market in Europe.

**The Time to Act on AI Is Now**

Dr. Sohrob Kazerounian, AI research lead at Vectra, an AI cybersecurity company, says the need to create a regulatory framework for AI has never been more pressing.

"AI systems are rapidly being integrated into products and services across wide-ranging markets," he says. "Yet the trustworthiness and interpretability of these systems can be rather opaque, with poorly understood risks to users and society more broadly."

While some existing legal frameworks and consumer protections may be relevant, applications that use AI are sufficiently different enough from traditional consumer products that they necessitate fundamentally new legal mechanisms, he adds.

The overarching goal of the bill is to anticipate and mitigate the most critical risks resulting from the use and failure of AI, with actions ranging from banning systems deemed to have "unacceptable risk" altogether to heavy regulation of "high-risk" systems. Another, albeit less-noted, consequence of the framework is that it could provide clarity and certainty to markets about what regulations will exist and how they will be applied.

"As such, the regulatory framework may in fact result in increased investment and market participation in the AI sector," Kazerounian said.

**Limits for Deepfakes and Biometric Recognition**

By addressing specific AI use cases, such as deepfakes and biometric or emotional recognition, the AI Act is hoping to ameliorate the heightened risks such technologies pose, such as violation of privacy, indiscriminate or mass surveillance, profiling and scoring of citizens, and manipulation, Strandell-Jansson says.  

"Biometrics for categorization and emotion recognition have the potential to lead to infringements of people's privacy and their right to the protection of personal data as well as to their manipulation," she says. "In addition, there are serious doubts as to the scientific nature and reliability of such systems."

The bill would require people to be notified when they encounter deepfakes, biometric recognition systems, or AI applications that claim to be able to read their emotions. Although that's a promising step, it raises a couple of potential issues.

Overall, Kazerounian says it is "undoubtedly" a good start to require increased visibility for consumers when they are being classified by biometric data and when they are interacting with AI-generated content rather than real humans or real content.

"Unfortunately, the AI act specifies a set of application areas within which the use of AI would be considered high-risk, without necessarily discussing the risk-based criteria that could be used to determine the status of future applications of AI," he said. "As such, the seemingly ad-hoc decisions about which application areas are considered high-risk simultaneously appear to be too specific and too vague."

Current high-risk areas include certain types of biometric identification, operation of critical infrastructure, employment decisions, and some law enforcement activities, he explains.

"Yet it isn't clear why only these areas were considered high-risk and furthermore doesn't delineate which applications of statistical models and machine-learning systems within these areas should receive heavy regulatory oversight," he adds.

**Possible Groundwork for Similar US Law**

It is unclear what this act could mean for a similar law in the US, Kazerounian says, noting that it has now been more than half a decade since the passing of GDPR, the EU law on data regulation, without any similar federal laws following in the US — yet.

"Nevertheless, GDPR has undoubtedly influenced the behavior of multinational corporations, which have either had to fracture their policies around data protections for EU and non-EU environments or simply have a single policy based on GDPR applied globally," he said. "In any case, if the US decides to propose legislation on the regulation of AI, at a minimum it will be influenced by the EU act."

EU Debates AI Act to Protect Human Rights, Define High-Risk Uses

So-called Symbiote malware, first found targeting financial institutions, contains stealthy rootkit capabilities.

A new malware variant attacking Linux systems that steals credentials and allows for remote access to victim machines camouflages so well that the researchers studying it say they can't conclude if it's being used in targeted or larger-scale attack campaigns.

Security researchers from Intezer and BlackBerry's Research & Intelligence Team say the so-called Symbiote malware is unusual in that it's not a pure executable file: it's actually a shared object library that loads itself into a machine's running processes using the LD\_Preload file in Linux. "Once it has infected all the running processes, it provides the threat actor with rootkit functionality, the ability to harvest credentials, and remote access capability," the researchers wrote in a blog post this week.

Symbiote was first sighted in November of 2021, they said, and at the time appeared to be created for attacking financial institutions in Latin America.

"Once the malware has infected a machine, it hides itself and any other malware used by the threat actor, making infections very hard to detect. Performing live forensics on an infected machine may not turn anything up since all the file, processes, and network artifacts are hidden by the malware. In addition to the rootkit capability, the malware provides a backdoor for the threat actor to log in as any user on the machine with a hardcoded password, and to execute commands with the highest privileges," the researchers wrote.

While detecting the rootkit is a major challenge, the researchers said organizations should watch for anomalous DNS requests. But relying on antivirus and endpoint detection and response tools to detect it is moot: They can be compromised by the rootkit since it's embedded in "userland," the researchers warned.  

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

New Linux Malware 'Nearly Impossible to Detect'

Raytheon Intelligence & Space's Jon Check joins Dark Reading's Terry Sweeney at Dark Reading News Desk at RSA Conference to talk about how hiring must change.

It was tough to find good, experienced security professionals already — then along the came the Great Resignation to make hiring even tougher, notes Jon Check, executive director of cyber protection solutions for Raytheon Intelligence and Space. Check explains how hiring practices must change, as well as new ways to attract new talent and how to encourage a better work-life balance among SOC personnel.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

A Few Simple Ways to Transform Your Cybersecurity Hiring

‘Zero trust’ architecture and secure supply chains to the fore in new strategy

‘Zero trust’ architecture and secure supply chains to the fore in new strategy

The US Department of Justice (DoJ) has set out a three-year strategic plan to bolster its cybersecurity posture among other priorities for improving its IT skills, systems, and processes.

Other overarching objectives set out in the Information Technology Strategic Plan for Fiscal Years 2022-2024 center on enhancing service delivery, embracing innovation, expanding the workforce, and increasing financial transparency.

The DoJ says the strategy was made in response to increasingly sophisticated cyber threats posed by foreign intelligence services, criminal groups, hacktivists, and insider threats.

Other cited influences were changing user expectations, growing technology complexity, a need to optimize resources, and the pandemic-fuelled demand for distributed workforce operating models.

**Securing the supply chain**

The cybersecurity strategy is made up from four strands, including proactively managing IT supply chain risk throughout the IT lifecycle via two key initiatives.

The first initiative, said the agency, involves developing “a thorough, comprehensive, and continuous understanding of its vendors and the software and hardware being used across the Department” – in particular for the “most mission-critical supply chains”.

RECOMMENDED HTTP/3 evolves into RFC 9114 – a security advantage, but not without challenges

This will help the DoJ “comply with the federal government-wide initiative to require a Software Bill of Materials (SBOM)”, which provides visibility of components used in software and the vulnerabilities lurking therein.

Armed with an SBOM, the agency can then “develop an enterprise-wide view to monitor IT supply chain risk” by “leveraging existing tools like SPDR \[Security Posture Dashboard\] and creating new ones, where needed”.

Existing processes for IT Investment and Acquisition Review (ITAR), meanwhile, will be modified “to ensure we can identify IT procurements with elevated supply chain risk early in the acquisition process”.

**Don’t trust, verify**

The DoJ will also reinforce its ‘cybersecurity foundation’ by enhancing asset inventory management, modernizing monitoring and management of internet traffic, and focusing “more heavily on the continuous assessment of public-facing applications and systems for exploitable vulnerabilities”.

A third pillar of the strategy focuses on adopting zero trust principles and tools to combat access-based threats.

Read more of the latest government security news

Doing so “removes the concept of implicit trust and instead requires a contextual approach that includes the application, user, and device to allow for access decisions to adjust based on the context of the user”, explained the DoJ.

Among other things, the agency plans to reduce more than 20 current ‘identity providers’ (IdPs) to a single provider in order to promote consistent security standards and reduce the administrative burden.

The final infosec pillar focuses on enhancing cloud security to support the DoJ’s growing adoption of cloud-based technolgies. This will involve centralizing and streamlining cloud monitoring to drive analytics for identifying and managing cybersecurity risks and implementing an SPDR.

**Presidential priorities**

The DoJ says its IT vision has been aligned to priorities set out in the President Biden’s Management Agenda and cybersecurity-oriented Executive Order signed last year, as well as its own Comprehensive Cyber Review.

“Cyber-attacks are constantly challenging DoJ and other agencies,” says Melinda Rogers, the DoJ’s chief information officer and deputy assistant attorney general.

“Therefore, we will continue to diligently protect the agency’s critical data through increased cyber resilience and risk reduction while optimizing data utilization to create consumable and intelligent products.”

The DoJ’s strategy comes as fellow US government agencies the FBI and Cybersecurity and Infrastructure Security Agency (CISA) have warned that “publicly known” but often unpatched vulnerabilities – as opposed to previously unknown (zero-day) flaws – are increasingly prioritized targets for Chinese threat actors.

YOU MIGHT ALSO LIKE Chinese cyber threat actors are widely abusing well-known attacks to infiltrate networks, CISA warns

US Justice Department offers blueprint for more ‘innovative, secure IT capabilities’

Next-generation AI products learn proactively and identify changes in the networks, users, and databases using "data drift" to adapt to specific threats as they evolve.

In March 2019, Norsk Hydro, a Norwegian renewable energy and aluminum manufacturing company, faced a ransomware attack. Rather than paying the ransom, a cybersecurity team used artificial intelligence to identify the corruption in the computer system and rebuild the operations in an uncorrupted parallel system. LockerGoga ransomware was eventually identified as the culprit, which spread via Windows-based systems. While Norsk avoided paying the ransom, the attack still forced it to operate without computer systems for an extended period of time (weeks to months), while the security team isolated and scanned thousands of employee accounts for malicious activity.

Signature-based detection is an approach in which a unique identifier is established about a known threat so that it can be identified in the future. However, signature-based approaches require continuous updates that take time and effort to maintain. Next-generation artificial intelligence (AI) products learn proactively and identify changes in the networks, users, and databases through what is called data drift to adapt to specific threats as they evolve.

AI products are the linchpin of a multifaceted defense system that can be utilized in the background prophylactically, especially against unknown threats. Cyberattacks that make the evening news are usually the ones that end in disaster; it is hardly ever reported how AI could have prevented those attacks in the first place. In addition, cyberattacks that are contained or thwarted on a daily basis, while AI is ubiquitously at work, are almost never reported in the news because they happen so frequently.

Unfortunately, as a result of the lack of coverage on these "non-events" in public forums, most people don't understand how AI makes an effective cyber defense achievable and not just theoretical. Here is what you should know.

**Deep-Learning Next-Generation AI Tools**

Data drift is a term used to measure changes in underlying data patterns. A typical example would be if an e-commerce business launched a new payment gateway to sell furniture. In this instance, BECS direct deposit might be a new financial term introduced in the business workflow. BECS, or Bulk Electronic Clearing System, governs how direct debits, automatic payments, bill payments, and direct credits work and how a range of bulk electronic transaction types are made between its participants.

Deep-learning AI models can detect the term and, with minimal human assistance, classify it as a financial transaction. Next-generation AI then can monitor financial transaction data flows and correlate the data accordingly, associating it with financial context and sensitivity.

The financial data monitoring can involve, for example, an application programming interface while the user checks out via online shopping cart or even general business flow. The advantage of the auto-detection approach is that a security team doesn't need to be on the lookout for new vulnerability patches for these terms. Instead, the security team can rely on AI to recommend new data patterns and self-patch accordingly.

A successful effort to thwart phishing attacks that endangered Stanford University can be used as an illustration. WannaCry ransomware threatened campus systems, but the university's self-patching AI software, in addition to its firewall protections and email security solutions, prevented the threats from successfully escalating.

Data transformers are one of the AI tools used to auto-discover and classify data patterns. A transformer model memorizes and tracks relationships between changes in data attributes to create contextual insights. It is similar in many ways to how a human brain works when reading a book. Although you often do not understand a character's role in the story or their relationships with the other characters when they first appear, you gain that knowledge as the story develops.

Data transformers use attention-based mechanisms constantly learning in the same way to gain a greater understanding of networks, files, emails, etc., and how the content of data relate to and interact with each other to identify and classify malicious changes. The text is represented by mathematical datasets, which derive data representations that can be later used to quantify the changes in data as it is being processed by a transformer.

Deep-learning models can also be used for behavioral purpose classification, which assist security teams with efficiently identifying sensitive or harmful content. An AI transformer model uses its understanding of natural language to analyze email data it has never been exposed to, such as credit offers, lottery ticket promotions, employment offers, or COVID test results, in order to classify and identify malicious content. Similar mechanisms can be used to identify malicious content in documents containing employee health information even though the AI model had never analyzed any kind of healthcare data before. The transfer model proactively alerted security teams regarding the sharing of sensitive data before a breach occurred.

**What This Means for Your Business**

Not only is it important to ensure that cybersecurity systems are in place to defend against and prevent threats, but it's also important to have the right one that synthesizes with your business's needs. Manual document classification for documents, emails, and text messages is complex and requires technical expertise. Deep-learning transformers simplify those tasks, and if done right, can be leveraged efficiently to save costs and effort.

However, an AI model with incorrect settings can result in false positives, and in turn, generate too many alerts, creating headaches for security teams. As a result, one should always seek expert advice when selecting products with AI components. The next-gen AI tools will be able to automate your business processes with minimal setup, human intervention, rules, and policies.

Artificial Intelligence and Security: What You Should Know

Cloud migration, DevSecOps, cyber insurance, and more have emerged as important motivators for cybersecurity investment and focus.

RSA CONFERENCE — San Francisco — Security hygiene and software supply-chain/vendor risk have emerged as the top two security priorities for chief information security officers (CISOs) at medium-sized organizations, new research has revealed.

That's according to Forgepoint Capital, which surveyed CISOs across a spectrum of industries and sizes. For organizations with 50 to 1,000 employees, security hygiene is seen as particularly critical, according to the data.

"Most breaches are due to unpatched systems, misconfigurations, poor passwords, and other easily avoidable issues," the report, shared with Dark Reading at the 2022 RSA Conference this week, pointed out. "Typically, organizations of this size don’t have the budget to build multiple backups and failovers, with real scenarios where a security incident can put the company out of business."

That said, there was notable variance across industry segments. For instance, zero percent of respondents in the healthcare vertical cited security hygiene as a priority.

"It's not that they think that nurses don't need to worry about passwords," says Will Lin, managing director of Forgepoint. "It's that security responsibility is much more distributed than in other industries. If I'm, say, BlueCross BlueShield, I can't control the password requirements and security hygiene of all the subsidiaries I have. It's each one's own responsibility to do it. I have to prioritize what I can actually solve."

There's a different narrative for professional services firms, where more than 80% said security hygiene is a top focus.

"They're exactly the opposite from healthcare," Lin says. "They're responsible for the security of all their consultants. These are all my employees, I need to do it. So that's why it becomes the highest priority for this group."

**Cybersecurity Workforce Shortage**

Meanwhile, CISOs at organizations with less than 50 employees cited talent development and social-engineering awareness as their top two priorities, with the ongoing cybersecurity workforce shortage of particular concern.

"Talent departure and social-engineering attacks can have major ramifications," according to the report. "Due to the small size of their employee base, these companies can realistically affect more change by focusing on human capital than a large organization can. As companies grow larger, no matter how much access control is established, threat vectors will remain. Thus, the focus shifts from personnel to security automation and incident response."

When examining CISOs' views of security prioritization by industry, the survey found that all security professionals prioritize areas with the highest return on investment (ROI). For example, 50% of professional services companies marked security hygiene as an essential focus, but healthcare professionals are focused more on the software supply chain and third-party vendor risk, such as the security of connected medical devices, given its bigger tie to ROI in their field.

**Cloud Migration and Digital Transformation**

Forgepoint also found that cloud migration is driving security prioritization for medium-sized businesses in particular, with 73% of survey respondents noting that it's a factor in 75% or more of their efforts. In contrast, just 13% of very large businesses (more than 10,000 employees) and 43% of large businesses (1,000 to 10,000 employees) said the same. For businesses with fewer than 50 employees, half of them said the move to the cloud is driving 75% of their security choices.

"Very large companies, surprisingly enough, are actually the furthest behind cloud migration," Lin tells Dark Reading. "And the smaller companies are further along in cloud migration. The big companies have a lot of legacy infrastructure, so it's going to take them a much longer time to move to the cloud, while smaller companies are more cloud native, and they're trying to cut costs, which the cloud helps with."

Digital transformation also emerged as a top security motivator for CISOs in every industry except for professional services — likely due to the ongoing reality of remote working forcing businesses to embrace software-as-a-service and other corporate working apps.

This is driving a new security focus on securing application programming interfaces (APIs, cited by 62% of all respondents) and DevSecOps for embedding security into application development (cited by 54%).

**Areas of Control and Cyber Insurance**

Survey respondents said traditional access control areas like data security (40%) and identity (41%) are still top priorities for organizations. But more than a quarter (28%) of CISOs highlighted an emerging area, cyber insurance, as a top control area of interest.

With ransomware, malware, APTs, and other cyberattacks at all-time highs, organizations of all sizes are considering investing in cyber insurance — however, it's a painful process, Lin says, especially as many insurance firms don't cover ransomware incidents, and the application process can be onerous and dictate where precious security dollars are invested.

"The cost of cyber insurance is going up, and the coverage is going down," Lin says. "And perhaps most of all, the questionnaires that cyber insurance companies give companies to fill out in order to determine how expensive coverage will be don't provide a representational picture of how good of a bet insuring a company is."

For instance, many require companies to have multifactor authentication (MFA) on all accounts in order to qualify for affordable coverage — but its across-the-board implementation at the expense of other efforts (patching, for instance) may not be the best approach for defending the business.

"Companies themselves often don't know how effective their controls are, so how could a cyber insurance underwriter be predictive?" Lin says. "If the question is, do you have an MFA on everything, companies can never check yes to that. Because there are some places where you can't have MFA. It's just not physically possible. Or, in some cases the app that's doing all the authentication might not have an MFA feature enabled. So they have to click no, and when they do, they immediately see a premium increase."

Meanwhile, just 24% of all respondents cited monitoring threat intelligence as a priority — which is a function of it being perceived as difficult to operationalize, Lin says.

"The key issue is, even like organizations like Google have no idea what to do with all of the telemetry and data," Lin said. "Companies simply have a tough time figuring out what to do with their threat intel — it's just the actionability of it."

Overall, the survey also found that three-quarters (76%) of CISO survey respondents say they expect security budgets to increase this year.

"As cybersecurity budgets increase, it’s expected that budgets will become more flexible to accommodate new and emerging products that defy the limitations of the currently identified categories," Forgepoint concluded.

In a Quickly Evolving Landscape, CISOs Shift Their 2022 Priorities

The dangerous malware appears to be well and truly back in action, sporting new variants and security-dodging behaviors in a wave of recent phishing campaigns.

The dangerous malware appears to be well and truly back in action, sporting new variants and security-dodging behaviors in a wave of recent phishing campaigns.

Emotet’s resurgence in April seems to be the signal of a full comeback for what was once dubbed “the most dangerous malware in the world,” with researchers spotting various new malicious phishing campaigns using hijacked emails to spread new variants of the malware.

The “new and improved” version of Emotet is exhibiting a “troubling” behavior of effectively collecting and using stolen credentials, “which are then being weaponized to further distribute the Emotet binaries,” Charles Everette from Deep Instinct revealed in a blog post this week.

“\[Emotet\] still utilizes many of the same attack vectors it has exploited in the past,” he wrote. “The issue is that these attacks are getting more sophisticated and are bypassing today’s standard security tools for detecting and filtering out these types of attacks.”

In April, Emotet malware attacks returned after a 10-month “spring break” with targeted phishing attacks linked to the threat actor known as TA542, which since 2014 has leveraged the Emotet malware with great success, according to a report by Proofpoint.

These attacks—which were being leveraged to deliver ransomware—came on the back of attacks in February and March hitting victims in Japan using hijacked email threads and then “using those accounts as a launch point to trick victims into enabling macros of attached malicious office documents,” Deep Instinct’s Everette wrote.

“Looking at the new threats coming from Emotet in 2022 we can see that there has been an almost 900 percent increase in the use of Microsoft Excel macros compared to what we observed in Q4 2021,” he wrote.

**Emotet Rides Again**

The attacks that followed in April targeted new regions beyond Japan and also demonstrated other characteristics signaling a ramp-up in activity and rise in sophistication of Emotet, Deep Instinct noted.

Emotet, like other threat groups, continues to leverage a more than 20-year-old Office bug that was patched in 2017, CVE-2017-11882, with nearly 20 percent of the samples that researchers observed exploiting this flaw. The Microsoft Office Memory corruption vulnerability allows an attacker to perform arbitrary code execution.

Nine percent of the new Emotet threats observed were never seen before, and 14 percent of the recent emails spreading the malware bypassed at least one email gateway security scanner before it was captured, according to Deep Instinct.

Emotet still primarily uses phishing campaigns with malicious attachments as its transportation of choice, with 45 percent of the malware detect using some type of Office attachment, according to Deep Instinct. Of these attachments, 33 percent were spreadsheets, 29 percent were executables and scripts, 22 percent were archives and 11 percent were documents.

Other notable changes to Emotet’s latest incarnation is its use of  64-bit shell code, as well as more advanced PowerShell and active scripts in attacks, according to Deep Instinct.

****History of a Pervasive Threat****

Emotet started its nefarious activity as a banking trojan in 2014, with its operators having the dubious honor of being one of the first criminal groups to provide malware-as-a-service (MaaS), Deep Instinct noted.

The trojan evolved over time to become a full-service threat-delivery mechanism, with the ability to install a collection of malware on victim machines, including information stealers, email harvesters, self-propagation mechanisms and ransomware. Indeed, Trickbot and the Ryuk and Conti ransomware groups have been habitual partners of Emotet, with the latter using the malware to gain initial entry onto targeted systems.

Emotet appeared to be put out of commission by an international law-enforcement collaborative takedown of a network of hundreds of botnet servers supporting the system in January 2021. But as often happens with cybercriminal groups, its operators have since regrouped and seem to be working once again at full power, researchers said.

In fact, in November 2021 when Emotet emerged again nearly a year after it went dark, it was on the back of its collaborator Trickbot. A team of researchers from Cryptolaemus, G DATA and AdvIntel separately observed the trojan launching a new loader for Emotet, signaling its return to the threat landscape.

Potent Emotet Variant Spreads Via Stolen Email Credentials

By Owais Sultan
Hyperconverged infrastructure is changing the way data centers work for the better. Learn about the benefits of hyperconverged…
This is a post from HackRead.com Read the original post: Hyperconverged Infrastructure (HCI) is Changing Data Centers

****Hyperconverged infrastructure is changing the way data centers work for the better. Learn about the benefits of hyperconverged infrastructure.****

Every year there is a huge number of technological reforms and upgrades that can make life easier for both individuals and companies. Sometimes, large-scale changes also affect the data processing centers.

If even more than 10 years ago data center managers worked with traditional infrastructure familiar to everyone, then in recent years there have been big changes. These changes were the use of networks that provide both speed and availability (software-defined networks), a distributed information technology architecture in which customer data is processed at the edge of the network, as close as possible to the source (edge computing), the fifth generation of mobile communications, as well as artificial intelligence. 

Such technologies imply a major transformation in how data centers operate. However, the most important thing is that qualified specialists are needed to work with such technologies, which means higher requirements for data center managers. They must be able and know how to work with such innovative solutions, and explore and customize them. It would seem that the use of technology should be beneficial, but for people working with such innovations, this becomes a challenge. 

That is why the latest technology has been developed that promises to solve all these problems. 

**Table of Contents:**

1.  **Hyperconverged Infrastructure** 
2.  **Converged Infrastructure** 
3.  **Key Benefits of HCI**

**Hyperconverged Infrastructure **

Before describing all the advantages of technology, it is worth considering the hyperconverged infrastructure definition. HCI is a distributed infrastructure platform that combines servers, networks, and storage with sophisticated software to produce adaptable key components that may improve existing infrastructure.

The consistent building pieces required to establish a hyperconverged infrastructure can be acquired as a mix of electronic, electrical, and mechanical hardware or as virtual stacks.

Such an infrastructure consists of standard components: servers running on the x86 architecture, software for creating, running, and managing virtual machines, and special software needed for management.

The beauty of a hyperconverged data center is that if you need more processing power, you can easily scale the process. All you need to do is attach a few extra boxes, depending on how much you need to scale everything. Thus, each organization gets a great opportunity to improve the processing centers of HCI data. 

It is already clearly visible how quickly the demand for the creation of such data centers is growing. 3 years ago, the global market for such products and services was estimated at over $6 billion. In 5 years, it will be valued at more than $22 billion. Companies now must cut information technology expenses, drastically speed up the building of data centers, manage numerous operations, and grow swiftly.

**Converged Infrastructure **

There existed a converged infrastructure prior to the introduction of such an upgraded infrastructure. It comprises pre-engineered equipment and programs that professionals may purchase and install independently. In short, it’s like an IKEA crib. You get a set of ready-made components that you need to combine to get the finished product. That is, you get components that will be compatible with each other. You do not need to search for suppliers for each component to separately assemble everything you need. 

Hyperconverged infrastructure is a more advanced CI. This infrastructure already contains all the necessary components that you can work with. In simple words, if CI is an IKEA crib that needs to be assembled, then HCI is a prepackaged meal that you just need to heat.

If you use a similar infrastructure in your data center, then to increase the capacity, you only need to order more infrastructure units. Easy and simple scalability allows multiple companies to increase the volume of data processing, as well as quickly adapt to new company needs. 

**Key Benefits of HCI**

Scalability is the most important advantage of HCI. However, this is not all that such an infrastructure can offer. 

**Low-cost hyperconverged infrastructure units **

HCI requires x86 servers, which are installed in most modern data centers. Thus, companies do not need to spend money to buy the necessary servers. In addition, every time there is a need to add capacity, companies need to buy only one type of device instead of a huge variety of different devices. They can be purchased from a single supplier, which reduces the time of purchase and implementation.

In addition, if necessary, if there are difficulties with installation or updates, then you only need to seek technical assistance from one vendor instead of working with many different vendors. 

**Remote control **

Infrastructure components are handled as services in a software-defined data center. They can be managed and configured remotely, which greatly facilitates the work of managers. At any time of the day or night, managers can quickly reduce or increase the amount of storage, and memory, adjust computing power, as well as all the necessary resources. This means that managers will be able to update all resources used as soon as it is needed.  

**Achieving the greatest efficiency of all processes **

All used infrastructure resources are combined into clusters. If you need more memory for a particular process or application, or need more storage capacity and compute power, you can quickly identify those resources that aren’t already being used to provide what you need. With unified management, managers can quickly discover these resources, pool them together, and make them available for process or application execution when needed. 

**Integrated management **

You only need a single console to manage all the processes. Local and remote clusters can be managed from one place. Thus, the entire management process is greatly simplified. 

Companies operating in the field of IT have a chance to reduce the costs of IT departments, as well as increase their productivity. The work of specialists is facilitated since it is no longer necessary to think about how to deploy a system, integrate it, and separately maintain each component while solving other problems associated with managing the center. 

There is no need to expand the staff, as well as to attract consultants who charge a lot for their work. If your staff has generalists, then they will be able to do most of the work without help. 

**Conclusion **

There are many benefits to implementing hyperconverged infrastructure in your data center. The first and most important is the speed and ease of scaling, which is low cost. In addition, all processes can be controlled remotely using a single console. Achieving the greatest efficiency of all processes occurs quickly if necessary.

1.  Why Data Security is crucial?
2.  Big Data and Cybersecurity: Opportunity or Threat?
3.  How big data analytics helps enterprises improve cybersecurity
4.  Top Data-Driven Methods for Improving Your Investment Decisions
5.  Cybersecurity, Big Data & Automation Tools: What Marketers Need To Know

Tag

#intel