Connect with us

Cyber Security

Global Affairs Canada Hit by Cyberattack

Published

on

Global Affairs Canada Hit by Cyberattack




canada

Unknown cybercriminals targeted Canada’s foreign ministry Global Affairs Canada (GAC), in a cyberattack. The incidents affected certain critical services and disrupted some online services temporarily.

“Critical services for Canadians through @GAC_Corporate are currently functioning. Some access to the Internet and internet-based services are not available as part of the mitigation measures, and work is underway to restore them. There is no indication that other departments have been impacted by this incident. There are systems and tools in place to monitor, detect, and investigate potential threats, and to take active measures to address and neutralize them when they occur,” said a statement from Canada’s Treasury Board

Investigation is Ongoing

While the officials did not mention the attackers behind the security incident, the security officials stated that a probe had been initiated to find the details.

Also Read: Canada Revenue Agency Shut Down Services after Cyberattacks

“This investigation is ongoing. We are unable to comment further on any specific details for operational reasons. Our cyber defense and incident response teams work 24/7 to identify compromises and potential alert victims within the GC and Canadian critical infrastructure. The incident response team offers advice and support to contain the threat and mitigate any potential harm,” the statement added.

Canada’s Cybersecurity Guidance

The cyberattack news comes immediately after the Canadian Centre for Cybersecurity warned critical infrastructure operators to raise awareness and take mitigations against known Russian state-sponsored hackers.

The Cyber Centre urged Canadian critical infrastructure network defenders to:

  • Be prepared to isolate critical infrastructure components and services from the internet and corporate/internal networks if those components would be considered attractive to a hostile threat actor to disrupt. When using industrial control systems or operational technology, perform manual controls to ensure that critical functions remain operable if the organization’s network is unavailable or untrusted.
  • Increase organizational vigilance. Monitor your networks, focusing on the TTPs reported in the CISA advisory. Ensure that cybersecurity/IT personnel are focused on identifying and quickly assessing any unexpected or unusual network behavior. Enable logging to better investigate issues or events.
  • Enhance your security posture: Patch your systems with a focus on the vulnerabilities in the CISA advisory to enable logging and backup. Deploy network and endpoint monitoring (such as anti-virus software), and implement multifactor authentication where appropriate.
  • Have a cyber incident response plan, a continuity of operations, and a communications plan, and be prepared to use them.
  • Inform the Cyber Centre of suspicious or malicious cyber activity.






Source link

Cyber Security

In-house vs. Outsourced Security: Understanding the Differences

Published

on

Cybersecurity is not optional for businesses today. Ignoring security can result in a devastating breach or a productivity-sapping attack on the organization. But for many small- and medium-sized businesses (SMBs), the debate often revolves around whether to hire a third party or assemble an in-house security operations team.

Both options have their own pros and cons, but SMBs should weigh several factors to make the best decision for their own unique security needs. An in-house team, a managed security services provider (MSSP), or even a hybrid approach can make sense for various reasons.

Before choosing to build an in-house security team or outsource to an MSSP, businesses must first evaluate their unique needs to ensure the choice lays a foundation for future success.

Weighing control vs. costs

The obvious reason for assembling your own security team is control and immediate knowledge of what goes into your security operations.

“Handling security internally means you will sometimes have better visibility and centralized management,” says Scott Barlow, vice president of global MSP and cloud alliances at Sophos. “That said, if you outsource with the right service provider, visibility into what is going on should not be an issue.”

For many smaller organizations, the cost of running an in-house security program is prohibitive. Hiring skilled security specialists is expensive, and they are often difficult to find. They require regular training, and certifications must be kept fresh – typically at a cost to the employer.

“When you outsource to an MSSP, you will be paying a lot less than paying a senior security executive,” Barlow says. “I suggest that organizations conduct a cost analysis of outsourcing compared to paying salaries. Much of the time, it’s better to outsource.”

There are also technology and license costs to consider. Keeping software licenses up to date can consume both time and money, whereas working with an MSSP means access to the latest technology without worrying about license costs.

If both are important, try a hybrid model

Of course, some large organizations might need an in-house security presence.

“Generally, the larger you become, the more you need someone internally. That is where a co-managed model makes the most sense,” Barlow says.

In a hybrid model, companies tap outside support to collaborate with an internal security executive or team. This approach allows for more scalability while also providing the business with plenty of expertise through their relationship with the MSSP.

“Maybe you want to outsource a portion of the services because you can’t cover 24-7. Or maybe you need coverage on weekends,” Barlow says.

One major benefit to tapping outside support: your in-house team will have more time to focus on mission-critical objectives.

“With a hybrid approach, the internal IT and security teams can pivot to focus on more revenue generating activities,” Barlow says.

Click here to learn more.

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Cyber Security

Prevention or Detection: Which Is More Important for Defending Your Network?

Published

on

When it comes to physically protecting a building, you have two primary defenses: prevention and detection. You can either prevent people from entering your property without your permission, or you can detect when they have already trespassed onto your property. Most people would prefer to prevent any trespassing, but a determined adversary is always going to be able gain access to your building, given enough time and resources. In this scenario, detection becomes the only alternative.

The same holds true for protecting assets in the digital world. We have the same two primary defenses: prevention and detection. And just like in the physical world, a determined adversary is going to gain access to your digital assets, given enough time and resources. The question will be: How quickly are you able to determine that an adversary has penetrated your network?

If you can’t prevent, you must discover

This is where detection comes in. Do you have the right tools and procedures in place to find attacks quickly when they are occurring? Most businesses do not. It takes days, weeks, and often even months before an attack is discovered. The gap between breach and discovery is known as dwell time, which is estimated to be more than 200 days in most cases and, according to IBM, as many as 280 days in some instances. If it takes this long to discover that an attack is in process, it may be impossible to determine the root cause if you don’t have enough historical data to review.

Therefore, it is just as important, and maybe even more important, to spend money increasing your ability to detect when a breach has occurred rather than to determine when a breach is actively occurring or to see that specific firewall (FW) or intrusion detection system (IDS) rules have actively prevented an attack. New attacks are taking place all the time, and bad actors are constantly coming up with new ways of infiltrating your network. It is important to understand that, at some point, a bad actor is going to get through and penetrate your network. What will be vitally important is whether you are able to see the attack when it is taking place, or shortly after, or whether instead the attack will be discovered weeks or months after the fact. In the latter case, do you have enough historical data to go back and determine when the attack started, or will that data be long gone by the time you notice something is wrong?

Saving the data you need

It is important to have several months’ worth of data so that you can go back and determine the initial compromise on your network. Having an advanced network detection and response (NDR) tool such as NETSCOUT’s Omnis Cyber Intelligence (OCI) can ensure that you have the data you need. OCI stores all of the relevant information, including layer 2-7 metadata and packets that you need to determine the root cause of an attack—not just flow data that won’t help in this situation.

How much historical network traffic are you storing? Do you have enough data to go back and research the start of an attack if it occurred 200 days ago? Or are you going to rely on catching bad actors faster than the industry average? It is important to understand the need for leveraging both prevention and detection capabilities and ensuring that you have enough storage to thoroughly investigate an attack when it occurs.

Watch this video to see how NETSCOUT can help your back-in-time investigation.

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Cyber Security

Want to Help Your Analysts? Embrace Automation and Outsourcing.

Published

on

While the security tools we choose to invest in can undoubtedly make or break our success, one area we tend to focus less on is the human component of cybersecurity. Yet today, two-thirds of global leaders claim that the global skills shortage creates additional cyber risks for their organization, including 80% who reported experiencing at least one breach during the last 12 months that they attributed to the cybersecurity skills gap.

The always-changing threat landscape, with fewer skilled people makes it nearly impossible to keep ahead of threats. That’s why it’s time to talk about the human element – specifically your Security Operations Center (SOC) analysts – and their role in your cybersecurity framework.

Helping the Humans in Your Security Stack: Enhance, Automate, and Outsource

When you consider your security stack, you probably immediately think of the technology you use. And you’re likely already consuming these as a service. Security vendors operate, maintain, and improve critical security capabilities for the tech you use, keeping those tools tuned to be resilient against the latest threats so your team can focus on more critical tasks.

But what about the people? They’re just as much a part of your security stack as any firewall, endpoint, application, devices, or sandboxing tool. But there’s likely less of a roadmap for their continual improvement. Your analysts are playing a constant catch up game with alerts, which leaves no time for professional development. You’ve probably considered evaluating which tasks the SOC performs that you could automate or outsource, but a lengthy list of other to-dos often means that process improvements get deprioritized.

If your team is overwhelmed, you’re not alone. Here’s the good news: You can take steps to strengthen your organization’s security posture while simultaneously reducing your analysts’ workloads (and lowering the chances that they’ll burn out).

The first is to enhance their capabilities by choosing the right technology and making time for training when possible. Next is to automate many of your team’s processes to improve accuracy, mean time to detection (MTTD), and mean time to remediation (MTTR). Lastly, there are simply some aspects of cybersecurity you’ll want to outsource to keep your team focused on the most critical tasks.

Enhance Their Capabilities with the Right Technology and Training Opportunities

If you’re like most of us, your SOC teams are heads-down sifting through alerts, logs, and tasks. They find it challenging to find the time to stay sharp as they’re focused on the evolving threat landscape and supporting (and improving) your organization’s security posture.

That said, practice – even if done every few months ­– will make your team better and faster in responding to attacks. Make the time for it. Build and test your processes and playbooks, and then allocate time for tactical training sessionsbased on real-world attacks. Consider partnering with an outside organization to help hone skills and provide additional insights into potential security gaps. Also, take advantage of onboarding and training programs that support short learning curve objectives.

Automate Processes to Improve Accuracy and Efficiency

The goal of every cybersecurity leader today should be to establish a unified security framework across the entire organization that prioritizes synergetic systems and centralized processes to deliver ML-powered automation. If you’re just starting with automation, looking within your team and identifying repetitive processes that may benefit from automation is a good jumping-off point. Consider log review, bot activity monitoring, and initial alert triage for starters.

Remember that AI and ML are only as good as the data they’re trained on and the people who teach and optimize them. When engaging with vendors offering ML-powered solutions, you must look inside the organization and figure out who’s designing their models. What datasets are they working with? What AI training models do they use? Ensure that the processes and automation used to gather, process, identify, and respond to incidents are trustworthy. 

Outsource to Improve (or Redirect) Your Team’s Focus

The current intensity we see across the threat landscape, both in velocity and sophistication, means we all need to work harder to stay on top of our game. But that can only get you so far. Working smarter means outsourcing certain tasks – like incident response and threat hunting – so your team can refocus on other strategic priorities.

This is why relying on a Managed Detection and Response (MDR) provider, Incident response (IR) or a SOC-as-a-service offering is helpful. Such enhancements are a critical way to eliminate noise, help your team focus on their most important tasks, and advance your business. Outsourcing can either be used as a temporary measure until your analysts are past the learning curve of new technology, or you can use these services as a permanent extension of your security team, adding professional expertise when and where you need it.

Don’t Forget About Employee Cybersecurity Education

There are many ways to support your SOC analysts, from enhancing their skills through training and certification to outsourcing your detection and response activities.

Yet security is everyone’s job, not just the responsibility of you and your analysts. In many cases, your employees are your first line of defense, which is why everyone in the organization must understand basic cybersecurity principles.

When you invest in ongoing training programs to help your workforce enhance their security knowledge, combined with tools like ongoing phishing simulation services, you enable them to be strong partners to your SOC. It’s one more important opportunity – beyond training, automation, and outsourcing – to support the people who are part of your cybersecurity stack.

Learn more about how Fortinet’s team of cybersecurity experts can help you enhance, automate, and outsource critical security functions to keep your organization secure.  

 

Copyright © 2022 IDG Communications, Inc.

Source link

Continue Reading

Trending

URGENT: CYBER SECURITY UPDATE