Author Archives: Mark Charleton

Heimdal Security logoHow would your customers feel if they had a Norse warrior stopping malware from reaching their endpoints? Meet Denmark’s Heimdal Security.

In days of old, the sight of Vikings on the horizon was enough to turn decent peasants’ blood to ice.

But the marauding Danes are now playing poacher-turned-gamekeeper – at least in IT security terms.

Because instead of being the threat, they’re now stopping the threats before they make landfall. (Or, at least, before they reach your customers’ endpoints!)

This is what our newest vendor partner Heimdal Security sees as its killer battle cry when compared to traditional endpoint security. And here’s why malware needs to be very afraid of it.

From last-ditch to proactive: endpoint protection transformed

“Form square and stick out your spears” – that’s basically the traditional approach to endpoint protection. Once the problem has hit the machine, the security software rings the panic bell, musters the garrison, and mounts a defence.

We Brits tried that against the (real) Vikings. It didn’t work.

But if we could have spotted their boats as they cast off – or, even better, seen activity on the quayside that indicated an attack being prepared – we could have taken proactive action against them before they reached Blighty.

This is exactly what Heimdal does. Instead of looking at application code and signatures in files that have already entered the endpoint, to work out if there’s a threat, it looks at the undercurrents in the ‘sea’ of network and internet traffic entering and leaving your customers’ businesses, to detect danger before it surfaces.

Rather cleverly, though, this isn’t just about identifying when users are being taken to places they shouldn’t be sailing towards – e.g. malicious websites – and blocking the connection to them before it’s made (although this is certainly important, as we explore below).

It’s also about using advanced machine-learning, heuristics and network forensics to detect apparently harmless network file ‘plankton’ that is in fact fodder for a coming malware attack.

Traditional security protects an endpoint with a last-ditch defence. Heimdal protects it by turning the entire network into a shield wall.

Which one are you betting your krone on?

Multi Layered Security Graphic
Conventional endpoint security is typically missing the traffic-based anti-malware protection that Heimdal delivers.

“Probably the best malware protection in the world…”

The famous Danish beer ad is tongue in cheek. But there’s a serious point to be made here about the strains of malware that Heimdal can protect against that many other security solutions simply can’t.

Take ransomware, for example. Traditional endpoint security looks for malicious code within files, but a ransomware-triggering hyperlink, or instruction to connect to a website, is neither a file nor, in itself, an inherently malicious piece of code. So, the endpoint security software doesn’t spot it.

But Heimdal is looking at the network, not the endpoint. It detects and blocks the malicious connections (to malvertising, legitimate but compromised web banners, malicious iFrames and redirects, botnets etc.) that signal an intention to activate or propagate attack strains like APTs, ransomware, Trojans, polymorphic malware and others.

In short, Heimdal gets stuck into the melee long before the blunt old endpoint battle-axe can!

Automatic software updates: that’s 85% of web app attacks defeated!

Exploit kits and other threats that exploit programs’ existing security weaknesses are a huge worry for traditional endpoint security vendors, because these weaknesses often exist at a lower level than that at which the security solutions operate.

Consequently, exploits can slip underneath the endpoint radar (the bad guys must feel like they’ve died and gone to Valhalla!)

They’re a huge worry for your customers, too, given that some 85% of web app attacks (like the kind that typically trigger ransomware and steal personal financial data) take hold of endpoints through an existing unpatched security hole of this kind.

But here, Heimdal have put a real edge on their sword. They have coupled their network traffic analysis with an automatic software update tool, to ensure that your customers’ internet-facing and non-internet-facing apps  – from Acrobat to Audacity, Flash to Firefox, Java to Jitsi, and many others besides – are constantly and automatically updated with the latest security fixes and patches, thus denying exploit kits an entry point.

The most security-critical applications are often those that are not concerned with security at all – how’s that for a typically innovative Scandinavian way of looking at a problem?

Why Heimdal
“Proactive” is a word you’ll hear a lot from Heimdal – and the automatic patching capability that embodies it is a good third of the company’s overall value proposition. (Click to enlarge)

Heimdal: the new word in security

Bloodthirsty or not, the Vikings gave their name to some very beneficial concepts. The word ‘law’ comes into English from their language, for example – and from where we’re sitting it looks like they’ve done it again with ‘Heimdal’!

(Loosely translated, we think the name means: “Stop the thing that’s trying to attack the longboat before it reaches the longboat.” Genius.)

Time some of your customers learnt some Danish, perhaps?

BadRabbit

BadRabbit has munched through cyber-defences, sowing ransomware far and wide. So how does it work? And can you protect your customers against it?

“Run rabbit, run”, goes the song – and ransomware attack BadRabbit has certainly done some running over the past few days!

It has got its teeth into Russia, Ukraine and many other Eastern European countries besides, with some sources also reporting cases in Germany, Turkey, and the US. It seems only a matter of time before it spreads further afield.

So what is BadRabbit – and is there any defence that can protect your customers against it?

What’s up, Doc? What BadRabbit does and how

BadRabbit Screenshot
What users see when BadRabbit bounces into view

BadRabbit is cryptolocker ransomware – it encrypts Windows users’ files using a private key that is known only to the hackers’ own servers. The user must pay for access to this key, in order to decrypt and recover their files (a Bitcoin wallet appears on screen to enable this transaction to take place).

Technically, according to this specialist cyber-security website, BadRabbit is closely related to the recent NotPetya attack, using much of the same code.

However, it executes in a different way, using hacked websites to display a fake Adobe Flash update that, if clicked on, triggers the attack (it drives users to these sites using malicious links.)

Additionally, according to this threat alert website, BadRabbit can move laterally across a network and propagate or spread without user interaction!

Can security vendors stop the naughty bunny?

In short, it seems some of them can.

Bitdefender, for example, states on its website that if your customers are “running a Bitdefender antimalware product for either home or business, you don’t need to worry, as our solutions detect this threat…”

machine-learning
Bitdefender’s inbuilt machine-learning recognises the signs of ransomware and stops it before it can execute

Enabling machine-learning in Trend Micro’s solutions also appears to detect BadRabbit, according to the former’s website, whilst Malwarebytes states that “Users of Malwarebytes for Windows, Malwarebytes Endpoint Protection, and Malwarebytes Endpoint Security are protected from BadRabbit.”

An interesting take on keeping the cunning coney at bay, however, comes from Heimdal, who point out in this very comprehensive ransomware resource that some 85% of ransomware attacks target vulnerabilities in existing applications.

By this logic, updates to software (and not just security software) are, in themselves, a key anti-ransomware security layer.

Damage caused by Ransomware graphic
The consequences of ransomware. Source: Heimdal Security

What other steps can you take to protect customers against BadRabbit?

For systems admin and IT people, of course, quick technical fixes in the form of ‘kill switches’ or similar are indispensable, and it turns out that BadRabbit, like NotPetya and Goldeneye before it, can be tamed by changing the properties of certain files (scroll down to the bottom of this article to find them).

But fundamentally, ransomware works by holding your customers’ data hostage. If this data is backed up and easily accessible, as we discussed in this recent post, ransomware, by definition, loses pretty much all of its bite.

It’s important, therefore, that you advise your customers well on how to choose an appropriate data backup and recovery solution.

For a comprehensive list of all the other steps your customers need to take to protect themselves against ransomware, this recent article from the Carnegie-Mellon Software Engineering Institute offers some thorough advice.

BadRabbit is on the loose. So share what we’ve told you above with your customers and they’ll be all ears.

Failing to correctly configure your security solutions is one of the biggest risks to you and your customers. Security health checks can prevent it.

So, you’ve got your customers’ security covered from all angles, right?

Layered protection that shares security intelligence across applications. Endpoint security that spots malware traditional anti-virus solutions miss. Machine-learning that gets better and better at understanding threats. Belt and braces.

But then you fail to configure it all correctly and your customers get hit anyway!

Sceptical? Look at Amazon’s AWS solution, which has suffered a number of critical security and other misconfigurations, resulting in compromised user data.

Read Gartner, who say that in 2017 misconfiguration will be the most common source of breaches in mobile applications.

And take heed of the Infosec Institute, who place security misconfiguration right in the middle of the top ten cyber-risks in 2017.

Whichever way you slice it, the evidence shows that even the cleverest solutions can be useless if they’re not set up correctly – but how do you go about making sure the security solutions you deliver don’t fall into this trap?

Health checks: an MOT for your security solutions

The answer isn’t rocket science, but it is common sense.

You get your car checked out regularly to ensure it’s running as it should, and to inform you of any action you need to take to keep it fit for purpose. Essentially, it’s a health check for your motor – and you can do exactly the same for the security solutions and services you deliver.

But the even better news is that the security healthcheck is often far less disruptive and time-consuming than taking your car to the local garage.This is because the health check can often be performed by an engineer remotely, using the same web consoles you use to deliver and manage your security offerings every day.

As the engineer finds configuration faults or errors, they document these in a report that includes recommendations for the actions you need to take to fix them.

Who delivers security health checks, and what do they cover?

Where and how you get your security health checks often depends on the support and services arrangements you have with the vendors of the security solutions you sell – although this is not the only way to access them.

You could, for example, go through a specialist security software distributor who has vendor-accredited technical expertise in-house. This means you get vendor-quality product knowledge but through an organisation that is typically smaller, more agile and delivers a more personal service.

Typically, a product security health check delivered in this way will cover the full spectrum of security configuration points (it could be 60 or more) that can become an issue if not properly attended to, including (amongst others):

  • Unresolved malware
  • Patching and security updates
  • Licence status
  • Choice of deployed modules and scan engines
  • Policy and protection compliance
  • Impending end-of-life, end of support, and other OS-related issues
  • Settings (e.g. threat sensitivity); options enabled and disenabled
  • Identification and authentication

Security health checks; who fixes what’s not working?

If you have technically proficient people in your organisation, they can of course take the recommendations of the health check report and act on them.

But how does it work if you haven’t got the necessary technical resources?

Again, think of your car: you have no hesitation in handing over your keys to a trusted specialist to carry out work you couldn’t. Depending on who you get your security health check services from, the same model is potentially available – hands-on, on-site corrective work, billed according to an agreed estimate of the time it takes to complete the job.

(But no expensive mechanical components to cause the sucking in of air between the teeth, of course!)

Insights: safer than consequences

“Prevention is better than cure”, runs the old adage – but when there’s no cure available, the need for prevention becomes even more urgent.

Sadly, you can’t “cure” breach and theft of your customers’ data, for example – once the data’s been taken, it’s an irreversible action.

And if it occurs because a solution you provide wasn’t set up correctly or hadn’t been kept up to date, the legal, reputational and financial consequences for your organisation – particularly under the imminent GDPR regulations – would be severe.

But regular insight into the status of your security solutions and how they have (or haven’t) been applied can wrongfoot the risk before it trips you up.

A healthier situation all round.

 

 

 

XGen badge (HES) is the latest Trend Micro solution to wear the xGen badge. We take a brief look at the machine learning benefits behind the brand.

For both MSPs and resellers, Trend Micro’s Hosted Email Security (HES) has always been a compelling sell, delivering powerful, serverless email protection for customers with limited IT resources.

But whereas the rest of Trend’s Worry-Free Business Security Services solutions have already been plugged into the Predictive Machine Learning technology that is one of the features of the newly minted xGen brand, HES (perhaps because it’s also available as a standalone solution, outside of Worry-Free) hadn’t been – until now.

Here are some of the benefits that ‘xGenned’ HES now delivers to end-users.

Zero-day and unknown threats detected

With the threat landscape evolving at bewildering speed, checking chunks of code against databases of the known ‘usual suspects’ is only fractionally effective.

Instead, security solutions now need to detect hitherto unknown and unidentified threats, too, as we described in a previous post recently - and this is exactly what the Predictive Machine Learning in HES now enables it to do.

Predictive Machine Learning uses advanced file feature analysis to ascertain both the probability that a threat exists in a file, and the probable file type – and, of course, because it is learning from each example, it gets better as it goes.

Dangerous files and processes neutralised

Once the machine learning process has identified an unknown or zero-day threat, it can then take action to keep end-users protected.

If the threat is file-based, for example, the solution will quarantine the files in question, to stop the threat from spreading across users’ networks.

HES shares its newfound machine learning capabilities not only with Trend’s Worry-Free Business Security Services solutions but also with OfficeScan, so this more detailed explanation of the latter’s Predictive Machine Learning features, and how they work, is worth a read.

No more multiple login hell

Bringing HES into the xGen fold appears to have prompted some other helpful alignments with existing Trend solutions, too (although, in truth, these don’t have much to do with machine learning!)

There’s a lot less cumbersome clickery involved, for a start. For example, you can now jump directly from HES into the management console of the Cloud App Security solution, whereas before you’d have had to go from the Customer Licensing Portal (CLP) to HES, then back to CLP in order to reach Cloud App Security.

This is important for two reasons: firstly, to stop you losing the will to live. And secondly, because it’s a significant improvement to the overall email security workflow (Cloud App Security is needed to provide Exchange Online mail store scans as well as inspection of internal email traffic - so an easy hook-up to it is a must).

In short, HES is going through the same operator-friendly evolution as many other Trend solutions - getting rid of fiddly separate passwords for each service.

Ultimately, this helps partners work more efficiently and thus cut down on admin overheads, but also it makes for smoother service delivery.

HES: an xGen latecomer poised to deliver

It’s worth noting that HES has also recently benefited from an overhauled interface, improved data insights, enhanced Time-of-Click web protection, and other additional refinements, as explored in this post - so it certainly hasn’t been standing still.

But it has moved at a different speed to the rest of the xGen stable, and it’s good news for security resellers and MSPs alike that they can now tell their customers the gap is being closed!

MSP programJoining an MSP program can work wonders with channel partners’ balance sheets, as our friends at Trend Micro explain in this blog!

We’re always keen to share compelling insight from our vendor partners, and Trend Micro have nailed it with their blog Five reasons you need to join an MSP program….today!

 So with thanks to the guys at Trend, we’ve condensed it below. (And if you like what you see, come and talk to us about the MSP solutions we offer!)

Five reasons you need to join an MSP program… today!

1. Better margins

It is not uncommon for our partners to earn in excess of 100% profit margin on the security solutions they are providing to their customers as part of their managed service agreements, which is probably a much higher percentage than what you are earning now if you are just buying annual licenses when your customers’ licenses expire.

Let me explain how in two words: aggregate pricing. Put simply, MSP programs typically offer pricing on an aggregate seat count basis, which means that you are paying for licenses based on the total number of clients you currently manage. This can be a significant difference as business grows and you move in to cheaper and cheaper seat bands. To figure out just how much margin you are missing out on ask your vendor how much it costs per seat in the lowest price band (typically five to 25 seats) vs. the cost per seat in the price band that represents your entire customer base. That number is the extra margin you are missing out on.

2. Predictable revenue stream

Compared to the feast-or-famine nature of revenue in a break-fix business model, predictability is one of the primary benefits of being a managed service provider. Joining an MSP program helps you further streamline and predict both the revenue from your customers, as well as your service delivery costs.

This one is a bit of a twofer since you can more easily calculate revenue projections and do forecasting into the future. You can also calculate cost projections and get a much better understanding of the health and future growth potential of your business. The icing on the cake is that the value of your business increases as well as your revenue streams–a critical component of your exit strategy.

3. Multiple recurring revenue streams

The great thing about being an MSP is that you are forced to heavily focus on automation and repeatability since controlling costs directly impacts your bottom line. Once you’ve joined an MSP program, you will generally have the ability to create multiple recurring revenue streams if they have a broad product portfolio. Once you have created processes and trained your staff around the tools provided as part of the MSP program it’s very easy to “turn on” any additional products your vendor may offer across your entire customer base. This can be done in a very efficient and cost-effective manner, with each of these products representing an additional recurring revenue stream and more profit.

4. Moving from CapEx to OpEx

There may be some tax and accounting benefits to joining an MSP program and moving from purchasing annual licenses upfront for your customers to paying for licenses monthly or quarterly — or moving from CapEx to OpEx. The main benefit is the ability to recognize deductions completely in the current period vs. recognizing them over the useful life of an asset (that is, if you buy a three-year license and deduct it over those three years).

Disclaimer: We are a cybersecurity company, not tax experts. Therefore, we highly recommend discussing this with your accountant or tax professional to weigh the pros and cons and how it may affect your business specifically.

5. Elimination of renewals

Lastly, a good MSP program will give you complete control over license management and provisioning from a self-service portal. This allows you not only to provision licenses when you need them (think evening or weekend deployment when you forgot to place an order three days in advance), but also to eliminate all the hassles, complexity and costs associated with renewals. In essence, since you have complete control over the licenses, an expiration date is no longer necessary–you can simply cancel the license when you need to.

If you’ve never figured out what it costs you to track disparate expiration dates across your entire customer base for every product, to request quotes from your vendors, to create invoices for your customers, to follow-up on payments from your customers, and to submit payments to your vendors just to renew a product, then you probably should! Most partners we  meet who go through this exercise are shocked to find out they often lose money on smaller customers because they did not factor the costs of renewing into their pricing or business model.

Although there are so many more reasons to join an MSP program as soon as possible, these are our top five reasons you should be seriously considering becoming part of one…

Blue Solutions is a specialist security software distributor with many years’ experience in helping partners take their MSP security proposition to market. To talk to us about our range of MSP security solutions, get in touch.

Cloud SecurityCloud security is often as nebulous a term as the word ‘cloud’ suggests! We look into its various meanings and identify where it can add value to channel partners’ propositions.

Cloud security is one of those terms that has morphed rapidly to mean several different things in a very short time. Result? Confusion, more often than not.

Are we talking about security solutions delivered to users from the cloud? Or security around applications that live in the cloud (like Office 365)? Or security that’s targeted at businesses that make use of public cloud services like AWS?

You see the challenge. But actually, each of these is a valid scenario and a saleable cloud security solution. Here’s more info.

1. Security services delivered from the cloud

Your SME customer has few or no IT specialists in the organisation, no money to hire them, and nowhere to store servers. Where do they turn?

To the cloud, of course. Security products are delivered to them via the internet, as a service.

They can typically choose to pay only for what they use, on a monthly ‘rental’ (managed service, or MSP) model, so there are no prohibitive upfront costs.

Their security partner (you!) monitors their networks from a centralised console, makes technical adjustments, and implements patches and upgrades, but the user can retain some control over their security settings if they wish.

But what kind of security solutions can be delivered in this way? Many.

Hosted email security, for example, works with most hosted and on-premise email systems to protect what is stilll the primary route into organisations for most forms of malware and spam.

More comprehensive business security services solutions and cloud security solutions designed specifically for MSPs provide wider protection to end-users, and also enable partners to sell into organisations who have some on-premise systems, but don’t wish to overburden them by adding security software into them.

In this scenario, end-users can run everything else on-premise, but get their security from the cloud!

2. Security for applications that live in the cloud

Solutions like Office 365 have revolutionised office processes, with powerful tools delivered to end-users’ desktops straight from the cloud.

But although the delivery mechanisms for these applications are secure, the content delivered by the applications can still contain threats that the application’s own in-built security can’t detect, as we explored in this cloud apps post a while ago.

Plugging these holes is still a big opportunity for resellers and other security channel partners – and the cloud app security solutions that can help them deliver this critical service are already ‘out there’.

3. Security for public cloud services

SaaS, IaaS, PaaS – businesses’ ability to build their entire proposition on a public cloud provider is no longer the preserve of large enterprises.

In fact, Forbes has ascribed the growth of AWS, for example, to their “Reaching out to all kinds of customers – startups, SMEs and big companies”.

It is this that has driven, in turn, a new kind of security need amongst end-users, as we explained not so long ago in this post - namely, the ability to spin up an AWS virtual server and know that server will immediately be protected by security software that has been specifically designed from the ground up for virtual environments.

We had a bit of fun defining these virtualised must-haves in this security opinion paper recently, but the message is deadly serious: if end-users are building a business on public cloud, and relying on virtual servers, security partners need to be able to reassure them that they can secure it!

Cloud security – evolving meanings, evolving opportunities

As the cloud billows ever more energetically within businesses’ operations, it drives the security agenda in many different directions at once. Cloud security is coming at us from many different angles, and is morphing into multiple meanings.

It’s a wise security partner who has got a handle on them all – and knows the security solutions that play strongest to each definition.

vaccineOrganisations in Europe and the US have been crippled by a ransomware attack known as ‘Petya’. There are claims of a ‘vaccine’ to stop it – but how credible are they?

Hot on the heels of WannaCry comes Petya – a nasty ransomware variant, based on the Goldeneye code.

It has already locked some of the world’s most prominent enterprises out of their data, including construction materials company Saint-Gobain, food giant Mondelez, legal firm DLA Piper, and advertising firm WPP.

But lo! There is a ‘vaccine’ that protects against it, apparently! Simply include the file C:\Windows\perfc.dat on the PC, and the ransomware is stopped in its tracks.

(Well, it’s stopped in its tracks on that machine – though it can still propagate to other machines on the network. So still not ideal.)

We took a look at what some security vendors are saying about Petya / Goldeneye – and whether the idea of a ‘vaccine’ is truly credible.

Bitdefender: ransomware vaccine is old news

The first thing that struck us is that security vendor Bitdefender has had a ransomware vaccine available for some time now, and it’s not just a quick fix using a read-only file.

Instead, it’s rather cleverer than that. It tricks ransomware into believing the machine is already infected, and so the attack goes looking elsewhere. In addition, it can be deployed to every machine on a network simply by ticking a box – meaning that one machine can’t pass the infection to another.

There’s little information at present, admittedly, as to whether this vaccine is effective specifically against the Petya /Goldeneye attack.

However, it has been stated publicly in the Bitdefender Resource Center that “Bitdefender blocks the currently known samples of the new GoldenEye variant. If you are running a Bitdefender security solution for consumer or business, your computers are not in danger.”

That’s pretty unequivocal. And what’s particularly interesting with this vendor is that the ransomware vaccine is standalone – businesses don’t need to have invested in Bitdefender’s suite of other security solutions to use it.

Trend Micro: decrypt it if you can’t stop it

Trend Micro has an established stable of solutions that provide layered protection against a whole range of threats, including ransomware, so they’d surely argue that a ransomware vaccine is unnecessary!

However, what they do also offer is decryptor tools that enable users to recover data even after their files have been encrypted by certain variants of ransomware.

Again, whether these solutions are effective against the most recent Petya / Goldeneye attack is not clear, although Trend Micro states here that it is “in the process of adding known variant and component detections” for Petya-related patterns “and all products that utilise them.”

So, more antidote than vaccine – but it’s worth noting that these decryption tools are free, so they could be a lifesaver (and pave the way to more proactive anti-ransomware strategies and product choices in the future).

Malwarebytes: no ransomware vaccine, but you're safe

Malwarebytes, for its part, has been less than confident about the ability of the C:\Windows\perfc.dat vaccine to stop the Petya infection – in fact, the company states that “our own tests have shown that in many cases, it doesn’t.”

Whilst Windows 10 systems, Malwarebytes says, “seem to have a fighting chance” by using this method, “Windows 7 gets infected every time.”

However, Malwarebytes also publicly says that customers using Malwarebytes Endpoint Security are protected against this specific ransomware variant – so, once again, a vaccine is – theoretically, at least – unnecessary.

Ransomware: vaccines, protection, remediation

For more of our thoughts on ransomware and what security vendors are doing to fight against it, check out our previous post here.

And remember – prevention is better than cure, so keep patching!

Phishing:Despite being one of the oldest internet scams, phishing continues to unleash mayhem in businesses. How can security partners protect customers against it?

The oldest scam on the internet – phishing – is going from strength to strength.

Indeed, the Anti-Phishing Working Group report published in February 2017 tells us that the number of unique phishing sites detected in the second quarter of last year was at an all-time high.

The dreaded bogus links in incoming emails can trigger everything from banking fraud, to ransomware (the Locky attack was set off this way), to theft of Office 365 logins, as this phishing video shows.

So what advice should security partners be offering to their end-users to help them mount an effective defence against this menace?

1. No more phish and spam sandwiches

Poor spam management is a recipe for heightened exposure to phishing risk, since spam email is often the ‘bread’ around the phishy ‘filling’.

It sounds disgusting – but end-users are still swallowing it. In 2016, for example, 71% of ransomware was delivered via spam, making spam the most common attack vector. In fact, it’s even spawned a new term – malspam!

Strong anti-spam detection is therefore a critical ingredient in stopping phishing attacks before they reach the user, and for this a number of critical features are necessary in the security solutions end-users choose, including:

  • Antispam filters, so that detection thresholds can be adjusted in response to users’ experience of how effectively spam is being caught.
  • Connection to a global email and web reputation database, so that domains and identities associated with known malicious servers can be identified, and their IP addresses blocked.
  • IP address behaviour analysis, so that potentially suspicious behaviours like dynamic or masked IP addresses can be detected.
  • Document exploit detection to look beyond the email and into the attached files that malspam often makes use of to trigger an exploit.

At its least harmful, spam is a distraction that leaves a bad taste in the business’s mouth. At worst, it carries a truly toxic payload.

2. Beware the newly-borns…

But at the risk of sounding like King Herod, one of the biggest threats in the phishing sphere comes from ‘newly-borns’ – malicious servers that simply haven’t been around long enough to make it onto any web or email reputation database, and so might not be detected.

So it’s critical that businesses’ anti-phishing security goes beyond this, and attempts to analyse the characteristics of the phishing email itself, such as:

  • Who sent it
  • Where it’s gone to
  • What it contains
  • When it was sent
  • How it reached a user’s inbox

As this excellent summary explains, by mapping these factors automatically to known social engineering scenarios (i.e. the many ways in which users can be tricked into doing something they shouldn’t!) tell-tale signs of phishing intent can be detected, and the relevant IP addresses blocked.

Needless to say, this process involves some pretty hefty probability calculations, and social engineering scenarios are changing all the time, so the system needs to be able to constantly learn from what it absorbs and update its assessments accordingly.

Machine-learning is the key here, and if implemented effectively it can ensure that businesses’ anti-phishing protection doesn’t behave as if it were born yesterday!

3. Educate, educate, educate!

Security vendors are in this business to make money by selling software – but even they have been vocal about the need for businesses to educate their workforce to spot the signs of phishing, and take evasive action.

Content like these Tips for mitigating phishing attacks, for example, is certainly helpful - but there is a realisation that hints, tips and instructions alone won’t change security culture within organisations.

Instead, businesses must fuel constant internal security conversations using simple, accessible content, and they are looking to resellers and MSPs to deliver this to them, working through cyber-security awareness content partners.

Phishing protection will never be 100% effective. But shouldn’t every business be wishing that whatever slips through the net (or should that be Net?) could be stopped by the ‘human firewall’?

Read the latest helpful updates on ransomware and cloud security from our industry partners and contacts.

We like to put our partner and media contacts to good use in helping you and your customers to understand the security landscape.

This month, we bring you three helpful new updates – two guides to ransomware (and how to defeat it) and the other an interesting short article from Cloudworks on the benefits of cloud security for small and medium businesses.

Business guide to ransomware

New from AppRiver, this guide is subtitled ‘Understand, Analyze and Protect’, and is a very readable resource covering what ransomware is, how it works, how it spreads, and the best practices and employee training that can help defend against it.

Ransomware: Malwarebytes bytes back!

Another take on ransomware and how to combat it comes from security experts Malwarebytes, who major on the importance of endpoint security (keeping PCs and devices protected) in this informative and short PDF.

Five reasons why cloud security is important for SMEs

Big servers, large infrastructure, lots of IT staff – these are all security components that SMEs just can’t afford! This is why they must look cloudward – and this article from Cloudworks describes the benefits of cloud security neatly.

We’ll be back with more helpful advice soon!

WannaCrypt0r ransomwareThe WannaCrypt0r ransomware floored the NHS and many other organisations besides. These guys reckon they could have stopped it.

WannaCrypt0r, the global cyber-attack that paralysed 45 NHS trusts, plus businesses in over 100 countries, has woken the world up.

It’s woken a few security vendors up too, as the flurry of emails in my inbox over the weekend shows.

And, predictably, they’re all keen to tell us that customers running their security software were protected from WannaCrypt0r’s terrifying exploits.

Here’s a summary of the claims each of these wannabe ‘WannaCrypt0r-killers’ have made. It will be interesting reading for those who are contemplating where to go next with their anti-ransomware strategy!

Bitdefender

The mail from security software vendor Bitdefender states its case boldly: “Customers running Bitdefender are not affected by this attack wave.”

How so? Bitdefender has a ‘ransomware vaccine’ that users can switch on to immunise machines, and this uses the ransomware’s own programming against it.

But at a deeper level, it boils down to the ability to detect memory violations – in other words, to understand when a machine’s memory is being tampered with, which indicates that a cyber-exploit is afoot long before it can actually execute and cause any damage.

It’s this kind of device behaviour, Bitdefender implies, that, with their GravityZone products, would have shut WannaCrypt0r down before it even really got started.

Trend Micro

It’s machine-learning that’s writ large in the Trend Micro response to the WannaCrypt0r incident.

“Customers are already protected against this threat through Predictive Machine Learning and other relevant ransomware protection features found in Trend Micro XGen™ security,” the firm claims.

It’s a highly layered approach, involving email and web gateway solutions, behaviour monitoring and reputation analysis, file and website blocking, across physical and virtual machines, with the overall goal being to “prevent ransomware from ever reaching end users.”

Of course, if WannaCrypt0r has shown us one thing, it’s that ransomware is perfectly capable of activating before it reaches the end user!

However, a beacon of hope in Trend Micro’s communication that I did not see elsewhere is that it has a tool that can decrypt files affected by certain crypto-ransomware variants, meaning victims would not have to pay the ransom in exchange for a decryption key.

(How many IT guys would have killed for that last Friday evening?)

Malwarebytes

Malwarebytes’ communication slaps its cards down on the table thus:

“Malwarebytes is protecting your organization against this specific ransomware variant. Our anti-ransomware technology uses a dedicated real-time detection and blocking engine that continuously monitors for ransomware behaviors, like those seen in WannaCrypt0r.”

Like Bitdefender and Trend Micro, this is hinting at some sort of intelligent analysis of machine and network behaviours that might predict a ransomware attack, before it actually starts to execute.

Malwarebytes’ four-layered security approach – operating system, memory, application behaviour and application hardening – contributes to this detection capability, as it monitors at multiple system levels for ransomware and other exploits, simultaneously.

But Malwarebytes goes further than this in its claims. It says in this blog about WannaCrypt0r that itwill stop any future unknown ransomware variants.”

(The italics are mine – but I’m sure you’ll agree they’re worth emphasising!)

What next for WannaCrypt0r?

There are few certainties in cyber-security but what experts are predicting is that wave two of the WannaCrypt0r attack will come soon – and wearing a different guise.

Will the security solutions above recognise it rapidly enough to combat it?

Let’s see whether the communications live up to their word.