Skip to content

ESET在嚴格的新型AV-Comparatives端點預防和響應測試中被評為“戰略領導者”

BRATISLAVA – ESET, a global leader in cybersecurity, has been named a Strategic Leader in the Endpoint Prevention and Response (EPR) Comparative Report, one of the most comprehensive tests of endpoint detection and response (EDR) solutions and endpoint security products ever performed by AV-Comparatives. The ESET PROTECT Enterprise bundle, comprising the ESET PROTECT management console, ESET Endpoint Security 7.3, and ESET Enterprise Inspector 1.4 – ESET’s EDR solution – was tested in the report.

AV-Comparatives, a leading independent testing organization, well-known for offering innovative real-world environment testing, subjected the products of nine vendors to dozens of targeted attacks, each deployed by a variety of techniques and tactics.

In addition to traditional in-depth testing, AV-Comparatives has developed an Enterprise EPR CyberRisk Quadrant™ that factors in the effectiveness of each product at preventing breaches, the calculated savings resulting from this, the purchase costs of the product, and the product’s accuracy costs (incurred due to false positives). ESET and its solutions were named a Strategic Leader in the quadrant – the highest certification in the quadrant. Strategic Leaders are defined as products that have a very high return on investment and provide very low total cost of ownership due to exceptional technical   capabilities, combined with reasonable costs. Strategic Leaders develop groundbreaking ideas and implement these impressively in their products.

ESET achieved particularly high scores in the categories of active response, passive response, and combined prevention/response capabilities, scoring the highest percentages of the test with 98%, 100%, and 99%, respectively. In the combined prevention category, only four out of the nine vendors received such a result.

As stated in the report, ESET PROTECT Enterprise did exceptionally well at handling threats targeted towards the user, in particular before the threat progressed inside the user environment. The easy-to-use intuitive console was praised, as well as the contextual data provided in order for security analysts to prioritize, mitigate, and further investigate threats. In addition to threat data and insight, ESET’s solutions showed good mapping to the MITRE ATT&CK®, enabling analysts to escalate an incident when necessary and provide additional defensive measures when available.

Andreas Clementi, CEO and founder, AV-Comparatives, commented, “ESET not only achieved the highest combined prevention and response score in the test, but also demonstrated outstanding overall detection and reporting capabilities. The test results contributed to ESET’s lowest total cost of ownership for organizations among all assessed vendors and ensured ESET’s position as a Strategic Leader in this new test by AV-Comparatives.”

Juraj Malcho, Chief Technology Officer at ESET, noted, “We are extremely proud of these results and of being named a Strategic Leader by AV-Comparatives in such a rigorous and important new test. We are passionate about always improving on and innovating our cutting-edge solutions, and third-party testing is a critical step in ensuring we’re delivering on that promise. The high scores in this EPR test reflect both our dedication to our customers’ safety and our commitment to providing the highest standard of EDR and endpoint security solutions from both passive and active defense standpoints.”

To learn more about ESET’s award-winning solutions, click here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

SolarWinds / SunBurst –企業應採用供應鏈認證嗎？

SunBurst – The Cyber Attack on SolarWinds

SunBurst is a cyber espionage campaign that leveraged a supply chain attack on SolarWinds, a leading supplier of network management software. Between March and May 2020, the attackers gained access to SolarWinds’ build system, added a malicious DLL (library) file, and distributed it to 18,000 SolarWinds Orion customers.

The malicious file allowed remote control of the target host, while leveraging advanced evasive tactics. Using this access point, the attackers were able to hack into organizations with well-established security practices such as Cisco and Microsoft. These organizations failed to detect the attack before FireEye (who was also attacked) made it public.

A targeted attack at this scale doesn’t happen very often. It’s a rare event that should shake both enterprises and the security community. The fact that this campaign went undetected for such a long period of time (6+ months), proves that something is fundamentally wrong with the way that computer networks are protected.

The success of this attack campaign, versus other campaigns, is built upon two factors:

  1. First and foremost, this is not a coincidence. This is a team of highly skilled attackers who made all of it possible. The campaign shows world-class planning, knowledge, experience and attention to detail.
  2. SolarWinds Orion is a network management product. Due to its role, it has a number of advantages as an attack source, vs. other types of attack sources:
    1. It’s whitelisted to perform reconnaissance (network monitoring) in many security tools – This tool is designed to perform reconnaissance, so no one will suspect when the tool does what it was designed to do.
    2. From SolarWindows Orion’s perspective in the network, the network is usually flat. Regardless of how many network segments are there, the component in Orion that scans the network requires direct network access to the target devices, so enterprises allow this traffic through their firewalls. This allows unique network access from the initial access point.
    3. SolarWinds Orion commonly has access to certain admin credentials that make it possible to move laterally.

The Supply Chain Risk

The supply chain risk to both enterprises and government organizations has been discussed in the last few years. The attack on SolarWinds is one of the most powerful examples of the supply chain risk. It joins a list of similar events such as the attack on Target in 2013. Supply chain attacks exploit trusted third-parties to enable access to a large number of attack targets in parallel. By using that trust, such as the trust organizations put on SolarWinds software updates, it’s easier to obtain access rather than attacking each target separately and directly.

Supply Chain Certification

The United States DoD (Department of Defense) is one of the government organizations that took far-reaching steps to reduce the supply chain risk. In October 2016, the DoD first issued a supplement to the DFARS regulation, that introduced cyber security requirements for DoD suppliers. In November 2020, only a month before the supply chain attack on SolarWinds, the DoD made another major addition to DFARS. This addition is called CMMC or the Cybersecurity Maturity Model Certification.

The CMMC includes a few non-linear improvements vs. the original DFARS supplement, in multiple categories:

  1. Third-party certification of suppliers by approved parties (C3PAOs) instead of self-certification.
  2. Certification is mandatory to be able to participate in RFIs and RFPs, meaning that it can affect the supplier’s revenue.
  3. CMMC has a 5-levels maturity model.
  4. There are 154 new requirements out of 171 in CMMC (vs. the original DFARS supplement), and they’re spread across the 5 levels of maturity.
  5. Reporting of compliance status in an online portal. This means that the DoD can monitor compliance of the entire DIB (Defense Industrial Base – the regulated organizations).

By introducing CMMC, the DoD conveys a clear message to DoD suppliers: We want you to be secure. And if you’re not secure enough, you cannot work on defense projects. Find another niche that’s less critical. If you want to work with the DoD, these are our requirements.

The question is: Should enterprises follow a similar path? Should a supply chain certification model be the standard in enterprise RFIs and RFPs?

The Pros and Cons of Supply Chain Certification

There are a few pros and cons to consider when discussing supply chain certification.

Pros:

  • Increased security of the supply chain using financial incentives.
  • Competition between suppliers on security maturity levels – Enterprises will start ranking suppliers based on a new metric.
  • Transparency in security maturity levels. “Are you a Level 3 Security supplier or a Level 5 Security supplier?”
  • Following a cyber attack, the certification might be re-evaluated. If major violations are found, the certification can be voided.

Cons:

  • How much is this going to increase the prices of goods and services? And is it worth it?
  • The certification can end up being another checkbox, where it has high costs and provides no security value.
  • Smaller suppliers might find it difficult or impossible to be certified within their resources, which will create a bias toward larger organizations.
  • Do enterprises have a large enough negotiation power, similar to that of the DoD, to pose such requirements on suppliers?
 

Our Predictions

We see a clear path to how supply chain certification becomes mainstream in the next years. With the DoD adopting CMMC, certain suppliers will have a CMMC certifications. They can then use their CMMC certification as a competitive advantage in non-DoD deals.

The DoD kickstarted this program, defined the requirements, and laid out the infrastructure (C3PAOs, RPs, etc). That allows the entire world to adopt CMMC – other government bodies and enterprises can easily adopt it at a low cost.

If the CMMC certification will be perceived as an efficient risk reduction strategy, and that there’s nothing fundamentally wrong about it, this (or a similar) model is going to expand into additional industries.

The SCADAfence Governance Portal is a compliance monitoring automation platform from SCADAfence, that automatically monitors your network’s compliance with the major cyber security standards and regulations. If you’re interested in learning more about how to measure and increase your security program maturity, please visit this page for a short demo about this product.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

微軟今年(2020年)最後一個Patch Tuesday，修補了58個安全漏洞

微軟在今年最後一個Patch Tuesday（12/8）修補了58個安全漏洞，當中有9個屬於重大（Critical）等級，且並無任何零時差漏洞。

CVE-2020-17121存在於SharePoint 中，該漏洞允許經過身分認證的使用者，以SharePoint Web Application服務的帳號，於伺服器上執行任意的.NET程式；另外還有藏匿在Hyper-V的CVE-2020-17095漏洞，則讓駭客可藉由傳遞無效的vSMB封包資料來擴張權限，使其能在Hyper-V主機上執行任意程式，而且看起來於客座作業系統不必特別的權限，就能開採該漏洞。CVE-2020-17095是此次微軟所修補的漏洞中最嚴重的，其CVSS v3漏洞分數為8.5，ESET資安專家建議用戶應盡快更新。

原文出處：https://www.welivesecurity.com/2020/12/09/microsoft-patch-tuesday/

#若有任何資安需求，歡迎洽詢台灣二版資安專業團隊，服務電話：(02)7722-6899，或上官網查詢：https://version-2.com.tw/?skip=1

關於 Version 2 Digital
資安解決方案 專業代理商與領導者
台灣二版 ( Version 2 ) 是亞洲其中一間最有活力的 IT 公司，多年來深耕資訊科技領域，致力於提供與時俱進的資安解決方案 ( 如EDR、NDR、漏洞管理 )，工具型產品 ( 如遠端控制、網頁過濾 ) 及資安威脅偵測應 變服務服務 ( MDR ) 等，透過龐大銷售點、經銷商及合作伙伴，提供廣被市場讚賞的產品及客製化、在地化的專業服務。

台灣二版 ( Version 2 ) 的銷售範圍包括台灣、香港、中國內地、新加坡、澳門等地區，客戶涵 蓋各產業，包括全球 1000 大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企業及來自亞 洲各城市的消費市場客戶。

關於ESET
ESET成立於1992年，是一家面向企業與個人用戶的全球性的電腦安全軟體提供商，其 獲獎產品——NOD32防病毒軟體系統，能夠針對各種已知或未知病毒、間諜軟體 （spyware）、rootkits和其他惡意軟體為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少，偵測速度最快，可以提供最有效的保護，並且比其他任何防病毒產品獲 得了更多的Virus Bulletin 100%獎項。ESET連續五年被評為“德勤高科技快速成長500 強”（Deloitte’s Technology Fast 500）公司，擁有廣泛的合作夥伴網絡，包括佳 能、戴爾、微軟等國際知名公司，在布拉迪斯拉發（斯洛伐克）、布里斯托爾（英國 ）、布宜諾斯艾利斯（阿根廷）、布拉格（捷克）、聖地亞哥（美國）等地均設有辦事 處，代理機構覆蓋全球超過100個國家。

ESET已加入《斯洛伐克共和國多樣性憲章》

Bratislava – ESET, a global leader in cybersecurity, has joined fifty other signatory companies operating in the Slovak Republic in signing the Diversity Charter of the Slovak Republic. In a first, the signing ceremony took place online. The Diversity Charter is a voluntary initiative by companies and organizations to promote diversity in the workplace. It is supported by the European Commission via the EU Platform of Diversity Charters, which supports the dissemination and sharing of principles, good practice and experience on diversity management in EU countries.

“For ESET, as a technology company, a central tenet of diversity and CSR activities is strengthening the representation of women and girls in IT, not only for the company itself, but for the entire sector as a whole. By signing the Diversity Charter of the Slovak Republic, we want to demonstrate that ESET takes inclusion and diversity seriously and that it is a matter of principle for us,” said Lucia Marková, ESET’s CSR Manager, at the signing of the Diversity Charter.

Membership in this initiative is open to all companies and organizations that are aware of the importance of equal treatment, inclusion and diversity in the workplace. The signatories agree with the content of the Diversity Charter of the Slovak Republic and subscribe to the following principles:

  • Voluntarily integrate into the life of the company a set of principles and procedures that take into account diversity and an inclusive approach in the workplace.
  • Build a relationship toward employees based on these principles and raise awareness of diversity issues at the management level.
  • Inspire other companies operating in Slovakia and spread awareness of the benefits arising from the implementation of a policy of diversity.

“We work hard at creating a respectful environment in which all our employees feel welcome, without distinction. We promote diversity in the workplace very naturally; on our part, we mainly focus on a receptive and individual approach, not on statistics. We also pay serious attention to the approach we’ve taken to promote mental health at work, a very current topic that underlies the success of any and all employees,” concludes Daniela Škripková, Chief HR Officer at ESET.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET發現操作SignSight：針對東南亞認證機構的供應鏈攻擊

BRATISLAVA, MONTREAL – ESET Research discovered another supply-chain attack in Asia, this time on the website of the Vietnam Government Certification Authority (VGCA). The attackers modified two of the software installers available for download on this website by adding a backdoor in order to compromise users of the legitimate application. Supply-chain attacks appear to be a quite common compromise vector for cyberespionage groups. Cybercrime operation SignSight leverages malware known as PhantomNet or Smanager.

“In Vietnam, digital signatures are very common, as digitally signed documents have the same level of enforceability as wet signatures. In addition to issuing certificates, the VGCA develops and distributes a digital signature toolkit. It is used by the Vietnamese government, and probably by private companies, to sign digital documents. The compromise of a certification authority website is a good opportunity for APT groups, since visitors are likely to have a high level of trust in a state organization responsible for digital signatures,” explains Matthieu Faou, one of ESET’s researchers investigating the SignSight operation.

The PhantomNet backdoor is quite simple and is able to collect victim information (computer name, hostname, username, OS version, user privileges [admin or not], and the public IP address) as well as install, remove and update malicious plugins. These additional and more complex plugins are probably only deployed on a few selected machines. By also installing the legitimate program, the attackers make sure that this compromise won’t be easily noticed by end users.

ESET researchers uncovered this new supply-chain attack in early December 2020 and notified the compromised organization and the VNCERT. We believe that the website ceased delivering compromised software installers at the end of August 2020. The Vietnam Government Certification Authority confirmed that they were aware of the attack before our notification and that they notified the users who downloaded the trojanized software.

ESET has seen victims in the Philippines in addition to Vietnam.

For more technical details about operation SignSight, read the blog post “Operation SignSight: Supply- chain attack against a certification authority in Southeast Asia” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

谷歌瀏覽器和ESET合作，共同對抗在線威脅

BRATISLAVA – ESET, a global leader in cybersecurity, announced today it is continuing to partner with Google to protect Google Chrome users. ESET’s award-winning technology is used by Google to scan, identify and remove unwanted software encountered by users of Chrome for Windows. The extension of the cooperation on Chrome Cleanup, part of Chrome’s Safe Browsing feature, continues the close collaboration between the world’s most popular browser and the leading EU-based IT security vendor’s technology.

As applied in Chrome Cleanup, ESET’s technology is used by Google to alert users about unwanted or potentially harmful software attempting to get on users’ devices through stealth, for example, by being bundled into the download of legitimate software or content. Google Chrome, using ESET’s security technology, then provides users with the option to remove the unwanted software. Chrome Cleanup operates in the background, without visibility or interruptions to the user. It deletes the unwanted software and notifies the user once the cleanup has been successfully completed.

The two companies enjoy a broad relationship that also includes a collaborative role in which ESET works closely with Google to ensure the safety of the Google Play Store as a partner in the App Defense Alliance. ESET also provides data for users of Chronicle, Google Cloud’s security analytics platform, to surface verdicts on malicious files.

“We are proud to partner with Google in helping Chrome users enjoy safer technology,” said Juraj Malcho, ESET Chief Technology Officer. “The ongoing collaboration with Google and Chrome Cleanup demonstrates the importance that both companies place on keeping users safe and secure. With Chrome being the browser of choice for most Windows users, ESET’s technology and engineers are providing frontline protection.”

For additional information about Google Chrome Cleanup, please click here

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

GREYCORTEX是DELOITTE TECHNOLOGY Fast 50 CE中最成功的50家技術公司中排名最高的公司

Brno, November 19, 2020

GREYCORTEX has won second place in the Rising Stars category in the prestigious ratings organized by Deloitte, where many Czech tech companies strove to be nominated as the fastest-growing tech company in the Deloitte Technology Fast 50 CE. The Tech Stars, Rising Stars, and Impact Stars categories present both the maturest and newest fast-growing companies in the Central European region as well as those companies that have had a revolutionary social or environmental impact on the market.

Petr Chaloupka, CEO at GREYCORTEX, said: “I am very pleased to have achieved international success in the 21st year of the Deloitte Technology Fast 50 CE competition and to have won second place in the Rising Stars category. In this category, seven out of 10 places were occupied by Czech companies, showing that the Czech Republic is still a cradle of technological innovation and that we have a good standing in this international competition. I wish to congratulate all the other companies and wish them success in further building their internationally competitive status”.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Deloitte Technology Fast 50 CE
Deloitte Technology Fast 50 CE is a program that identifies and rewards the 50 fastest-growing tech companies in the Central Europe region based on revenue growth over a four-year period.