GREYCORTEX CTO ON SECURING THE HOME-OFFICE NETWORK

The emergency provisions related to COVID-19 have been active for some time and more and more companies are allowing their employees to work from home. We asked Our Chief Technology Officer Vladimír Sedláček, a seasoned administrator of ICT, corporate systems, cybersecurity, and experienced developer, about his opinion on current affairs.

The Coronavirus pandemic impact is discussed everywhere, but few people seem to realize that despite all the physical risks, digital issues still present a significant problem. How do you see the current situation, and what do you consider to be the biggest risk in terms of virtual infections, and their possible outcome for companies?

It would be naive to assume that the global crisis would lead to a drop in cyberattacks or will result in a ceasefire. On the contrary. In nature, each weakened individual becomes prey. Regardless of any previous “ceasefire declarations”, we see an increase in the number of attacks and targeted at the SARS-NCov-2 situation. Obviously, we can expect contacts from faux health inspectors and money collectors. Even my inbox has received several phishing emails offering nano-silver infused masks. In addition to attacking the weakest part of cybersecurity – the user – we also see an increase in scanning; looking for vulnerable computers and security holes in firewalls or hastily constructed VPNs and remote desktop gateways. In the end, all of this contributes to latent disclosure of company secrets, production, and patent documentation, or personal data. Infiltration by extortion malware also becomes a threat and can mean a total production halt, as seen both last year and recently in some hospitals in the Czech Republic.

What do you see as the most common errors from employers and top management regarding data exposure; and how does the risk increase with massive deployments of quarantine provisions where most employees work from home?

Right now, the risk is increased by companies laying off contractors, often those working on infrastructure, promoting rotating furloughs, and allowing their administrators to work from home. This can cause a delay in necessary security patching and increased response time. Also, ad hoc suspension of certain user accounts can leave the access ripe for unauthorized access restores later. Last, but not least, some companies have allowed their employees to work from home using their home computers. VPN has thus become a gateway for free access directly into company networks, and to internal company systems, all thanks to home devices with uncertain security postures, possibly outdated operating systems, obsolete software, or a load of games full of spyware. These systems are being used by home-bound users surfing the web with local superuser rights. It is very similar to allowing the usage of personal devices (BYOD) and letting them directly connect into internal, as opposed to guest networks. A lot of companies do not, however, tackle the situation accordingly, and have not familiarized their employees with relevant security policies. Without in-depth employee training and without respecting the basic rules of cyber hygiene, internal data can leave the control of responsible people working with it. What has not received much attention so far is the risk of company device theft in conjunction with wiping such devices clean. Partly due to the fact that the employees “stay home” and are convinced that they have good visibility over their physical environment. However, thefts will happen, and the security angle will need to be tackled. I cannot understand why so few administrators allow internal networks to stay open, and who pay attention to their internal network traffic with only commonly used tools for network monitoring. Same tools that are deployed normally are themselves a potential attack target.

 

About Version 2 Limited

Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.


About GREYCORTEX

Founded in 2016 in Brno, Czech Republic, GREYCORTEX helps organizations make their IT and OT operations secure and reliable with uses advanced artificial intelligence, machine learning, and data mining methods which detect advanced threats to security and risks to reliability that other solutions miss.

MENDEL 3.5 NOW AVAILABLE

GREYCORTEX is happy to announce that we have released the latest version of our MENDEL network traffic analysis solution. Version 3.5.0 brings important features, improvements, and bug fixes. Among major features, you can find Central Event Management, which enables users to create multi-level appliance structure for exhaustive network overview, or data export into CSV format for more in-depth analysis or enriching other big data tools.

This version contains a number of major changes in the system. To ensure a smooth upgrade process and to provide support to all our partners and customers, we will be introducing this release gradually over the next 14 days.

NEW FEATURES

Data Export into CSV format

MENDEL users can now export data regarding hosts, network, flows, and even incidents into csv. format for further processing and creation of new network data visualizations.

Central Event Management

For customers or partners with larger deployments, MENDEL offers the ability to connect appliances using a multi-level structure; consisting of sensors, collectors, and a Central Event Management console. This provides a more comprehensive overview of the full network.

Validating SSL and TLS certificates

For encrypted communication, MENDEL detects expired or invalid SSL and TLS certificates and alerts the user.

ARP protocol parser

We have added the ability to parse the communications using the Address Resolution Protocol for even better processing of non-IP data.

ENHANCEMENTS

Operating system identification using L7 data

MENDEL is able to detect the operating system of the host more precisely, using an advanced data model based on Samba, DHCP, HTTP, SSH, and L3/L4 parameters, among others. Data is also presented within a new dashboard showing the top operating systems in the network for the chosen period.

Filtering data by additional values

We added the option to filter by additional variables, including operating system, interface, application, and port range.

New predefined dashboards

We have provided two new dashboards: Risks and Statistics; for our users to quickly and easily review the situation in their network.

Additional Enhancements:

  • Upgrade of system components
  • Printer tagging
  • Browser protocol parser
  • Sensor-Collector management
  • Enhanced TLS 1.3 protocol parser
  • Extended host/subnet lease time
  • Configurable display level
  • Decoding QoS/DSCP
  • System improvements
  • Network capture module improvements
  • GUI improvements
  • Localization improvements 

SCADA

MMS protocol processing

For the visualization of MMS protocol data and further analysis, we added MMS protocol processing.

Asset resources management

We added the ability to name, manage, and add new devices in the network.

DLMS/COSEM protocol parser

We added parsing for DLMS/COSEM, one of the most widely accepted international standards for utility meter data exchange.

OMRON FINS protocol parser

We added parsing for the OMRON FINS protocol, which can be used by a PLC program to transfer data and perform other services with a remote PLC connected on an ethernet network.

FIXED ISSUES

In general, our development team focused on improving user experience and reporting. As well as more improvements to user experience, system stability, and performance.

Please note that upgrading to version 3.5.0 will replace the system kernel and reboot the appliance.

We recommend having direct or remote access to the appliance in order to be able to restart it if necessary.

About Version 2 Limited

Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About GREYCORTEX

Founded in 2016 in Brno, Czech Republic, GREYCORTEX helps organizations make their IT and OT operations secure and reliable with uses advanced artificial intelligence, machine learning, and data mining methods which detect advanced threats to security and risks to reliability that other solutions miss.

NEW GREYCORTEX AREA MANAGER – ALENA ŘEZNÍČKOVÁ

GREYCORTEX is happy to announce that beginning January 1st, Alena Řezníčková will be the new Area Manager for the Czech Republic and Slovakia. Řezníčková has been working in the IT security field since 1992. She has held business and managerial positions in several well-known Czech and international companies, including AEC, ASSECO, PCS, ANECT, McAfee, and Intel Czech Tradings. Prior to assuming the Area Manager role, she worked with GREYCORTEX for several months as an external consultant.
“During the time I have worked with the GREYCORTEX team, I’ve seen for myself that MENDEL, the GREYCORTEX solution for network security monitoring, is a unique product with great potential. The GREYCORTEX team is made up of committed and determined professionals with great personal qualities. It is fascinating to continually experience the “wow effect” when presenting MENDEL to customers and visualizing their networks; since, with MENDEL, they can see what is happening inside their infrastructure. Our clients and customers appreciate that they are part of the team in terms of discussions about our road map and the development of the solution. I can see my main mission in these two areas: strengthening the partner channel and expanding the partner network, including the full lifecycle of cybersecurity management, further leveraging experience and customer needs to develop our solutions,” said Řezníčková.
GREYCORTEX CEO, Petr Chaloupka added: “Alena has many years of experience working in companies offering cyber security solutions and in managing business teams. In previous positions, especially as Country Manager of McAfee (later Intel), she managed to build mutually beneficial partnerships with technology companies in the Czech Republic and Slovakia. I appreciate her involvement in the activities of the Czech branch of AFCEA and long-term relationships with key personalities of IT security.”

GREYCORTEX MENDEL網路流量分析系統收集數百種特徵以檢測網路威脅

【GREYCORTEX MENDEL(人工智慧監控軟體)】針對企業網路流量進行深度剖析，收集流量的數百種特徵，再藉由機器學習，找出潛伏在內部的威脅，達到較為全面保護整體網路環境的目的
 
 
偵測企業內部網路流量，找出可能潛在的威脅，稱做網路流量分析（Network Traffic Analysis，NTA）系統，近年陸續有相關產品引進到臺灣，今年年初，代理ESET防毒軟體的臺灣二版，他們開始提供GreyCortex Mendel解決方案，訴求企業能藉著這套系統，分析流量封包，監控內部網路的行為，進行找出網路環境中，可能存在的弱點或是攻擊事件。
 
這款網路流量分析系統運用了機器學習，並能深度檢測流量內容，找出未知的威脅。原廠也指出，Mendel能處理比NetFlow多出6倍的功能，具備應用程式的感測，以及使用者身分識別的能力，同時能區隔人類與機器人執行的行為。有別於許多同類型產品收取NetFlow流量，這套系統支援進階安全網路評量（Advanced Security Network Metrics，ASNM）協定，會收集網路流量裡的數百種特徵，做為分析資料的來源，以便加以快速檢測。
 
而針對現今網路流量幾乎都受到加密保護的情況，Mendel也能夠拆解，並且支援最新的TLS 1.3。
 
藉著與企業已經部署的防火牆整合，Mendel能進一步封鎖指定的連接埠，阻斷所發現的攻擊事件。
 
原廠也強調Mendel能檢測的裝置類型相當廣泛，能涵蓋員工自行攜帶的設備（BYOD），以及應用相當廣泛的物聯網（IoT）裝置等。由於Mendel也會收集額外的感知資料，原廠宣稱，可更迅速彙整出攻擊事件的樣貌。
 
在建置架構的部分，Mendel由1個收集器（Collector）與多個感測器（Sensor）組合而成，企業可依據網路環境的組態，增加或是減少所需的感測器數量，而這些設備的型態，可以是實體設備或是虛擬機器。
 
產品資訊
●系統組成元件：收集器（Collector）、感測器（Sensor）
●部署型式：純軟體或虛擬機器
●系統需求：8核心處理器、32GB記憶體、500GB儲存空間、2張網路卡
 
*原文出處：<iThome> https://www.ithome.com.tw/review/133852

GREYCORTEX WINS EY CYBERSECURITY SPACE INNOVATION TROPHY

Brno, Czech Republic

GREYCORTEX is happy to announce that we have won the 2019 EY Cybersecurity Trophy (EY ESO) in the Cybersecurity Space Innovation category. The winners were announced at an awards ceremony in Bratislava, Slovakia on December 10, 2019.

EY, whose motto is “Building a better working world,” has identified the need for greater focus on cybersecurity. Based on many years with the world’s leading consulting firms, competition founder Peter Borák, has good reason to emphasize cybersecurity. Due to the increasing frequency of cyber-attacks, extremely sensitive data is leaked, and risks increase every year. “Our primary concern is to help organizations make better decisions on very complex cybersecurity issues. With faster digitization, the risk is accelerating. All organizations should take care about their data protection,” said Borák.

In its Global Information Security Survey, EY recommends that cyber security and surveillance be included in the structure of every organization. EY’s main goal is not only to draw attention to the problem and to inform the professional and general public about the cyber security issues, but also to offer solutions and a wider understanding of the context of the problem. This is why EY recognizes innovative cybersecurity companies and ethical hackers with these awards.

Petr Chaloupka, CEO of GREYCORTEX, noted after receiving the award: “Cybercriminals now run on huge budgets and are constantly improving their procedures. This is the reason why cybersecurity analysts also need to have state-of-the-art technology to defend themselves effectively. Today, it is no longer possible to manually analyze all traffic in each individual private or state organization, to monitor all possible attack vectors, or eliminate all human failures. That’s why advanced technologies, machine learning, and artificial intelligence are on the scene to help with this defense.” Thanks to the integration of these principles into our MENDEL product, GREYCORTEX was included in Gartner’s 2019 Market Guide for Network Traffic Analysis.

This year, the EY ESO winners are Rastislav Klč in the EY ESO Chief Information Security Officer category, Tomáš Ležovič as EY ESO DNA Born Ethical Hacker, GREYCORTEX s.r.o. as the EY ESO Cyber Security Space Innovation, and Milan Kyselica as the winner of the EY ESO Security Future Promise, as well as overall winner.

 

EY ESO photo

EQUIFAX DISCLOSES MASSIVE DATA BREACH

Today, September 8, 2017, Equifax, one of the largest credit reporting agencies in the United States, has disclosed that they suffered a massive data breach because their network was compromised by unknown hackers. According to the Equifax’s press release, attackers gained access to personal data of almost 143 million Americans. Social security numbers, birth dates and addresses of nearly half the population lost in this breach of the US could be misused by hackers for years to come. Credit card numbers of US-customers and non-US customers were also stolen. After Equifax announced the cyberattack, their shares dropped 13%.
Official information posted on the Equifax website states: “Based on the company’s investigation, the unauthorized access occurred from mid-May through July 2017.” The breach was disclosed only yesterday, meaning it took six weeks to detect the cyberattack.
Network security solutions like GREYCORTEX that identify anomalous behavior within your network are especially important in this situation. These solutions mean your IT team can identify malware by its anomalous movement within the network, and identify it as it replicates. GREYCORTEX MENDEL identifies such anomalous behavior, offers deep network visibility, and differentiates between human and machine behavior, meaning you can find infected devices within your network and secure your company’s data and reputation.

THE FIREWALL ISN’T A FIX-ALL

Understanding the limitations of perimeter security

June 10, 2019

Firewalls.

Everybody in IT knows what they are and nearly every company has them, some even without knowing it. They prevent unwanted communication. In most cases, it’s the first line of defense against network threats. They are effective, and are part of the list of basic requirements for any network security infrastructure.
But are firewalls enough? How about “Next Generation Firewalls”? To answer that, it is helpful to have at least a basic understanding of how firewalls work. Firewalls work like a ticket agent at the airport – you have a ticket? Great, you’re on the flight. No ticket? Go away. In technical terms, firewalls are based on rules that describe the network communication, which can, for example, allow or deny communication only from specific subnets, IP addresses, on particular ports, or no communication at all.
Firewalls haven’t stayed static, and they have become more advanced; like Next Generation Firewalls or Web Application Firewalls. Next Generation Firewalls are like a gatekeeper on steroids – not only will they not let you in if you don’t have a ticket, but will kick you out if you misbehave during the communication for which you had access. Essentially like a bouncer at a bar on New Year’s – you can come in if you have a ticket, but if you start being “fresh” with your fellow party-goers, you get tossed out. Beside basic firewall features, Next Generation Firewalls also contain Application Firewalls, which controls specific services or applications (not just IPs and ports) and Intrusion Prevention Systems, which block unwanted or malicious communication and are also referred to as IPS.
That’s a lot of walls.

Now, let’s look at whether they are as effective as they are expected to be.

Physical access

Picture a situation where an attacker tries to get into your network the easy way – through physical means. Firewalls are configured to ignore any communication that originates in the external network and is aimed at the core switch. The physical attack can include interaction with employees (more on that in our previous blog post), dumpster diving, physical access to areas, even the restricted ones, and more. In most cases, it’s enough to get into a conference room (sometimes even alone), plug your device into the network via wire and the attacker is into the network and off to the races. It’s then possible to set up a remote connection from within the network, because firewall policies for internal networks are often much less restrictive than those for external network (employees need to be able to work), allowing undisturbed access inside the network, not cut off by a firewall.

Remote access

Of course, access can be gained even without any physical access. For example, a new critical vulnerability is discovered for a popular network device provider which allows anyone to execute commands from the console on that device. Cases like this don’t happen every day, but they happen nevertheless. And when they happen, they can be catastrophic, because they are unknown to the existing network security tools or network/network security administrators. An attacker with remote shell access on such a device is then able to do anything. At that point, network is his, not yours.
While vulnerabilities like this are not as common, there are other remote attacks that are efficient, effective, and more common. In our previous blogpost we described one phishing scenario and we can build on that here. Say an attacker sends a crafted .pdf file via email to the victim. Since email communication is something that nearly every company needs, the email itself is not blocked. Maybe it’s disguised as an invoice or as a charity offer (as in the previous blog post), but once that file opens, the attacker gains full access to that computer and possibly even anything that’s available from there. You might think “but we use tools that prevent any malware in emails, we’re safe.” You might be right, but these are functionally just protection against spambots. Keep in mind that this will catch only known files – that are known to the security tool. If someone sends new malware, or specially created malware (which is usually how this attack is accomplished), then it won’t help.
Sign Up

BYOD

Finally, consider the example of the “personal device” – where (for example) Karen in the Accounting Department brings her phone to the office, and connects it to the network. Karen likes to watch MMA, but happens to use her mobile to stream content from sites which don’t respect authors and performance rights – what might be called a “bootleg feed” or a torrent site. As these streaming sites are notoriously rife with malware, Karen’s device is now infected – because she isn’t deploying mobile device security. When she accesses the trusted internal wifi network via her phone, she is opening up a direct pipeline for all of the malware on her phone, without having to go through the firewall.
In all of these scenarios, the firewall is ineffective, because not all of the communication comes through the firewall. This means that while a firewall is effective, it doesn’t offer 100% protection. Gaps exist, just a few of which have been included here.

But how to close the gap?

With enough time and effort, any network can be penetrated. To minimize the damage, you need to take precautions steps and close gaps left by tools like firewalls. How can you do this? To be able to identify what dangers have escaped your firewall, you need to be able to visualize every communication and every device in the network. Network Traffic Analysis (NTA) solutions monitor network traffic from communications not just through the firewall, but within the firewall as well – closing the gap on not just targeted attacks from outside, but also on BYOD, and other “safe” communications within the network. With full visibility, you know about everything that happens, right when it happens, which means you can respond to detected attacks before any serious damage happens to your organization, saving money, reputation, and your IT team’s sanity.

Identify anomalies

But what good is a mere visibility if there are countless packets every second? No one will be able to go through it all in real time – even with a team of thousands. So how to make sure that this incident gets the attention it deserves? NTA technology also helps to identify anomalous communications – devices acting strangely – on the network. Since an infected device starts to behave differently than it’s normal behavior – even in hard-to-identify ways – NTA technology; like MENDEL from GREYCORTEX, solves the problem, because it analyzes all network traffic and is able to spot these anomalous behaviors nearly immediately. It then informs the network team, allowing them to isolate infected or questionable devices from the rest of the network, preventing further damage, as well as to further investigate the incident without any risk of compromising further devices.
Having a firewall greatly improves the security of your network, but relying only on firewalls is irresponsible for many reasons – poor configuration, advanced threats or above-mentioned gaps. To be sure that nothing leaves your network without you knowing about it or having a say in it, you need bigger guns than just a firewall, even a next generation one. For significant improvement in your security, you need NTA solution to identify the hidden connected devices on the network, as well as to identify anomalous behavior that shows the hidden work of a compromised device.

BEING “SMART” DOESN’T MAKE YOU SAFE

As you may have noticed, we have posted a lot on LinkedIn recently about new cyber attacks. The biggest link between these is that those attacks are commonly caused by not following best practices, or relying only on “legacy” security tools and/or the use of weak passwords.
Even with the use of today’s most advanced security tools, it can all fail at the weakest link of the security chain – people. According to csoonline, 56% of IT decision-makers claim that targeted phishing attacks are their top security threat. And this fear isn’t wrong. Everyone can be conned, even conmen. In many cases, it’s easier to get inside of the network if you abuse that fact. The most commonly used methods of exploiting people are phishing and blackmailing.
Phishing in its simplest form can be easily detected by regular humans. Because it’s not targeted, people on the receiving end can simply ask question “why did I get this email when it has nothing to do with me?” When it comes to more advanced phishing forms, like “whale” (going for the big target, e.g. top management or CEO) or spear phishing (targeted attacks against certain group/ individual), the attacker does the research and gets to know as much as possible about victims, which can be done with a search on the Internet or dumpster diving (think about what you throw away – are there any documents?). Once equipped with knowledge about the target, those attempts are way more effective.
Let’s examine it the security context. In this example, paraphrased from Christopher Hadnagy’s book “Social Engineering: The Art of Human Hacking,” an overconfident CEO is the target. The CEO thought that it’s not possible to hack him mainly for two reasons: he doesn’t utilize much technology in his personal life, and he thought that he was too smart to fall for phishing. Turns out he wasn’t that smart after all. In this example, the CEO expected an audit and readied himself for it. After scouring various sources of information, attackers decided to go with: the name of his favorite baseball team, favorite restaurant, and that he contributed funding to cancer research. On one Friday evening, a phone call took place. In it, the attacker approached the CEO with a plea asking about small contribution to the cancer cure research stating that here will be also a contest for contributors – winners will get two tickets to CEO’s favorite baseball team match (claiming that they know that baseball is not everyone’s cup of tea) and a voucher to one of three restaurants, including CEO’s favorite one. The CEO was willing to contribute, motivated by his desire to cure cancer and the possibility of winning tickets and a voucher, he told the attacker his email address, so they would be able to send him a .pdf file. That file contained a malicious code and CEO opened it, thus providing the attacker with access to his computer and everything in its reach.
Now that his computer has been compromised, as well as access to everything within the organization his authority (and passwords) will let him touch. So what to do? The attacker has access from his computer, so access rights to sensitive files are not an issue, nor is it an issue for the security team that the CEO is accessing files throughout the company. Is there a way to identify that the “CEO” accessing sensitive data is not actually the “real” CEO? Here’s where NTA technology can help. The next step following gaining access to the CEO’s accounts is to exfiltrate data. Network traffic analysis identifies that the computer in question is transmitting data where it shouldn’t, and/or in volumes that it shouldn’t. The computer can then be quarantined, the CEO alerted, and the attacker caught.
But while phishing may be the attack that’s on the mind of management, IT teams understand that “legacy” security tools, like sandbox, IDS, endpoint security or even a firewall, are not sufficient anymore. Let’s look at why.
Modern malware has many methods of detecting if it has infiltrated a “real” environment, or in cases of targeted attacks, if it has hit the right target. When such malware determines that it could be exposed, it lies dormant. This means that if you check everything that enters your company using a sandbox, malicious software can still enter the network if it is sufficiently advanced.
Known threats are usually detected by known patterns or hashes used by endpoint security or IDS, which makes them ineffective against new or advanced threats. Some endpoint security tools use AI to determine malicious behavior and are better equipped to fight new threats, but not every device can have endpoint security. Personal or “bring your own device (BYOD)” are a great example – like a laptop that an employee brings from home and connects to the network – or an IoT sensor where endpoint software cannot be installed. These devices are connected, but not secured by endpoint security.
Firewalls are essential to any networks security infrastructure, and stop communication that goes through them, meaning that generally they are able to protect the company for any threat that comes from the external network. But what if the attack starts after a user accidentally opens a communication link which allows the attacker to get behind the firewall and inside the network? What if the threat was brought inside the company by other means than through the Internet and then tries to spread in the internal network?
While the technology is different in each of these possible attacks, they all have one thing in common – attackers who exploit a gap in the security. The best gap fillers currently available are NTA solutions, like MENDEL from GREYCORTEX. MENDEL monitors all network traffic and analyzes changes of behavior in hosts, detects policy violations, data leaks, and much more. Not every unauthorized entry can be prevented before hit happens. Relying on legacy security tools means it can take months (some statistics reference nearly 200 days) to detect attackers as they move in the network. NTA solutions like MENDEL lower this time to between minutes and a few hours, often before actual damage happens in the network or the attacker knows they’ve gained access.
The question is not if you will get hacked. The question is when you will get hacked. And when that happens, are you ready for it and can you stop it, or will you still rely solely on best practices, as the CEO did, or on “legacy” security tools?