Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In the first part of this blog series, I took a look at how an understanding of digital strategy and digital risk is key to starting a security transformation journey. And in the second, I dug further into how a secure access service edge (SASE) architecture with security service edge (SSE) capabilities and zero trust principles can help mitigate the types of digital risk. In this final part, I will outline a few key use cases to show all of these elements in action.

Cyber incidents are becoming increasingly common and disruptive–whether it’s ransomware, data breaches, or leaks. The number of compelling events in the last few months in Australia have shown us the implications for businesses, and their customers, when a breach occurs.

Two weeks ago, I had the opportunity to attend and speak at the H-ISAC fall summit here in Phoenix. As always, this conference is a great opportunity to meet back up with customers and friends from all around the Healthcare sector. This leads to illuminating conversations that really give me a higher definition picture of what is happening in the trenches and helps me better understand how the work we’re doing here at Netskope can help.

Consolidating vendors has always been on the mind of digital leaders, but the current economic climate has elevated this topic, with a recent Gartner survey claiming that 75% of organisations are currently pursuing security vendor consolidation projects, up from 29% in 2020.

Threat actors exploiting cloud services are keeping me very busy in these final days of this troubled 2022. The main character of this Cloud Threats Memo is MuddyWater (also known as Earth Vetala, MERCURY, Static Kitten, Seedworm, and TEMP.Zagros), one of the most prolific cyber espionage groups, active since at least 2017, and believed to be a subordinate element within Iran’s Ministry of Intelligence and Security (MOIS).

In order to enable and sustain an effective and secure hybrid work environment, enterprises need security that can deliver protection anywhere, stop modern threats, ensure compliance, and maintain consistent policies across both on-premise and remote locations.

Starting January 1, 2023, Netskope will offer customers Cloud Exchange (CE), its industry leading integration platform, as a managed service. This managed service will enable a much larger customer base to benefit from CE, including customers lacking in-house resources or preferring to consume CE as a managed service.

If I asked you what the common ways to exploit a cloud app for malicious purposes are, I bet your answer would probably be either to use it to distribute malicious content (such as malware or phishing pages), or to host the command and control (C2) infrastructure. In reality another frequent technique is the dead drop resolver, where a legitimate service is abused by threat actors to host the information related to the C2 infrastructure rather than the C2 infrastructure itself.

In 2001, NIST (the US National Institute of Standards and Technology) announced Advanced Encryption Standard (AES), a new encryption standard, designed to help organisations enhance protections against brute force attacks. The previous Data Encryption Standard (DES) had become vulnerable, with processing power growing, and the Electronic Frontier Foundation (EFF) had proved that DES encryption could be broken in less than 24 hours, therefore a new encryption standard was required.