2021 彙整 - Page 61 of 67

ASRC 2020 年郵件安全趨勢回顧

2020 年幾乎全年都受到 COVID-19 疫情影響。疫情的出現改變了全球數位工作模式，為了降低疫情對工作人力的衝擊，遠距工作或在家學習成了重要選項，很可能也將成為今後的常態。

遠距工作挑戰了傳統的資安部署觀念，遠端存取不再有「可信任的區塊或空間場域」，因此，所有服務的存取都需要驗證迫使了零信任的架構要提早被實現。遠距工作也推動了雲端應用的加速，雲端服務商算是疫情下少數的受惠者；但雲端服務設定不當造成資料大批洩漏的情況，算是容易被忽視的資安弱點。此外，不論是安全人員或是攻擊者，面對遠距工作直覺可聯想到的資安問題，就是 VPN 連線的安全性保護及 DDoS 攻擊或任何可能阻斷服務取得的手段，這類攻擊在 2020 年算是最容易被觀察到的事件了。

2020 年郵件安全有哪些明顯的趨勢呢？

詐騙郵件

到疫情的影響，在郵件安全方面防疫物資的詐騙經常出現。這些防疫物資的銷售廣告來自不明的公司與新註冊的域名，且出現的頻率與疫情的嚴重程度、防疫物資的匱乏程度有關係。2020 年的第一季與第二季較常看到此類詐騙；第四季後就相對少了許多。

為了口罩銷售而指向一些新註冊的域名

除了與疫情有關的詐騙郵件外，還有內容以恫嚇收件人電腦遭到入侵與監控的比特幣詐騙郵件。詐騙的內容其實是杜撰的，但這樣的詐騙郵件內容依發送的地區與國別，融合了多國的在地化語言，以提高詐騙成功的機率。

攻擊目標為中國，則以簡體字為內容

有些詐騙並非以直接騙取金錢為目的，而是騙取企業內部的資訊，再作後續利用。這樣的詐騙在 2020 年居家辦公，不便直接確認的情況下，特別容易奏效。

冒充企業高層，向員工索討企業內部資訊，或冒名令其執行不該執行的事務

釣魚郵件

2020 年最大宗的攻擊，非釣魚郵件莫屬了。通常釣魚的目標，是希望能釣取企業服務的各種憑證，尤其在遠距工作的情況下，若能釣到一組企業電子郵件的帳號密碼，很可能就能遠距取用企業的所有服務！

意圖騙取郵件帳號密碼的釣魚郵件

在 2020 年第四季，我們也觀察到了聲稱未付稅金導致郵件包裹延遲的釣魚郵件。這種釣魚郵件的目的是藉由假的刷卡付稅，釣取信用卡資訊。在受疫情影響仰賴物流的情況之下，這種釣魚郵件將使受害者更容易上勾！

藉由假的刷卡付稅，釣取信用卡的刷卡資訊

漏洞利用

試圖透過電子郵件嘗試入侵企業單位內部，以利進行後續的竊資、部署勒索軟體等目的。這類攻擊，多半直接寄送可利用 Office 漏洞的惡意文件，並以疫情相關主題誘騙收信人開啟，試圖藉此提高攻擊成功機率。

經統計，此類型攻擊常用的漏洞編號為：CVE-2012-0158、CVE-2017-11882、CVE-2017-0199、CVE-2017-8570 以及 CVE-2018-0802。

冒名 CDC 的通知，事實上為一可利用 CVE-2017-11882 漏洞的惡意文件

針對性攻擊

在 2020 年我們也觀察到了多起與疫情有關的針對性攻擊，與國家資助有關的 APT 族群嘗試以電子郵件攻擊則在五月份最為頻繁，其中有許多與疫情資訊、設備發放、公告通知或口罩相關資訊有關。

假防疫設備支援名義，試圖攻擊相關業者

搭配當時發生的時事，對特定單位發動的針對性攻擊

此外，BEC 攻擊事件以一月份為基準做為比對的話，在 2020 年 11 月份達到全年最高峰，這些 BEC 攻擊郵件中都存在著被攻擊對象才能知道的機敏資訊。

結語

2021 年仍無法明確預測何時可以完全擺脫疫情，而許多企業已將遠距工作視為未來可能的常態。遠距工作為資安帶來了新的挑戰，在家辦公的電腦及所使用的網路也難以確保安全性，因此具備合理存取權限的零信任的架構勢必是未來趨勢。由於遠距工作的關係，非即時同步確認事項的聯繫，多半倚賴電子郵件或其他傳訊軟體，各種詐騙事件將層出不窮。除了應避免公司資料外洩外，重要事項的聯絡，最好能設立第二通訊管道作確認；而重大決策也必須落實複核機制，才能避免 BEC 事件的發生。

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於中華數位科技 Softnext Technologies Corp.
創立於2000年8月。
秉持著【We Secure Your Content】的服務理念，以提供企業資訊應用管理服務及打造資訊內容安全防護為宗旨。專精於提供網路應用服務技術，根據市場需求推出多款資訊內容安全的解決方案及應用服務，能夠協助企業透過符合資安管理規範並遵循法規的方式進行資訊內容安全管理，以維護員工的生產力、提升企業經營績效。

關於 ASRC 垃圾訊息研究中心
ASRC 垃圾訊息研究中心 (Asia Spam-message Research Center)，長期與中華數位科技合作，致力於全球垃圾郵件、惡意郵件、網路攻擊事件等相關研究事宜，並運用相關數據統計、調查、趨勢分析、學術研究、跨業交流、研討活動..等方式，促成產官學界共同致力於淨化網際網路之電子郵件使用環境。更多資訊請參考 www.asrc-global.com .

Softnext 2021

SASE & the Future of Network Access Control

The current enterprise network security practices focus on verifying the identity of the user and the device in a perimeter-less environment, where cloud-hosted technologies prevail in the enterprise and where remote sites include branch offices and employees working from home.

In Gartner’s paper “The Future of Network Security is in the Cloud”, one of the key findings is that “network security architectures that place the enterprise data center at the center of connectivity requirements are an inhibitor to the dynamic access requirements of digital business.” And there is a recommendation for enterprises to move their security into the cloud, based on a networking and security model called Secure SASE, a term coined by Gartner’s leading security analysts.

What is SASE?

SASE, pronounced “sassy”, stands for Secure Access Service Edge. It is a cloud-based network security model and category, proposed by Gartner in 2019, to support agile secure access to enterprise assets. This model includes the network security solutions in a global and cloud-native service that allows IT teams to easily connect and secure all of their organization’s networks and users in an agile, cost-effective, and scalable way. This is especially useful in the currently globally dispersed digital enterprise.

According to Gartner’s analysis, SASE can be characterized as an identity-driven, cloud-native, globally distributed technology that supports and impacts all enterprise edges and IT domains. For example, this would include a branch office in LA along with the main HQ in London, while traveling/mobile team members can connect on the go.

“SASE capabilities are delivered as a service-based upon the identity of the entity, real-time context, enterprise security/compliance policies and continuous assessment of risk/trust throughout the sessions. Identities of entities can be associated with people, groups of people (branch offices), devices, applications, services, IoT systems, or edge computing locations.” (Gartner)

SASE addresses the numerous problems with traditional network security methods, many of which are rooted in the idea that network security architectures should be placed at the center of connectivity in the HQ or data center, where typically branch locations are more vulnerable to attack.

Why should I care? What’s the problem?

Network security legacy applications cannot efficiently support newer networking use cases that have moved to “the edge”, such as cloud applications, dynamic services, and distributed data in remote branch offices. Traditional on-premises architectures introduce challenges such as latency, large management overhead, networking blind spots, and continuous reconfiguration work by the IT team as vendors, services, and equipment change. Even though the SASE model is not without its own challenges, it can eliminate these issues by removing cumbersome technologies and networking complexities, while moving the entire security process to the network edge (The point where the enterprise-owned network connects to a third-party, particularly cloud technologies. Oftentimes, network administrators refer to their “WAN edge” or “internet edge”).

If enterprises try to solve IT challenges as they emerge, with ad-hoc/point solutions, they will be leading themselves into technical compounds that are complex and costly to manage, and that will not necessarily work well with each other in terms of efficiency and speed. Complex and cumbersome communications between IT components slow down IT and its response rate to different business requirements.

SASE can change this paradigm because as mentioned, it is identity-driven, cloud-native, globally distributed, and securely connects all edges (WAN, cloud, mobile, and IoT). With SASE, enterprises can reduce the time it takes to develop new products, deliver them to the market, and respond efficiently and appropriately to the increasing changes in business conditions.

Shift happens.

In the last few years, as more organizations around the world became more decentralized, each office location is considered to be a remote site/ a branch office location, by organizational security controls. Companies either consume access security services in a costly method through data centers, implementing redundant controls in each location, or worse, neglecting the security for that part of the enterprise network altogether.

In simple terms, we are talking about delivering an all-access security suite from the cloud and not from the data center. This is in line with the trend of identity brokers moving to the cloud (such as Azure, G Suite, Okta, and others) as well as the continued migration to the cloud of many other cyber-security architectures and IT services.

In a scenario where you are implementing an on-premises NAC solution that goes with your on-premises network equipment, you can easily identify and authenticate the end-users. However, if your organization is distributed and like many others, has transitioned to using a cloud-delivered ID broker, then continuing to consume authentication and access services from the cloud make much more sense.

In the diagram, on the left side, we can see the price of not leaving any remote site exposed – either you pay a very high price for each location, or you need to duplicate your security mechanisms in each location which is costly. The second option is to authenticate and obtain your access rights and compliance needs via the closest, geo-redundant cloud service available.

OK, so what happens now?

The sensible course of action is to plan a security strategy to be scalable and efficient in the present, while at the same time future-proofing the organization’s security. With the organizational data migrating to the network edge, it makes sense to authenticate and authorize users and devices in a cloud format, thereby assuring that regardless of the equipment and geolocation, employees can securely connect in a cost-efficient and secure method to the needed resources.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

What have we learned about mobile security in 2020?

Whether we like it or not, it is now an established fact that mobile phones play a major role in our day-to-day life, and never has this been truer than in 2020. With opportunities for socializing and travel reduced, it has been a year of scrolling, messaging and video calling. While there is a general perception that mobile phones are a safe haven from malware and cyberthreats, ESET’s research this year has shown that to be far from the truth.

Android threats surged in March, as the COVID-19 crisis created an opportunity for threat actors to exploit Android users’ hunger for information about the virus and related topics. ESET researchers witnessed malicious apps distributed in campaigns under coronavirus-themed disguises, such as infection maps, tracking applications and information about financial compensation.

For example, in Q2 2020, ESET researchers identified a new Android crypto-ransomware posing as a Canadian COVID-19 tracing app, just days after the Canadian government announced its intention to back the development of a nationwide tracing app. ESET researchers also analyzed an extremely dangerous Android app in May called DEFENSOR ID, which was capable of wiping out a victim’s bank account or cryptocurrency wallet and taking over their email or social media accounts.

In July, a long-running cyberespionage campaign was discovered that targeted Android users in the Middle East via the malicious Welcome Chat app. The app’s operators spied on their victims and then made the data harvested from them freely available on the internet. Similarly, victims in the Middle East were also targeted with a new version of Android spyware used by the APT-C-23 group, which allowed threat actors to read notifications from messaging apps and record calls and screen activity.

These discoveries demonstrate that threats must be taken seriously, but they do not need to ruin our experience with mobile phones – it is vital that we are just as committed to protecting our phones with cybersecurity software as we are our laptops and desktops. ESET Mobile Security (EMS) is a solution for Android that protects against a multitude of mobile threats, securing users’ data through strong malware protection and providing a safe browsing environment with its anti-phishing feature. EMS also protects users from physical loss and theft, supplying real-time information about the status and whereabouts of the device in question.

In September of this year, version 6.0 of ESET Mobile Security was launched, adding a host of new features including Payment Protection, which safeguards users while they are using applications in which they access sensitive financial information for banking transactions or online shopping. The feature prevents other apps replacing or reading the screen of any applications installed from the Google Play store that fall into the finance category, also allowing users to use the same protection for other installed apps that fall outside of the finance category.

Version 6.0 also brought design changes, improving its intuitiveness and ease of use with features such as the Call Filter feature that allows users to protect against unwanted incoming calls and a redesign of the Anti-Theft feature to allow for simpler onboarding and resetting of passwords.

The year 2020 also saw ESET awarded certificates by MRG Effitas, a world leader in independent IT security efficacy testing, in their Android 360° Assessment Programmes in Q1, Q2 and Q3, receiving a 99%+ score for detection. As both the report and ESET’s research highlight, Android-based threats are constantly on the rise, and it is therefore vital to have software installed that protects against malware, as well as other threats such as phishing.

To find out more about ESET Mobile Security and how it can keep you and your phone safe from mobile threats, head over to ESET’s website.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2021

ESET discovers Kobalos: tiny yet complex Linux threat attacking supercomputers

BRATISLAVA, MONTREAL – ESET researchers discovered Kobalos, a malware that has been attacking supercomputers – high performance computer (HPC) clusters. ESET has worked with the CERN Computer Security Team and other organizations involved in mitigating attacks on these scientific research networks. Among other targets was a large Asian ISP, a North American endpoint security vendor as well as several privately held servers.

ESET researchers have reverse engineered this small, yet complex malware that is portable to many operating systems including Linux, BSD, Solaris, and possibly AIX and Windows. “We have named this malware Kobalos for its tiny code size and many tricks; in Greek mythology, a kobalos is a small, mischievous creature,” explains Marc-Etienne Léveillé, who investigated Kobalos. “It has to be said that this level of sophistication is only rarely seen in Linux malware,” adds Léveillé.

Kobalos is a backdoor containing broad commands that don’t reveal the intent of the attackers. “In short, Kobalos grants remote access to the file system, provides the ability to spawn terminal sessions, and allows proxying connections to other Kobalos-infected servers,” says Léveillé.

Any server compromised by Kobalos can be turned into a Command & Control (C&C) server by the operators sending a single command. As the C&C server IP addresses and ports are hardcoded into the executable, the operators can then generate new Kobalos samples that use this new C&C server. In addition, in most systems compromised by Kobalos, the client for secure communication (SSH) is compromised to steal credentials.

“Anyone using the SSH client of a compromised machine will have their credentials captured. Those credentials can then be used by the attackers to install Kobalos on the newly discovered server later,”

adds Léveillé. Setting up two-factor authentication for connecting to SSH servers will mitigate the threat, since the use of stolen credentials seems to be one of the ways it is able to propagate to different systems.

For more technical details about Kobalos, read the blogpost “Kobalos – A complex Linux threat to high performance computing infrastructure” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

Industry and region of compromised organizations

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET 2021

The Competitive Landscape report for PAM

Privileged credentials are spread across the infrastructure of organizations of all sizes and types. Through them, it is possible to take a series of administrative actions, such as significant changes in assets and critical systems as Domain Admin servers or ERP systems. No wonder one can also call them “keys to the kingdom”.

And ensuring the security of these “keys” and privileged access is not an easy task for those responsible for Information Security. And taking into account the latest news of data leaks, not just IT teams but all organizational leaders are aware of the risks associated with privileged credentials and how such risks are considered to be part of the business strategy.

It is also worth remembering that, driven by the shift to decentralized models, we saw a boom of cloud-based approaches. For this reason, according to Gartner, more than half of global companies that already use Cloud will adopt a 100% Cloud-based strategy by 2021. In addition, the increase in connected devices as a result of the expansion of IoT, Industry 4.0 (also called Industrial IoT), DevOps, and other digital transformation initiatives has also increased the number of connected devices and privileged credentials. Many of these credentials are not associated with people and are called service accounts. As they are not associated with a user, in most cases, these accounts are not properly managed and monitored by the security teams, which increases the risk of being exploited by malicious attackers.

And for those who think cyberattacks are limited to large organizations, 28% of these attacks were performed against small and medium-sized businesses, according to the Data Breach Investigation Report from 2020. Also, research by the National Cyber Security Alliance has found that 60% of these companies shut down within 6 months after a cyberattack.

Regarding cyberattacks, some of the biggest and most recent ones involved the lack of proper protection for privileged credentials. The attack on SolarWinds, for example, came to show us the need to ensure the security of these credentials. This is because, by obtaining improper access to the infrastructure through malware, malicious attackers were able to move laterally through the infrastructure via compromised privileged credentials.

Thus, the goal of Privileged Access Management is to assist organizations to protect, control, manage, and monitor privileged access to critical assets. Therefore, by centralizing the management of privileged credentials in one place, a PAM solution is able to ensure the maximum level of security, controlling access and monitoring suspicious activities.

Gartner considers Privileged Access Management so important that it chose this market as the number one security project for two years in a row in its publication Top 10 Security Projects. And to address the Privileged Access Management scenario, Gartner has released the Competitive Landscape: Privileged Access Management report, prepared by its researcher Swati Rakheja.

And with the increase in PAM adoption, mainly through SaaS deployments, privileged credential management solutions, which were previously limited only to global organizations, are now also reaching small and medium-sized companies. Also according to Gartner’s report, the PAM market will continue to experience great adoption, expecting a compound annual growth (CAGR) of 10.7% between 2020 and 2024, reaching the size of USD 2.9 billion in 2024.

Considering that PAM use cases are evolving along with the capabilities and functionality of the solutions, and in order to continue to serve this large and promising market, PAM providers must reassess their strategic positioning in the market by offering new features to meet the needs of organizations of all sizes.

Some of the basic functionalities of a PAM solution, according to Gartner, include everything from credential discovery, onboarding, and management through password vaulting and rotation to privileged access governance and recording and auditing capabilities, such as privileged activity logging and reporting.

While small and medium-sized companies are starting their PAM implementations with these basic functionalities, global organizations are including advanced PAM use cases, which cover, for example, Just-in-time, or JIT access. When using JIT approaches, the solution performs access provisioning based on time of use, reducing the attack surface and the risks of attacks that exploit privileged credentials.

Also, functionalities based on Artificial Intelligence and Machine Learning, Privileged Task Automation, or PTA, and privileged session auditing are also included in the list of advanced PAM functionalities.

Other emerging needs in the PAM market are access management in multi-cloud and DevOps environments, including CI/CD automation and secrets management.

It is important to note that this difference in the use of PAM features also extends to geographic regions: while emerging markets such as Asia-Pacific and Latin America are still implementing basic Privileged Access Management features, more mature markets such as the European and North American already consider and implement more advanced use cases.

Finally, Gartner’s report presents the competitive profile of the main provider within the PAM market, including senhasegura. In this profile, Gartner brings information such as the product or portfolio overview and how the provider competes in the market.

Regarding senhasegura, Gartner highlighted our PAM offer based on the privileged access life-cycle, considering the Before-During-After approach. This life-cycle includes aspects from the discovery of assets, credentials, and digital certificates to the visibility of actions performed in the environment, allowing the organization to cover all aspects associated with the protection of credentials and privileged access.

As a competitive advantage of senhasegura, Gartner mentions Keystroke Dynamic Identity, or KDI. Based entirely on Artificial Intelligence and Machine Learning, KDI allows the continuous verification of the user’s identity through behavioral biometrics. Gartner also shows that senhasegura has been highly praised by its users for its ease of use and quick installation, not to mention its intuitive and user-friendly interface.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

2021 Segura