2024 彙整 - 頁159，共180

10 Security Metrics You Need to Be Monitoring Now

Monitoring key security metrics is an essential practice for network protection. By meticulously observing these indicators, you gain a better understanding of your security’s strength and potential weak spots, allowing for informed decision making and efficient planning of cybersecurity initiatives. This proactive approach provides an effective defense against potential threats.

Importance of Monitoring Security Metrics

In today’s complex cybersecurity landscape, the need for tracking and understanding security metrics is pivotal. These quantifiable indicators serve as a beacon, guiding your path through the challenging terrain of network security. They shed light on the performance and efficacy of your security systems, pinpointing the potential areas of vulnerability and charting the success of your team’s threat detection and mitigation efforts.

Security metrics, when carefully analyzed, equip you with the power to shape your cybersecurity approach effectively. They help in prioritizing resource allocation, ensuring you invest in areas that need the most attention. By providing an accurate picture of your organization’s compliance status, these metrics allow you to meet regulatory standards, thereby protecting your reputation and avoiding financial penalties.

With the right set of metrics, you can fine-tune your cybersecurity budget, ensuring every dollar spent contributes to enhancing your network security. Moreover, these metrics can identify potential opportunities for automation, an emerging force that can significantly boost your overall security and efficiency.

However, merely tracking these metrics is not enough. It’s crucial to imbibe these numbers into your strategic planning process, making data-driven decisions that bring about optimal results. This calls for a profound understanding of these metrics and their role in shaping your cybersecurity posture.

In the battlefield of cybersecurity, these metrics are your arsenal. They arm you with knowledge, insight, and the power to make strategic decisions. Leveraging them correctly can be the difference between a well-guarded fortress and a susceptible target. Hence, the importance of monitoring security metrics cannot be overstated. They are your compass in the intricate labyrinth of cybersecurity, guiding you towards a safer, more secure digital future for your organization.

Top 10 Security Metrics to Monitor

In the convoluted world of cybersecurity, there are vital security metrics that can serve as your organization’s touchstone. Monitoring these metrics not only provides insightful data but also aids in shaping a robust defense against cyber threats.

Here are the top 10 security metrics that deserve your constant attention:

Incidence Response Time: This denotes how swiftly your team acts upon detecting a potential threat. A prompt response is crucial to minimizing damage.
Patching Cadence: This metric measures how often and how rapidly your organization applies security patches. Regular, quick updates help to seal potential vulnerabilities.
Password Hygiene: An evaluation of the strength and frequency of password modifications throughout your network can significantly impact your cybersecurity strength.
Vulnerability Density: Monitoring the amount of vulnerabilities per system or application will enable your team to prioritize their remediation efforts.
Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR): These represent the average span it takes to discover and address a breach or threat. Lower values here indicate stronger security procedures.
Risk Appetite: It’s vital to understand the level of risk your organization is prepared to withstand while navigating through its digital operations.
Cost per Incident: Recognizing the financial repercussions of each security breach or incident provides a clearer picture of your cybersecurity ROI.
User Behavior: Identifying unusual or risky patterns in user behavior can serve as early warning signs of a potential security threat.
Compliance Status: Keeping tabs on your alignment with relevant industry regulations and standards will help avoid non-compliance penalties.
Threat Intelligence: Gauge how effectively your team utilizes their knowledge about the latest cybersecurity threats. This metric directly impacts your capability to stay one step ahead of potential cyber threats.

Properly comprehending and monitoring these metrics can illuminate your cybersecurity team’s path, assisting them in formulating effective strategies to safeguard your organization’s digital environment.

Achieving Success Against these Metrics

Attaining triumph against these metrics is a complex endeavor that calls for a thoughtful, comprehensive strategy. The cornerstone of this endeavor is a thorough grasp of these metrics and their respective implications on your cybersecurity landscape. By defining tangible benchmarks for success for each metric and regularly tracking your progression towards these benchmarks, you foster a culture of continual improvement in your cybersecurity operations.

Initiating an ongoing learning program for your team is equally crucial. This initiative will ensure that every member comprehends these metrics, appreciates their importance, and contributes effectively towards achieving your cybersecurity goals.

Integration of potent cybersecurity tools is another pivotal step towards success. Leverage technologies that provide actionable insights, bolster your defenses, and help you stay apace with the evolving threat landscape. Seek products that seamlessly align with your existing infrastructure, complement your security protocols, and deliver value for your investment.

Automation can be a game-changer in your quest for success against these metrics. When appropriately deployed, automation can take over routine tasks, free up your team’s bandwidth for more strategic activities, and significantly enhance your cybersecurity efficiency. It enables quicker detection and mitigation of threats, thereby improving your overall security posture.

Proactive engagement is yet another key to success. Encourage your team to stay vigilant, constantly analyze patterns, anticipate potential threats, and act swiftly when an issue is detected. This proactive approach is invaluable in a domain where threats can emerge at any moment and can quickly escalate if not addressed promptly.

Lastly, create an environment where every team member feels accountable for cybersecurity. Make it clear that cybersecurity is not just the responsibility of a specific team, but a shared responsibility across the organization. This mindset fosters a security-conscious culture, where everyone is actively engaged in protecting the organization’s digital assets.

In essence, attaining success against these metrics is a journey that demands a clear vision, the right tools, continual learning, proactive engagement, and a shared sense of responsibility. With these elements in place, you are well on your way to shaping a robust cybersecurity posture.

Risks of Failing to Monitor these Metrics

The repercussions of overlooking the surveillance of these security metrics can be quite perilous for your organization. Without these quantifiable indicators, evaluating the efficacy of your cybersecurity measures becomes a daunting task, potentially leaving your digital fortifications ill-equipped against the rapidly evolving and highly sophisticated cyber threats. Consequently, you may find your organization in the unenviable position of reacting to attacks rather than proactively preventing them.

Besides, in the absence of these critical metrics, your decision-making process regarding the allocation of resources might be compromised, leading to potential inefficiencies or even unnecessary spending. By bypassing these vital indicators, you may inadvertently misdirect your investments, leading to underprotected areas within your cybersecurity landscape.

Ignoring these metrics could also expose your organization to compliance risks. Without constant monitoring of your compliance status, there’s a significant risk of unknowingly breaching regulations, leading to costly penalties and potential reputational damage. Thus, failing to track these metrics can have serious implications for your organization’s regulatory alignment.

Also, by disregarding these metrics, you may be neglecting the potential for technological advancements, such as automation, to enhance your cybersecurity. This missed opportunity could leave your team burdened with routine tasks that could have been automated, leaving less time for strategic activities aimed at fortifying your network security.

Finally, without these metrics, you may find it challenging to anticipate and adapt to the increasing sophistication of cyber threats. The inability to identify and track threat intelligence effectively could leave your organization playing catch-up, a position that’s far from ideal in the high-stakes game of cybersecurity.

Therefore, by sidestepping the surveillance of these critical security metrics, you risk impairing your organization’s ability to protect itself in the ever-complex world of cybersecurity. The role of these metrics in maintaining a robust defense against cyber threats cannot be underestimated, making their constant monitoring an absolute necessity.

Conclusion

Navigating the ever-evolving labyrinth of cybersecurity is an intricate endeavor, made even more critical given the increasing sophistication and prevalence of cyber threats. In this complex arena, monitoring security metrics stands as an indispensable cornerstone. These measurable indicators serve as vital guides to your strategic formulation, enabling resource optimization, and fortifying your defense against the ceaseless tide of cyber threats. By giving due diligence to these ten key security metrics, you empower your team with the essential tools to effectively counter cyber threats, thereby safeguarding your organization’s invaluable digital assets. In essence, these security metrics are not just beneficial – they are a lifeline in the increasingly intricate and volatile world of cybersecurity. Therefore, any successful cybersecurity management approach should prioritize these metrics to secure a safer digital future for the organization.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

What is MSSP in cybersecurity?

A Managed Security Service Provider (MSSP) is a specialized IT service company focusing on cybersecurity. MSSPs help businesses protect themselves from cyber threats, enhance their security operations, and navigate the complex landscape of information security with greater ease and expertise.

MSSP vs. MSP: what’s the difference?

While both Managed Security Service Providers (MSSPs) and Managed Service Providers (MSPs) offer outsourced services, their focus areas differ significantly.

MSSPs specialize in cybersecurity, offering security services tailored to protect businesses from cyber threats. MSPs, on the other hand, provide a broader range of IT services, including but not limited to network management, support services, and software management.

The key distinction lies in the Managed Security Service Provider’s specialized focus on securing your digital assets against cyber threats.

What kinds of services do MSSPs offer?

Navigating the complexities of cybersecurity requires more than just a keen eye—it necessitates a comprehensive suite of services designed to protect, detect, and respond to threats efficiently.

MSSPs offer this critical support of managed security services, delivering a range of specialized services tailored to enhance an organization’s security posture. Let’s examine the key offerings that define the role of MSSPs in safeguarding digital assets.

Security event monitoring

MSSPs continuously monitor your network for security events, ensuring that any potential threats are identified and addressed promptly. This proactive approach helps minimize the risk of breaches.

Security event monitoring is the cornerstone of what MSSPs offer, providing round-the-clock surveillance of network and system activities. This service ensures that any unusual or potentially harmful activity is spotted immediately, enabling swift action to mitigate risks. It’s about keeping a vigilant watch over your digital domain, ready to flag anything out of the ordinary.

Managed detection and response (MDR)

Through MDR services, MSSPs not only detect threats but also respond to them swiftly, often before they can cause significant damage. This includes isolating affected systems and removing malicious entities.

MDR goes beyond spotting threats by actively taking steps to stop them in their tracks and by deploying countermeasures to prevent the spread of an attack. MDR services embody the rapid reflexes needed to defend against cyber threats effectively.

Penetration testing

Penetration testing is akin to a stress test for your cybersecurity defenses. Using a simulation strategy to create cyber-attacks, MSSPs identify vulnerabilities in your infrastructure that could be exploited by malicious actors. This proactive approach allows organizations to fortify their defenses before real threats emerge.

Threat hunting

MSSPs actively search for indicators of compromise within your environment that may elude traditional detection methods. This proactive search uncovers hidden threats, ensuring they’re addressed before causing harm.

Managed firewall

Managed firewall services focus on the management, maintenance, and monitoring of firewall infrastructure. This includes configuring firewall rules to allow legitimate traffic while blocking malicious or unauthorized access attempts. It’s a critical line of defense in controlling data flow in and out of the network.

Vulnerability management

Through vulnerability management, a Managed Security Service Provider helps identify, assess, remediate, and report on security vulnerabilities in your systems and software, keeping your IT environment secure.

Benefits of working with an MSSP

The decision to partner with an MSSP is not just about outsourcing but also about empowering your organization with a robust security framework. This framework is designed to defy the complexities of modern cyber threats.

The benefits of engaging with an MSSP are various, touching upon not just the technological aspects of cybersecurity but also the strategic and operational enhancements it brings to an organization. Here’s a closer look at the key advantages:

Comprehensive protection and scale-up of security

MSSPs offer a broad spectrum of security services that cover all aspects of your cybersecurity needs, allowing for scalable protection as your business grows.

Comprehensive protection and scale-up of security encapsulate the essence of MSSP engagement. Organizations gain a dynamic shield, capable of adapting to evolving threats and expanding in tandem with business growth. This isn’t just about having more tools in the arsenal; it’s about ensuring each layer of security is interwoven to form an impenetrable defense.

Access to specialized expertise and filling internal IT skills gaps

Access to specialized expertise and filling internal IT skills gaps addresses a critical challenge many organizations face: the scarcity of cybersecurity talent.

Partnering with a Managed Security Service Provider bridges this gap by bringing in a team of experts. They improve the organization’s security posture without requiring lengthy and often unsuccessful recruiting and training processes.

Cost savings and efficiency

Cost savings and efficiency emerge from the strategic allocation of resources that an MSSP facilitates.

Instead of bearing the high costs associated with maintaining a comprehensive in-house security team and the latest technologies, organizations can save money and work more efficiently by using MSSPs. This approach not only optimizes spending but also allows businesses to focus their internal resources on core activities.

Improved visibility into threats and expedited security responses

Improved visibility into threats and expedited security responses are critical in a landscape where the speed and stealth of cyber attacks continue to increase.

MSSPs offer advanced monitoring and detection capabilities, ensuring that threats are identified and addressed with speed and precision. This rapid response mechanism minimizes potential damage and maintains business continuity.

Support for compliance with industry standards and regulations

MSSPs help ensure that your business stays compliant with relevant cybersecurity standards and regulations, reducing the risk of penalties and breaches.

MSSPs possess the expertise to navigate these complex regulations, ensuring that organizations meet and maintain compliance standards, thereby avoiding penalties and safeguarding their reputation.

Selecting the right MSSP

Selecting the right MSSP is a critical decision that can significantly impact your organization’s cybersecurity posture.

When choosing an MSSP, consider their expertise in cybersecurity, the technology they use, their cost-effectiveness, and their ability to provide threat intelligence. Look for providers with excellent customer service and efficient onboarding processes to ensure a smooth partnership.

To ensure you partner with a provider that aligns with your security needs and business objectives, consider the following guidelines and factors:

Security expertise

Track record: evaluate the MSSP’s history of success in your industry. Look for case studies or references demonstrating their capability to manage complex security environments.
Certifications: check for industry-recognized certifications among their team members, such as CISSP, CISM, or others relevant to cybersecurity. This indicates a level of expertise and commitment to professional development.
Custom security solutions: ensure the MSSP can tailor its security services to fit your unique business requirements rather than offer a one-size-fits-all approach.

Technology

Advanced tools: investigate whether the MSSP employs state-of-the-art security technologies and tools that can effectively detect and mitigate threats.
Integration capability: the ability of the MSSP to integrate their solutions with your existing IT infrastructure is crucial for a seamless security posture.
Continuous innovation: look for signs that the MSSP invests in research and development to stay ahead of emerging cybersecurity threats.

Cost-effectiveness

Transparent pricing: seek an MSSP that offers clear, upfront pricing models without hidden fees. This transparency helps in budgeting and assessing the overall value of their services.
ROI analysis: consider whether the MSSP can provide evidence or case studies demonstrating a return on investment for their clients through enhanced security and risk mitigation.

Threat intelligence

Global threat landscape awareness: the MSSP should have a robust mechanism for gathering and analyzing threat intelligence worldwide, offering proactive protection against emerging threats
Custom threat reporting: ensure they can deliver personalized threat reports that are relevant to your business, enabling informed decision-making.

Customer service

Availability: confirm that the MSSP offers 24/7 support to address any security incidents or concerns as they arise.
Communication: assess the MSSP’s commitment to informing you about your security status, including regular updates and reviews.

Onboarding processes

Smooth transition: the MSSP should have a clear and efficient onboarding process that minimizes disruption to your operations
Training and support: check if they provide training for your team on their systems and processes, ensuring you can fully leverage their services from day one.

Compliance and regulation support

Expertise in compliance: ensure the MSSP has experience with and understanding of the specific compliance requirements relevant to your industry, such as GDPR, HIPAA, or PCI-DSS.
Compliance services: some MSSPs offer services specifically designed to help you meet compliance standards, including regular audits, compliance gap analysis, and reporting.

How does NordLayer enhance MSSP capabilities?

NordLayer enhances the capabilities of MSSPs by offering advanced security features and services, such as Secure Remote Access, end-to-end encryption, and threat intelligence integration.

By partnering with NordLayer, MSSPs can offer their clients a more robust security solution, ensuring that businesses of all sizes can protect their digital assets effectively and efficiently based on their security requirements.

NordLayer’s security software complements the MSSP’s expertise, providing a comprehensive security posture that meets the evolving threats in the cybersecurity landscape. A collaboration of cybersecurity professionals helps achieve the best results in cybersecurity services, data security, and network security.

Are you looking for a trusted partner to secure your clients’ networks? NordLayer offers a Partner Program with a focus on tangible benefits for its partners and simple yet effective solutions to protect businesses in the hectic cybersecurity landscape.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Nord Security NordLayer 2024

Potential disruptions for MSPs in the wake of VMware’s acquisition by Broadcom

The foundations of a successful MSP business model are stability, predictability, and reliability.

This encompasses vendor partnerships and continuity in delivering managed services to customers.

As the bridge connecting organizations to solutions that deliver reliable technical services, the success of the MSP model hinges on the dependability and reliability of their chosen vendors and platforms.

In other words, building a profitable managed services portfolio depends on forging strong partnerships with vendors like Parallels RAS, who can provide long-term stability, support, and innovation.

These partnerships ensure the delivery of seamless services and contribute to the financial stability crucial for the MSP model to operate successfully.

Equally vital is the cultivation of trust with vendor partnerships — a trust rooted in their partner programs’ reliability.

The recent disruptions sparked by Broadcom’s acquisition of VMware have left some MSPs facing a significant hurdle. It’s been reported that their ability to transact as Cloud Services Providers under the VMware Partner Connect Program ends in April.

This shift requires MSPs delivering VMware solutions to sign up for a new Partner Program. This adds uncertainty and potential changes to their existing partner terms and agreements.

This shift could cause disruption of services for MSPs or, even worse, their customers opting to switch providers, resulting in the loss of long-term customers.

Are you an MSP looking to shift from VMWare? Sign up for our Parallels RAS Partner Program!

Why stability is critical for MSPs

MSPs are entrusted with delivering seamless services to their customers.

They rely heavily on vendors to provide stable solutions across infrastructure, platforms, and software to ensure business continuity for everyone involved.

Broadcom’s acquisition of VMware introduces an element of unpredictability, emphasizing the need for MSPs to swiftly adapt and maintain the reliability their clients depend on.

The effect of the VMware acquisition on managed services

For MSPs, service disruptions (regardless of the cause) can be devastating.

This is true for their operations but, more importantly, for their customers who rely on uninterrupted access to critical applications and resources.

Changes to the business ecosystem may pose challenges, threatening the smooth delivery of services that MSPs build their reputations upon.

Maintaining recurring income streams

The business model of MSPs is intricately tied to a steady and recurring income stream, often generated through monthly billing and long-term contracts.

The turbulence caused by changes to vendor partnerships raises concerns about potential disruptions impacting financial stability.

Navigating the impact of change

Amidst this turbulence, MSPs must have a strategic mindset. Some key considerations include:

1. Swift adaptation

MSPs must swiftly adapt to the new changes in Partner Programs, ensuring a seamless transition for both their internal operations and customer services.

2. Customer communication

Clear and transparent communication with customers is essential. MSPs need to inform customers about potential changes in services and reassure them of their commitment to continued excellence.

3. Diversification

Exploring additional partnerships and service offerings can provide MSPs with a diversified portfolio, mitigating risks associated with a single vendor reliance.

Leveraging Parallels RAS: Navigating the transition with ease

As MSPs try to adapt to the shifts brought on by the Broadcom acquisition of VMware, a silver lining emerges – the seamless and comprehensive solution provided by Parallels RAS.

In times of uncertainty, Parallels RAS stands out as a stable option, offering MSPs a robust platform to deliver managed desktop and application services without interruption.

Unified solution, single license model

Parallels RAS simplifies the complex landscape for MSPs by providing a unified solution with a single license model.

This not only streamlines the licensing process but also ensures that MSPs clearly understand their operational costs, offering financial stability and control.

Flexible management across environments

One of the standout features of Parallels RAS is its ability to manage and administer customer environments across on-premises, cloud environments, and/or hybrid scenarios.

MSPs using Parallels RAS are empowered with the flexibility to provide services from their platform(s) of choice, adapting to the diverse needs of their customers without compromising efficiency or security.

Seamless integration

Parallels RAS excels in providing a user-friendly experience for both MSPs and their customers. Its seamless integration capabilities enable MSPs to effortlessly incorporate Parallels RAS into their existing infrastructure, reducing the technical learning curve and minimizing disruptions to ongoing operations.

Enhanced flexibility with multi-cloud support

In an era where multi-cloud strategies are growing in popularity, Parallels RAS can be delivered across a mix of public cloud vendors like AWS, Azure, and Google Cloud.

You can select the best cloud platform to deliver your solutions of choice and avoid vendor lock-ins.

Efficient administration and monitoring

Parallels simplifies management and administrative aspects for MSPs.

With centralized management and monitoring tools, MSPs have granular control over their clients’ environments, facilitating efficient administration, troubleshooting, and performance optimization.

Technical training and support included

The Parallels MSP Partner program provides free technical training and certifications to ensure your technical staff is equipped with the latest knowledge and expertise.

The free 24/7 technical support also alleviates the pressure on internal staff, providing a safety net for troubleshooting and problem resolution.

Providing future confidence

As MSPs navigate uncertainty, adopting Parallels RAS offers a unified, flexible, and comprehensive solution.

Parallels RAS equips MSPs with the tools and technical training they need to confidently approach the future, ensuring the continuity of services for their clients while maintaining the financial stability crucial to building an MSP business model.

Sign up for the Parallels Partner program and learn how Parallels RAS can help your MSP business.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Parallels
Parallels® is a global leader in cross-platform solutions, enabling businesses and individuals to access and use the applications and files they need on any device or operating system. Parallels helps customers leverage the best technology available, whether it’s Windows, Linux, macOS, iOS, Android or the cloud.

Parallels 2024

I am not sorry for wasting your time: Lessons to learn from Texonto PSYOPs targeting Ukraine

Since the invasion started, ESET has both investigated and prevented a significant number of attacks launched by Russia-aligned groups against Ukraine.

In 1998, one of the most annoying things IT-equipped employees needed to deal with, SPAM, made it into the New Oxford Dictionary of English. Prior to 1998, the word “spam” only referenced a variety of processed canned meat produced by the Hormel Foods Corporation.

“It’s sort of unfortunate that we’ve gotten this far,” John Mozena, then board member of the U.S.-based Coalition Against Unsolicited Commercial Email commented in the news. And that was just the beginning. More than 20 years later, spam messages accounted for over 45 percent of 333 billion emails sent and received daily around the world in 2022.

The latest ESET research about Operation Texonto highlights a scheme targeting Ukrainian citizens with a combination of spam and phishing messages. This situation reminds us that spam not only frustrates employees, but can also serve as a vehicle for disinformation, psychological operations, and data theft attempts against businesses and institutions.

These cyber incidents may look simple, but just the sheer volume of unsolicited emails coming on a daily basis can be so overwhelming that the situation begs for a professional solution. Especially now, that businesses are moving to the cloud.

After the full-scale invasion of Ukraine two years ago, all critical institutions and operators of critical infrastructure in Ukraine were offered a free upgrade to ESET’s highest-grade solution. When it comes to spam and phishing, for example, ESET Cloud Office Security (ECOS) offers broad coverage with advanced protection for Microsoft 365 and Google Workspace applications.

Constant pressure

The use of spam as a popular term for unsolicited email, comes from an episode of the 1970s TV show Monty Python’s Flying Circus. In one episode, a couple tries to order food in a cafe, but every course of the meal contains spam. To make things even more irritating, a group of Vikings sitting nearby are passionately singing about spam. The word “spam” is uttered at least 132 times.

While Monty Python was clearly trying to mock annoying things in people’s lives, their “spam” numbers were no match for the number of today’s spam emails. We are talking about a staggering 150 billion unsolicited emails sent and received daily. Well, that’s annoying, right?

With this influx of emails, it is no surprise that 2022 data showed that up to 80 person-hours a year ago in vain just with filtering spam messages.

Moreover, this problem is not only about getting rid of unwanted emails but also avoiding being caught on the hooks of phishing attacks, the most common type of cyberthreat.

According to the latest government survey in the United Kingdom, one third of businesses identified a data breach in 2022, and 79 percent of those attacks were phishing. Similarly, in the US, the FBI received more than 300,000 phishing complaints in 2022, making it to the top of the bureau’s cybercrime victim list. To compare, personal data breach was the second most reported cybercrime with almost 59,000 victims.

ESET Telemetry confirms that trend. According to the latest ESET H2 2023 Threat Report, spam has increased by 6 percent and malicious HTML files sending victims to phishing websites (HTML/Phishing.Agent trojan) are still by far the most detected email threat. Overall, these email attacks comprise almost a quarter (23.4 percent) of all cyber threats detected by ESET.

According to the latest government survey in the United Kingdom, one third of businesses identified a data breach during 2022, and 79% percent of those attacks were phishing. Similarly, in the US, the FBI received more than 300,000 phishing complaints in 2022, making it to the top of the bureau’s cybercrime victim list. To compare, personal data breach was the second most reported cybercrime with almost 59,000 victims.

ESET Telemetry confirms the trend. According to the latest ESET H2 2023 Threat Report, spam has increased by 6 percent and malicious HTML files sending victims to phishing websites (HTML/Phishing.Agent trojan) are still by far the most detected email threat. Overall, these email attacks comprise almost a quarter (23.4%) of all cyber threats detected by ESET.

Lessons from Ukraine

Operation Texonto in Ukraine shows what such a campaign combining spam emails and phishing can look like.

At the end of 2023, Russia-aligned threat actors tried to demoralize Ukrainian citizens with two waves of spam emails. Additionally, ESET detected a spear phishing campaign conducted by the same group and within the same time period.

Employees working at a major Ukrainian defense company received a phishing email in October 2023, purportedly coming from their IT department.

It was an old-fashioned but still popular phishing message claiming that the employee’s email account was about to expire and they needed to fill in their login details on a given website to keep the account alive. The attached link sent victims to a phishing website posing as a legitimate Microsoft login page, but in reality, trying to steal credentials for Microsoft Office 365 accounts.

To deal with such threats, companies need to not only focus on employee awareness training but also have reliable anti-spam and anti-phishing protection.

Mitigating the threat

If you want to know more about spotting phishing attacks, you can check this blog, but let’s now focus more on a technical solutions implemented in the ESET Cloud Office Security such as Antispam which consecutively won spam filtering tests by Virus Bulletin, a leading security testing authority, and received the VBSpam+ certification for several years.

The ECOS Antispam technology has high catch rates and being a cloud-based service, allows for prompt data updates that provide quicker reaction times when new spam emerges. This essential component filters all spam emails and keeps user mailboxes free of unsolicited or undesired messages.

ECOS Anti-Phishing prevents users from accessing web pages that are known to be phishing sites. Because phishing emails often contain links leading victims to phishing webpages, ESET Cloud Office Security searches the message body and the subject of incoming email messages to identify such links (URLs). The links are compared against the phishing database, which is being constantly updated.

Combining these powerful tools together with anti-malware scanning, ultimate zero-day threat defense, and an easy-to-use cloud management console, ECOS helps to protect companies’ communications, collaboration, and cloud applications.

Conclusion

When looking at spam and phishing data, it is clear that no one has come up with a definitive answer for these threats, but that doesn’t mean you should give up the fight. Quite the contrary. You need professional protection in order not to be overwhelmed by tons of emails both soaking up employees’ time and trying to sneak some phishing messages into corporate mailboxes.

How ESET helps:

• ESET products and threat intelligence have been protecting Ukrainian IT infrastructure for years. Since the start of the full-scale war in February 2022, ESET have prevented and investigated a significant number of attacks launched by Russia-aligned groups such as HermeticWiper and Industroyer2.

• As the leading endpoint protection platform vendor headquartered in the European Union, ESET also announced that it has stopped all sales to any individuals, businesses, and organizations in Russia and Belarus.

• ESET offered critical institutions and operators of critical infrastructure in Ukraine a free upgrade to ESET’s highest-grade solution.

• Between March and May 2022, ESET automatically extended expiring licenses for consumers in Ukraine at no cost.

• On top of that, ESET Foundation has allocated 1,277,700 euros for humanitarian relief in Ukraine.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

2024 ESET

Russian-made PSYOPs in Ukraine: Operation Texonto targets Ukrainians with war-related disinformation, ESET Research discovers

A Russian-aligned aligned threat actor spread war-related disinformation to Ukrainian readers via spam emails.
The spearphishing campaign targeted a Ukrainian defense company and an EU agency.
Due to the similarities in the network infrastructure used in these PSYOPs and phishing operations, ESET research can say with high confidence that they are linked.
Operation Texonto loosely resembles Russia-aligned Callisto APT group activities; however, ESET Research does not have enough evidence to attribute the operations to any specific group.
In the first wave of disinformation emails in November 2023, the Russia-aligned threat actors tried to influence and demoralize Ukrainian citizens with disinformation messages about war-related topics. The second wave in December 2023 was even darker in tone.

BRATISLAVA, MONTREAL — February 21, 2024 — ESET Research recently discovered Operation Texonto, a disinformation/psychological operations (PSYOPs) campaign using spam emails as the main distribution method. Via messages sent in two waves of PSYOPs, the Russia-aligned threat actors tried to influence and demoralize Ukrainian citizens with disinformation messages about war-related topics. The first wave took place in November 2023 and the second one at the end of December 2023. The contents of the emails were about heating interruptions, drug shortages, and food shortages, which are typical themes of Russian propaganda. Additionally, in October 2023, ESET detected a spearphishing campaign that targeted a Ukrainian defense company, and one targeting an EU agency in November 2023 utilizing standard-looking fake Microsoft login pages. The goal of both was to steal credentials for Microsoft Office 365 accounts. Due to the similarities in the network infrastructure used in these PSYOPs and phishing operations, ESET research can say with high confidence that they are linked.

“Since the start of the war in Ukraine, Russia-aligned groups such as Sandworm have been busy disrupting Ukrainian IT infrastructure using wipers. In recent months, we have observed an uptick in cyberespionage operations, especially by the infamous Gamaredon group. Operation Texonto shows yet another use of technologies to try to influence the war,” says ESET researcher Matthieu Faou, who discovered Operation Texonto.

“The strange brew of espionage, information operations, and fake pharma messages can only remind us of Callisto, a well-known Russia-aligned cyberespionage group, some members of which were the subject of an indictment by the U.S. Department of Justice in December 2023. Callisto targets government officials, staff in think tanks, and military-related organizations via spearphishing websites designed to mimic common cloud providers. The group has also run disinformation operations such as a document leak just ahead of the 2019 UK general election. Finally, pivoting on its old network infrastructure leads to fake pharma domains,” continues Faou. However, he concludes: “While there are several high-level points of similarity between Operation Texonto and Callisto operations, we haven’t found any technical overlap, and we currently do not attribute Operation Texonto to a specific threat actor. However, given the TTPs, targeting, and the spread of messages, we attribute the operation with high confidence to a group that is Russia aligned.”

An email server, operated by the attackers and used to send the PSYOPs emails, was reused two weeks later to send typical Canadian pharmacy spam. This category of illegal business has been very popular within the Russian cybercrime community for a long time. A few more pivots also revealed domain names that are part of Operation Texonto and related to internal Russian topics, such as Alexei Navalny, the well-known Russian opposition leader who was in jail and died on 2024-02-16. This means that Operation Texonto probably includes spearphishing or information operations targeting Russian dissidents and supporters of the late opposition leader.

The goal of the first wave of disinformation emails was to sow doubt in the minds of Ukrainians; for instance, one email says “There may be heating interruptions this winter.” Others purportedly from the Ministry of Health talk about medicine shortages. It doesn’t seem that there were any malicious links or malware in this specific wave, only disinformation. One domain masquerading as the Ministry of Agrarian Policy and Food of Ukraine recommended replacing unavailable medicine with herbs. In yet another email “from” the Ministry, they suggest eating “pigeon risotto” a photo of a live pigeon and a cooked pigeon. Those documents were purposely created in order to rile up and demoralize the readers. Overall, these fake messages align with common Russian propaganda themes. They are trying to make Ukrainian people believe they won’t have drugs, food, and heating because of the Russia-Ukraine war.

About a month after the first wave, ESET detected a second PSYOPs email campaign targeting not only Ukrainians, but also people in other European countries. The targets are somewhat random, ranging from the Ukrainian government to an Italian shoe manufacturer. According to ESET telemetry, a few hundred people received emails in this wave. The second wave was darker in its messaging, with the attackers suggesting people amputate a leg or an arm to avoid military deployment. Overall, it has all the characteristics of PSYOPs during wartime.

ESET products and research have been protecting Ukrainian IT infrastructure for many years. And since the start of the Russian invasion in February 2022, ESET Research has prevented and investigated a significant number of attacks launched by Russia-aligned groups.

For more technical information about Operation Texonto, check out the blogpost “Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Timeline of Operation Texonto

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

2024 ESET