IT Brief New Zealand logo
Technology news for New Zealand's largest enterprises
Story image

The rise of viral threats and network detection and response

By Contributor
Thu 5 Nov 2020
FYI, this story is more than a year old

Article by Vectra AI director of security engineering for APJ, Chris Fisher.

This year the globe has had to fight threats on two fronts - the human health threat of COVID-19 and the technology threat of escalating cyber-attacks. As governments have learned through lockdowns and large-scale breaches, managing these threats requires a robust response and early detection.

And businesses have been under pressure, too. Earlier in the year, the Toll Group had a significant ransomware attack, known as ‘Mailto’ — one of the most significant in Australian corporate history. Since then, there have been attacks on both sides of the Tasman, across industries and entities like the NZ Stock Exchange. 
When it comes to managing cyber-threats, the traditional focus has been on prevention, but today, good cyber-health requires a more balanced approach as more organisations experience increasingly complex and targeted attacks. 

So, what are the options for businesses today?

According to Gartner, AI-assisted network detection and response (NDR) tools, delivered across on-prem, cloud, and IoT, are helping businesses better detect suspicious network traffic compared to more traditional perimeter security tools. This explains why NDR is such a fast-growing market as entities seek to diversify their security investments to include detection and response — not just prevention. 

The reason for the growth is obvious — cyber-threats left unidentified can have substantial financial and reputation repercussions as seen over recent years. Perhaps not surprisingly, 2020 has driven increased cyber-criminal activity as more attackers have sought to exploit the unsettling pandemic with advanced cyber-attacks across industries. 

During the first six months of 2020, many Fortune 500 businesses were the victim of significant data breaches that saw hackers sell account credentials, sensitive data, and confidential financial records.

And like the virus itself, attackers are moving and expanding their attack surface and getting more effective. Simply building higher walls to fend off cyber-threats no longer works, especially when it comes to slowing down astute attackers and speeding up detections. 

The need for speed

Speed is characteristic of today’s attackers from their approach to ‘getting in’ to how quickly they attack and move through an environment. Despite telemetry information, most businesses don’t have the resources to outrun attackers across every environment or the resources to know what information to drill into at the speed now required. 

Front-line security analysts are doing their best to collect risk information and respond to threats. Still, attackers are clever — they don’t want to stay in the same environment for too long, they pivot as quickly as possible to avoid the risk of being detected. 

Time is ticking 

Looking back three or four years, attacker dwell-time was around 90 to 100 days. Attackers would spend several hours identifying an environment they’d landed on. They could even take some days or weeks to do their reconnaissance on a network. But that timeframe has completely shrunk. 

It’s now down to within an hour from initial landing to having, for example, domain admin credentials compromised. And they’re pivoting away much quicker because they don’t want to get caught. 

Unmasking attackers

The profile of attackers has also broadened, but their profile continues to depend on their motivation. They could be nation-state attackers that threaten to stay in an environment until their objective is complete, through to criminal groups that are financially motivated and demand payment or stealing data and then threaten extortion. 

The faster an organisation can move, the quicker they can slow an attacker down because the longer it runs, the more expensive it becomes to an organisation to respond and recover.

Changing behaviours 

Looking at traditional legacy security, signatures or IP addresses are low value for today’s attacker to change. It’s very easy to change the domain of a hash of a file. 

What’s more difficult is their techniques and their behaviours, which are incredibly expensive for them to change. And that’s where machine learning gives organisations an edge — it provides the broadest coverage which makes it very difficult for an attacker to evade.

Combating the noise 

Attackers are also leveraging new technology such as AI to profile people and streamline their attack process. But traditional threats, like phone style communication, still attempt to get individuals to provide passwords for example and phishing are continuing to evolve. 

Attackers are also pivoting into things like business email compromise and Office 365 being a large attack surface. 

But the biggest challenge for many businesses is the sheer volume of noise that comes into their security operations centres and being able to determine what is a genuine attack and what’s just general network noise. 

Using a combination of both supervised and unsupervised machine learning can help security experts focus in on particular attacker behaviours. 

This means experts can prioritise hosts inside that organisation that are the most critical so analysts can focus on slowing the attacker down and buying more time to go through their incident process while reducing attacker dwell-time and getting them out of that network.

The year ahead

As we head towards 2021 and move towards cloud services, bridge time, or how quickly an entity can respond to a breach and identify attacks, remains critical. 

It’s not necessarily about identifying every single detection but prioritising hosts or accounts that are causing problems. Once identified, organisations need to be able to respond incredibly quickly and effectively. 

With this in mind, organisations should maintain the good endpoint hygiene we have seen recently and focus on the modern network as a data source for detection and response. This is where businesses will get the best benefit and be best able to drive down the noise coming into security operation centres.

Stitching things together

Identifying not just how the attacker got into the environment, but what they did across the network, is growing in importance. Understanding the root cause and how to fix the problem often takes time.

But with AI, targeting, and prioritising, responding based on privilege and risk is better and faster than before.

Looking ahead, its critical businesses have a clear understanding of what their attack surface is and also look out for fundamental attacker behaviour. It has never been more vital for businesses when it comes to remaining secure and sustainable in our rapidly evolving world. 

Related stories
Top stories
Story image
Tech job moves
Tech job moves - Cohesity, Equinix, IDC, Proofpoint & Xero
We round up all job appointments from July 29 - August 5, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
DCI Data Centers breaks ground on AKL02 center
DCI Data Centers has commenced construction on Auckland's largest data center.
Story image
10 Minute IT Jams
Video: 10 Minute IT Jams - An update from Heidrick & Struggles
Graham Kittle joins us today to discuss how the company is helping organisations bring about change within their business.
Story image
Exclusive: UKG brings a people focused approach to workforce management
Managing an effective and efficient workforce is the crux of any business operation, and in today's climate, it's more than just work employers need to be aware of.
Story image
Exclusive: Inde provides innovative solutions across the tech sector
Inde likes to call its approach the 'power of the collective', which essentially means that if a client approaches the company with a problem, they'll get the team's collective insight to help drive the best outcome.
Story image
Fortinet reports second quarter 2022 financial results
“We delivered strong revenue and billings growth in the second quarter driven by an increase in the number of transactions larger than one million dollars."
Story image
MyRepublic unveils 'choose the speed you need' mobile plans
Broadband provider MyRepublic has announced the details of its new 'choose the speed you need' mobile plans, designed for New Zealanders. 
Story image
SaaS sector in NZ thriving as a result of trans -Tasman partnerships
New Zealand's Software-as-a-Service (SaaS) sector is on track to be the biggest contributor to GDP this year, generating more than NZD$20 billion for the New Zealand economy.
Story image
Hybrid Cloud
The essential guide to digital transformation by SolarWinds
Digital transformation is a buzzword thrown around all the time by companies, but what does it actually mean and why is it important? SolarWinds breaks it down.
Story image
Enterprise Resource Planning / ERP
Why the right ERP (and partner) is crucial to an innovative and successful business
Enterprise Resource Planning (ERP) is a foundational step to ensuring a robust business model; here's why choosing the right one could be vital to ensuring long-term success and innovative results.
Story image
Why security needs to shape your journey to the cloud
It's estimated that 80% of workloads could be in the cloud in the next few years. How can you make all that data secure?
Story image
Data center
Macquarie Asset Management acquires stake in ST Telemedias VIRTUS Data Centres
"We will further strengthen VIRTUS' focus on sustainability by backing investment in its technology and enhancing the lifecycle management of its equipment."
Story image
Chorus announces Hyperfibre sponsorship deal with NZ Esports
Chorus has put its support behind New Zealand's Esports community with a newly announced three-year Hyperfibre sponsorship deal with NZ Esports.
Story image
Google NZ numbers show strong comprehensive profit increase
The latest financial report from Google New Zealand Limited has revealed an increase in total comprehensive profit of over $NZD 7 million.
Story image
Why enhancing bot protection for web and API endpoints matters
The trouble with bots is that they aren’t all bad. Unfortunately, this can make it challenging to detect malicious bots that find their way into your system and threaten your business.
Story image
OfficeMax NZ sees significant growth through Seismic partnership
OfficeMax New Zealand has announced it has seen a significant increase in customer and sales confidence as a result of Seismic’s digital enablement software.
Story image
ManageEngine unveils SaaS availability of Analytics Plus
ManageEngine's Analytics Plus is now available as a software as a service (SaaS) offering, enabling users to set up a completely functional and integrated analytics platform anywhere in under a minute.
Story image
Tablets & laptops
Chromebook and tablet shipments see another rapid decline for the year
According to research from Canalys PC Analysis, Chromebook and tablet shipments have fallen for the fourth quarter in a row for Q2 of 2022.
Story image
Why is MACH architecture a new big thing in the tech world?
More and more global enterprises are considering replacing the monolithic tech stack with the best-of-breed composable stack that enables greater business agility.
Story image
Security gaps in APIs plague organisations - study
Together, the findings highlight that existing solutions and API security tactics focused on shift-left strategies are failing to adequately protect APIs.
Story image
Gartner names Rubrik Leader in 2022 Magic Quadrant
Rubrik has been positioned by Gartner as a Leader in the 2022 Magic Quadrant for Enterprise Backup and Recovery Software Solutions.
Story image
Identity and Access Management
Pitney Bowes launches rebranded management offering in A/NZ
Pitney Bowes has launched Smart Access Management (SAM), its rebranded digital visitor and contractor management offering in Australia and New Zealand.
Story image
SOTI research explores professional's thoughts on digitisation in the healthcare sector
Interconnectivity, automation and data management were the three key trends highlighted in the report as integral parts of successful medical technology implementation.
Story image
Remote Working
Four-day week: Perceptions across Asia Pacific and Japan
Workers across APJ want to be empowered to do their best work, wherever and whenever they want.
Story image
Financial results
Facebook NZ financial report reveals notable revenue increase
Revenue from contracts with customers increased by $NZD 1,089,292 compared to 2020's figures.
Story image
Data Protection
Video: 10 Minute IT Jams - An update from SearchInform
Alexey Pinchuk joins us today to discuss the role the company plays in helping organisations manage risk and provide better security outcomes.
Story image
Veeam named Leader in enterprise backup and recovery
"We believe our innovation and ability to execute validates our solid standing as the #1 trusted provider of modern data protection."
Story image
NOVATION releases cloud-based solution to maximise value of data
NOVATION has announced the release of DataVio, its cloud-based solution for helping businesses automate the processing and extraction of data.
Story image
Data Protection
CyberRes partners with Google Cloud in lead up to BigQuery release
CyberRes, a Micro Focus line of business, has announced a partnership with Google Cloud to support the upcoming release of BigQuery remote functions.
Story image
Hazelcast launches beta release of new serverless offering
Hazelcast Viridian Serverless speeds up app development, simplifies provisioning, and enables integration of real-time data into applications.
Story image
Robotic Process Automation / RPA
Gartner anticipates RPA software revenue of US$2.9 billion
Gartner predicts global robotic process automation (RPA) software revenue to reach US$2.9 billion in 2022, an increase of 19.5% from 2021.
Story image
Viavi updates Observer platform to simplify cloud monitoring
Version 18.8 simplifies cloud monitoring with data centre-like visibility, bringing two key capabilities to cloud-based applications and deployments.
Story image
Ivanti and SentinelOne partner on patch management solution
Ivanti and SentinelOne will integrate their technologies Ivanti Neurons for Patch Management and SentinelOne's Singularity XDR platform.
Story image
More than a fifth of cybersecurity teams ban the use of public WiFi
Verizon’s fifth annual Mobile Security Index report has revealed a continued rise in significant cyberattacks in the last year involving a mobile/IoT device.
Story image
Visa launches Eco Benefits solutions in Australia and NZ
Eco Benefits is a suite of sustainability-focused solutions that will help Visa cardholders better understand the environmental impact of their payments.
Story image
Four benefits companies can realise by transitioning to S/4HANA early
Although there is time before organisations are required to transition to a cloud-based solution, such as S/4HANA, it is beneficial to transition now. Waiting too long could complicate the process.
Story image
10 Minute IT Jams
Video: 10 Minute IT Jams - An update from Talend
Stu Garrow joins us today to discuss the company’s key solutions, and how they can help organisations thrive in the data management space.
Story image
Why the Metaverse could be the key to enhancing the healthcare sector
The experts at Accenture understand that the programmable world is about building the next version of the physical world in healthcare, understanding complex layers in order to fully utilise technology to its maximum effect.
Story image
2degrees unveils eSIM functionality for selected devices
2degrees has enabled eSIM functionality to work with a variety of Apple, Samsung and Oppo devices, including a range of iPads.
AWS Marketplace
Learn how security orchestration, automation, and response (SOAR) enhances your security strategy.
Link image
Story image
FirstWave responds to SMB demand for better cybersecurity
FirstWave developed the CyberCision Open Security Management Platform to respond to SMBs 'urgent' need for comprehensive cyber protection.
Register now for the Sydney Cloud & Datacenter Convention 2022 and learn about topics ranging from digital transformation to data center sustainability.
Link image
Story image
Microsoft unveils two new security products to help reduce attack surfaces
The products are set to give companies deeper insights into threat actor activity and help them successfully navigate the changing threat landscape.
Story image
Qualys develops EASM capabilities for Cloud Platform
"Qualys unique approach to EASM is integrating the internal and external asset data from CyberSecurity Attack Management with its VMDR solution into a single view."