Security News
A new attack group called Agrius is launching damaging wiper attacks against Israeli targets, which researchers said are hiding behind ransomware to make their state-sponsored activities appear financially motivated. Researchers added that the wiper attacks were conducted using a secondary malware called "Deadwood", which Sentinel Labs said has "Unconfirmed links to an Iranian threat group."
As cyberattacks snowball and insider threats become an ever-larger part of the problem, it may be time to move beyond purely software-based cyber-defenses. Insider threats have become an alarmingly significant source of risk.
An FBI analyst with top-secret security clearance illegally squirreled away national-security documents related to Osama bin Laden, al-Qaeda, cybersecurity and more in her home for years, the feds say. Kendra Kingsbury, who was working in the FBI's Kansas City Division until being put on leave in December 2017, has been indicted by a federal grand jury for allegedly routinely removing numerous documents from their safekeeping at the office, over and over during the period between June 2004 to Dec. 15, 2017.
The federal indictment charged Kendra Kingsbury, 48, with two counts of having unauthorized possession of documents relating to the national defense, according to an unsealed indictment that was made public on Friday. Kingsbury worked as an intelligence analyst in the FBI's Kansas City Division for more than 12 years, until her suspension in 2017.
In its early days, SIEM was shaped by new compliance drivers that dominated the era, like PCI or HIPAA. In more recent years, SIEM has evolved to handle the convergence of platforms while accelerating threat detection against sophisticated ransomware and malware. Why SIEM is an Ideal Setup, Now More Than Ever SIEM software uses analytics engines to match events against an organization's policies.
To give themselves an edge, many organizations set up threat intelligence programs. "I've seen a lot of threat intelligence programs that are just about pretty reports or some metric [such as] how many attacks we have seen on our website," said Shi.
Neal Dennis: There's a lot of good things out there that are kind of one-offs, or staging one-offs, when the campaigns in the cyberwar kick off. You're kind of out in front of the threats as a community.
Why intelligence sharing is important to help get ahead of attacks. If knowledge is shared with others, they can thwart attacks sooner.
McAfee announced significant expansion of its MVISION Extended Detection and Response solution by correlating the extensive telemetry of McAfee's endpoint security solution, Secure Access Service Edge solution, and threat intelligence solution powered by MVISION Insights. These integrations protect organizations against the most advanced threats while simplifying security operations with unified control and visibility from device to cloud.
Machine data solutions firm Splunk announced Tuesday that it has agreed to acquire TruSTAR, a San Francisco-based company that provides a threat intelligence platform designed to integrate various threat data sources and improve detection and response times. Founded in 2014, TruSTAR's platform collects and enriches internal and external data sources to automate the dissemination of intelligence to various tools and teams.