US Pipelines Ordered to Increase Cyber Defenses After Hack

U.S. pipeline operators will be required for the first time to conduct a cybersecurity assessment under a Biden administration directive in response to the ransomware hack that disrupted gas supplies in several states this month.

The Transportation Security Administration directive being issued Thursday will also mandate that the owners and operators of the nation’s pipelines report any cyber incidents to the federal government and have a cybersecurity coordinator available at all times to work with authorities in the event of an attack like the one that shut down Colonial Pipeline.

Pipeline companies, which until now operated under voluntary guidelines, could face financial penalties that start at $7,000 per day if they fail to comply with a security directive that reflects an administration focus on cybersecurity that predates the May attack on Colonial, senior Department of Homeland Security officials said.

“The evolution of ransomware attacks in the last 12-18 months has gotten to a point that it poses a national security risk and that we are concerned about the impact on national critical functions,” one of the officials said, speaking on the condition of anonymity to discuss details of the regulation ahead of the formal release.

Criminal syndicates, often based in Russia or elsewhere in Eastern Europe, have unleashed a wave of ransomware attacks in which they scramble a target’s data with encryption and demand a ransom. Victims have included state and local governments, hospitals and medical researchers and businesses large and small, leaving some victims unable to perform even routine operations.

The hack that targeted Colonial Pipeline prompted the company to shut down a system that delivers about 45% of the gasoline consumed on the East Coast for about a week. It led to panic-buying and shortages at gas stations from Washington, D.C., to Florida.

It came up in Congress on Wednesday as DHS Secretary Alejandro Mayorkas outlined the agency’s budget next year to the House Appropriations Committee’s subcommittee for homeland security.

“The Colonial Pipeline breach, in particular, was a wake-up call to many Americans about how malicious cyber actors, often backed by foreign states, can disrupt the U.S. economy and all of our lives,” said Rep. Lucille Roybal-Allard, D-Calif., the panel’s chair.

Colonial Pipeline, based in Alpharetta, Georgia, later disclosed it paid a ransom of $4.4 million to retrieve access to its data from the gang of hackers, linked by the FBI to a Russian-speaking criminal syndicate known as DarkSide.

The episode exposed the threat to the more than 2.7 million miles (4.4 million kilometers) of pipeline used to transport oil, other liquids and natural gas around the U.S.

The TSA is responsible for the physical security and cybersecurity of this network and has worked with the owners and operators, about 100 companies in all, to develop the voluntary guidelines and conducts on-site assessments. Lawmakers and experts have been critical of industry security standards.

DHS, under Mayorkas, launched a “60-day sprint” to focus the agency on the ransomware threat weeks before the Colonial Pipeline hack became publicly known on May 7. The directive is intended to address issues that emerged in the response and may have enabled the hack to occur in the first place.

Pipeline owners will be required to do the assessment within 30 days. They will have to show how their processes line up with the voluntary guidelines, identify any gaps and provide a plan for addressing them, the officials said.

Operators will be required for the first time to report any cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency, another DHS component. Companies have been reluctant to report breaches in the past for a variety of reasons, including embarrassment and concern that they could expose themselves to legal liability.

Pipeline companies will also have to designate a cybersecurity coordinator who would be on duty 24 hours a day, seven days a week to work with TSA and CISA in case of a breach like the one at Colonial Pipeline.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/Gn0lXfFZaZc/us-pipelines-ordered-increase-cyber-defenses-after-hack

Vulnerabilities in Visual Studio Code Extensions Expose Developers to Attacks

Vulnerabilities in Visual Studio Code extensions could be exploited by malicious attackers to steal valuable information from developers and even compromise organizations, researchers with open-source software security firm Snyk say.

Generally considered secure, VS Code extensions could expose millions of developers to malicious attacks, potentially leading to the compromise of information stored on developer machines, such as credentials, or even opening the route to further attacks.

Snyk’s security researchers analyzed popular VS Code extensions that start web servers, which are typically accessible locally via a browser, and discovered that malicious actors could exploit vulnerabilities in the web server to target the developers using these extensions. The attacks demonstrated by Snyk only require the victim to click on a link.

“By leveraging this attack scenario a malicious actor can steal important pieces of information, like RSA keys, and eventually access version control systems (VCS) or even connect to production servers and compromise the security of an entire organization,” Snyk notes.

One of the vulnerable extensions, LaTeX Workshop, which has approximately 1.2 million installs, starts an HTTP server and a WebSocket server (on a random port) when the developer opens a .tex file in the editor, to allow them to preview a PDF file in the browser.

Because the input from the WebSocket client to the openExternal VS Code API method was not sanitized, however, the extension was vulnerable to command injection exploitable by a malicious web page able to connect to the extension’s local WebSocket server (by checking all possible ports).

The Open In Default Browser extension, which starts an HTTP server to preview pages in the browser, was found to contain a path traversal bug that a malicious actor could exploit to steal files from the machine. While same-origin policy (SOP) protections would prevent exploitation, a cross-site scripting (XSS) payload could be crafted to help with the process.

Snyk also discovered that the Rainbow Fart extension (60,000 installs), which plays a sound when the user types specific keywords, contained a Zip Slip vulnerability that could be abused to overwrite arbitrary files on the target computer, and possibly achieve arbitrary code execution.

In some cases, the vulnerable VS Code extensions could have leveraged existing NPM packages to implement the desired functionality instead of using custom code — this can help avoid introducing vulnerabilities.

“What has been clear for third-party dependencies is also now clear for IDE plugins — they introduce an inherent risk to an application. They’re potentially dangerous both because of their custom written code pieces and the dependencies they are built upon. What has been shown here for VS Code might be applicable to other IDEs as well,” Snyk concludes.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/qXeUDOFklUs/vulnerabilities-visual-studio-code-extensions-expose-developers-attacks

Facebook Adapts Defenses as Deception Campaigns Go Stealth

Facebook said Wednesday that it has disrupted more than 150 deceptive influence schemes since 2017, with Russia the biggest single source, as culprits strive to stay “under the radar.”

The number of coordinated inauthentic behavior (CIB) campaigns derailed at the leading social network ramped up each year since a Russia-linked operation to sway the outcome of the 2016 US presidential election put Facebook on the defensive.

While those behind influence operations (IO) went unchecked on the playing field in 2016, Facebook has invested in hiring, automated systems, and industry alliances over the ensuing years.

“These efforts have pressed threat actors to shift their tactics,” Facebook head of security policy Nathaniel Gleicher said during a briefing on the report.

“They have – often without success – moved away from the major platforms and increased their operational security to stay under the radar.”

As tactics have gone more steathly, the deception campaigns have seen their reach shrink since, by design, they are trying not to be noticed by the social network, according to executives.

From 2017 through the middle of this year, Facebook has exposed and taken down more than 150 covert operations that violate its policy against coordinated inauthentic behavior, according to the report.

“These operations have targeted public debate across both established and emerging social media platforms, as well as everything from local blogs to major newspapers and magazines,” Gleicher said.

“They were foreign and domestic, run by governments, commercial entities, politicians, and conspiracy and fringe political groups.”

The campaigns originated in more than 50 countries overall, with Russia the largest single source accounting for 27 of the deceptive networks, the report indicated.

Iran was the source of 23 CIB campaigns, second to Russia, according to the report.

Meanwhile, the United States was the most common target as well as home to nine such influence operations by fringe political characters, conspiracy pushers, and consulting or public relations firms.

Influence campaigns continue to “push the boundaries of acceptable online behavior” and blur lines between deceit and free speech, Gleicher said.

Those behind IO campaigns were expected to continue to try to “weaponize” moments of uncertainty worldwide, amplifying division around crises such as the pandemic and civic protests.

The US 2020 election campaign brought to the forefront the complexity of separating bad actors behind covert influence operations from unwitting people they co-opt or local folks whose interests are in synch with the deceptive messaging, according to Gleicher.

“We found and removed IO attempting to get authentic voices to post on their behalf,” the report said.

“We also saw authentic voices, including the then-US President, promoting false information amplified by IO from various countries including Russia and Iran.”

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/c6opC-Ho2Sg/facebook-adapts-defenses-deception-campaigns-go-stealth

NASA Identified Over 6,000 Cyber Incidents in Past 4 Years

The U.S. National Aeronautics and Space Administration (NASA) identified more than 6,000 cyber-related incidents in the last four years, according to a report published this month by NASA’s Office of Inspector General.

NASA has institutional systems, which are used for the day-to-day work of employees — these include data centers, web services, computers and networks. It also has mission systems, which support its aeronautics, space exploration and science programs — these include systems used for controlling spacecraft and processing scientific data.

The agency has more than 4,400 applications, over 15,000 mobile devices, roughly 13,000 software licenses, nearly 50,000 computers, and a whopping 39,000 Tb of data.

The audit conducted by NASA’s inspector general has revealed that while attacks on the agency’s networks are not uncommon, “attempts to steal critical information are increasing in both complexity and severity,” and the agency’s ability to detect, prevent and mitigate attacks is limited.

The cyber incidents observed over the past years — more than 1,700 were identified in 2020 — included brute-force attacks, email-related incidents, impersonation attacks, improper usage issues, loss or theft of equipment, web-based attacks, and incidents involving external or removable media.

Last year, a majority of incidents were related to improper usage, which includes installing unapproved software or accessing inappropriate materials. These types of incidents increased from 249 in 2017 to 1,103 in 2020. On the other hand, NASA also believes that the higher number of detected incidents is also a result of improved network visibility.

NASA breaches and other cyber incidents

The report has highlighted several incidents, including a 2018 hack of NASA’s Jet Propulsion Laboratory, which resulted in hackers accessing servers and even its Deep Space Network telescopes. In the same year, someone stole roughly 500 Mb of data from a major mission system after the account of an external user was compromised.

In 2019, NASA discovered that a contract employee used its systems to mine cryptocurrency, and in the same year two Chinese nationals were indicted for allegedly hacking NASA systems and stealing data.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/DEJWYcDJGls/nasa-identified-over-6000-cyber-incidents-past-4-years

Email Protection Firm Material Security Raises $40 Million

Email protection company Material Security this week announced that it raised $40 million in Series B funding, which brings the capital raised by the firm to date to $62 million.

Founded in 2017, the Redwood City, California-based company is focused on protecting email accounts both before and after compromise.

Material Security launched its full product portfolio in 2020 and claims to have seen tremendous growth over the past year, nearly quadrupling its customer base.

The company’s suite of products offers anti-phishing capabilities, visibility and control into email security risks, and can prevent account takeover attempts and data leaks.

The new infusion of cash, the company says, will help it expand business operations to more markets, while also allowing it to aggressively invest in research and development.

Material Security’s Series B funding round was led by Silicon Valley entrepreneur and investor Elad Gil, and saw participation from Andreessen Horowitz and individual tech industry leaders and investors.

“As hackers continue to intensify their efforts, organizations must look beyond perimeter-only security – aka the beloved firewall – and extend zero trust security to every mailbox, protecting email before, during, and after everything from minor incidents to major breaches,” said Ryan Noon, CEO and cofounder of Material Security.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/x7QYBdjm7UA/email-protection-firm-material-security-raises-40-million

ICS Vendors Assessing Impact of New OPC UA Vulnerabilities

Multiple companies that develop industrial systems are assessing the impact of two new OPC UA vulnerabilities on their products, and German automation technology firm Beckhoff is the first to release a security advisory.

Earlier this month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released advisories to describe two OPC UA vulnerabilities discovered by Eran Jacob of OTORIO, an Israel-based company that specializes in operational technology (OT) security and digital risk management solutions.

Developed by the OPC Foundation, OPC UA (Unified Architecture) is a machine-to-machine communication protocol that is widely used in industrial automation and other fields.

Jacob, who is the security research team lead at OTORIO, analyzed OPC UA and uncovered a couple of vulnerabilities that have been assigned a high severity rating. New OPC UA vulnerabilities affect the products of ICS vendors

One of the flaws is tracked as CVE-2021-27432 and it has been described as an uncontrolled recursion issue that can be exploited to trigger a stack overflow. This vulnerability has been found to impact OPC UA .NET Standard and Legacy.

The second vulnerability is CVE-2021-27434, which has been described as a sensitive information disclosure issue that impacts the Unified Automation .NET based OPC UA client/server SDK.

The OPC Foundation released a patch in March. The flaw affecting Unified Automation software is related to the use of vulnerable versions of the .NET framework. According to CISA, CVE-2021-27434 is related to a .NET vulnerability patched by Microsoft in 2015 (CVE-2015-6096). CISA said Unified Automation has addressed the issue with an update.

Learn More About Vulnerabilities in Industrial Products at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits Virtual Event Series

Jacob told SecurityWeek that multiple vendors are assessing the potential impact of these vulnerabilities on their products — he has notified them through CISA — but it seems that so far only Beckhoff has released an advisory.

In the advisory, published on May 14, the company said components of its TwinCAT PLC runtime are impacted by the security holes.

Beckhoff, whose advisory was also published by Germany’s [email protected], said the vulnerabilities can be exploited by an unauthenticated attacker to cause a denial of service (DoS) condition or to obtain information by sending specially crafted OPC UA packets. The information disclosure issue was described by the company as an XML external entity (XXE) flaw.

“For both kinds of attacks the attacker needs to use a specifically crafted OPC UA client when attacking an OPC UA server, respectively needs to use a specifically crafted OPC UA server when attacking an OPC UA client,” Beckhoff explained. “For attacking a server the attacker needs to be able to establish a TCP connection to that server. For attacking a client the attacker needs to be able to make the client connect to the attacker’s server. For all cases it is sufficient if after the establishment of the TCP connection the attacker lets the specifically crafted application (client or server) respond with a sequence of specifically crafted network packets.”

Jacob said it’s possible to exploit the vulnerabilities remotely from the internet “if the vulnerable OPC UA server is accessible through the internet, or a vulnerable client accesses a server controlled by an attacker through the internet.”

“Theoretically, an attacker performing DoS to an OPC UA server may impact connectivity between control systems, which can result in loss of visibility and possibly loss of control on the process,” Jacob explained. “Also, theoretically, the XXE vulnerability may allow leaking of sensitive files from the system (for example – unprotected private keys or configuration files), or it can be used to perform arbitrary HTTP GET requests on behalf of the attacked server/client.”

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/Po-TVFzP4hc/ics-vendors-assessing-impact-new-opc-ua-vulnerabilities

Microsoft Unveils SimuLand: Open Source Attack Techniques Simulator

Microsoft this week announced the availability of SimuLand, an open source tool that enables security researchers to reproduce attack techniques in lab environments.

The purpose of SimuLand, Microsoft says, is to help understand the behavior and functionality of threat actors’ tradecraft, to find mitigations and validate existing detection capabilities, and to identify and share data sources relevant to adversary detection.

SimuLand can be used to test the effectiveness of Microsoft 365 Defender, Azure Defender, and Azure Sentinel detections.

Furthermore, it is expected to help accelerate the building and deployment of threat research lab environments and to enable security researchers to stay up to date with the techniques and tools that threat actors employ in real-world attacks.

“Our goal is to have SimuLand integrated with threat research methodologies where dynamic analysis is applied to end-to-end simulation scenarios,” Microsoft says.

Based on open-source projects such as Azure Sentinel2Go and the Open Threat Research (OTR) community’s Blacksmith and featuring a modular design, SimuLand can be used to test various combinations of attack actions and also includes guides for lab deployment and for executing simulation exercises.

The simulator can replicate different types of environments (hybrid, cloud) and includes Azure Resource Manager (ARM) templates. The vast majority of the lab environments in the project require at least an Azure tenant and a Microsoft 365 E5 license (paid or trial).

The tool aims to get researchers accustomed with attacker behavior, and “every simulation plan provided through this project is research-based and broken down into attacker actions mapped to the MITRE ATT&CK framework,” Microsoft notes.

Moving forth, the tech company will focus on creating more scenarios, delivering a data model for a more organized documentation of simulation steps, developing capabilities to export generated telemetry and share it with the community, and more.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/j0kUSLrYDmY/microsoft-unveils-simuland-open-source-attack-techniques-simulator

Tulsa Cybersecurity Attack Similar to Pipeline Attack

A cybersecurity attack on the city of Tulsa’s computer system was similar to an attack on the Colonial Pipeline and that the hacker is known, officials said Thursday.

“I can’t share anything other than we know who did it,” Mayor G.T. Bynum said, adding that the city did not pay the hackers. “They wanted to talk with us about what (a ransom) would be for them not to announce (the attack) and we never engaged them.”

Bynum said Tulsa’s computer security system identified the attack and shut down the system before it was infiltrated.

The attack, discovered earlier this month, was similar to the ransomware attack that shut down the Colonial Pipeline for days, according to Tulsa Chief Information Officer Michael Dellinger.

Colonial Pipeline eventually paid a $4.4 million ransom, the Georgia-based company said.

Tulsa’s computer system remains shut down while each of the city’s computers and servers are examined and cleaned, Dellinger said. There has been no indication any data was breached, he added.

Dellinger said an investigation is underway to determine how the attacker infiltrated the system.

Bynum said city utility services, such as water, will not be disconnected until five days after the system is back online and electronic payments are possible.

Police and fire responses continue, but issues such as uploading police body cameras are slowed because of the computer shutdown.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/TAiPgHMaQL4/tulsa-cybersecurity-attack-similar-pipeline-attack

RSA Conference 2021 – Summary of Vendor Announcements

RSA Conference 2021 summary

The 2021 edition of the RSA Conference — a fully virtual event this year — took place May 17-20 and several companies used the opportunity to announce new products, services, initiatives, and other resources.

To help cut through the clutter, the SecurityWeek team is providing a summary of the announcements made at RSA Conference 2021.

Products, services and initiatives

Arctic Wolf launches Managed Security Awareness

Arctic Wolf announced Managed Security Awareness, a new solution that it described as a security awareness and training program delivered as a concierge service. Its goal is to help organizations be more resilient to social engineering, credential theft and phishing attacks. The new solution includes security awareness microlearning, automated phishing simulations, and account takeover monitoring.

BigID launches Data Retention App

BigID announced the availability of Data Retention App, which provides automated retention management capabilities to help organizations reduce risk, automate data lifecycle management and achieve compliance.

Cisco announces XDR, SASE and network security improvements

Cisco unveiled improvements for its extended detection and response (XDR) solutions, including enhanced vulnerability management capabilities as a result of the acquisition of Kenna Security, better device visibility via SecureX, simplified transition from EDR to XDR, and expanded investigation and threat hunting capabilities.

The company also announced Secure Access Service Edge (SASE) improvements, specifically new integrations, a new protection layer, and a new package — all for its Umbrella enterprise network security solution. Other announcements related to network security include an update to Secure Firewall Threat Defense and the launch of Cisco Secure Firewall Cloud Native for Kubernetes.

Cloud Security Alliance announces CxO Trust initiative

CxO Trust is an initiative that aims to bring together C-suite executives to evolve cloud and cybersecurity understanding, knowledge, and solutions in response to enterprise challenges. Members will collaborate on developing practical privacy and governance models, training and certificate programs, mentorship and hiring best practices, regulatory/legislative programs, and product and services development.

CrowdStrike announces Falcon Fusion and updates to Falcon Platform

CrowdStrike announced Falcon Fusion, a framework based on the Falcon platform that is designed to help organizations improve the efficiency of their security operation center (SOC). The company said Falcon Fusion can be used to orchestrate and automate complex workflows, simplify security operations, and accelerate incident triaging and real-time response.

As for the updates made to the CrowdStrike Falcon Platform, the company announced expanded macOS coverage, new Zero Trust capabilities, and a new Message Center for Falcon Complete and OverWatch.

Devo Technology introduces Devo Content Stream

Devo Technology introduced Devo Content Stream, a content delivery service designed to continuously provide security teams with curated alert content and threat intelligence.

Digital.ai launches Essential App Protection

Digital.ai has launched Essential App Protection, a low code solution that is designed to provide a first line of defense against application layer attacks. Essential App Protection provides visibility that security and DevOps teams can use to determine the level and type of application protection that is needed.

Fortinet extends FortiEDR capabilities

Fortinet has extended the capabilities of its FortiEDR endpoint detection and response (EDR) solution. FortiEDR now provides cloud-native endpoint security and integrated endpoint protection capabilities, as well as a managed detection and response service that delivers 24×7 threat monitoring, alert triage and remote response.

Hunters launches XDR platform

Hunters has launched Hunters XDR, the firm’s open extended detection and response platform. Hunters XDR is designed to ingest data from existing security tools and analyze threat signals to help organizations more efficiently respond to incidents.

McAfee expands MVISION XDR solution

McAfee announced a “significant expansion” of its MVISION XDR product by correlating telemetry of the company’s endpoint, SASE and threat intelligence solutions. MVISION XDR capabilities include threat detection, automated threat management tasks, and proactive threat hunting.

Palo Alto Networks announces SaaS Security and Zero Trust Network Security

Palo Alto Networks unveiled SaaS Security, an integrated cloud access security broker (CASB) that enables security teams to automatically discover and control new SaaS applications, It also provides data loss prevention capabilities, helps prevent threats, and aids organizations in maintaining compliance.

SaaS Security is only one of the several new solutions from Palo Alto Networks for what the company calls Zero Trust Network Security. The company this week also announced a Cloud Identity Engine for verifying user identities, an Advanced URL Filtering service, and new firewall appliances.

ReversingLabs announces Malware Lab solution

ReversingLabs has unveiled its Malware Lab solution, which provides organizations a threat analysis engine and console designed for detecting, classifying, analyzing, and responding to malware and associated IoCs.

SecurID launches Interactive Experience

SecurID, an RSA business specializing in identity and authentication solutions, announced the launch of Interactive Experience, which enables customers to choose authentication methods, build access policies and configure rule sets.

ServiceNow integrations with Microsoft products

ServiceNow announced new security integrations with Microsoft products. Specifically, it informed customers about ServiceNow Security Operations Solution Suite integrations with Microsoft Azure Sentinel, Microsoft Threat & Vulnerability Management, Microsoft Teams, and Microsoft SharePoint.

Synopsys expands TAP program and announces new integrations

Synopsis announced the expansion of its Technology Alliance Partner (TAP) program and added new integrations for its Intelligent Orchestration solution, including with GitHub Actions and CloudBees.

Reports and other resources

Vectra Report on Top 10 Threat Detections for Microsoft Azure AD and Office 365

Vectra has released a report on the top 10 threat detections across Azure AD and Office 365. In the case of Office 365, the list includes risky Exchange operations, suspicious download activity, suspicious sharing activity, external Teams access, suspicious Power Automate Flow creation, and suspicious mail forwarding. In the case of AD, the list includes suspicious operations and redundant access creation.

VMware Threat Landscape Report

VMware has released a new threat landscape report that highlights the extent of threats evading perimeter defenses. Key findings include evasion of defense systems being the most encountered MITRE ATT&CK tactic used by malware, email being the most common attack vector for initial access, and the transmission of plain-text passwords over the network being the most common bad security practice.

Palo Alto Networks 2021 Cortex Xpanse Attack Surface Threat Report

One of the most interesting findings of the report is that hackers often start looking for vulnerable systems just minutes after the existence of a vulnerability is made public. In the case of the recent Microsoft Exchange flaws, for instance, it took hackers only 5 minutes to start scanning the web for vulnerable servers.

ZeroNorth Journey to True DevSecOps

A survey of 250 security, DevOps and IT professionals showed that a majority believe DevOps and security teams will share AppSec responsibility. Roughly 90% also believe that integrating AppSec tools into DevOps pipelines through automation will be critical to the success of DevSecOps.

Sophos Active Adversary Playbook 2021

Sophos has published its Active Adversary Playbook 2021, which details attacker behavior and impact, as well as the TTPs seen in the wild by the company. The playbook can help security teams understand what adversaries do during attacks and how to spot and defend against such activity on their network.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/dbWZdfi3zQs/rsa-conference-2021-summary-vendor-announcements

UK-Based API Security Firm 42Crunch Raises $17 Million

API security firm 42Crunch has raised $17 million in a Series A funding round led by Energy Impact Partners and joined by Adara Ventures. $17 million in a Series A round, especially outside of the U.S., is a strong indication of confidence in the technology from the investors.

42Crunch provides an application programming interface (API) ‘micro firewall’. APIs are a serious and growing threat vector. In 2019, Gartner stated, “By 2022, API abuses will move from an infrequent to the most-frequent attack vector, resulting in data breaches for enterprise web applications.” Its proposed solution was, “Use a Combination of API Management and Web Application Firewalls to Protect APIs, in Conjunction with Identity Infrastructure.”

This advice is clearly not getting through. On April 28, 2021, Brian Krebs explained an API weakness with an Experian partner website. The flaw had been discovered by researcher Bill Demirkapi while looking for student loan vendors online. The website offered to check his loan eligibility by checking his Experian score. It did this by combining his name, address and date of birth, and an Experian API. But the API was flawed.

“Demirkapi found the Experian API could be accessed directly without any sort of authentication,” wrote Krebs, “and that entering all zeros in the ‘date of birth’ field let him then pull a person’s credit score.”

[ On Demand Webinar: API MythBusters: The Five Myths Putting you at Risk ]

Earlier in April, Ahmad Talahmeh discovered that he could effectively remove a Facebook video belonging to someone else. “Anyone can trim any live video on Facebook,” he wrote. “Trimming video to 5 milliseconds will cause the video to be 0 seconds long and the owner won’t be able to untrim it.” It was a Broken Object-Level Authorization (BOLA) vulnerability in Facebook’s video editing API (now fixed by Facebook)

These are just two recent examples of a growing number of discovered API flaws. Other flaws can lead to breaches, although it is almost impossible to tell how many compromises have been conducted via APIs, since company breach disclosures rarely go into so much detail.

42Crunch offers a new approach to securing APIs: an individually tailored micro-firewall that is embedded within the API it is designed to protect. “Eighty-three percent of internet traffic now comes from APIs,” comments Jacques Declas, CEO and co-founder of 42Crunch, “but traditional firewall approaches are not adapted to cope with the specific threats that APIs create.”

Declas’ solution is to provide developers with the automated tools to build the micro firewall into the API at development. “Development has changed in the past decade, becoming extremely agile, with the adoption of loose coupling architectures and Kubernetes,” said Isabelle Mauny, co-founder and CTO. “The cost of fixing security flaws at production time is a major issue for enterprises. Our mission is to make API threat protection as agile and automated as development.”

Nazo Moosa, co-managing partner at Energy Impact Partners, added, “42Crunch’s ‘shift-left approach’ to the creation of secure-by-design APIs fits strongly with EIP’s vision of protecting global critical infrastructure. The company’s six-digit customer wins last year were catalytic to our decision to lead the round… our goal is to help 42Crunch build on this commercial traction and expand in the US, APAC and Europe.”

42Crunch, based in London, UK, was founded in 2016 by Isabelle Mauny (CTO), Jacques Declas (CEO), and Philippe Leothaud (CSO). It has now raised a total of $20.6 million.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/FcaxbQNuuo8/uk-based-api-security-firm-42crunch-raises-17-million