Category: Blog

Who Does Ransomware Target?

Ransomware attacks are no longer affecting enterprises only. They’re spreading to organizations of all sizes, maturities, and even across industries. Why? It’s profitable.

Many mid-market businesses have a false sense of security that ransomware attacks only happen to big corporations with millions to pay in ransom. But both enterprise and mid-market companies have valuable data attackers can hold for ransom.

How Do I Protect My Business?

(LINK) Protect your business using the 5 Ps of Preparedness approach:

1. Program. Work with IT to align your cybersecurity program with your ransomware strategy to minimize the operational and financial impact of a ransomware incident.
   
2. Policy. Work with leadership and the board to create a policy that explains how you will approach ransomware, including if your business will attempt to make a payment.
   
3. Plan. Your plan should be concise, comprehensive, and simple. Who will provide external support, who will you empower to make decisions, and who will execute your plan?
   
4. People. Identify strategic partners within your organization and external parties and clearly define their roles, inform them of their responsibility, and document their contact information.
   
5. Practice. Consistently test your ransomware strategy to understand your ability to organize, execute, and improve response capabilities. This will ensure your preparedness.

What is the Ransomware Lifecycle?

Understand the ransomware lifecycle to prepare for and resolve it as quickly as possible. 

1. Infection. Ransomware finds its way into corporate assets through phishing emails, a misconfigured cloud asset, and the exploitation of your open vulnerabilities.
   
2. Communication. Ransomware communicates back to its control network, where attackers determine how they’ll attack your network.
   
3. Discovery. Built-in mechanisms discover specific types of sensitive information for ransom, identify defensive measures, and help attackers maximize their impact.
   
4. Data exfiltration and backup destruction. Ransomware components silently corrupt and disable backups and steal sensitive information.
   
5. Encryption. Attackers silently and selectively encrypt your data, making your systems and data useless without decryption.
   
6. Ransom demand. Ransomware attackers make ransom demands (typically in Bitcoin) to get your data back.
   
7. Negotiation. Some ransomware attackers will negotiate.
   
8. Decryption. You can pay the ransom to get the decryption keys, but there’s no guarantee attackers won’t leak or re-encrypt your data.

Top 3 Initial Infection Vectors

• Phishing emails
• Remote Desktop Protocol (RDP) exploitation
• Software vulnerabilities exploitation

How Can Technology Help?

Apply a zero-trust security strategy to empower your security teams and leadership to move faster and more securely. At its core, zero trust believes we should not inherently trust any interaction, at any level. It focuses on setting up systems and applications that protect themselves from every other system, allowing them to defend against attacks by minimizing the impact of any single compromise or attack. 

NIST CSF

Five areas of the NIST CSF to include if your cybersecurity and ransomware strategy:

1. Identify. Operationalized identification, detection, and classification of critical and sensitive data
   
2. Protect. Data and individual asset protection that prevent known threats and attack patterns
   
3. Detect. Operationalized cyber attack and malicious software detection
   
4. Respond. Integrated technology platforms that detect ransomware rapidly to contain it
   
5. Recover. Recovery strategy that can scale

Conclusion

Are you prepared to defend against ransomware attacks? At Lightstream, we have helped customers build effective strategies to empower them to fight against ransomware attacks, and we can do the same for you.

We’ll assess your current strategies, build upon them, and help you mitigate as much risk as possible by preparing for and setting up the proper technologies to fight ransomware attacks.

Why you should move to the AWS cloud?

Modernize your infrastructure and drive business transformation, respond quickly to ever changing demands from employees and customers, boost innovation…

Modern operational practices improve results :

• 20% average infrastructure cost savings
• 69% reduction in unplanned downtime
• 43% fewer security incidents per year

Migration & Transfer on AWS – Migrate to AWS and see business results faster

Clearly, migrating to AWS is good for business. But successful migrations take planning and expertise, as well as an understanding of the challenges you’re likely to face as part of the process. By understanding those challenges, the pitfalls that can result when they aren’t fully addressed, and the possible solutions to smooth your way forward, you’ve taken the first step on your cloud migration journey.

How do I migrate to the cloud?

• (LINK) Identify which of the 7 Rs (migration ideologies) makes the most sense for your migration
• (LINK) Use AWS tools, utilize AWS partners, or use their MAP program

What is the AWS MAP process?

Use the MAP (Migration Acceleration Program) to assess, mobilize, migrate and modernize (How do I migrate?):

AWS wants you to have a great experience, so we provide assessment tools that help determine if you’re ready to migrate to the cloud (cloud readiness)

Conclusion:

Ready to migrate to AWS? We’re here to help you migrate to the cloud
Lightstream is an AWS Advanced Consulting Partner → our AWS-certified engineers and architects have years of experience assisting and driving migrations of all sizes.

We’ll assess how ready you are to migrate to AWS and plan a course of action.

There’s no doubt that migrating assets to the cloud brings a multitude of benefits. The promise of improved availability, and increased agility, scalability and IT flexibility are just a few. But what about the risks? When security is architected and designed into the cloud platform – the risk can be significantly less than that of traditional infrastructure. Unfortunately, when cybersecurity is not a design-time consideration the results can be catastrophic.

The agility that allows IT organizations to rapidly build and scale environments is a phenomenal asset to business, but it can be one of its greatest vulnerabilities if not managed. Attackers go where the value is – so as business puts more and more sensitive data into the public cloud, it makes sense that attackers make public cloud their primary target. Configuration errors – in both known and unknown cloud assets – are a primary source of cyber security and compliance failures. Configuration errors give attackers a potential way in, and can lead to intellectual property theft, or breach of confidential information, or even a full environment compromise. Rather than having to develop exploits and probe organizations for weaknesses, configuration errors often provide exposed administrative capabilities, open access to sensitive data, or allow systems to attack each other without monitoring or protection.

The problem is that configuration errors in the public cloud are made at cloud scale and speed. This means that potentially hundreds of data stores, privileged accounts or services can be exposed in seconds. The challenge for security professionals is to address the growing complexity and security challenges without adding complexity further into the equation. The good news for security professionals is that there is a wealth of tools out that can help.

Prisma® Cloud from market leader Palo Alto Networks is a best-of-breed cloud security solution that many of the world’s top enterprises rely on to secure their highly complex, multi-cloud environments. The popularity of Prisma Cloud is driven by the low-complexity dashboard providing a complete set of features such as multi-cloud analysis, automated remediation, and contextual understanding of systems, applications and users. It provides complete visibility and control over public-cloud based risks within Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI) and Alibaba Cloud infrastructures.

The fact that 74% of Fortune 100 companies rely on the proven capabilities of Prisma Cloud means it will be able to support your environment as well. But even with such cutting-edge technology available to secure their cloud environments, IT and cybersecurity professionals are still faced with the arduous task of managing the workload the platform produces. Managing identified vulnerabilities, analyzing detected anomalies, ensuring compliance with appropriate frameworks and configuring runtime defense in heterogeneous environments on a day-to-day basis requires expertise and staffing – something companies big and small struggle with. A significant number of exhausted security leaders are turning to companies like Lightstream to operationalize, manage and optimize their Prisma Cloud platforms in their public cloud environments for this very reason.

Build Resiliency and Lower Cloud Risk

As a Palo Alto Networks Global Cloud Partner, Lightstream has the world-class expertise you need in a managed security provider. Together, Palo Alto Networks and Lightstream can help you accelerate your move to the cloud by delivering consistent, automated protections across multi-cloud deployments that prevent data loss and defend against business disruption.
Lightstream’s Cloud Defense built on Prisma Cloud provides customers like you with continuous monitoring, detection and incident response for their public cloud environments. Our team of security experts begins by working to baseline your cloud environment, creating recommendations, and remediating urgent issues then monitoring your environment against the new guard-rails. When security issues arise, we’re there to help with critical incident response services from security professionals and cloud architects and engineers. While other providers call that good-enough, we don’t stop there. Lightstream is different in that we staff industry-certified cloud security architects to continuously advise and improve the security of your public cloud throughout the lifecycle.
And with our Quickstart program, this isn’t a long, drawn-out process. Lightstream can help take you from initial assessment of your existing cloud environment to the design of a customized managed services plan to a fully optimized and managed cloud environment within 30 days. From there, you’ll have all the benefits of 24/7/365 monitoring and management via a single point of contact at Lightstream.
It’s time to mitigate your business’s cloud security risks and de-complicate the management of its infrastructure. Contact Lightstream today to find out how Palo Alto Networks’ Global Cloud Partner of the Year for two consecutive years can help take the burden and complexity out of protecting and optimizing the security of your organization’s public cloud environments.

Unlike technology as a whole which continues to advance at an astoundingly rapid rate, vulnerability management is one area of cybersecurity that is harmfully stuck in the past.

In the 90s the primary sources for vulnerability information were mailings lists like Bugtag and FD. With the volume in these public lists security professionals struggled to scan, identify and patch their systems – but the long gaps between exploit releases gave security teams the luxury of time. The early 2000s brought remote vulnerability scanning engines that were managed, woefully, in spreadsheets. In that time we had learned two things: first that there was more to vulnerability management than missing patches, and second that identifying missing patches and unpatched systems was the easy part. But over a decade later in the 2010s spreadsheets were still the predominant vulnerability management tool. And now here we are in 2021, and what is the state of the art for vulnerability management? If you guessed vulnerability scanning and spreadsheets – you’re unfortunately correct. Nearly 30 years and countless technical advancements later, and we’re still basically on clay tablets and chisels.

Today’s Vulnerability Landscape

The time between a software or system vulnerability being identified and a readily available, weaponized, exploit in the wild has shrunk to a sliver of time. Security teams no longer have the luxury of time to try to scan, find systems, manually triage, prioritize and then push patches. Never mind that patching is only a part of overall vulnerability management.

In spite of all the latest technology now available to us, the lessons we’ve learned over the three decades, and the renewed sense of urgency brought on by the COVID19 pandemic, the whole vulnerability management process is a train wreck. IT and cybersecurity professionals are still primarily focusing on missed patches and relying on spreadsheets for reporting and prioritizing vulnerabilities – and no one is being held accountable. Combine that with the work-from-home environment, and you have an avalanche of new vulnerabilities daily, more tools than you can effectively manage, insufficient resources and skills to dig yourself out – and all of it is driving increased business risk.

So, let’s get back to fundamentals, and attempt to understand the problem we’re trying to collectively solve for. First, a vulnerability can be any weakness in your infrastructure that could compromise business operations. And they can come from anywhere. Yes, missing patches are a major factor, but so are misconfigurations, penetration test results and bug bounty programs (if you have them). Vulnerability scanners are highly ineffective in dealing with anything outside missing patches, so they’re not your solution. Finding vulnerabilities is relatively easy, but what do you do with them once they’re uncovered, and when they’re so out of date that patching isn’t an option (also known as technical debt)?

Many IT leaders think the answer lies in purchasing state-of-the-art technology. No matter what the buzzwords, technology doesn’t solve a human problem. Most companies have a volume problem, as well as a culture problem – but we’ll address that in another blog. When you have potentially 10,000 or more identified vulnerabilities, prioritization becomes a pretty tough obstacle to overcome. Your fancy tech is only as good as the analyst who operates it, no matter how much magical “AI” secret sauce is in their marketing fluff. Don’t get me wrong, a strong and capable technology platform is crucial – but that comes after you’ve addressed the human-sized problem in the equation.

What you need is a Programmatic Reduction of Risk

Unfortunately, a significant portion of technology owned by organizations is outdated or worse, no longer being supported by your vendors. This is partly due to tight budgets, partially feature dependence and partially an if-its-not-broken-don’t-fix-it mentality. What may seem like a minor issue today can result in a massive breach tomorrow. While the business is asking for agility from its technology, CIOs everywhere are facing huge technical debt. And the longer it goes on, the more expensive it becomes to fix or replace. How do you extinguish all of these burning fires?

The CIO essentially has to declare technical bankruptcy. Take inventory, acknowledge there are problems, identify them and create a plan to fix them. Communication and accountability among business leaders and IT professionals is the key to implementing an effective solution. In many cases, this includes admitting that the organization lacks the in-house expertise to solve the problems.

The most forward-looking CIOs turn to a trusted provider for help. Lightstream is one such partner with the expertise to move your organization out of this quagmire, and our Rapid Risk Profile is often the best place to start your risk management assessment. This approach helps us to understand your biggest systemic risk so we can work together to create an informed path forward that aligns to your business goals and financial situation. The first step is easy, no-friction, and involves virtually no invasive technology. What we assess and identify are hallmark people, process, and program categories to understand your organizational and program maturity. Whatever stage your organization is at in its journey and program development, we can provide understanding and high-level guidance.

The immediate next step is to take a consultative and technical deep-dive, to understand not only what your organization does in terms of vulnerability management, but how it does it. We create your baseline, and provide a gap-assessment against industry-driven baselines. Lastly, we develop a bespoke roadmap that involves both short-term tactical remediation strategy to prevent catastrophic business disruption, and long-term program development to aid your business into effectively managing technical debt and vulnerabilities across the business. Lightstream’s suite of packaged services provides peace of mind, technical as well as program capabilities, and continuous evolution in your vulnerability management program. The key to effectively managing vulnerabilities is to go beyond patching and implement a lifecycle approach for identification, triage, mitigation and reporting.
Stop buying into the misconception that vulnerability management is about scanning and patching. It’s time to acknowledge the magnitude of the problem and the risks it’s creating for your business. Contact Lightstream today to find out how we can help you establish an effective vulnerability management program – protecting and future-proofing your organization while creating a culture of accountability.

Amazon Web Services (AWS) first introduced customers to its AWS Well-Architected Framework in 2020 in the form of a whitepaper designed to help cloud architects build secure, high-performing, resilient and efficient infrastructure for their applications and workloads. As my colleague Ty Annen outlined in his Annual Performance Review blog post back in June, The AWS Well-Architected Framework is divided into five pillars of architectural best practices:

1. Operational Excellence
2. Security
3. Reliability
4. Performance Efficiency
5. Cost Optimization

The AWS Well-Architected Framework has rapidly expanded to include domain-specific lenses, hands-on labs, and the AWS Well-Architected Tool, all of which provide a consistent approach for AWS cloud users to evaluate architectures and implement designs that can scale over time.

Once a Well-Architected Framework has been established, AWS encourages customers to keep their cloud environments finely tuned by regularly evaluating their AWS workloads, identifying high risk issues and making and recording their necessary improvements. It provides a way for you to consistently measure your architectures against best practices and identify areas for improvement.

How it Works

The AWS Well-Architected Framework Review, often called the “AWS WAFR,” was developed to help IT professionals, operations staff and anyone with a cost interest to evaluate the workload and implement improvements for future workloads. AWS advises customers to complete the Framework Review quarterly.

As an AWS Advanced Consulting Partner and member of the AWS Well-Architected Partner Program, Lightstream has deep AWS knowledge and is certified to deliver an AWS Well-Architected Review that includes strategies to help you compare your workloads against best practices and obtain guidance to produce stable and efficient systems.

Prior to your Well-Architected Review, Lightstream can help you identify a priority workload to evaluate. Then together we’ll take a deep dive into that critical workload and provide recommendations as well as a roadmap to making the recommended modifications. Once you implement the modifications, you will receive credit funding from AWS to cover the cost of the review and remediation.

It’s not uncommon for overworked and understaffed business leaders and IT professionals to put off performing Well-Architected Reviews. They think, everything is running smoothly so why try to fix something that isn’t broken? But the truth is, no matter how well your environment seems to be performing or how much you’ve managed to improve processes and increase your organization’s efficiency, you have the opportunity to do it even better.

The bottom line is this: you have a duty to correct misconfigurations and proactively avert security threats and financial and operational inefficiencies. And between new instances, changing security groups, and updated service offerings, you must make sure that your organization is maximizing every opportunity for savings and automation. The longer you put off your AWS Well-Architected Reviews, the greater your organization’s vulnerability is to cybersecurity attacks and getting bypassed by your competition.

Contact Lightstream to find out how Well-Architected Framework Reviews can optimize and update your AWS cloud environment, ultimately helping your organization to cut costs, increase revenue, ensure compliance, go to market faster and increase the quality of your products and services.

 

Microsoft began familiarizing customers with its Azure Well-Architected Framework in 2020 in order to help customers design and build secure, scalable, high-performing solutions in Azure and to effectively and consistently optimize workloads. As I outlined in my Annual Performance Review blog post back in June, the Azure Well-Architected Framework is divided into five pillars of architectural best practices:

1. Cost Management
2. Operational Excellence
3. Performance Efficiency
4. Reliability
5. Security

Once a Well-Architected Framework has been established, Microsoft encourages Azure customers to keep their cloud environments finely tuned by having periodic reviews performed against Azure best practices as well as specific business priorities in their cloud journey.

In August, Microsoft started offering Well-Architected Framework Technical Workshops for qualifying Azure customers. Each of the workshops in the series focuses on a different best practice pillar. It is recommended that reviews be performed quarterly, however Microsoft offers eligible customers fully funded workshops once a year.

How it Works

As a Microsoft Gold Cloud Platform Partner, Lightstream has deep Azure knowledge and is certified to help assess and analyze your architecture with Azure’s Well-Architected Review tool to identify risks.

Workshops begin with an evaluation of that specific aspect of your cloud environment – i.e., operational excellence, performance efficiency, reliability or security, depending on the workshop. As you complete the assessment, you’re provided a score for each pillar that you chose to evaluate and an aggregate score across the entire workload. Then we’ll advise what actions should be taken for optimization and create a plan to implement the prioritized, and funded recommendations.

It’s not uncommon for overworked and understaffed business leaders and IT professionals to put off performing Well-Architected Reviews. They think, everything is running smoothly so why try to fix something that isn’t broken? But the truth is, no matter how well your environment seems to be performing or how much you’ve managed to improve processes and increase your organization’s efficiency, you have the opportunity to do it even better.

The bottom line is this: you have a duty to correct misconfigurations and proactively avert security threats and financial and operational inefficiencies. And between new instances, changing security groups and updated service offerings, you must make sure that your organization is maximizing every opportunity for savings and automation. The longer you put off Well-Architected Reviews, the greater your organization’s vulnerability is to cybersecurity attacks and getting bypassed by your competition.

Contact Lightstream to find out how Well-Architected Framework Technical Workshops can optimize and update your Azure cloud environment, ultimately helping your organization to cut costs, increase revenue, ensure compliance, go to market faster and increase the quality of your products and services.