Entrust has announced its new distribution partnership with CyberKnight to address compliance and simplify cyber threat management. In line with evolving regional compliance regulations and standards, Entrust’s new partnership with CyberKnight as its newest regional distributor will see the two companies jointly build solutions for the Middle East market that achieve the highest standards of cyber security.

Entrust and CyberKnight are strategically aligned on their security vision with a ‘Zero Trust’ philosophy at its core. With the aim of increasing access to the highest standards of security for Middle East customers, Entrust’s new partnership with CyberKnight will further enable the delivery of digital security solutions to customers, by tapping into CyberKnight’s local network to offer advice, education, expertise, and confidence.

“Digital transformation in the Middle East continues to evolve at a phenomenal pace, especially as the demands of the past two years called for a rapid implementation of cloud-based systems to manage the unprecedented shift to remote workforces,” said Scott Kemish, Global Vice President Channel Sales, Entrust. “In order to support local customers championing cloud adoption while meeting the requirements of local compliance regulations, as well as protecting themselves against an all-time-high of cybercrime, we have entered a stage of channel development that requires our channel distribution partners to stand up and make a difference; CyberKnight has all of the right attributes that we are looking for in the market.”

“Our partnership with CyberKnight further cements our commitment to the region, and we look forward to helping more customers transform their digital security in line with the requirements of this new age,” Scott continued. Over the last two years, the rapid adoption of cloud solutions to enable remote working resulted in an increase in cybercrime globally, as it provided cybercriminals more opportunities to target victims at home. Cybercrime is set to cost the global economy $10.5 trillion annually by 2025. And industry research reveals that, in the UAE, the average cost of remediating a ransomware attack is over $500,000.

“The pandemic has reminded us that cybercriminals are constantly fine-tuning their skills and techniques. If we do not help our customers do the same, then they will be playing catch-up,” said Avinash Advani, Founder & CEO of CyberKnight. “Our partnership with Entrust as our newest vendor will enable us to continue helping customers fill the existing gap between their digital transformation efforts, and their security posture by securing their digital ecosystems as well as supporting them with their zero-trust security journey. We are very excited about working with them to further support our local customers across the region.

Entrust’s certificate solutions, PKI, identity and access management, encryption key management and hardware security modules are available to local customers through the partnership. Later this year, Entrust will join CyberKnight’s annual roadshow, set to take place in November 2022.

According to the 2022 SonicWall Cyber Threat Report, “ransomware volume increased 105% year over year and is up 232% since 2019.” With the risk of ransomware attacks continuing to rise, it’s crucial to shield your organization from these attacks to avoid unwanted financial fallout.

Ransomware attacks commonly target an organization’s file servers and databases using malicious code to encrypt files such as documents, images, and videos on the system. Ransomware can also be programmed to find vulnerabilities on the network and use these to spread to other systems in an organization. Ransomware attacks are typically executed through social engineering like widespread phishing attacks, but cybercriminals can also specifically target a certain entity, sometimes a popular one. These attacks have the potential to cripple an entire organization’s database.

Once encrypted by ransomware, files are almost impossible to retrieve without the decryption key. To get this key, the victim is demanded to pay a ransom—often millions of dollars—within a short timeframe, usually 24 to 48 hours. If the victim organization keeps a backup of its files, then it’ll be able to restore those files and avoid paying the ransom. If not, the organization often has no option but to pay the ransom.

However, if you fall victim to a ransomware attack, it’s strongly recommended that you don’t pay the ransom to regain access to your encrypted files. This is because you are relying on the integrity of a cybercriminal. The cybercriminal may not give you the decryption key after the transaction or, even worse, they may continue to target your organization and repeatedly demand higher ransoms now that they know you’re willing to pay.

In recent years, it has become much easier to develop ransomware, resulting in the continued rise in ransomware attacks. Cybercriminals can develop and execute a ransomware attack with readily available open-source code and with easy-to-use drag-and-drop platforms. It is also hard to track these cybercriminals because transactions involving ransomware are commonly made using cryptocurrency.

Ransomware attacks can result in exploitation and loss of your organization’s critical and confidential data. But there are steps you can take to prevent and mitigate these attacks.

Back-Up Your Data
Take regular backups of all your files and data; this way, even if your system is infected, you can erase the infected files and recover them using your backups. This cannot prevent a ransomware attack, but it can mitigate the risk of losing all your data.

Keep Your System and Software Up-to-Date
Maintain a healthy patching routine. This includes updating your software as soon as possible when patches for security vulnerabilities are released by vendors. To keep your device secure from ransomware attacks, use a security solution that can identify these attacks at their earliest stages and mitigate their impact.

Be Careful Where You Click
Beware of social engineering attacks and email scams, and avoid downloading files from untrusted sources as these can result in your system being exploited by malicious software like ransomware. What makes social engineering attacks so dangerous is that they take advantage of human error rather than system vulnerabilities.

Create Awareness Among Employees About Ransomware Attacks
Since human error is a major vector cybercriminal manipulate to carry out ransomware attacks, it is essential to educate and train employees on social engineering and email phishing attacks to effectively secure your organization against them.

ManageEngine’s security information and event management (SIEM) solutions protect your enterprise network from cyberattacks and insider threats. SIEM solutions collect and analyze the security data generated by your devices in real-time, alerting you about vulnerabilities, indicators of compromise, and any suspicious activity to help you mitigate the risk of ransomware attacks.

Written by Yossi Naar, Chief Visionary Officer, and Cofounder, Cybereason

Extended Detection and Response (XDR) is everywhere today, and it seems that every company is rolling out a strategy and products to meet the growing demand. According to the industry analyst firm Gartner, XDR is “a SaaS-based, vendor-specific, security threat detection and incident response tool that natively integrates multiple security products into a cohesive security operations system that unifies all licensed components.”

Notwithstanding XDR’s tremendous growth in adoption, more than a few misconceptions about XDR remain, so let’s debunk three of those myths here:

Myth 1: XDR is all about Endpoint Security
No, that’s what Endpoint Detection and Response (EDR) does, which is just one aspect of what XDR delivers. EDR solutions focus solely on the endpoint, and they don’t correlate intelligence from the cloud and other parts of an organization’s infrastructure.

In fact, most EDR platforms are not even capable of ingesting all of the relevant endpoint telemetry and are forced to “filter out” intelligence without even knowing if that information is critical to making a detection because the solutions cannot handle the volumes of data generated.

Indeed, there are vendors that simply cannot ingest all available telemetry for EDR, yet they profess to be able to deliver an XDR solution that ingests endpoint data plus an array of telemetry from numerous other sources on the network and in the cloud.

Data filtering negatively impacts the ability to proactively thwart attacks because it omits telemetry that could allow for earlier detection of malicious activity. When broadened to include non-endpoint sources, data filtering can further distort an organization’s visibility into the threats confronting them.

XDR does not suffer from these limitations. It extends continuous threat detection and monitoring as well as an automated response to endpoints, applications, cloud workloads, and the network…all without data filtering. This helps to ensure the high fidelity of a threat detection yielded by XDR.

Myth 2: XDR Should be Augmented by a SIEM
It’s true that XDR delivers some of the same functionality as SIEM (Security Information and Event Management) tools. Chief among their similarities is the ability to aggregate and correlate data from a variety of sources spread across an organization’s infrastructure, thereby providing the required visibility for threat detection, investigation and response.

But there are several key factors that hold SIEMs back: SIEMs are nothing without the data lake structure and cloud analytics they need to centralize security events. Those resources vary in the types and quality of data to which they have access, a reality that affects the value and effectiveness of a SIEM.

There are also the costs, time, and other resources involved with building, tuning, and maintaining a SIEM. Tuning is an especially common pain point with SIEMs. Indeed, these tools frequently generate false positives and an overwhelming volume of alerts.

Such noise contributes to “alert fatigue” in the organization, motivating infosec personnel to overlook the deluge of alerts coming in and miss opportunities to launch investigations at the earliest signs of an incursion. Simultaneously, SIEMs don’t do much to help security teams with executing a response beyond generating a lot of alerts that need to be manually triaged.

XDR, by contrast, doesn’t require any data lake structure. It correlates alerts across disparate network assets to deliver actionable intelligence that works to reduce alert fatigue. What’s more, XDR enables security teams to build automated playbooks using the platform itself, thereby streamlining response.

Myth 3: All XDR Platforms Are Created Equal
No. Consider the fact that there’s hybrid/open vs. native XDR. The latter only offers integrations to other security tools developed by the same vendor. This can lock customers into an agreement with a vendor that might not offer the security capabilities they need to protect their systems and data. It also means existing investments in solutions from other vendors cannot be fully realized.

In contrast, Open (or hybrid) XDR takes a collective approach that leverages multiple security tools, vendors, and telemetry types to meet organizations’ needs from within a single detection and response platform. There’s no vendor lock-in here. Security teams are free to choose the vendors and tools they want, allowing them to get the most out of their XDR platform, and the DevOps and API integrations enable personnel to bring these tools and telemetry sources together.

There’s also an argument to be made about what defines a truly mature XDR offering versus pseudo-XDR solutions that are basically nothing more than an EDR tool with cloud integration. All XDR platforms integrate with threat intelligence to spot known Indicators of Compromise (IOCs), but only an advanced XDR solution can detect them based on Indicators of Behavior (IOBs).

IOBs are the more subtle signs of an attack in progress which include otherwise benign activity one would expect to see occurring on a network. When these “legitimate” behaviors are chained in certain sequences, they produce conditions that are either exceedingly rare or represent a distinct advantage for an attacker.

This is where the context-rich correlations across endpoints, the cloud, application suites, and user identities that a mature XDR solution delivers are critical for detecting malicious activity at the earliest stages of an attack. Take ransomware attacks for example – most security solutions are focused on detecting the exploit and blocking the ransomware payload, or rolling back the encryption after the attack was successful. But the detonation of the ransomware executable is the tail end of what is actually a much longer attack sequence, with weeks or even months of detectable activity from initial ingress, to lateral movement, to credential abuse and privilege escalation, to name a few.

An AI-driven XDR solution can make the necessary correlations to detect that activity long before the ransomware payload is delivered, reducing a potentially devastating attack to the level of an intrusion attempt or similar. Additionally, the ability to leverage AI/ML to correlate telemetry from across an organization’s infrastructure is a key aspect of a mature XDR solution. The application of AI/ML allows Defenders to move from a detect and respond mode to a more proactive “predictive response” posture where the next steps an attack can and would take are instantly anticipated and blocked, eliminating the opportunity to progress the attack to the next stage.

This predictive capability is the key to the future of security, enabling organizations to “defend forward” by understanding attacks from an operation-centric approach, where analysts are freed from chasing alerts that point to individual elements of an attack in favor of a holistic view of the entire attack story from root cause to every affected device, system and user. And only an AI-driven XDR solution can deliver this “predictive response” capability that will shorten detection and remediation periods from days or weeks down to minutes.

The AI-Driven XDR Advantage
An AI-driven XDR solution enables organizations to embrace an operation-centric approach to security that delivers the visibility organizations require to be confident in their security posture across all network assets, and the automated responses to halt attack progressions at the earliest stages. This approach also provides defenders with the ability to predict, detect and respond to cyberattacks across the entire enterprise, including endpoints, networks, identities, cloud, application workspaces, and more.