Connect with us

Cyber Security

Why Context is Everything When it Comes to Cybersecurity?

Published

on

Written by Hadi Jaafarawi, managing director – Middle East, Qualys

The cybersecurity threat landscape has never been more challenging, sophisticated, and severe. Research suggests that in the UAE alone, around $746 million is lost every year to cybercrime, and the country faced a 79% increase in the problem from 2019 to 2020. For firms and IT departments across the region, it’s a constant battle to stay ahead of the bad actors.

Add in the fact that several security teams are either stretched or under-skilled, not to mention, that many face pressure to keep budgets in check and it really is a perfect storm. In an effort to level the playing field, security teams are turning to technology. But that comes with challenges of its own.

A lack of clarity
There’s no shortage of security tools offering what professes to be the solution. And it’s no surprise that security teams reach for them in the hope of coping with the issue and reducing their risks. More and more, companies are adopting an increasing number of tools to add further layers of security and protect against risk. Today an organisation’s security infrastructure will include everything from Security Incident and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) to Network Detection & Response (NDR) and Extended Detection and Response (XDR)

Admittedly, the tools each have value, so that’s not the problem. The challenge is that each new tool adds another data silo. Each separately reports its own specific data based on its own particular use and area of the network. And it’s then down to the analysts, who are faced with multiple alerts from multiple systems and solutions, to make sense of it all.

When there are too many alerts, issues can be notified to lots of different teams, or worse missed altogether. Alert fatigue — where the team is exposed to constant alerts and consequently fails to act when it really matters — is a real problem. This is why XDR tools are designed as a holistic, top-layer solution that collects data from multiple sources to provide a comprehensive picture, enabling real-time incident detection and response. But again, it’s not that simple, as XDRs vary in quality, effectiveness, and even function.

Some SIEM and XDR tools simply deliver raw data to analysts, who then have to interpret the data and make endless decisions about any actions that are needed. They collect disparate, unrelated data, and it’s up to the analyst to deal with the notifications, analyse, prioritise and then act, or not. Busy security analysts are likely to be faced with multiple alerts in any given day, many of which are actually false alarms. It’s little wonder that it’s easy to miss or ignore that one really vital alert.

Context is key
Enter the value of contextual insight. Rather than simply churning out data and leaving it to the over-worked analyst to handle, some XDR tools can go a step further by providing that all-important context. All alerts may look basically the same in one tool. But, when brought together with external threat intelligence and other security data, that harmless-looking alert will suddenly have more meaning and jump up the priority list. XDR is designed to break down data silos and provide the context required to help analysts get better insight, by creating a consolidated view of the entire enterprise technology stack and any threats. It pulls together all security solutions and functions into one place, giving analysts a single, comprehensive view of threats across the entire network.

By correlating data from asset inventory and vulnerability information, high-quality threat intelligence, network endpoint telemetry, and third-party log data, analysts get more context on what’s happening — leading to a far more effective and quicker response to threats. Without this context, too much time is wasted on manual tasks and important alerts can easily be missed. This context allows the rapid, focused investigation to be carried out where it’s actually needed.

Providing context using XDR gives security professionals the visibility and insights they need to reduce risks and improve their security approach. It empowers busy teams with the clarity and context to enable them to make the right decisions and deal with potential issues — and quickly.

Cyber Security

Beyond Blocklists: How Behavioural Intent Analysis Can Safeguard Middle East Businesses from Rising AI-Driven Bot Threats

Published

on

The Middle East is facing an unprecedented surge in AI-driven bot attacks, with malicious automation now outpacing traditional defenses. Mohammad Ismail, Vice President for EMEA at Cequence Security, warns that legacy tools like IP blocklists and rate limiting are no match for today’s sophisticated threats (more…)

Continue Reading

Cyber Security

Sophos Boosts Firewall with New Protection and Incident Response Features

Published

on

Sophos has announced a significant update to its Sophos Firewall software, introducing enhanced protection and incident response capabilities. This update notably includes Sophos NDR Essential, a new feature now available free of charge to all customers holding an XStream Protection license for Sophos Firewall.

This integration empowers Sophos Firewall with two dedicated artificial intelligence (AI) engines specifically designed to detect both malware communications and those utilizing algorithmically generated domain names. This advanced functionality, derived from the Sophos Network Detection and Response (NDR) probe, aims to identify sophisticated malware communications even if they are previously unknown or not yet indexed. It serves as a powerful complement to the Active Threat Response capabilities already embedded within Sophos firewalls.

Chris McCormack, Senior Product Marketing Manager at Sophos

Addressing the technical demands of such advanced detection, Chris McCormack, Senior Product Marketing Manager at Sophos, explained the strategic approach, “NDR traffic analysis requires substantial processing power. That’s why we’ve adopted a new approach by deploying an NDR solution in Sophos Cloud to offload the heaviest tasks from the firewall.” This cloud-centric design ensures optimal performance without burdening the firewall’s on-device resources.

Beyond network detection, the update also brings significant improvements to connectivity and user authentication. Sophos Connect now integrates EntraID for Single Sign-On (SSO). This new feature for the VPN client, bundled with Sophos Firewall, is set to enhance both the security and user experience for SSL and IPsec VPN connections. The integration with EntraID (Azure AD) enables users to authenticate and leverage multi-factor authentication for both Sophos Connect and access to the user portal hosted by the firewall, streamlining secure access.

Further VPN-related enhancements include:

  • Improved user interface and usability: Connection types have been renamed for greater clarity, with “site-to-site” now referred to as “policy-based” and tunnel interfaces as “route-based,” making configurations more intuitive.
  • Dynamic validation of the IP address pool: For VPN connections (SSL VPN, IPsec, L2TP, and PPTP), the system now dynamically validates the allocated IP address pool, helping to better resolve potential IP address conflicts.
  • Strict profile enforcement: IPsec profiles now exclude default values to ensure algorithm synchronization, effectively eliminating potential fragmentation of session negotiation packets that could otherwise prevent site-to-site VPN tunnels from being established.
  • Route-based VPN and SD-RED scalability: The system has been optimized to support up to 3,000 simultaneously established tunnels. Specifically, Sophos Firewall solutions can now manage up to 1,000 SD-RED site-to-site tunnels and connect up to 650 concurrent SD-RED devices.

Additional management improvements enhance administrative flexibility and search capabilities:

  • More flexible DHCP Prefix Delegation (IPv6 DHCP-PD): The system now supports a broader range of prefixes, from /48 to /64, improving compatibility with various internet service providers.
  • Router Advertisement (RA) and DHCPv6 server: These features are now enabled by default, simplifying IPv6 network setup.
  • Resizable table columns: The web admin interface continues its adaptation for ultra-wide screens, with many configuration pages now allowing users to resize columns as needed for improved usability.
  • Enhanced object search functionality: The search field within the SD-WAN routing configuration screen now supports more granular criteria, including route name, ID, objects, and object values like IP addresses and domains. Similarly, local ACL rules now also support object name and value searches, extending to content-based searches for more precise results.
  • Default configuration changes: To streamline initial setups, default firewall rules and rule groups previously created during new firewall deployments have been removed. The initial configuration now only includes the default network rule and MTA rules. Furthermore, the default firewall rule group and the default gateway probe for custom gateways are now set to “None” by default.

Sophos continues its commitment to cybersecurity through a “Secure by Design” approach, enhancing the intrinsic security of its firewalls. This methodology involves the containerization of specific features and rigorous integrity checks on critical operating system files using mathematical checksums. Any detected checksum mismatch triggers a potential compromise alert, enabling monitoring teams to proactively identify possible security incidents affecting the firewall OS integrity. This proactive detection allows incident response and development teams to react swiftly to critical security events.

This update is now available for manual download and deployment by customers with any Sophos Firewall equipped with a valid license.

Continue Reading

Cyber Security

Honeywell Report Reveals 46% Quarterly Spike in Industrial Ransomware

Published

on

A new report from Honeywell reveals a significant escalation in cyber threats facing the industrial sector, with ransomware attacks surging by 46% from Q4 2024 to Q1 2025. The company’s 2025 Cybersecurity Threat Report indicates a widespread increase in both malware and ransomware activity, notably including a 3,000% spike in a specific trojan designed to steal credentials from industrial operators.

The allure of industrial targets for cybercriminals is clear, as explained by Paul Smith, director of Honeywell Operational Technology (OT) Cybersecurity Engineering and author of the report, “Industrial operations across critical sectors like energy and manufacturing must avoid unplanned downtime as much as possible – which is precisely why they are such attractive ransomware targets.” He further emphasized the agility of attackers, stating, “These attackers are evolving fast, leveraging ransomware-as-a-service kits to compromise the industrial operations that keep our economy moving.”

The urgency of these threats is underscored by definitions from the Cybersecurity and Infrastructure Security Agency (CISA) in the United States, which classifies incidents as “substantial” if they lead to unauthorized access causing significant operational downtime or impairment. Industry analyses corroborate the severe financial impact, showing that unplanned downtime—whether from cyberattacks or equipment failure—costs Fortune 500 companies approximately $1.5 trillion annually, representing a substantial 11% of their revenue.

To compile these critical findings, Honeywell’s researchers undertook an extensive analysis, reviewing over 250 billion logs, 79 million files, and blocking 4,600 incident events across the company’s global installed base. Their detailed examination yielded several concerning trends:

  • Ransomware’s Relentless Ascent: The first quarter of 2025 alone saw 2,472 potential ransomware attacks, already accounting for 40% of the entire annual total recorded in 2024, signaling a rapid acceleration of this threat.
  • Trojan Exploitation Targeting OT: A particularly dangerous trojan, identified as W32.Worm.Ramnit, was responsible for 37% of files blocked by Honeywell’s Secure Media Exchange (SMX). This figure represents an alarming 3,000% increase in this specific trojan compared to the preceding quarter, indicating a concerted effort to exploit industrial access.
  • Persistent USB-Based Risks: Despite awareness campaigns, external media continues to pose a significant threat. Honeywell’s SMX detected 1,826 unique USB threats in Q1 2025, with 124 of these being entirely new and previously unseen. This follows a 33% increase in USB malware detections in 2023 and an astounding 700% year-over-year surge in 2022, highlighting the enduring vulnerability posed by removable devices.

The scope of the report’s analysis also expanded to include threats introduced via other plug-in hardware, known as Human Interface Devices (HIDs). This encompasses commonly used items such as mice, mobile device charging cords, laptops, and various other peripherals, which are frequently connected to on-premise systems for software updates or patching, creating additional vectors for potential compromise.

In light of these escalating risks and evolving regulatory landscapes—such as new SEC reporting regulations requiring the disclosure of material cybersecurity incidents—industrial operators face increasing pressure to enhance their defenses. As Smith concluded, “Leveraging Zero Trust architecture and AI for security analysis can speed detection and enable smarter decision making and proactive defense in an increasingly complex digital landscape.” His recommendation underscores the need for decisive action and advanced security strategies to mitigate costly operational downtime and safety-related risks in the industrial environment.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.