Where is the new “Security Stack” hiding?

/by

Security challenges resulting from migrating the security stack to the cloud

The days of the traditional security stack are numbered, brought on by the maturity of shared resource computing and the rapid migration to the public cloud due to the COVID-19 pandemic. This blog will explore a brief history of fortification, its impact on the early internet security architectures, and today’s challenges. I’ll conclude with a few suggestions that every security professional should consider.

From the beginning, cave dwellings were used to protect that of value. Humans have long considered, planned, and implemented various fortification methods. A city wall built around valuable, trusted assets is commonplace from our very early history. Fortification walls were used to protect individuals, tribes, and countries and could be made more secure by adding additional layers. The extra layers of defense increased the protection by the means known as “defense in depth” whereby a compromise in one other layer would sufficiently hinder further advancement or retreat by the attacker.

Fast forward to the late 20th century, many Request for Comments (RFC) drafted, outlined the internet foundation by focusing on moving datagrams from point A to point B. The primary concern was redundancy, resiliency, and reliable delivery of information. However, in the last few years of the 20th century, three essential security concepts were explored: confidentiality, integrity, and availability, known as the “CIA Triad.” Think of CIA as security that attempts to ensure information from the sender can:

  1. only be read by the receiver
  2. while in transit, the data has not been changed or tampered with
  3. the information reaches the intended audience

The 21st century brought a flurry of security and technologies based on ancient, fortified city walls. These defense in depth architectures often made the incorrect assumption that data inherited implicit trust based on location. For instance, data inside a corporate network was not scrutinized equally to data outside the corporate network. These initial security tools – the “Security Stack” – were often placed at the ingress/egress points of the network to inspect, analyze, prioritize, route, and scan for nefarious activities or threats from outside the network perimeter.

The problem with relying on perimeter-based security alone is people. People have always been migratory, traveling beyond the city walls. Speaking for myself, I have worked remotely, assisting companies with network security for 20+ years. As a “road warrior”, my network connections are from hotels, public hotspots, and client networks that have traversed untrusted networks. To prevent unauthorized access, my company had had to apply additional security controls to allow me to be connected successfully behind the “security stack.”

Between 2006 and 2010, the concept of shared computing resources took hold, and the promise of more computing power for less cost fueled a steady adoption rate over the next decade. Cloud service providers (CSPs) like Amazon, Microsoft, Google, Oracle, and others saw a steady, predictable increase in the use of shared resources located within a CSPs network, A.K.A “Public Cloud Network.” However, with the advent of cloud computing, the lines between trusted and untrusted networks were further obscured, and the need for visibility into and across disparate networks became more evident.

2020 brought with it a pandemic that forced hundreds of millions of employees to connect from untrusted sources and work remotely, in many cases bypassing the traditional security stacks intended to provide defense in depth. Corporations faced an unforeseen lack of visibility and conventional tools failed.  This rapid migration of corporate workloads (applications) to cloud computing combined with a disintegration of the traditional security stack has resulted in an environment of ever-increasing attacks and ransomware.

Post pandemic, the traditional security stack has dispersed. Some components still reside in on-premises networks, some in the public/private clouds, some at the network perimeter edge, and some on the endpoint device. The critical lesson is that the “edge” is no longer the boundary of location. The new “edge” is now the boundary of information. Data is the new edge.

To achieve security in modern networks, visibility is now more critical than ever. Complex architectures based on, IaaS, PaaS, SaaS, and On-Premises resources combined with new wide-area transport systems like SD-WAN, and a myriad of security filters in the form of cloud regions, accounts, VPC/VNETs, Network ACLs, Security Groups, and tools like SASE (Secure Access Service Edge), and Transit Gateways are indeed the new modern “Security Stack.” To secure this modern-day infrastructure, the corporation needs unparalleled visibility, awareness of where vulnerabilities exist, and connectivity across all network clouds and on-premise.

Finally, here is a message for the CISO or security professional searching for solutions. Ask yourself the following questions and seek answers for any you are unsure of.

  1. How well do your security teams understand cloud inventory?
  2. How do you check to see if resources are unintentionally exposed to the internet?
  3. How do you validate cloud segmentation policies and remediate them?
  4. How do you prioritize vulnerabilities in a public cloud environment?

For tips on how to “Safeguard Your Cloud Journey with a Comprehensive Security Solution” download our data sheet.

The Impact of the ONC Cures Act on API Security

/by

In March 2020, the US Department of Health and Human Services issued the 21st Century Office of the National Coordinator (ONC) Final Rule, also known as the ONC Cures Act Final Rule. This Final Rule supports secured, limitless access, exchange, and use of Electronic Health Information (EHI).

ONC Cures Act Final Rule, apart from providing patients and their healthcare providers secure yet seamless access to health information, aims to increase innovation and trigger competition. With more competition comes innovation, as new entrants offer much wider healthcare choices and solutions for patients.

Summary of the ONC Cures Act Regulations

Due to the COVID-19 pandemic, the US Department of Health and Human Services provided an extension for compliance to the ONC Cures Act Final Rule. This extension ended on April 5, 2021.

According to the National Law Review, organizations subject to the Cures Act should have the following in place:

  • An efficient configuration of digital patient portals to provide electronic health information (EHI) to patients without needless delay
  • An up-to-date release of information policies
  • A thorough assessment of contracts and arrangements involving EHI with any third parties should be conducted to achieve compliance with information blocking prohibitions
  • Preparation of real-world testing plans, EHI data export, Application Programming Interfaces (APIs) with latest HL7 Fast Healthcare Interoperability Resources (FHIR) capabilities, and various other capabilities targeted for 2021 and 2022

ONC Cures Act Final Rule calls on the healthcare industry to adopt standardized APIs that allow individuals or patients to access and better use of EHI using smartphone applications securely and quickly.

Identity and Security Requirements of the Regulations

ONC Cures Act Final Rule, as explained in the Federal Register, lays out conditions for the compliance certification of healthcare providers. Those conditions include support for standards and published APIs that allow health information “to be accessed, exchanged, and used without special effort” and “access to all data elements of a patient’s electronic health record to the extent permissible under applicable privacy laws.” The aim of the Final Rule is nationwide transparent data portability with standardized yet agile data exchange processes.

Along with that, ONC Cures Act Final Rule can avoid many security risks associated with healthcare APIs, such as inadequate SSL certification validation, the vulnerability of Simple Object Access Protocol (SOAP), and accountability issues, to name a few.

The following are the specific identity and healthcare security requirements of the ONC Cures Act Final Rule:

ONC Cures Act Final Rule that allows agility of EHI also puts limits on information blocking and anti-competitive practices of the healthcare providers. The Code of Federal Regulations, with a few exceptions, allows patients to decide upon the healthcare applications that can access their EHI.

Vulnerabilities of the APIs

ONC Cures Act Final Rule ushers in an era of the widespread adoption of standardized APIs by the healthcare industry all over the globe. On the one hand, it helps individuals or patients securely access and easily makes use of EHI using smartphone applications. On the other hand, since APIs deal with sensitive data that can be easily accessible over the internet, they are vulnerable to sophisticated cyberattacks. Without question, healthcare organizations need enhanced digital healthcare security and vigilant monitoring to protect sensitive and private patient information.

More than anything else, implementing and maintaining enhanced API security is an exhaustive process. It also incurs extra expenditure on updating features or fixing bugs. This scenario demands a significant part of the API development lifecycle to maintain security.

Another concern is the consistent testing of API security. This complicated process requires hiring the right talent to identify and expose API security issues before the launch of the application.

Leveraging Cloud Solutions

According to IBM, The widespread global cloud migration can amplify the cost of cybercrime damage by nearly $300,000. As more enterprises migrate to the cloud, sensitive corporate data becomes vulnerable to cyberattacks, technical glitches, and data storage issues.

However, the increased technical difficulties, expenses, and larger talent pools associated with the integration, management, and dissemination of EHI can be overcome by cloud solutions. Today, many healthcare providers have embraced the power of healthcare cloud computing to meet the ONC Cures Act Final Rule requirements and to future-proof their Information Technology (IT) environment.

Cloud solutions eliminate the additional time and cost associated with traditional storage systems. An integrated data ecosystem that can feed multiple data centers can be easily deployed within a short period with lesser complications using cloud solutions.

Additionally, cloud solutions can empower healthcare providers to scale up and scale down their data processing resources as demands fluctuate. As an added benefit, the pay-per-use business model implemented by most cloud solutions providers worldwide makes the expensive resource procurement associated with traditional storage systems a thing of the past.

Another advantage of cloud computing infrastructure is that it provides access to data through open-source tools. That means no more data locked in silos and unwanted license expirations common with other proprietary storage solutions.

Cloud Is the Future of Healthcare

The future is healthcare cloud computing. ONC Cures Act Final Rule is the call from the future. EHI should flow smoothly and safely. Healthcare IT should provide more portable, interoperable, and patient-centric healthcare solutions. And cloud solutions are the only way forward.

RedSeal, a hybrid cloud security solution provider, helps you identify all your resources and how they are connected in your complex network environment. It allows easier validation of your security policies and prioritizes the security issues that can breach your most valuable network assets. RedSeal constantly monitors your network to find out glitches in your networking setup and ensure whether it meets the compliance standards and organizational policy.

RedSeal Cloud is a Software as a Service (SaaS)-based Cloud Security Posture Management solution that provides your cloud solutions security team with increased visibility and understanding of the provider’s infrastructure. RedSeal Cloud can help you manage the increased digital healthcare security risks with an up-to-date visualization of cloud solutions infrastructure and detailed identification of digital resources exposed to the internet. Your security team will also be bestowed with updated knowledge of Kubernetes accounts and policies.

Register for a demo to see RedSeal Cloud in action.

Understanding What’s In My Cloud

/by

Today’s business applications run in an environment that would be unrecognizable to IT professionals 10 years ago. The rise of virtualization and the cloud has finally cut the ties to specific hardware, and all but the most exotic workloads can now be run anywhere — on virtual machines in your physical buildings, or on a cloud vendor of your choice. The underlying cloud technologies are powerful, but with that power comes great responsibility. Security teams struggle to keep up, because the new technologies focus on agility, rapid rate of change, and dynamic response — all of these are positive buzzwords to most people in a business, but all of them are bad news to security. Ask any military commander — defense is far easier when your resources are home in a well-built fort, and far harder when your troops are constantly moving, shifting location into unfamiliar terrain.

It’s not all doom and gloom, however. Cloud innovation takes away certain legacy risks — after all, you can’t leave an open password on a key router in the middle of your network infrastructure if you don’t control the routers any more! The trouble is that the change to new ways of building and managing modern apps (often referred to as DevOps) closes out some old challenges, but opens just as many new ones. Cloud gives you new kinds of rope, and it’s different from the old rope, but you can still get just as tangled up in the complexities.

Some security fundamentals remain, though. No matter what kind of infrastructure you own or rent, you still need to pursue the basics:

1.    Find all your stuff

2.    Categorize it so you know what’s most important

3.    Harden the individual elements to avoid easy compromise

4.    Map out and run your defenses as a system, so you can be a hard target

The most basic discipline of all is inventory — cyber security experts and industry guidance all agree that you must start there. Inventory in cloud is not like inventory in conventional networks, though, so the same old principle has to be thought about differently in a cloud world.

The good news with the cloud is that each virtual network has a “God of the Cloud” — a central controller, run by the cloud provider that you can talk to via a proprietary API. I call it a “God”, because no endpoints can exist in that small virtual network that the controller did not create. This means you can always find a completely reliable resource for each virtual network — someone who knows the inventory. Problem solved, right? Well, not so fast — it’s certainly very different from legacy on-premises networks, but that’s hardly all there is to it. There are three major problems when talking to each cloud controller — finding the controllers, speaking their language, and keeping up with the changes.

The good news is a cloud account comes with an API you can talk to and get a complete inventory of the assets it knows about. The bad news is your company has many, many accounts. And even once you locate them all, they will speak a proprietary and changing language — the Amazon language for the AWS API is different from Microsoft’s for Azure, or Google’s, or Oracle’s. You need a network linguist to make sense of it all, and pull together a single view of your clouds — in all flavors. And since security is central by its nature (because it needs to look at the complete picture), that means security has the unenviable task of needing to speak all the languages — fluently — at once. This is hard, but it’s a great job for automated software.

Equally, the rate of change in the cloud is something automated software can tackle far more effectively than humans can. Cloud assets have ugly names — often just a long stream of gibberish assigned by a robot, to make it easy for other robots. You’ll need your own robot interpreter to even identify one asset, let alone track it as it moves and changes. The nature of the cloud is highly dynamic — instances are spun up and killed on demand, and they move far faster than, say, a classic vulnerability scanner can keep up with. If you want to see your final as-built infrastructure (and you need to, since this is what your adversary is looking at too), you need software to keep up with all the changes, track the assets, and untangle the myriad ways that cloud assets are marked. There are tags, there are labels, there are unique ID’s, and there are security groups. Every vendor has subtly different rules, and just to add to the confusion cloud vendors don’t even agree on what a cloud network should be called, but they all offer the same idea.

At the end of the day, security is about adapting and keeping up, as the pace of change keeps speeding up. Cloud is just the latest evolution, where names change, details shift, but the core principles remain — first and strongest of all is inventory. This is why we at RedSeal build software to automate all the communication and mapping, so that you can visually scan your cloud footprint, understand your security posture, and make optimal moves to increase your security and reduce your risk.

For more information, check out our overview of RedSeal Stratus Maps and Inventory capabilities to learn more about how you can Map Your AWS Infrastructure Including Connectivity Paths.

RedSeal and Cloud Security Posture Management

/by

According to Gartner’s Innovation Insight for Cloud Security Posture Management, this year (2021), “50% of enterprises will unknowingly and mistakenly have exposed some applications, network segments, storage, or APIs directly to the public internet”. And by 2023, “…at least 99% of cloud security failures will be the customer’s fault.”

What do these statistics say about the changing face of cybersecurity? Twenty years ago, the most common source of security failures was naïve user behavior, typically clicking on a malicious email attachment or link. In on-premise environments, this is still a common vector of infection, but in the cloud the problem is not naïve users, it is overwhelmed administrators. 99% of cloud security failures will be the customer’s fault, because cloud platforms and applications will simply be misconfigured. Let that sink in. Simple misconfigurations were never the primary source of security failures in the past.

Administrators aren’t stupid; they misconfigure systems because they are overwhelmed. Of course, there is a chronic shortage of security talent, but that has been true for decades. What has changed, with the advent of cloud computing, is the overwhelming complexity of the systems. Cloud security controls and best practices are very different from those used in on-premise environments. Those available in AWS are similar, but different from those in Azure, or Google Cloud. Kubernetes has a unique security model of its own, and all these environments are changing constantly.

To deal with this complexity and constant change, a new family of technology has emerged broadly referred to as Cloud Security Posture Management (CSPM). The goal of these technologies is to help admins understand what resources they have in their cloud environments, what security controls are in place, how it is all really configured, and whether it meets various compliance standards.

For more than a decade, RedSeal has been in the business of helping customers understand their on-premise networks i.e. what devices are on the network, how they are connected, and the security implications of their configuration. We do this by creating a detailed model of their network that can be compared against best practices, compliance standards, and the customer’s intended network design (customers are almost always surprised with how different their network is from what they originally intended). Put simply, customers use us to find and correct network misconfigurations.

With data centers and networks moving to the cloud, our customers are increasingly asking us to help them find and correct cloud misconfigurations as well. They need an accurate model of their cloud environments to understand questions like how many cloud accounts they really have, what resources are in each, what security controls are in place, what is the aggregate effect of all those security controls on resource access, and are any resources inadvertently exposed to the internet. They often have a basic design for their cloud but are unsure if their implementation is consistent with their intentions. The truth is, it never is, and they need a product that can provide them with a reality check.

At RedSeal, our mission is to provide organizations with technology that allows them to understand their network, hybrid, and cloud security posture. Because cloud technology is so complex, and changing so quickly, organizations need powerful technology to understand their implementation. They need to model their environment, so they can easily spot flaws. Our tag line is “See and Secure” because you can’t secure what you don’t understand.

For more information on RedSeal Stratus, our new CSPM solution, click here.

For more information of ways that RedSeal can help avoid unintended internet exposure, check out our Solution Brief.

If you’re concerned about your EKS Security, click here.

RedSeal Launches New Cloud Security Posture Management Solution to Empower Security Teams

/by

RedSeal Stratus identifies unintended exposure to the Internet, creates a connectivity visualization of your cloud architecture, and helps you understand your Kubernetes Inventory

Building on more than a decade of award-winning cybersecurity analytics we are excited to launch RedSeal Stratus, our new Cloud Security Posture Management (CSPM) solution that stops unintended exposure of cloud resources to the Internet.

Cloud misconfigurations, which can leave resources unintentionally exposed to untrusted networks, are the major source of data breaches. To help security teams better manage the increased risk associated with increasing cloud complexity, RedSeal Stratus provides security teams with an out-of-the-box overview of Internet-exposed resources by tags, connectivity visualization between and within their Amazon Web Service (AWS) cloud resources, and inventory of AWS Elastic Kubernetes Service (EKS) resources.

While native Cloud Security Provider tools provide basic capabilities that may be sufficient for smaller cloud-first organizations, larger organizations who are probably hybrid, multi-cloud, and need advanced features should choose a third-party CSPM solution.

Current CSPM solutions simply call CSP APIs to determine if subnets are Internet-facing. For more accurate results, RedSeal Stratus identifies resources exposed to the Internet by calculating access through security control points from end-to-end.

Only RedSeal Stratus can calculate how an instance gets to the Internet, what security points it goes through, and through which ports and protocols. Other security products may show connectivity where there is traffic, using an agent-based approach, but only RedSeal Stratus can show you all connectivity possible including that without traffic–and without an agent. As a result, RedSeal Stratus is unique among native CSP and CSPM offerings by:

  • Immediately identifying exposure to the Internet, with an out-of-the-box dashboard of all resources exposed to the Internet, pre-calculated and grouped by tags
  • Providing complete and up-to-date visualization of your AWS infrastructure, including all accounts, VPCs, gateways and instances
  • Showing details of your Amazon Kubernetes (EKS) inventory to quickly identify services exposed outside your clusters, and to discover overly permissive user and service accounts

RedSeal Stratus is a cloud security solution for the modern day that provides security teams with a unified, interactive view of their AWS environments, including Kubernetes (EKS) inventory, and exposed resources that can lead to costly data breaches.

To learn more, visit www.redseal.net/stratus or Request A Demo.

CISA and FBI Publishes List of Top Vulnerabilities Currently Targeted by Foreign Sponsored Hacking Groups

/by

RedSeal Cyber Threat Series

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have jointly released a report on the top 10 vulnerabilities consistently being scanned, targeted, and exploited by foreign sponsored hacking groups.

All 10 of the vulnerabilities are known and have patches available from their vendors.

Exploits for many vulnerabilities are available publicly and have been used by various malware and ransomware groups and other nation-state actors.

RedSeal customers should:

  1. Create and run daily reports until all systems with the 10 vulnerabilities are patched
  2. Contact your RedSeal sales representatives or email info@redseal.net for additional details

References:

https://us-cert.cisa.gov/ncas/alerts/aa20-133a

Cyber Readiness Pillars and RedSeal

/by

Cybersecurity readiness is an excellent tool that has the ability to provide you with the right services. It has the ability for identifying, preventing and responding to cyber threats. This tool is required by organizations all over the world, and organizations that lack this strategy are prone to more cybersecurity threats.

The Cybersecurity and Infrastructure Security Agency (CISA) suggested and developed the Cyber Essentials for small businesses. Along with these businesses, the local government leaders are also provided with ideas on how to successfully make an actionable understanding of how to implement organizational cybersecurity practices.

CISA leaders offered a detailed awareness of how the pillars of Cyber Essentials are important. Building a corporate culture is required for cybersecurity and the organization which fails to do so faces cyber-attacks. During a webinar with the U.S. Chamber of Commerce on June 29, CISA provided a starting point for better flexibility considering cyber readiness.

“From human resources to marketing to sales and procurement, it is almost guaranteed that you rely on one or more digital platforms to facilitate the success of your business operations. The Cyber Essentials are a series of tools and practices that we have assembled to provide what we consider to be the basics of cyber organizational readiness,” Trent Frazier, deputy assistant director of the Stakeholder Engagement Division at CISA, said.

Every team requires to have a safe cybersecurity practice. If you don’t have a holistic approach towards it, then, you are one organization that is in danger. Great help from the global leader is what you require in this case. RedSeal is a company that you can depend on for sophisticated cybersecurity.

RedSeal as a force multiplier for every other security device within a network is indulged in cybersecurity. If you have short of skilled cybersecurity personnel, then, don’t forget to connect with us.

The 6 Pillars of Cyber Readiness 

Creation of Cyber Readiness Culture 

Pillar One 

Pillar one of cyber readiness is leadership. The leaders are always the backbone of an organization and a great help in maintaining the business culture.

That is why it is suggested that the leaders shouldn’t forget to keep the essential cybersecurity in mind. The leaders should not overlook the essential investment required in cybersecurity. They should also determine how much work is dependent on IT and have a trusted relationship with the sector partners and government agencies. It is required to have a trusted relationship so that the cyber threat information can get easily accessed.

Pillar Two

The second pillar of cyber readiness is the staff. The people associated with the organization’s system are an essential part of this readiness. This element’s task is developing awareness and alert about cybersecurity.

Systems and Data Environment in Cyber Readiness 

Pillar Three

The third pillar consists of systems and leaders being taught and trained on what is present in their network. Also, they are offered knowledge on how to maintain hardware and software assets inventories. It will help them in letting them know what is there and what things are at risk because of the attack.

Pillar Four 

The fourth pillar advises the leaders to have knowledge on:

  • The network
  • Maintenance of inventories of network connects including user accounts and vendors
  • Multiple-factor authentication for every user, starting with those who have privileged, administrative, and remote access

Pillar Five

The fifth pillar of cyber readiness is the data, intellectual property along with another delicate information present within the organization. In this case, the leaders and staff get tasked with learning how the data can get protected.

Respond to and Recover from a Crisis 

Pillar Six

Crisis response is the sixth and last pillar in the Cyber Essentials. It focuses on restricting the damage and rushing restoration of the normal operations after a cyber-attack.

The Cyber Essentials have given the authority and tasked leaders for the development of an incident response along with a disaster recovery plan. This plan should outline the roles and responsibilities and should get tested often for cybersecurity needs.

Leaders should know and be aware of the cybersecurity of the organization. Their assessment will influence the business impact as well. Also, the leaders should have proper security on which systems should be recovered at the earliest.

As a leader, the person should be well aware of who to call for help if they don’t have sufficient staff for it. Learn who should be the people that you should call for help first. These can include outside partners, government, technical advisors, and law enforcement.

If by any chance you are looking for cybersecurity services, then, our platform is the one. We offer the following cybersecurity services.

RedSeal Service Offerings 

  • Cloud Cyber Inventory Assessment
  • Cyber Visibility Assessment
  • Health Check Service
  • Secure Remote Work Assessment
  • Managed Service
  • Cyber Cloud Access Assessment

Our professional services are the solution to all your cybersecurity answers. We work as a team and offer skilled and trained cybersecurity personnel. Along with them, we offer cybersecurity products that make your investment more valued.

The Bottom Line 

Organizations need a cybersecurity strategy to protect both infrastructure and customer data from growing cybersecurity threats. The Cybersecurity and Infrastructure Security Agency (CISA) developed the Cyber Essentials as a guide for small businesses and local government leaders to develop an actionable understanding of where to start implementing organizational cybersecurity practices.

How to Mitigate Security Risks in the the Cloud

/by

CloudTweaks | August 3, 2021

Enterprises continue to spend billions annually on security technology, yet cyber breaches continue to come fast and furious. So what exactly is going on here? Why are the odds stacked against the good guys?

It turns out there are some pretty good reasons why security remains so elusive. Many organizations simply don’t have the staffing resources to do battle with a heavily automated enemy.

Read More

Automation, Integration and RedSeal

/by

Automation is one of the trending topics in cybersecurity. The primary reason for automating mundane and repeatable tasks is to allow people to shift focus to problem-solving activities. Organizations can become more resilient to cyber-attacks by directing all the resources to these problem-solving activities.

Integration means the taking multiple tools and combining their processes, whether those tasks are automated or not.

Automation examples include change management collection across a network firewall. Going line by line manually is a tedious and ultimately futile task given the length of log files. Creating a script to identify changes is far easier and more accurate.

In RedSeal, most processes can be automated:

  • Save query
  • Run query
  • Anything scheduled is an automation

Without security automation, analysts must resolve threats manually. This often entails investigating the issue and comparing it against the organization’s threat intelligence to determine its legitimacy, deciding on a course of action, then manually resolving the issue — all on potentially millions of alerts and often with incomplete data.

That means automating individual tools leaves a lot to be desired. That is where the benefits on integration kick in. 30 years ago software applications were rigid and closed off from each other. Fifteen years ago, there were APIs which allowed data to flow easily from one application to another. As of, five years ago, things became more flexible.

Now, integrations are only limited by imagination.

ServiceNow

For security teams using RedSeal, most common integration is ServiceNow for not just ticketing, but identifying stale and missing network assets in the ServiceNow CMDB. RedSeal enriches the ServiceNow inventory data by adding specific location information about the network devices. ServiceNow provides back critical asset information into RedSeal, which in turn identifies risk to these assets—all while the operation is in the ServiceNow Service Management dashboard. RedSeal plus ServiceNow enables network and security teams to automate the resolution of change control requests in a matter of minutes rather than days. Click here to learn more about RedSeal and ServiceNow.

ForeScout

For users of ForeScout, integrating with RedSeal allows them to identify high-risk end points based on RedSeal’s risk score; use RedSeal to identify risk to critical assets; use ForeScout CounterACT to automate risk mitigation; and discover devices that have STIG or other configuration violations. Click here to learn more about RedSeal and ForeScout.

Splunk

The goal of Incident Response is to address and manage a security breach in a way that limits damage and reduces recovery time and costs. Your SIEM solution can identify an Indicator of Compromise (IOC) by analyzing and correlating the massive streams of machine data generated by your IT systems and technology infrastructure.

Through a seamless integration with the Splunk Adaptive Response framework, the combination of RedSeal and Splunk can result in a significant increase in network situational awareness and full visibility of network access paths to/from an IOC to critical assets and contain downstream risk, within minutes. Click here to learn more about RedSeal and Splunk.

Moreover, there are third party tools are custom applications that are grassroots tools that can create specific integrations that provide data exactly when and how they want to meet their enterprises specific requirements.

At the same time you must do what you can to detect and prevent network security incidents, you need a quick response to network attacks that do get through, quickly investigating and containing network security incidents to minimize (or prevent) loss.

Although SIEMs reduce a large volume of data, they still generate more indicators of compromise (IoC) than your team can quickly investigate.  Just locating a compromised device — physically or logically — can be a time-consuming, manual task.

RedSeal’s model of your network provides detailed options.

A RedSeal model of your network — across on-premise, cloud and virtual environments — gives you the detail you need to quickly accelerate network incident response. You will be able to quickly locate a compromised device, determine which assets bad actors can reach from there – and get information to stop them. Since RedSeal’s model includes all possible access paths, you will see the paths a network attacker could take to valuable assets. And, you’ll get specific containment options so you can decide what action to take — from increasing monitoring, to placing honey pots, to changing firewall rules, to simply unplugging the device — decreasing your network incident response time.

What is RedSeal’s Approach to Automation and Integration?

RedSeal has been called by CSO Magazine as a “force multiplier for your existing security products.”

To streamline security teams’ efforts, and further improve network security, RedSeal now integrates into the user interfaces of several leading security products.

The RedSeal security platform integration improves the efficacy of each of these security products, giving their users unprecedented network context within the tools, and in the format they’re already using.

Integrate your technology ecosystem.

RedSeal enhances your existing security investments by adding network topology and connectivity knowledge across all your network environments. You get a comprehensive network-wide view of your security posture.

View our Technology Integration Guide for details on supported devices and software.

Even advanced security systems depend on adjacent solutions to provide a comprehensive and current view into network risk. RedSeal works with Technology Integration Partners to develop deep integrations through integration apps. The apps add value to both products, providing users with exceptional network context within the tools, and in the format, they are already using.

Benefits:

  • Contextual and actionable insights by RedSeal within host applications
  • Relevant and focused data inside the application and the workflow that you are already familiar with
  • No need for another application on your already-crowded desktop
  • The power of RedSeal without additional training/IT resources required
  • Free of cost and available now

Click here to read more about RedSeal’s integrations.

Behind the Firewall: 5 security leaders share incident response plans

/by

Cybersecurity Dive | July 30, 2021

First, it’s good you have a plan to begin with. But have you tested it?

That is, have you gathered all your stakeholders, from the C-suite to the trenches, and run through your plan? And testing it once is not good enough. Your teams and networks are constantly changing, so your plan should evolve as well with time.

When an incident occurs, that is not the time to find out if your plan works. Testing turns up simple things, like having the ability to use outside communication mechanisms. If your system gets locked down by ransomware there is a good chance your address book in Outlook will be inaccessible.

Part of testing is also getting to know your network by modeling it and examining how it’s all connected. Having a continuously updated model of your network greatly speeds up your response time.

Read More