A recent Forbes article states – “The bottom line is that investing in securing perimeters leaves the most popular attack vector of all unprotected, which are privileged credentials.” We could not agree more.Some of the solutions proposed in the article, however, do not prevent privileged credential attacks – they just detect attacks, maybe, once they have occurred.
Numerous media sources are reporting newly discovered Exchange malware, called LightNeuron, believed to have been created by a Russian hacking organization known as Turla.
LightNeuron is a “backdoor” that allows attackers to read and modify any email passing through compromised Microsoft Exchange servers. The malware also allows attackers to create and send new emails, as well as to block emails so that intended recipients do not receive them. Researchers who discovered LightNeuron believe that this malware has been in use since 2014!
Cord3’s UNITY Email solution protects emails with encryption before they reach the Exchange server, so even a LightNeuron-compromised server cannot read emails protected by Cord3.
While LightNeuron is one specific attack vector, Cord3’s general approach prevents all sorts of attacks on email servers from accessing sensitive emails, including attacks using privileged administrator credentials.
Cord3’s solutions separate data security away from users, applications, and servers. It is this approach that mitigates traditional attack vectors, newly discovered attacks like LightNeuron, and even new attacks to come in the future. If Turla has determined techniques to install malware on Exchange servers, it is reasonable to believe others will follow in their footsteps and generate similar attacks.
Email is an entrenched business tool. Organizations cannot just turn off email. The best solution against LightNeuron and other backdoor attacks is to protect sensitive emails before they reach the Exchange server with software that is easy to deploy and easy to use – Cord3’s UNITY Email solution is exactly that solution!
One thing that does not improve when moving to the Cloud (or outsourcing to any MSP) is privileged credential abuse. In fact, when you use the Cloud, the opportunity for privileged credential attacks expands substantially beyond what is available to attackers in the Enterprise – which is bad enough.
Are your IT people spending more time than you would like on security audits and administration? If your answer is yes, then you are certainly not alone.
We’ve got your data covered … For encrypting data at rest, Cord3 only uses symmetric cryptography. Cord3 uses the Advanced Encryption Standard (AES) algorithm with 256-bit keys. We’ve got your data covered against future advances in quantum computing that are projected to “completely break” widely used algorithms like RSA and ECC.
Cord3 implements its data-centric security in Intercepts. These Intercepts get overlaid onto a network between users and application servers. By “overlaid”, we mean that there are minimal changes required to get Intercepts to work because they simply get connected to a network and immediately begin capturing data asset packets flowing over a network between end points. When a data asset (e.g., a file or an email) is fully re-built on an Intercept, the Intercept applies the organization’s security policy to that data asset before delivering the now-secured data to its destination.
Intercepts capture data asset packets flowing over a network and re-build the original data asset (e.g., a file or an email). When a data asset is fully re-built on an Intercept, the Intercept applies the organization’s security policy to that data asset, whether that is to protect an asset going to a server or make an access decision about data on a server.
“It’s your worst nightmare, and a cyber attacker’s dream come true: the credentials of a privileged user getting stolen or otherwise compromised. After all, privileged users can go practically anywhere and do anything in your network as they go about the business of configuring servers and systems and setting security policies.” CSO Online, January 2018
“Why is encryption software so horrid to use?” The long answer to that question is complex and diverse. The short answer is that encryption comes in two fundamental forms and one of the forms is actually easy to use – that form is “in transit” encryption, like SSL and VPN. The second form – encryption “at rest” – is a completely different story.
Privileged credential abuse has been traditionally difficult to detect and stop because data security is tightly integrated into applications and applications grant unrestricted access to privileged credential users, including access to sensitive data. Cord3 separates data security from applications. This separation of data security from applications enables two critical capabilities for protecting sensitive data against privileged credential abuse.
- Protect Your Data from Privileged Credential Attacks – Detecting Attacks is Too Late!July 5, 2019 - 11:05 am
- LightNeuron malware – Cord3’s Solution!May 15, 2019 - 2:44 pm
- The Cloud & Privileged Credential AbuseFebruary 28, 2019 - 4:23 pm
- Cord3 to Exhibit at RSA Conference 2019February 28, 2019 - 2:34 pm
900 Morrison Drive Suite 206
+1 343 488 8720