The post Grady Summers Appointed as Netwrix CEO appeared first on Digital IT News.

“Based on our beta testing, the added coverage of Entra ID in Netwrix Threat Manager 3.0 shows the real possibility of safeguarding both our on-premises and cloud environments with a single solution. The product demonstrated the capability to provide greater control and visibility, which we believe could make it easier for organizations like ours to manage data security across hybrid infrastructure,” said a Senior Systems Engineer at a US non-profit testing organization.

The latest Netwrix Threat Manager enhances the protection of sensitive data and empowers customers to:

• Avoid attack escalation by detecting and preventing improper changes in AD and Entra ID, including analysis of abnormal user behavior, modifications to application permissions, changes in sensitive roles like Global Admin, and more.
• Contain security incidents on-premises and in the cloud by automating threat response with account disablement, reset of the affected user’s password, terminating all active sessions of the affected account, and marking the user account as compromised to trigger additional security measures and investigation.
• Minimize data overexposure thanks to more granular role-based access control for reporting and investigations across Active Directory and Entra ID.

“In 2024, 48% of organizations had to make changes to their security posture to meet the criteria of the cyber insurance policy they chose. To help our customers face digital threats with confidence and ensure their eligibility for cyber insurance, we remain focused on delivering strong, consistent security measures across the entire on-premises and cloud infrastructure,” says Michael Tweddle, Chief Product Officer at Netwrix.

To learn more about the new version of Netwrix Threat Manager, visit the product page here.

Related News:

84% of Large Enterprises Faced a Security Incident in the Past Year

In the Education Sector 77% of Organizations Spotted a Cyberattack

The post Netwrix Threat Manager 3.0 Extends its Capabilities appeared first on Digital IT News.

According to the survey, 84% of organizations in the large enterprises sector spotted a cyberattack within the last 12 months, compared to only 65% in 2023. The most common security incidents are phishing, user or admin account compromise, and ransomware or other malware attack.

“The surge in the attack rates across organizations of all sizes, including the enterprise sector, may indicate that threat actors found AI automation extremely beneficial. With the introduction of AI, sending a massive number of phishing emails and probing systems and services for vulnerabilities is only a matter of orchestration on those platforms operated by cybercriminals. Constant pressure stresses the security teams and might lead to reduced and worn-out protection levels. To ease this burden, organizations should consider involving third-party investigators as a part of their incident response plan. It will help offload the internal security team when dealing with an ongoing attack,” says Dirk Schrader, VP of Security Research and Field CISO EMEA at Netwrix.

For 53% of attacked large organizations, a security incident resulted in additional unexpected expenses to fix security gaps. Each fifth enterprise faced compliance fines (22%) and a reduced competitive edge (21%). Moreover, 30% of enterprises estimated their financial damage from cyber threats to be at least $50,000, compared to just 17% among organizations overall.

“Typically, large enterprises have already implemented the basic security controls and thus must address more complex and costly issues in the aftermath of an attack. Where a smaller organization may have a quick fix available and can accept certain risks, enterprises must invest in the security team, process changes, and tooling to close even the smallest gaps exploited by the attacker,” says Ilia Sotnikov, Security Strategist at Netwrix.

To view Netwrix’s additional findings for the enterprise sector, visit the website here. Or to review its annual global 2024 Hybrid Security Trends Report, visit the website here.

Related News:

In the Education Sector 77% of Organizations Spotted a Cyberattack

MSPs Face Unplanned Security Expenses from 51% of Cyberattacks

The post 84% of Large Enterprises Faced a Security Incident in the Past Year appeared first on Digital IT News.

It reveals that 77% of organizations in the education sector spotted a cyberattack on their infrastructure within the last 12 months, up from 69% in 2023. The most common attack vectors were similar to those among other industries: Phishing, user account compromise, and ransomware or other malware attacks.

In the education sector, almost half (47%) of organizations faced unplanned expenses to fix security gaps because of a security incident. Moreover, one in seven of those organizations incurred compliance fines, and each tenth reported changes in senior leadership and lawsuits.

“An incident can reveal security gaps such as excessive admin privileges, dormant accounts, weak or unchanged passwords, default passwords or configurations, and unpatched systems due to negligence or lack of knowledge. Fixing a gap might not immediately require spending additional money but will definitely require time from the IT security team. In other words, addressing the root cause of a security incident results in additional investment, in either money or effort, or both,” says Dirk Schrader, VP of Security Research and Field CISO EMEA at Netwrix.

“In the aftermath of a breach, organizations must prioritize remediation steps to reduce risks moving forward. For example, the immediate response may include patching software on the most critical servers and adding a manual review step on certain operations. Longer-term remediation may have to wait for the next budget cycle and require additional software, services engagement, or headcount,” says Ilia Sotnikov, Security Strategist at Netwrix.

Learn more about how the education sector can ensure data security at the website here.

Related News:

Organizations with Cyber Insurance had to Improve Security to Meet Requirements

MSPs Face Unplanned Security Expenses from 51% of Cyberattacks

The post In the Education Sector 77% of Organizations Spotted a Cyberattack appeared first on Digital IT News.

It reveals that 76% of MSPs spotted a cyberattack on their infrastructure within the last 12 months, similar to the results among organizations overall (79%). Among those that were attacked, every second MSP (51%) had to deal with unplanned expenses to fix the security gaps. Moreover, 31% experienced a loss of competitive edge, and 27% faced compliance fines compared to 20% and 17% across other verticals.

For the MSP sector, each second security incident in the cloud (49%) was associated with user account compromise, while 46% of attacks on premises were ransomware or other malware attacks. In contrast, these types of attacks were less common among other industries.

“Our team has had significant success in handling user account compromises and ransomware attacks using Netwrix 1Secure,” says Rory Cooksey, Director of Growth at WheelHouse IT. “Its robust monitoring and alerting capabilities allow us to detect and respond to threats swiftly, ensuring minimal disruption to our clients’ operations. The comprehensive visibility and control provided by 1Secure empower us to confidently address and mitigate these security challenges, maintaining the highest level of protection for our clients.”

“MSPs largely rely on software-as-a-service (SaaS), platform-as-a-service (PaaS), and infrastructure-as-a-service (IaaS) solutions. These are usually accessible to both MSPs and their clients, significantly limiting the implementation of network-based restrictions like IP address filters. As a result, attackers target such cloud-based solutions because they might be easier to infiltrate, and one successful breach gives keys to many kingdoms,” says Dirk Schrader, VP of Security Research at Netwrix.

“The service provider is a promising target for ransomware gangs. On one hand, MSPs can hardly afford downtime and would be more eager to have the operations back up and running, which increases the chances for ransom payout. On the other hand, breaching a service provider can be just a step toward the real target in a supply chain attack. MSPs should adequately assess the risks and rely on threat intelligence to make their security decisions,” says Ilia Sotnikov, Security Strategist at Netwrix.

To learn more about the Additional Findings for the Managed Service Provider MSPs download the 2024 Hybrid Security Trends Report here.

Related News:

Netwrix Solutions Expanded Its Global Partnership Network by 36%

Key Enhancements Made to Netwrix Products and DLP Capabilities

The post MSPs Face Unplanned Security Expenses from 51% of Cyberattacks appeared first on Digital IT News.

The survey reveals that almost half (48%) of organizations with a cyber insurance policy had to enhance their security posture to meet the insurer’s requirements. Among those, 30% made changes simply to be eligible for the policy compared to 22% a year ago. 18% of respondents say they implemented additional security measures in order to reduce the cost of a policy, down from 28% in 2023. What’s more, almost 1 in 5 (19%) insured organizations used their cyber insurance policy within the last 12 months.

The most common security measure required by insurers in 2024 is multi-factor authentication, named by 75% of respondents (up from 65% in 2023), followed by patch management (55%) and regular cybersecurity training for employees (49%). Moreover, insurance companies are now more likely to require advanced security solutions. Indeed, in 2024, 45% of respondents named IAM among the requested security measures in place, up from 38% in 2023, and 42% said the same about PAM compared to 36% in 2023.

“One thing insurance providers understand well is risk management. They know that, sooner or later, adversaries with enough motivation and resources will infiltrate an IT environment,” says Ilia Sotnikov, Security Strategist at Netwrix. “PAM makes it harder for attackers to move laterally through the environment and escalate their privileges, and it ensures they will create more noise along the way. All this gives the security team the opportunity to detect and respond to attacks in time to prevent significant losses. And minimizing the loss (e.g., the payout request) is exactly what insurance providers are looking for.”

Learn how a logistics firm secured a cyber insurance renewal by implementing a PAM solution in just two months here.

Related News:

Netwrix Solutions Expanded Its Global Partnership Network by 36%

2024 Cybersecurity Trends to Expect Released by Netwrix

The post Organizations with Cyber Insurance had to Improve Security to Meet Requirements appeared first on Digital IT News.

“Growing security awareness at the executive level means a better understanding that the risks of security gaps extend far beyond downtime and data loss. As a result, more organizations are investing resources into audits to investigate the root cause of security incidents to prevent similar events in the future,” explains Ilia Sotnikov, Security Strategist at Netwrix.

1 in 6 (17%) organizations estimated their financial damage from cyber security incidents to be at least $50,000. In addition, the share of those who faced no financial consequences dropped from 47% to 38% compared to last year. To mitigate the risk of financial loss from data breach, organizations often opt to purchase cyber insurance. Indeed, 62% of respondents confirmed having a cyber insurance policy or planning to purchase one within 12 months. Almost 1 in 5 (19%) insured organizations used their policy last year.

“Considering the high chances of a payout request, it’s no wonder the requirements for obtaining a policy have become stricter. The survey shows that insurers are now more likely to require identity and access management as well as privileged access management,” says Dirk Schrader, VP of Security Research at Netwrix. “These solutions significantly complicate the privilege escalation for the attacker and their lateral movement. As a result, the security team has more time to spot suspicious activity and respond to the attack before any serious damage occurs.”

Other notable survey findings include:

• Phishing is still the most common attack vector both on premises and in the cloud: 74% of respondents suffered this type of cyberattack.
• Account compromise attacks in the cloud spiked, with 55% of respondents reporting them in 2024, compared to 39% in 2023, 31% in 2022, and just 16% in 2020.
• Targeted attacks on premises continue to intensify: the share of those who suffered this type of attack increased by 42%, from 19% to 27%.
• Interest in implementing AI tools surged: This year, 28% of respondents named it among their top IT priorities compared to only 9% in 2023.

“The interest in AI is surging across enterprises – both within the security department and outside. The introduction of AI tools like Copilot to assist with regular business processes raises a new scope of associated security gaps. Since Copilot relies on native access controls within Microsoft 365, it can access all data a user can. If the user has been granted inappropriate access to content, then sensitive information can quickly spiral out of control,” warns Ilia Sotnikov. “Implementing and maintaining a strict least-privilege model is a good start to address the risks associated with Copilot and similar AI-powered business tools.”

Download the 2024 Hybrid Security Trends Report to learn about IT architecture, Security challenges, and security incidents and more here.

Related News:

Netwrix Solutions Expanded Its Global Partnership Network by 36%

Olympic Games Traveling Tips from Netwrix to Avoid Being Scammed

The post Security Incidents Spotted by Organizations in the Past Year, Up 68% appeared first on Digital IT News.

One such mathematical problem happens to be at the core of all current encryption standards. These standards have been a cornerstone of IT security worldwide for decades because, without the decryption key, decrypting data takes so long that the process is rendered pointless. However, quantum computers will not have this limitation, which will make current encryption standards useless.

Although quantum technology is not likely to reach this milestone for 5–10 years, malicious actors are already harvesting encrypted data from both public and private organizations, in anticipation of being able to decrypt and leverage it later. This article identifies the organizations most at risk and provides recommendations on how to mitigate the threat.

Who is at risk?

Harvest now, decrypt later (HNDL) attacks focus on data that will retain its value until quantum-powered decryption becomes available to unlock it, such as sensitive business information, research data and intellectual property. HNDL attacks do not target transactional data or payment card information, which lose value relatively quickly due to expiration or obsolescence.

Consequently, top targets for HNDL attacks include government bodies, especially those associated with the military. For example, back in 2015, the US Office of Personnel Management suffered a breach of approximately 21.5 million records. Some of this data is so sensitive, that its future decryption can impact lives and national security even decades after adversaries obtain it. 

Hospitals and other healthcare organizations are also at high risk for HDNL attacks. Medical records are already valued higher than, for example, credit cards or PII on the dark web. Personal healthcare information like medical conditions, histories, or genetic information is of enduring value. Breaches of health data often have a direct impact on the data subjects, which can be used to extort the victim organization and serve as a foundation for a wider attack.

Commercial organizations with long research and development cycles, such as those in the manufacturing and pharmaceutical sectors, are also in danger of having their data harvested. The nature of their business means that research can last over a decade and therefore stolen data is likely to be valuable for years.

Five Steps to Mitigate the Risk of HNDL Data Breaches

1. Identify the types of data being stored.

Technical and business teams should work together to assess the types of data that the organization possesses, along with the value and shelf life of each data type. This initial business risk assessment will drive the technical mitigation strategy. Executive buy-in is essential because project urgency, depth and costs will vary greatly depending on the results of the assessment.

2. Discover the data.

Once the organization knows which data is useful to adversaries, it needs to concentrate its security efforts on what really matters. Data discovery and classification will provide a clear understanding of the scope of the project, and visibility into data access rights will offer insight into data exposure.

3. Mitigate data risks.

Next, the organization should ensure that all data likely to be targeted in HNDL attacks is difficult to access by implementing additional security controls around it. Start with network security basics like VPN-only access to the most critical data and network segmentation. Then, rigorously enforce the least privilege principle by eliminating unnecessary permissions. Consider implementing just-in-time (JiT) access so that access privileges exist for only as long as needed.

4. Stay alert.

HNDL attacks are more likely to go undetected than other types of attacks. For example, ransomware infections become obvious as soon as the cybercriminals freeze business operations and demand a ransom. But HNDL attackers work hard to stay unnoticed so they can continue to silently harvest data for as long as possible.

To spot HDNL attacks, organizations should establish ongoing monitoring and threat detection. They should also consider implementing threat hunting, either in-house or through a third-party vendor. Security analysts will regularly examine logs for suspicious activity that could indicate adversaries lurking in the environment or signs of data exfiltration, enabling further investigation. Understanding the motivation of HNDL threat actors and which data is most attractive to them results in more tailored threat hunting.

5. Stay informed.

Quantum computing is a very expensive technology, so it is likely to appear not in someone’s basement but rather as a dedicated state-level project. Nevertheless, the threat is real and efforts to combat it have been underway for several years. In 2022, the US National Institute of Standards and Technology (NIST) announced the first 4 quantum-resistant cryptographic algorithms. In 2023, US President Biden issued a declaration that threats resulting from advancements in quantum computing constitute a national emergency.

Organizations whose assessments reveal that they are at high risk from HNDL attacks are more likely to participate in the NIST workgroups and be early adopters of new quantum-resistant encryption algorithms. The rest of us need to stay aware and learn from these early implementations.

The power of action

If organizations follow encryption best practices, the sensitive data harvested in HNDL attacks will not be immediately useful to cybercriminals. However, the rapid advancement of quantum computing technology makes it likely that they will be able to decrypt the stolen data in the near future. At that point, the victim organization could suffer serious consequences, from damaging its reputation to jeopardizing its very existence. Accordingly, it is crucial that all public and private businesses that hold evergreen sensitive data acknowledge the risks associated with data harvesting and take steps to prevent data breaches.

Related News:

Netwrix Solutions Expanded Its Global Partnership Network by 36%

Olympic Games Traveling Tips from Netwrix to Avoid Being Scammed

The post Harvest Now, Decrypt Later: Data Stolen Today Is at Risk in the Future appeared first on Digital IT News.

Over the last two years, the Netwrix team has successfully integrated partners from four acquired companies in North America and Europe, enabling them to take full advantage of the complete Netwrix portfolio. In addition, Netwrix expanded its presence in the Asia-Pacific (APAC) region. The recent partnership agreement with Nihon Cyber Defence, headquartered in Japan, aims to accelerate the delivery of Netwrix solutions to the world’s fastest-growing cybersecurity market.

“The increasing complexity of the IT infrastructure that organizations are working in requires a comprehensive approach to cybersecurity. We are thrilled to provide our customers with Netwrix solutions that safeguard sensitive data both on-premises and in the cloud. Together, we will help organizations reduce both the risk and the impact of a breach,” said Cartan McLaughlin, Founder and CEO of Nihon Cyber Defence.

“We stay committed to our channel-first strategy. We aim to provide our partners with easy access to deal registration, training, and marketing materials for our solutions that enable organizations to secure their Active Directory, govern access to sensitive data, manage privileged accounts, secure passwords, and many more. By growing our businesses together with the partners, we ensure a brighter digital future for organizations around the globe,” says Steven Hollins, Chief Revenue Officer at Netwrix.

For more information about Netwrix solutions for its growing global channel Partner Program, visit the website here.

Related News: 

Key Enhancements Made to Netwrix Products and DLP Capabilities

2024 Cybersecurity Trends to Expect Released by Netwrix

The post Netwrix Solutions Expanded Its Global Partnership Network by 36% appeared first on Digital IT News.

The post Olympic Games Traveling Tips from Netwrix to Avoid Being Scammed appeared first on Digital IT News.