Network News

“To continue evolving with the speed of today’s business, our customers’ data centers have transformed into highly dynamic, distributed hybrid architectures that often span multiple clouds. Fortinet’s FortiGate next-generation firewalls allow us to accelerate our customers’ cloud on-ramp because of their scalable high-performance security and networking that enables security-driven networking.” --Bart Hubbs, Manager, Global Security Practice at WWT

Hewlett Packard Enterprise (HPE) announced today that it shattered 37 world records, establishing undisputed performance and efficiency leadership with the new HPE ProLiant DL325 and HPE ProLiant DL385 servers equipped with the 2nd Gen AMD EPYC™ processor. Eclipsing previous virtualization performance records by as much as 321 percent and power efficiency records by 28 percent, the new HPE ProLiant DL325 and HPE ProLiant DL385 servers deliver results that redefine value and economics across virtualization, cloud, enterprise infrastructure and data-intensive workloads. About Hewlett Packard Enterprise Hewlett Packard Enterprise is a global technology leader focused on developing intelligent solutions that allow customers to capture, analyze and act upon data seamlessly from edge to cloud. HPE enables customers to accelerate business outcomes by driving new business models, creating new customer and employee experiences, and increasing operational efficiency today and into the future.

Cisco has announced its intent to acquire Voicea* which represents another proof point in Cisco’s continuous commitment to making Webex the collaboration platform-of-choice for the best employee experience. With Voicea technology, Cisco will enhance its Webex portfolio of products with a powerful transcription service that blends AI and Automated Speech Recognition (ASR) to unlock the power of any collaboration, like meetings and calls. Our first focus with Voicea is to turn meetings into a treasure trove of digital meeting notes and insights. Attendees and non-attendees can quickly gather the most relevant information from these digital notes and insights, turning a block of text into actionable information. Voicea is the creator of a market-leading real-time solution that provides meeting transcription, voice search, and meeting highlights/action items, with robust data privacy. It helps teams have more productive and actionable meetings by turning talk into action. Acquisition builds upon Cisco’s vision of Cognitive Collaboration, which slipstreams AI across all interactions to make teams more productive. "As part of the Webex portfolio, our first focus is to use Voicea to turn a simple meeting into a treasure trove of digital meeting notes and insights, with robust data privacy." Cisco collaboration customers include 95 percent of the Fortune 500 and more than 130 million people use Webex every month. "Voicea's true market leading technology will be a game changer for our Webex customers to experience more productive and actionable meetings", said Amy Chang, senior vice president and general manager, Cisco Collaboration. "The acquisition of Voicea allows us to leap past basic transcription services and instead, continue delivering on our vision of AI-driven, Cognitive Collaboration across our entire portfolio." Head here for the full media release.

We need to agree that the Security Landscape is changing and evolving. Gone are the days a Basic router or firewall to protect the internet connection and a bit of antivirus to protect the desktops, is or should be a relic of the past. The notion that we are a small country and therefore not a target for hackers is a misnomer. Attacks are not always personal, but a widespread assault to gain nuisance factor or monetary gain such as ransomware.

For many years, businesses have been building their security infrastructure around loosely affiliated point products from multiple vendors, opting for best-of-breed solutions that often proved difficult or impossible to integrate. And, over time, security practitioners have gotten used to working with the inconsistencies between products. As digital transformation brings more users, devices and applications online, companies are challenged to protect an expanding attack surface. With more space to operate in and greater opportunities to generate a profit, active adversaries are relentlessly targeting businesses, organizations and people. In response, we've ended up deploying disparate security products to address a variety of needs - a practice that can be difficult to manage and often leaves businesses more vulnerable. Security services become a complex mix of technologies, endless alerts and false positives - Noise - that we filter out in the hope that the security layers we have in place are doing their job. The Network Perimeter; once easily defined behind your corporate firewall is now stretched to wherever your users happen to be working. The prevalence of 3rd party systems and cloud services has decentralised your users and the information systems they have access to. Excellent for an increasingly mobile and flexible workforce, but a growing headache of complexity for Information Security. Anti-Virus is an Industry standard. We all have it in one way or form, we accept that we need it and we trust it to protect us. The problem is that the AV industry is playing catch up against a more agile, faster growing, malicious trend. The reality is that Anti-Virus cannot keep up. In the 1st quarter of 2016, the industry average time to detect a new threat variant was 170 days. 39 days to contain and 43 days to remediate. Signature based Anti-Virus in that form is almost useless. New Malware variants are mutating and impacting services world-wide every other week. But for so much of the IT industry; this is what we know and this is how we work. Keep your Operating System patched and up to date. Get your AV definitions out as often as possible. Make sure you have backups of your critical data in place. Ransomware dominated the threat landscape in 2016. In January of 2016, ransomware accounted for around 18% of the global malware delivered by spam and exploit kits. By November 2016 that number exploded to account for 66% of malware payloads. The threat landscape has changed rapidly because it's been so effectively monetised. Your files are encrypted. You pay the ransom (and hope to recover your files), or you lose the files and hope to restore everything from backup. There's no need for a targeted approach. The malware is sent far and wide, the more systems impacted, the more monetary opportunity. The Cisco 2017 Annual Cyber Security Report revealed the potential financial impact of attacks on businesses, from Enterprise to SMB. More than 50 percent of organizations faced public scrutiny after a security breach. Operations and finance systems were the most affected, followed by brand reputation and customer retention. For organizations that experienced an attack, the effect was substantial. Twenty-two percent of breached organizations lost customers - 40 percent of them lost more than 20 percent of their customer base. Twenty-nine percent lost revenue, with 38 percent of that group losing more than 20 percent of revenue. Twenty-three percent of breached organizations lost business opportunities, with 42 percent of them losing more than 20 percent. Small business can no longer hide behind the mantra of "Why would any target us?" The global reality is that if you haven't been hit by some form of crypto or malware, and you do not have an effective security posture, it's only a matter of time until you are impacted. Ransomware attacks are opportunistic. Profit with as little effort and risk as possible. If you operate a large enough network environment, it's likely that you have already deployed a hierarchical network architecture consisting of access, distribution, and core layers. Potentially with multiple security products, deployed in a DMZ or local services zone, such as a firewall and/or web proxy server. It's the model we've pushed for almost 20 years. Unfortunately, this has become an outdated security model. As our businesses and users change and digital disruption continues to influence business direction the attack surface increases leading to more opportunistic threats. The traditional model no longer gives us any true defence in depth. With more remote and roaming on-the-go users working directly via the cloud on various devices, perimeter-based security technologies and virtual private networks are no longer able to fully protect devices and corporate data. Many cloud-based services are accessed directly over an internet connection, leaving these applications and data with only basic security. According to Gartner, by 2018, 25 percent of corporate data traffic will bypass perimeter security and flow directly from mobile devices to the cloud. For New Zealand SMB's that number is already a lot higher. We start to lack integration or correlation. We rely on multiple stand-alone products designed to provide best effort protection for users on the go. We lose visibility of the devices using our resources. To better safeguard our businesses and data against ransomware and the emergence of new threats we need to re-define our security architecture. We need to look at creating a Defense in Depth strategy providing us with an Effective Security Posture that reduces the gap between time to detect, contain and remediate. We need to leverage integrated, open and automated systems that Automatically shares threat intelligence and provides aggregated, correlated context with other security products and services, both on premises and in the cloud. We need reduced complexity and better visibility across the entire environment. We need better integration with new and existing security investments using open, extensible standards and technology. Knowing what we need, the panacea starts to take shape. NGFW/NGIPS - "Next Gen" Firewalls and Intrusion Prevention with visibility into who is accessing the network and what they are doing. Policy enforcement, analytics, file and device trajectory. DNS Security - Extend protection beyond the organizations firewalls by leveraging threat analytics at the Domain Name System layer to analyse outbound network calls, intercept and prevent active connections to Command and Control services. Immediately preventing access to URL's containing malware. SDN - Granular, Software Defined Network segmentation and role based policy enforcement regardless of the location, device or IP Address. Email Security - On Premise, Hybrid or Cloud based multi-layer malware and spam detection and prevention. Sandboxing - Network, Cloud, or Host based advanced analysis of unknown data in or out of the organisation. Now comes the critical component - Analytics. The ability to take all the information we're getting from these security pieces and do something meaningful with it. Traditionally, by developing baselines, we can start alerting or reacting to anomalies. We can define what is normal so we can identify the abnormal. The issue we're faced with today is the sheer amount of data to process. We solve this with Cloud Based Threat Intelligence. Security sources which are constantly fed, updated, analysed and quantified. Analytics from millions and millions of devices reviewed in near real-time using advanced AI techniques and security teams from around the globe to identify and detect emerging threats. We know we're always going to be on the back foot trying to prevent or contain new threats but as we build up our analytics and enhance AI learning our time to detect gets lower and lower and our chance of predictive heuristics used to detect emerging threats get better. So now we have what looks like a model for an all-encompassing network perimeter and an effective security posture. Through continuous analysis we're detecting and blocking threats within hours instead of days, weeks or months. We're using our Cloud Based Threat Intelligence to get protection in place on all our interconnected systems as soon as a new threat is identified. Our time to detect is reduced considerably and our Security Posture is feeling quite Effective. We can block known threats faster than ever before! We're feeling confident that when the business owner asks if the network is now secure we can respond with certainty that we have secured the network. But Security is not static, we know that time quickly moves forward. Let's say that in 30 minutes time a new exploit is released into the wild. Through sheer bad luck the organisation you are being trusted to protect is one of the first places in the world hit with a new zero-day exploit. An invasive little bug has slipped by all your carefully constructed security, despite you doing everything possible to prevent it. This is where the final piece of the security puzzle needs to fall quickly into place. We've built our analytics, we've narrowed our time to detect, now we need to rapidly and retrospectively remediate the issue. Traditional point based security has always worked on the premise of known good and known bad. Data with an unknown disposition is typically let through with the hope that the next layer of security will deal with it. If we're going to be able to deal with the unknown we need to be able to track it. Not just vertically, but also horizontally through the network. We need both our Network and Endpoint protection watching, analysing and recording activity so we can track data of an unknown disposition. Until that disposition is clarified our position on that data is fluid. We can sandbox, we can monitor and then we can classify. If we've tracked that data through the organisation while our sandboxing and analytics engines are running then we have the all-important component of visibility within the network. The moment that the disposition of that data changes from unknown to known bad, we can retrospectively follow that data throughout the network. Isolating, triaging and remediating wherever necessary. This is the security model that we're adopting to provide an Effective Security Posture for ourselves and our customers. Seamless end to end analytics, with context, to narrow the mean time to detect, protect and remediate. To ensure that the network security perimeter is extended as the business evolves.