Illusive Joins CyberArk Marketplace

We’ve got some exciting news to share with you: we’ve just joined CyberArk Marketplace! As you may know, CyberArk offers the leading Privileged Access Management solution and is the only security software company focused on eliminating cyber threats that use insider privileges to attack an organization’s most critical assets and infrastructure. The CyberArk Marketplace delivers unprecedented simplicity and speed for security and IT operations teams to extend the benefits of securing privileged access across the enterprise – on-premises, in hybrid cloud environments, and throughout the DevOps pipeline.
Read More

3 Facts About MITRE Shield and Targeted Ransomware

You’ve probably heard me write or speak about ransomware a lot more recently, and for good reason. Targeted, APT-like ransomware attacks against large healthcare organizations and other enterprises have been all over the news. 

Recently, I had the opportunity to present a webinar along with MITRE that focused on MITRE Shield, the concept of Active Defense, and how we can use some of these proactive techniques against ransomware attackers. Below, I’ll look at 3 key facts for security teams to understand when planning your active defense strategy against ransomware threats. 
Read More

Why Are Ransomware Attacks Still Happening?

Here we go again: this past Thursday, officials from three US federal agencies issued a statement warning about an “imminent cybercrime threat to US hospitals and healthcare providers.” The threat in question comes from a Russia-based cybercriminal gang preparing to disrupt information technology systems at hundreds of hospitals and medical care facilities all over the US with ransomware. The attackers will make devices on the hospital networks unusable unless a sizable payoff is made, and indeed, at least five US hospitals already seem to be under attack. With patient populations surging in the wake of another wave of coronavirus cases and a presidential election on the horizon, the imminent threat could prove catastrophic without the proper security measures to fight back.
Read More

Healthcare Under Cyberattack – Advanced Ransomware, IoMT Devices, and Data Breaches

Healthcare institutions are facing unprecedented threats. We’ve all been rocked with horror at the major cyberattacks on hospitals this past week. What’s scary about these types of attacks is that they can very quickly lead to lost lives, not just lost dollars.
Read More

MITRE Shield Tactics Confirm that Deception Is Essential

We recently wrote about MITRE Shield, just after the initial release. In this article I’ll go into more detail about specific capabilities that Illusive platform provides, and how they map to the MITRE SHIELD framework.
Read More

MITRE’s Shield Maps Tactics and Techniques to Achieve an Active Defense Posture

With the release of Shield, a rich knowledgebase built on over a decade of enemy engagement, MITRE is once again stepping in front of the pack, and leading the global cybersecurity ecosystem in thought and action.

According to MITRE, Shield is intended to stimulate discussion about Active Defense. Read More

Why Deception Gives Cybersecurity Teams the Upper Hand (part 2)

The first part of this guest post series from Kevin Fiscus, SANS instructor and cybersecurity expert, explained the challenges of early threat detection strategies. In part 2, we look at how a deception-focused strategy can confuse attackers, limit lateral movement, and give security teams back the advantage against attackers.
Read More

The Agentless Advantage in Cybersecurity – Lower IT Burden and Risk

Agent vs. agentless: you’re likely familiar with the debate about which approach is best in today’s ever-changing threat environment. However, when it comes to detection of in-network threats, particularly using endpoint-based distributed deception as a strategy, an agentless approach is significantly more effective and safe. 
Read More

Easier Security Management Across Segmented Networks

Network segmentation—splitting up a network into smaller subnetworks—is a common practice, especially in large organizations. The benefits in segmenting networks include heightened network security, including better privilege management across different departments, isolating a successful attack (or other types of network failures) to a local network, and reduced attack surface, as well as better network performance through reduced congestion (fewer hosts in each subnetwork). Regulatory compliance can be a motivation as well. Additionally, previous mergers and acquisitions often necessitate that networks remain separate.
Read More

Preventing Attackers From Turning a Cloud Ecosystem Into a Security Nightmare

One topic we’ve written about a lot on this blog is lateral movement, when attackers leverage existing credentials and connections to move from one machine to another within an environment. When you add cloud to the mix, however, there are so many changes - from new attack vectors to methodologies and prioritizations - that the phrase seems incomplete.
Read More