Eliana Willis

IBM has announced a new Secure Access Service Edge (SASE) solution designed to encourage the zero-trust security approach in the enterprise. 

On Wednesday, the tech giant said that the new service, IBM Security Services for SASE, will leverage technology provided through a partnership with cybersecurity firm Zscaler, announced in May. The new offering has been “designed to help accelerate organizations’ adoption of cloud-delivered security at the edge, closer to the users and devices that access corporate resources,” according to IBM, as well as to promote zero-trust network access (ZTNA) in the enterprise. IBM Security Services for SASE includes the firm’s zero-trust strategy protocols, SASE blueprints, a modern network architecture, and Zscaler capabilities, including the creation of processes and policies for managing SASE, as well as support for IBM Managed Security Services.  According to the company, IBM Security Services for SASE will help support a now-hybrid workforce, third-party access systems, merger acquisition execution, and network upgrades to facilitate the cloud, 5G, and Internet of Things (IoT) devices.  “Traditional approaches to network security are no longer viable in a digital world where users and applications are distributed,” commented Mary O’Brien, General Manager at IBM Security. “We’re seeing this transformation happen right before our eyes as many organizations plan to operate in a hybrid model for the foreseeable future. This new approach requires a shift in culture, processes and collaboration across teams alongside a new technology architecture.”The new solution is now commercially available. 

Earlier this year, IBM and Zscaler announced its alliance alongside the creation of a Software-as-a-Service (SaaS) implementation of IBM Cloud Pak for Security, focused on streamlining the development of zero-trust architectures in the enterprise.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

StackCommerce
Apparently, the COVID-19 pandemic is driving the next big wave of IT outsourcing. And since security is such a huge chunk of IT responsibilities, the affordable self-paced 2021 All-in-One Ethical Hacking & Penetration Testing Bundle would be an excellent choice for anyone considering a career change. Best of all, all nine courses are designed for beginners, so no previous knowledge or experience is required.

You can jump right in with “Applications & Penetration Testing: Fast Start” to find out all about the main aspects of ethical hacking. Or you might prefer to begin with the crowd favorite, “Ethical Hacking with Metasploit: Exploit & Post Exploit”, which takes you from novice to expert as a white hat hacker. Former students have given this course an impressive 4.8 out of 5 stars rating. However, that’s not completely surprising since Oak Academy was created by elite tech experts and specializes in critical skillsets for cybersecurity, game development, mobile app monetization, and more.You will learn all about spoofing, sniffing, password cracking and much more in “Ethical Hacking: Network Fundamentals & Network Layer Attacks” and “Wi-Fi Hacking & Wireless Penetration Testing Course”, which also teaches about WPS Cracking and other topics specific to Wi-Fi. You’ll get more familiar with password cracking, as well as network scanning and a variety of other useful tips in “Free Tools for Penetration Testing & Ethical Hacking”. And then you dive deeper into network scanning with “Ethical Hacking: Network Scan by Nmap & Nessus”.Find out how hackers use social engineering to access the Windows, Linux, and Android platforms in “The Complete Social Engineering, Phishing, OSINT & Malware”. You’ll learn how black hat hackers compromise applications on the web and how to fight them in “Complete Web Application Hacking & Penetration Testing”. “Cloud Security with Microsoft Azure For Beginners” covers cloud computing fundamentals and how to secure your infrastructure when working in Microsoft Azure Cloud Computing Services.Don’t pass up this opportunity to start training for a hot new career as a cybersecurity expert. Get The 2021 All-in-One Ethical Hacking & Penetration Testing Bundle today while it’s on sale for just $29.99.

ZDNet Recommends More

Cybersecurity researchers have warned of four emerging families of ransomware that could pose a significant cybersecurity threat to businesses.  Ransomware remains one of the key cybersecurity threats facing businesses around the world as cyber criminals try to compromise networks and encrypt them to demand ransom payments, which can amount to millions. This lure of potentially easy money attracts cyber criminals of all levels towards ransomware, from specialist ransomware gangs who keep the malware for themselves, to ransomware-as-a-service groups who lease out their illicit product to low-level malicious hackers who want to get in on the action. In recent months, some significant ransomware operators have seemingly disappeared. But that doesn’t mean that ransomware is any less of a problem – new groups are emerging to fill the gaps. Cybersecurity researchers at Palo Alto Networks have detailed four upcoming families of ransomware discovered during investigations – and under the right circumstances, any of them could become the next big ransomware threat. One of these is LockBit 2.0, a ransomware-as-a-service operation that has existed since September 2019 but has gained major traction over the course of this summer. Those behind it revamped their dark web operations in June – when they launched the 2.0 version of LockBit – and aggressive advertising has drawn attention from cyber criminals. According to researchers, LockBit has compromised 52 organisations around the world since June. Perhaps most notably, criminals using LockBit compromised Accenture, although the company was able to restore from back-ups without needing to pay a ransom. 

The rise of LockBit hasn’t gone unnoticed, as Australia’s Cyber Security Centre has posted an alert warning organisations about the threat. But LockBit isn’t the only form of ansomware that’s on the rise – AvosLocker ransomware first appeared in July and offers a ransomware-a-as-service scheme that includes the operators taking care of negotiating ransoms.  The group has compromised several organisations around the world, including law firms in the United States and the United Kingdom. Like other ransomware groups, AvosLocker leaks stolen data if a ransom isn’t paid. SEE: A winning strategy for cybersecurity (ZDNet special report) Ransom demands following AvosLocker attacks are relatively low for ransomware in 2021, standing at between $50,000 and $75,000. But unlike many other ransomware groups that demand a payment in Bitcoin, AvosLocker asks for it in Monero – a cryptocurrency designed to be anonymous. Monero isn’t as high-value as Bitcoin, but the added anonymity means that it’s more difficult to trace cyber criminals who use it. Another new player in the ransomware market is Hive ransomware, which was first seen infecting organisations in June 2021. The attackers behind it also leverage stolen data and double extortion to coerce victims into paying the ransom.  In total, Hive has so far claimed 28 victims –  including healthcare providers – in attacks that have the potential to disrupt patient care. This sort of cavalier attitude to the wellbeing of the general public could make Hive a dangerous ransomware threat. The fourth emerging threat detailed by researchers is a twist on an established form of ransomware. Hello Kitty ransomware first appeared in December 2020 and primarily targeted Windows systems. Now, researchers have identified a new version of Hello Kitty that targets Linux systems, opening a whole new platform for cyber criminals to target. “Ransomware not only is after Windows systems – now with the Hello Kitty variant targeting ESxi, they are trying to get a whole different market that wasn’t explored before,” Doel Santos, threat intelligence analyst at Unit 42, Palo Alto Networks told ZDNet. Organisations around the world have been targeted with this variant of Hello Kitty, which alters ransom demands depending on the target. The criminals have demanded as much as $10 million in Monero from one victim – although the operators are also open to accepting payment in Bitcoin. The rise of these ransomware groups just goes to show that, even as established groups seemingly disappear, new players rise to take their place. Many of these will adopt the tactics and techniques of successful ransomware outfits that came before them to make attacks as effective as possible. “Many more prevalent groups paved the way for these smaller groups to emerge, giving them a business model to follow to carry out operations. That’s another reason why we see these emerging ransomware groups leverage double extortion approaches, which has become the standard since Maze ransomware,” said Santos. No matter what type of ransomware cyber criminals are using, it represents a major threat to businesses. To help protect networks from falling victim to ransomware attacks, it’s recommended that security patches are applied in a timely manner to prevent criminals exploiting known vulnerabilities. Multi-factor authentication should also be applied to all users to provide an extra barrier to attacks exploiting stolen or leaked usernames and passwords as an entry point. It’s also recommended that businesses regularly update and test their backups – and store them offline – so if the network does fall to a ransomware attack, there’s the ability to restore it without having to pay the ransom.MORE ON CYBERSECURITY More

Singapore is looking to widen access to its COVID-19 contact tracing wearable device, which soon can be delivered to the homes of new users. Current users of the TraceTogether token also will be able to replace non-working ones via more vending machines.  A home delivery service would be introduced for new users of the TraceTogether wearable device, as part of “continuous effort to support” the nation’s public health requirements, said the Smart Nation and Digital Government Group (SNDGG) in a statement Wednesday.  The government agency said more vending machines to issue replacement tokens also would be deployed progressively at more than 40 shopping malls, particularly those with high traffic, as well as all 108 community centres across the island, in the coming week. 

It added that manned booths for the collection and replacement of TraceTogether tokens then would be reduced gradually, with such booths in shopping malls to stop operating on August 31. Token counters at community centres would be pulled back at a later date.  SNDGG said it had worked with Temasek Foundation, which deployed mask dispensing machines, to retrofit these vending machines to include TraceTogether tokens.  Each vending machine would be able to hold 1,400 tokens and could be used to replace wearables that were out of battery or not working. Specifically, the machine would allow for replacement of tokens only if these were issued at least 60 days ago.  Deployment of the vending machines was slated to complete by end of October, according to SNDGG.

Singapore’s TraceTogether platform, comprising the mobile app and token, currently has a high adoption rate of more than 90%. It is widely used alongside SafeEntry, a digital checkin tool that collects visitors’ personal data when they enter venues such as supermarkets, restaurants, shopping malls, and workplaces.  The government in February 2021 passed a legislation detailing the scope of local law enforcement’s access to TraceTogether data. Then move came amidst public outcry when it was revealed the police could access the information for criminal investigations, contradicting previous assertions the data would only be used when the individual tested positive for the coronavirus.Singapore had issued the TraceTogether wearable device as part of efforts to quell data privacy concerns, touting the token as a “no internet” device that did not have GPS, internet, or cellular connectivity. Data collected only could be extracted when the wearable device was physically handed over to a health official, the government said. It also said the use of TraceTogether would cease once the pandemic was under control and contact tracing no longer necessary.Minister-in-Charge of the Smart Nation Initiative and Foreign Affairs, Vivian Balakrishnan, said last week any decision to stop using the contact tracing platform should be based on “science”, not politics. Referring to doctors, the minister said in an interview with Reuters: “Let the professionals tell us whether contact tracing to that level is necessary or helpful, and whether it secures the safety of our people. I will leave it at that. There is no need to politicise it.”In the week leading up to August 24, unlinked cases accounted for 33% of COVID-19 infections in Singapore, up from 25% two weeks before and 23% the week before, according to figures from the Ministry of Health. It recorded 269 community cases in the week leading to August 24, compared to 551 two weeks before and 372 the week before.RELATED COVERAGE More

M1 and its sister company Keppel Land have introduced 5G services that they say aim to improve maritime operations and enrich waterfront lifestyle. These include automated vessel analytics and recognition technologies to facilitate real-time surveillance. Targeted for deployment at Marina at Keppel Bay, the new suite of services would be delivered on M1’s 5G Standalone network, said the companies in a joint statement Wednesday. M1 and Keppel Land are part of the Keppel Group. 

Vessel owners at the bay would be able to tap 5G to “elevate” their waterfront lifestyle and yacht experience, as well as enhance work processes for berth operations, said M1 and Keppel. The new services would enable high speed and further automate and streamline processes, boosting productivity and efficiency for maritime operators, they said. 5G-powered monitoring devices armed with automated vessel analytics and recognition technologies, for instance, could facilitate real-time surveillance. This would ensure the safety and security of registered vessels and trigger alerts when unauthorised vessels entered the marina. Surveillance robots also could be deployed on the docks to support onsite monitoring and remote assistance. These bots would be integrated with incident management applications so data could be automatically captured, enabling communication between relevant personnel during incidents and providing 3D visualisation to assist in risk management and planning. The robots also could be leveraged to monitor and maintain the marina’s surroundings, automatically clearing any garbage identified in the waters. They then could reduce resources needed in maintaining water conditions. In addition, maintenance staff could put on 5G-powered headgears to carry out checks, handsfree. The high-speed connection would further enable them to join video conferences, share videos in real-time at any location, and receive remove support. 

M1 CEO Manjot Singh Mann said the mobile operator hoped to drive the use of 5G-enabled services across various industry sectors. Noting that this was in line with Keppel’s Vision 2030 strategy to accelerate smart cities, Mann said: “[The launch] heralds the beginning of our journey towards more viable commercial-ready 5G solutions that will advance our digital economy.”RELATED COVERAGE More