IT Brief Asia logo
Technology news for Asia's largest enterprises
Story image

Examining the future of ransomware threats with Vectra’s CTO

By Contributor
Wed 6 Jul 2022

Article by Vectra chief technology officer Oliver Tavakoli.

In the last few years, businesses and security leaders have been zeroing in on how to better manage and secure cloud infrastructure amidst a wave of change as enterprise cyber-attacks evolve and increase.

Recent studies reveal that 80% of Australian organisations were hit with ransomware in 2021, up from 45% in 2020. Vectra's own research found that 57% of A/NZ respondents feel it is possible or likely they have been breached whilst being unaware it is happening, 75% have experienced a significant security event that required an incident response effort​, and 9% are not fully confident their security tools would protect against sophisticated attacks​.

As a CTO, a big part of my focus is the future, creating 'thought experiments' to determine the best ways to protect our critical data and systems. With planes back in the skies, I was delighted to speak at the Australian Cyber Conference earlier this month to discuss and debate some of these so-called 'experiments' with others in the industry.

Ransomware remains an important topic of debate among cybersecurity professionals in Australia and elsewhere in Europe and the US. The other consistent issue is related to supply chain attacks, including traditional on-premises products as well as services delivered via the cloud.

Within Australia, migration to cloud and SaaS, and the inability to source experienced talent who understand the security implications of clouds, are also connected issues. There is tension between businesses wanting to go agile through cloud adoption and security teams trying to gain visibility and implement security in those environments. In a perfect world, that tension is resolved in a balanced manner, but we don't live in a perfect world and often, the business imperative to rapidly roll out new services outstrips the ability of organisations to do so securely.

The problem with cloud

Not so long ago, on-premise networks were wide open to attackers, so this has been our focus. Now, employee traffic is predominantly accessing applications across the internet. This means we need to look at logs in cloud platforms such as Amazon Web Services (AWS), Azure and Google Cloud Platform (GCP), cloud identity systems such as Azure AD and Okta and collaboration applications such as Microsoft 365 and Google Workspace.

Highlighting how businesses are being inundated with cyber criminals looking to capitalise on vulnerabilities, the Australian Cyber Security Centre (ACSC) says it received one cybercrime report every eight minutes over the 12 months to June 30, 2021. On top of this, the ACSC states that Australia experienced a 13% jump in cybercrime over the year, with about one incident in four targeting critical infrastructure and services as working from home during the pandemic made more people vulnerable to
online attacks.

A common story is that the pandemic drove businesses to move into multi or hybrid cloud setups, not through a grand strategy but because of a pressing need. As a result, services such as Microsoft 365 or eCommerce platforms were implemented quickly, without consideration for how this impacted infrastructure or security. On top of this, different business units or departments often evolved in different directions, adding layers of complexity. 

Now we find ourselves at a point of reckoning where we must understand the reality of the situation and how to fix it.

Ransomware in the cloud

The move to cloud has left gateways for attackers to leverage and gain a point of entry, and they are beginning to take full advantage of this. On-premise, if a cybercriminal wants to encrypt a business's data, they must go through the laborious exercise of connecting to a server, pulling all data across the network, encrypting it and writing it back to the server – and finally deleting the original copy. 

To be successful, ransomware operators try and get their hooks into as many places as possible and encrypt as much as possible. In the cloud, ransomware operators can leverage server-side encryption provided in the cloud platforms, allowing them to encrypt data much faster and without heavy lifting.

At Vectra, we look at a cloud like AWS or Azure as having two different attack surfaces. There's the traditional attack surface where attackers go through the network to attack a workload running in the cloud, escape the workload, and then steal data. And there's the management plane or the control plane of a cloud platform which represents a more potent and less well-understood set of controls.

Recognising this, Vectra has solutions to cover both attack surfaces. We work to protect customers being attacked from the network, and we work to protect businesses from being attacked at the control plane of their tenant in a cloud. The inbound initial vector can be incredibly complex and varied, but once it lands and establishes some foothold in the environment, we help the business find and stop the incursion before it does actual damage.

Looking forward

As customers' valuable data move to the cloud, so will ransomware. So we are asking questions such as, what does the combination of cloud and ransomware look like, how quickly will attackers become cloud-capable, and what measures should we take now?

This was the focus of my presentation at the Australian Cyber Conference in Canberra and many of the surrounding conversations. Highlighting the early harbingers that exist, I looked at how we can protect ourselves against ransomware in cloud systems and why this is substantially different to the defensive measures required for on-premise.

By discussing such issues, I hope to encourage CISOs to bridge the worlds of security and business so investments can be prioritised and our infrastructure can be protected.

Related stories
Top stories
Story image
Tech job moves
Tech job moves - Cohesity, Equinix, IDC, Proofpoint & Xero
We round up all job appointments from July 29 - August 5, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Firewall
Fortinet unveils compact firewall for hyperscale data centres, 5G networks
"Fortinet’s dedication to pushing the boundaries of what is possible in security performance has yielded the most powerful compact firewall yet."
Story image
Enterprise
Fortinet reports second quarter 2022 financial results
“We delivered strong revenue and billings growth in the second quarter driven by an increase in the number of transactions larger than one million dollars."
Story image
Mergers and Acquisitions
Netskope acquires Infiot, delivers integrated SASE platform
Converged SASE platform provides AI-driven zero trust security and simplified, optimised connectivity to any network location or device, including IoT.
Story image
SaaS
Why is MACH architecture a new big thing in the tech world?
More and more global enterprises are considering replacing the monolithic tech stack with the best-of-breed composable stack that enables greater business agility.
Story image
Cloud
TBC Bank decreases time to market for new offerings by 40%
TBC Bank has reduced time to market for new and enhanced products and services by 40% since implementing Kong Enterprise, the cloud native API platform. 
Story image
Data
NOVATION releases cloud-based solution to maximise value of data
NOVATION has announced the release of DataVio, its cloud-based solution for helping businesses automate the processing and extraction of data.
Story image
SAP
OutSystems joins SAP PartnerEdge program, integrates solutions
OutSystems has become an official member of the SAP PartnerEdge program. This will make it easier for other businesses within the SAP ecosystem to discover and connect with OutSystems.
Story image
Remote Working
Four-day week: Perceptions across Asia Pacific and Japan
Workers across APJ want to be empowered to do their best work, wherever and whenever they want.
Story image
Cybersecurity
FirstWave responds to SMB demand for better cybersecurity
FirstWave developed the CyberCision Open Security Management Platform to respond to SMBs 'urgent' need for comprehensive cyber protection.
Story image
Robotic Process Automation / RPA
Gartner anticipates RPA software revenue of US$2.9 billion
Gartner predicts global robotic process automation (RPA) software revenue to reach US$2.9 billion in 2022, an increase of 19.5% from 2021.
Story image
Ransomware
Ivanti and SentinelOne partner on patch management solution
Ivanti and SentinelOne will integrate their technologies Ivanti Neurons for Patch Management and SentinelOne's Singularity XDR platform.
Story image
SAP
Microsoft unveils two new security products to help reduce attack surfaces
The products are set to give companies deeper insights into threat actor activity and help them successfully navigate the changing threat landscape.
Story image
Compliance
Why security needs to shape your journey to the cloud
It's estimated that 80% of workloads could be in the cloud in the next few years. How can you make all that data secure?
Story image
API
Security gaps in APIs plague organisations - study
Together, the findings highlight that existing solutions and API security tactics focused on shift-left strategies are failing to adequately protect APIs.
Story image
Product Management
TeamViewer and Siemens to innovate product lifecycle space with AR
TeamViewer's new partnership with Siemens Digital Industries Software to bring the power of TeamViewer's AR platform, Frontline, to Siemen Teamcenter software.
Story image
CRM
Forrester names Pega a Leader in CRM Solutions 2022 report
Forrester Research has named Pega a Leader among 11 competitors in The Forrester Wave: Core CRM Solutions, Q3 2022 report.
Story image
Digital Transformation
Government needs content services aligned for better customer experience
Organisations across all industries in the private sector have made significant progress in digital transformation. The public sector, however, has not always kept up with the pace.
Story image
Hybrid Cloud
The essential guide to digital transformation by SolarWinds
Digital transformation is a buzzword thrown around all the time by companies, but what does it actually mean and why is it important? SolarWinds breaks it down.
Story image
10 Minute IT Jams
Video: 10 Minute IT Jams - An update from Incode Technologies
Jonathan Andresen joins us today to discuss the identification and authentication solutions offered by Incode.
Story image
Radware
Good or bad - answer these questions to check application visibility
With the adoption of the hybrid cloud, applications now run in multiple private and public cloud environments managed by different teams and tools.
AWS Marketplace
Learn how security orchestration, automation, and response (SOAR) enhances your security strategy.
Link image
Story image
Data
Hazelcast launches beta release of new serverless offering
Hazelcast Viridian Serverless speeds up app development, simplifies provisioning, and enables integration of real-time data into applications.
AWS Marketplace
See how managed security services (MSS) have evolved to Managed Detection and Response (MDR) and Extended Detection and Response (XDR). Learn how these new holistic solutions can simplify security management and improve your threat detection and response.
Link image
Story image
Partnership
NCS, FPT Software launch Strategic Delivery Centre in Vietnam
The new partnership is designed to support increasing demand for high quality digital services across the region.
Story image
Indusface
Why enhancing bot protection for web and API endpoints matters
The trouble with bots is that they aren’t all bad. Unfortunately, this can make it challenging to detect malicious bots that find their way into your system and threaten your business.
Story image
Apps
Freshworks integrates with Google's Business Messages
"The integration with Freshworks makes it fast and easy for businesses to have conversations with their customers within the Google apps."
Story image
Data Centre Maintenance / Management
Vertiv releases update to Smart InfraSight platform
Vertiv has unveiled an update to its Smart InfraSight data centre management platform, featuring improved intelligence and the ability to manage multiple IT devices.
Story image
SaaS
ManageEngine unveils SaaS availability of Analytics Plus
ManageEngine's Analytics Plus is now available as a software as a service (SaaS) offering, enabling users to set up a completely functional and integrated analytics platform anywhere in under a minute.
Story image
Ransomware
Majority of execs in SEA anticipate ransomware attacks
Kaspersky's study uncovers that more than half believe a ransomware attack against their business is too small to worry about.
Story image
Internet of Things
AI-Link chooses Keysight offering to validate 5G performance
AI-Link has chosen Keysight Technologies' 5G test tools for end-to-end performance validation of cloud-native 5G radio access network (RAN) equipment.
Story image
Healthcare
SOTI research explores professional's thoughts on digitisation in the healthcare sector
Interconnectivity, automation and data management were the three key trends highlighted in the report as integral parts of successful medical technology implementation.
Story image
SaaS
OpenText launches new solutions on Salesforce AppExchange
Included in this latest launch is OpenText Core Content, a Content Services platform that customers can leverage to effectively manage their content.
Story image
Infrastructure
New developments for cable set to connect South America to APAC and Oceania
Further proposals have been issued to begin construction of the almost 15,000 km subsea Humboldt Cable cable, which connects South America to APAC and Oceania.
Story image
Cybersecurity
More than a fifth of cybersecurity teams ban the use of public WiFi
Verizon’s fifth annual Mobile Security Index report has revealed a continued rise in significant cyberattacks in the last year involving a mobile/IoT device.
Story image
SaaS
Viavi updates Observer platform to simplify cloud monitoring
Version 18.8 simplifies cloud monitoring with data centre-like visibility, bringing two key capabilities to cloud-based applications and deployments.
Story image
Healthcare
Why the Metaverse could be the key to enhancing the healthcare sector
The experts at Accenture understand that the programmable world is about building the next version of the physical world in healthcare, understanding complex layers in order to fully utilise technology to its maximum effect.
AWS Marketplace
Watch this webinar to gain building blocks for data mesh, and how AWS customers today are successfully enabling domain driven data.
Link image
Story image
Data Protection
CyberRes partners with Google Cloud in lead up to BigQuery release
CyberRes, a Micro Focus line of business, has announced a partnership with Google Cloud to support the upcoming release of BigQuery remote functions.
Story image
Appointments
Tech job moves - Checkmarx, Kinly, Syniti, Trellix & WalkMe
We round up all job appointments from July 22-28, 2022, in one place to keep you updated with the latest from across the tech industries.
Story image
Cybersecurity
Qualys develops EASM capabilities for Cloud Platform
"Qualys unique approach to EASM is integrating the internal and external asset data from CyberSecurity Attack Management with its VMDR solution into a single view."