Tag: Network Security

Improve Visibility and Detection Beyond Endpoints with Trend Micro XDR

Arby News and Events , , , , , ,
Improve Visibility and Detection Beyond Endpoints with Trend Micro XDR

The threat landscape is always evolving, making it hard for traditional security measures to adapt to it. This has become even more prominent ever since the pandemic; threat actors have been taking advantage of the increased attack surfaces that remote work has provided. However, if you are only securing the endpoint side, you only see a part of the malicious activity and would not be able to properly find the source and cause of it.

Another thing that must be put into consideration is that not all companies have a dedicated security team to make sense of all the alerts that an organizations security solution may notify them of. If you have no one to analyze the alert or if your team can’t respond fast enough due to the number of alerts, you leave your network vulnerable to threat actors.

This is where a security solution like Trend Micro’s XDR can help.

Better visibility of threats to your network

Trend Micro XDR has a reference of indicators of compromise (IoC) that is capable of scanning not just endpoints, but also across emails and network servers, giving your IT team more security visibility of your infrastructure.

Investigating across your organization

Trend Micro XDR allows your IT team to find threats that may have bypassed your security before and also allows you to investigate threats that have already been blocked to find their origin.

Extending your security team

With Trend Micro Managed XDR, you are able to outsource experts from Trend Micro to help interpret the security reports and alerts to quickly remediate threats to your network. This is helpful in both situations in which you have a dedicated security team, as it helps free their time to do other tasks, and those who cannot afford to have a dedicated team.

Machine learning and signatures

Machine learning is used to ensure that files you download are safe through sandboxing to ensure no malicious actions are done once it is running. Signatures on the other hand help quickly distinguish known malicious files and immediately blocks them once detected.

Virtual patching

Once an exploit is found, you need to apply the necessary vendor patch to ensure your business-critical server is safe. However, as we know this is usually easier said than done as patching requires your operations to stop. With Trend Micro, you are able to virtually patch your machine to protect you from the exploit while you slowly patch your business-critical servers.

These are just some features of the XDR suite that Trend Micro Offers, if you are interested in learning more on Trend Micro XDR or other security solutions, you may fill out the form below and we will contact you as soon as we can!

Cisco Umbrella: Camuto Group Case Study

Arby News and Events , , , , , ,
Cisco Umbrella: Camuto Group Case Study

The Challenge

A US footwear and lifestyle brand company, the Camuto Group, has been thriving in their industry due to the unique designs that sets them apart from the competition.  However, the company’s creativity is also one of its IT’s main pain points when it comes to security.  With almost 100 employees working remotely and another 250 roaming laptop users, it makes it difficult for IT to allow the flexibility to access the wide range of edgy sites which many web filtering solutions block incorrectly.

Tom Olejniczak, Camuto Group’s network engineering manager says that they found the traditional approach to securing the web experience (Proxy servers) caused too many problems that needed manual resolution.  Meaning whenever someone could not access a site, someone from IT had to go to that user to help resolve the issue, which was not feasible for them given the multiple remote and roaming users.

They needed to find a network security solution that protected on and off-network devices which didn’t add to their latency that could help them as malware and social media started to cut into the productivity of the users.

The Solution

Tom says that the company has been following Umbrella as their first line of defense since it was still OpenDNS.  However, to test if there were better alternatives, they decided to try two similar products to Umbrella.  The result of the test was that Umbrella outperformed both products whether it was by malware protection and overall user experience.

This was achieved by deploying Umbrella’s virtual appliances.  This gave them the visibility to see if internal networks or Active Directory users were infected or targeted by attacks without the need to touch devices or reauthenticate users.  Users working out of the corporate network are protected via Umbrella’s roaming client which was simple to put in place as adding someone to a group in Microsoft Active Directory.

The Camuto Group saw immediate impact on the security, almost four hundred detections of malware were redirected on a daily basis.  The solution itself also was great for user experience as it is unobtrusive and even helped improve the speed of the internet slightly, about five to ten percent.

The ability to white and black list sites was one of the main concerns of the company that Umbrella helped solve quite easily.  Tom says that they are able to choose safe and HR-acceptable categories for content filtering fast, it would usually take them about 3 minutes make a change.

To learn more about the Cisco, you may check out our product page here or you can contact us directly at 893-9515 for more details!

University of Kansas Hospital: A Cisco Umbrella Case Study

Arby News and Events , , , , ,
University of Kansas Hospital: A Cisco Umbrella Case Study

The challenge: gaining transparency to secure sensitive data

Ranked among the nation’s best hospitals every year since 2007 by U.S. News & World Report, The University of Kansas Hospital is the region’s premier academic medical center. Physicians teach as faculty members at the KU School of Medicine and are at the forefront of medical discoveries taking place at the KU Medical Center, a research leader in cancer treatment and prevention, neurology and liver and kidney transplantation.

Like every hospital, University of Kansas Hospital prioritizes its IT security as to avoid threats such as malware from affecting or theft of its patient’s sensitive data.  This means that they have to safeguard every medical device that is connected to their network, any compromise to this could cause a life-or-death situation.  Besides this, as an academic hospital as well, they also deal with a lot of sensitive research data and intellectual property.

When the time ransomware was beginning to impact hospitals around the world, University of Kansas Hospital started to look for security solutions that would help deliver their commitment for the best possible healthcare experience.  This led them to realize that visibility was a major challenge and attacks were starting from DNS.

The solution: security that starts at the DNS layer

To start improving the existing security design, University of Kansas Hospital started to initially implement different solutions to help produce very basic information about the infected machines, however they lacked full visibility into the source of the infection.  Meaning that they could see the malicious sites being accessed but only trace the infection only till the proxy server, IP address, or their DNS server.

 “First we just pointed our external DNS requests to Cisco Umbrella’s global network, which netted enough information to prompt an instant ‘Wow, we have to have this!’ response,” Duong says. “When our Umbrella trial began, we saw an immediate return, which I was able to document using Umbrella reporting and share with executive stakeholders. Those numbers, which ultimately led to executive buy-in, spoke volumes about the instant effect Umbrella had on our network.”

After they did an initial test of pointing their external DNS requests through the Cisco Umbrella global network, it provided enough information for them to immediately start a trial with Umbrella.  After beginning their trial, they were able to see immediate returns, which were then documented through Umbrella’s reporting and shared to their executive stakeholders.  This eventually led to an executive buy-in for Umbrella.

The result: Bolstered security and unprecedented insight

For University of Kansas Hospital, Deploying Umbrella was fast while also giving them an immediate time-to-value experience.  In just one hour of Umbrella going live, they saw a huge increase in visibility, protection, and blocked malicious traffic.  From their usual 100,000 hits against the network (20 to 30 percent of which were ransomware), they were able drop the number down to nearly zero with Umbrella.

Once they enabled AD integration as well to their Umbrella (which took only an hour), they were able to move from struggling to find attacks to being able to correlate users with events and trace every clock of their online journey.  This also gave them ways on how to investigate and understand each threat that was hitting their network to help better understand user behavior to help better mitigate them as efficiently as they can.

Cisco Umbrella has dramatically improved the incident response of University of Kansas hospital for the better, one incident before Umbrella would have taken 2 days now has been lessened by at least 75% or even can be done in 30 minutes.

To learn more about Cisco products, you can visit our Cisco Product Page here or you may call us at 893-9515 and we would be happy to answer your inquiries!