デジタル世界の安全確保

セキュアアクセスサービスエッジ（SASE）の理解

09/19/2023 Secure access service edge (SASE – pronounced “sassy”) is a modern architectural framework that combines network security and wide area networking (WAN) capabilities into a unified cloud-based service. It is designed to provide secure and optimized access to network resources for users, regardless of their location or the devices they use. Secure access service edge represents a shift from the traditional approach of backhauling network traffic to centralized data centers for security inspection. Instead, it adopts a cloud-native model where security services are delivered from the cloud and applied directly at the network edge, close to the user and the resources they are accessing. Acronyms to Know Before we get […]
もっと読む

秘密の保護：コード難読化技術の洞察

06/29/2023 Once a threat actor gains access to a network or tricks a user into downloading a malicious attachment. The next step is to download their payload, this could be a toolset or malware. Code obfuscation has become an important step for threat actors to accomplish this task.  Whether it is a webshell, or a utility program code obfuscation is often utilized during part of the command execution phase.  In this post we are going to review a recently observed phishing attack where the threat actor delivered the remote access tool known as “asyncrat”   through several different variations of code obfuscation.  As we have all seen many many times the […]
もっと読む

NetWitness OrchestratorでSecOpsを効率化する方法

06/07/2023 Security operations (SecOps) teams are battling a complex and ever-evolving challenge: Keeping an organization secure against cyberattacks from faceless, remote users in a technologically advanced world. With the rise of threats, new technologies, and increasingly sophisticated scams, staying ahead of the bad guys is more important than ever. That’s where security orchestration, automation, and response (SOAR) comes in to make your SecOps team more effective against attacks. A SOAR system automates what would be a manual process of identifying cyberattacks and making it easier to respond to those attacks. However, not all SOAR systems are created equal. NetWitness Orchestrator, a SOAR solution from NetWitness, is an invaluable tool for SecOps […]
もっと読む

NetWitnessは、Black Hat Asia 2023のNOCに参加できることを誇りに思います。

05/08/2023 This week, NetWitness proudly joins BlackHat in the Network Operations Center (NOC) at the BlackHat ASIA event, continuing our long-standing collaboration. As always, we’re here to provide top-notch SIEM, NDR, and SOAR services, standing shoulder to shoulder with our seasoned global threat-hunting team, which comprises Sales Engineering and Incident Response. 
もっと読む

クラウドSIEM：徹底解説

03/08/2023 日々の業務にクラウド技術を使用している、またはこれから使用しようとしている場合、NetWitnessクラウドSIEMは、安全でセキュアな運用を保証します！
もっと読む

ランサムウェアの標的としてのUSMSと法執行機関への広範な影響

03/02/2023   The mission of the U.S. Marshals Service (USMS) is “to enforce federal laws and provide support to virtually all elements of the federal justice system” through multiple disciplines. Its law enforcement (LE) focus, reach and scope make this week’s report of a recent cyberattack involving both ransomware and data exfiltration especially concerning. While this news is fresh, and the incident ongoing, it’s a good time for us all to reflect on why LE entities can be especially attractive targets to bad actors. As with all important things in life, it always pays off to understand motivations and incentives, and how they can drive behaviors and actions. Low-hanging fruit of […]
もっと読む

ハイブのテイクダウンに関する5つの考察

02/03/2023   The takedown of the Hive ransomware-as-a-service group has been in the news over the past week, and it’s good news indeed. Beyond the obvious benefits of disrupting this criminal enterprise, there are some other discrete takeaways which are particularly important to note. Cross-jurisdictional cooperation and coordination can be done, and done effectively. Any of us who have served on committees know about Parkinson’s Law, which correlates a group’s size to the amount of time needed to accomplish its goals: the bigger the group, the longer the time taken, even without a change in scope. The fact that this global law enforcement effort was a success is even more impressive […]
もっと読む

犠牲を払え：脅威となる行為者のコストを引き上げて抑止する方法

09/30/2022 Introduction Many years ago, I spoke at a @suitsandspooks panel in Washington, D.C. with some of the cybersecurity industry’s best and brightest minds. One of the topics addressed was the concept of active defense strategy in the commercial (private sector) world versus the public world. In those days the idea of ‘hacking back’ against a hostile, adversarial threat actor or group was discussed frequently, with some organizations and their leaders taking a more vocal stance (in both public and private sectors). The panel was fantastic: Dmitri Alperovitch (CrowdStrike), Greg Hoglund, Jeff Carr, me, and moderated by Anup Ghosh. A smart group of guys all with strong opinions on the subject […]
もっと読む

UPDATE：ロシアとウクライナの紛争について我々が知っていることと、サイバーセキュリティ能力をどのように準備すべきか

03/25/2022 UPDATED March 25, 2022: The Biden Administration released a statement on March 21 urging companies to strengthen their cybersecurity capabilities and protections in the face of potentially damaging cyber activity perpetrated by threat actors as part of the ongoing conflict. The Administration also urged organizations to execute a number of best practices for bolstering cyber defense capabilities. Additionally, the Cybersecurity & Infrastructure Security Agency (CISA) website’s Shields Up page is an excellent resource to help prepare for disruptive cyber incidents. The NetWitness Incident Response team is available to assist organizations with enacting these recommendations, as well as several other services, and does not require organizations to be existing NetWitness customers […]
もっと読む

Apache Log4jのゼロデイ脆弱性：知っておくべきこと

12/14/2021 When the Log4j vulnerability was revealed, the NetWitness team launched an immediate investigation into Log4j use within the NetWitness Platform, as well as actions to support its customers in identifying and remediating attempts to exploit the vulnerability in their own environments.
もっと読む

あなたのコラボレーションツールはハッカーフレンドリー？

11/19/2021 It’s back to the future. Companies and their employees are slowly returning to in-person work, with many organizations maintaining their hybrid workforce model. And this shift to remote work has resulted in an increasing reliance on web-based collaborative tools. In fact, a Gartner study found that usage of collaboration tools has nearly doubled over the last two years, going from 55% to 80% among workers. Many of these tools, such as Microsoft Teams, Slack, and Zoom, have been integral components of organizational productivity for years, but the change to a highly remote workforce has more deeply embedded these types of applications into business operating procedures. Realizing this opportunity, hackers and […]
もっと読む

ネットウィットネスXDR、可視性、SOCの未来

09/16/2021 This overview introduces a downloadable XDR whitepaper by Frost & Sullivan, covering XDR and enhanced visibility, the value of XDR to the future of security ops, and why organizations should adopt XDR by focusing on 3 essential keys.
もっと読む

ランサムウェア初心者のための脅威検知ガイド

08/11/2021 At NetWitness we know how devastating it can be to find your organization impacted by a ransomware attack, so we created this Ransomware FAQ. This intro to ransomware explains essential ransomware concepts to equip IT and non-IT professionals with deeper knowledge of this growing threat.
もっと読む

XDRとゼロ・トラスト：脅威検知のパートナー

08/10/2021 Zero Trust isn’t always part of the XDR conversation—but it should be. Here’s why the relationship of these threat detection partners is so critically important to an enterprise’s digital transformation security.
もっと読む

GrifterでBlack Hat NOCの内部を覗く

07/20/2021 In this interview, Neil Wyler, a.k.a. Grifter, talks about how he got involved with Black Hat more than 20 years ago, and how the event’s network operations center (NOC) has evolved in that time to take on today’s modern cybersecurity challenges.
もっと読む

検証可能なクレデンシャル：次のウェブにおける信頼の鍵

07/14/2021 RSA once again secures the open web In 1994 the World Wide Web was at a crossroads. The technology that today we simply call “the web,” invented five years earlier by Tim Berners-Lee, was poised to become the de facto interface to the internet. Its document-based, human-centric, point-and-click model was wildly popular among the technologists of the day, and was beginning to see rapid uptake among the broader population of desktop software users. But something was missing: trust. Because the web was inherently open, any use case requiring trust between parties was impossible. All web traffic at that point traveled in clear text where it could be intercepted, and potentially […]
もっと読む

脅威インテリジェンス・プラットフォームがSOARの準備完了

06/16/2021 When security is weaved in from the outset, the fabric you produce at the end of the project is stronger and safer. In the security orchestration, automation and response (SOAR) space, that essential ingredient is a threat intelligence platform (TIP) capability.
もっと読む

IoTエッジ・エコシステムの保護

03/22/2021 IoT Edge architecture is emerging to tackle the explosion of Internet of Things (IoT) devices and systems. This open ecosystem approach enables contributions from many sources. RSA is doing its part to add security across the range of IoT Edge solutions.
もっと読む

セキュリティ・オペレーション・センターの将来性

02/15/2021 Recommendations for building SOCs for the future.
もっと読む

インサイダー脅威軽減のための戦略

09/09/2020 In Part II of this blog series, we examine strategies for insider threat risk mitigation including key tenants of data visibility and advanced analytics to provide organizations a road map for addressing this evolving threat.
もっと読む

破壊の灰からイノベーションと新しい働き方が生まれる

07/28/2020 RSA CTO Dr. Zulfikar Ramzan talks with ITPSmagazine about the security and risk challenges of transitioning employee and business operations back to physical locations and why this period of disruption may be a catalyst for a new era of innovation.
もっと読む

仕事の未来のためにSOCを再構築する

07/27/2020 Amy Blackshaw and Michael Adler talk with ITPSmagazine about ways to enable a successful virtual SOC and what organizations need to do to manage the growing threat of dynamic workforce risks.
もっと読む

モノのインターネット新時代のデジタルリスク管理

07/15/2020 IoT risk is digital risk. Manage it correctly to gain the full power of IoT.
もっと読む

ダイナミックな労働力に対するセキュリティの考慮事項

06/01/2020 The way we work has changed forever. From offices to homes and remote locations, what do security operations need to consider? And how do they need to adapt to this dynamic workforce? There are five security considerations that should be top of mind in this new reality.
もっと読む

インシデントレスポンスの運用

11/04/2019 Risk management, threat intelligence, and incident response come together in a sensible, practical, and operational detect and respond model to positively impact your cyber risk strategy. Staffing models (small and large), tools, and managed service providers can also be leveraged successfully.
もっと読む