Tom Gillis Headshot - VMware News and Stories

https://news-editor.vmware.com/wp-content/uploads/2021/09/logo_media_thumbnail.jpg

VMware News & Stories

VMware News and Stories

Home

Why CISOs Should Invest More Inside Their Infrastructure

Tom Gillis Headshot

Bank vault with open door &amp; grill (B&amp;W)

- VMware News and Stories

Modern Bank Heists 5.0: The Escalation from Dwell to Destruction

Female Government Employee Works in a Monitoring Room. In The Background Supervisor Holds Briefing. Possibly Government Agency Conducts Investigation.

public sector innovation - VMware News and Stories

Multi-Cloud for Mission Success

public sector innovation

This problem is going to need everyone's imput

VMware Prevents 100% of Critical Attacks Tested During MITRE Engenuity ATT&#038;CK® Evaluation

Network Security.

VMware Pioneers Modern Security for Modern Applications from Development to Production

Snowboarder Jumping

VMware Wins Gold at 2022 Cybersecurity Excellence Awards

firewall and internet security concept, secured access

MicrosoftTeams-image-16 - VMware News and Stories

Cybercriminals Target Linux-Based Systems With Ransomware and Cryptojacking Attacks

MicrosoftTeams-image-16

Close up of a woman's hand paying with her smartphone in a cafe, scan and pay a bill on a card machine making a quick and easy contactless payment. NFC technology, tap and go concept.

Close up of a woman's hand paying with her smartphone in a cafe, scan and pay a bill on a card machine making a quick and easy contactless payment. NFC technology, tap and go concept

Close up of a woman's hand paying with her smartphone in a cafe, scan and pay a bill on a card machine making a quick and easy contactless payment. NFC technology, tap and go concept - VMware News and Stories

The Future of Retail Is Now. Are You Ready?

Close up of a woman&#8217;s hand paying with her smartphone in a cafe, scan and pay a bill on a card machine making a quick and easy contactless payment. NFC technology, tap and go concept

Professional Development programmer working in programming website a software and coding technology, writing codes and data code, Programming with HTML, PHP and javascript

Professional Development programmer working in programming website a software and coding technology, writing codes and data code, Programming with HTML, PHP and javascript - VMware News and Stories

More Secure Open Source Software: A Shared Responsibility

Young female engineer coding over laptop in IT startup company

Young female engineer coding over laptop in IT startup company - VMware News and Stories

VMware Attends White House Summit on Open Source Software Security

Sylvenstein Lake Reservoir. Cycler biking over the bridge. Drone Shot. Bavaria Germany Alps

Securing the Future: 7 Cybersecurity Predictions for 2022

Back View in the System Control Center Operator Working. Multiple Screens Showing Technical Data.

GovCon Wire: Government Security Strategy Zero Trust - VMware News and Stories

GovCon Wire | Zero Trust Should Be Part of Agencies&#8217; Holistic Security Strategy

GovCon Wire: Government Security Strategy Zero Trust

Kit Colbert, Senior Vice President and Chief Technology Officer, VMware

Kit Colbert Headshot - VMware News and Stories

Kit Colbert Headshot

Tom Gillis explores how CISOs should invest in detecting and stopping lateral movement of threats on private and public clouds. 

core/paragraph

Tom Gillis explores how CISOs should invest on detecting and stopping lateral movement of threats on private and public clouds. 

https://news-editor.vmware.com/wp-content/uploads/2022/06/Tom-Gillis.jpg

Posts

There has been a fundamental restructuring of cybercrime cartels thanks to a booming dark web economy of scale. Powerful cybercriminal groups now operate like multinational corporations and are relied upon by traditional crime syndicates to carry out illegal activities such as extortion and money laundering. Cybercrime cartels are more organized than ever before and enjoy greater protection and resources from the nation-states that view them as national assets.1

With this ground truth serving as the backdrop for the threats facing financial institutions, I interviewed 130 financial security leaders and CISOs from around the world for the fifth edition of the <a href="https://www.vmware.com/learn/security/1414485_REG.html">Modern Bank Heists report.</a> This year’s findings should serve as a warning to the financial sector that attackers are moving from dwell to destruction.

Geopolitical Tension Is Metastasizing in Cyberspace

core/heading

Cybercriminals targeting the financial sector often escalate their destructive attacks in order to burn evidence as part of their counter incident response. Our report found that 63% of financial institutions experienced an increase in destructive attacks, a 17% increase from last year. Destructive attacks are launched punitively to destroy, disrupt, or degrade victim systems by taking actions such as encrypting files, deleting data, destroying hard drives, terminating connections, or executing malicious code. In fact, we’ve recently witnessed <a href="https://blogs.vmware.com/security/2022/03/shields-up-prepare-for-destructive-cyberattacks.html">destructive malware</a> like HermeticWiper being launched following Russia’s invasion of Ukraine. Notably, the majority of financial leaders I spoke to for this report stated that Russia posed the greatest concern to their institution.

Financial institutions were certainly not immune to the recent resurgence of ransomware. 74% of financial security leaders experienced one or more ransomware attacks in the past year, and 63% of those victims paid the ransom. This is a staggering statistic.

One of the reasons that traditional crime syndicates have become loyal dark web customers is because of the well-funded ecosystem of readymade and available ransomware kits. Cybercrime cartels, such as the Conti ransomware gang, have made it as easy as possible for their associates to launch ransomware attacks on critical industries like the financial sector.

A technical analysis in the VMware Threat Analysis Unit’s latest <a href="https://www.vmware.com/resources/security/exposing-malware-in-multi-cloud.html">threat report</a> provides a view into the proliferation of ransomware and how Remote Access Tools (RATs) help adversaries gain control of systems. Ransomware has a sinister relationship with these RATs, given these tools allow bad actors to persist within the environment and establish a staging server that can be used to target additional systems. Once an adversary has gained this limited access, they will typically work to monetize it by relying on the victim’s data for extortion (including double and triple extortion) or through stealing resources from cloud services using cryptojacking attacks.

Manipulation of Financial Markets

Cybercrime cartels have realized that the most significant asset of a financial institution is nonpublic market information. 2 out of 3 (66 percent) of the leaders I interviewed experienced attacks that targeted market strategies, and 1 in 4 (25 percent) stated that market data was the primary target for cyberattacks on their financial institution.

What exactly are these cybercrime cartels looking for? We’re witnessing an evolution from bank heist to economic espionage, where cybercriminals target corporate information or strategies that can affect the share price of a company as soon as it becomes public. This information can then be used to digitize insider trading and front-run the market. Our report also found that 44% of Chronos attacks targeted market positions. A Chronos attack involves the manipulation of time stamps – a concerning development considering how critical of a role the clock plays in the markets.

Defense Is the Best Offense

Security has become a top-of-mind issue for financial sector leaders. According to our report findings, the majority of financial institutions plan to increase their security budget by 20-30% this year and named extended detection and response (XDR) as their top security investment priority.

As security leaders, we know that a strong defense is the best offense. Modern threat hunting on a weekly basis should be adopted as a best practice to help security teams detect behavioral anomalies, as adversaries can maintain clandestine persistence in an organization’s system. Our report found that currently, only 51% of financial institutions are conducting weekly threat hunts. I am hopeful that this number will jump in next year’s report as threat hunting programs have multiple outputs beyond finding a cybercriminal, such as fueling threat intelligence.

In today’s evolving threat landscape, cybersecurity has become a brand protection imperative. Trust and confidence in the safety of financial institutions depends on effectively avoiding, mitigating, and responding to modern cyber threats.

Download the full report to learn more: <a href="https://www.vmware.com/learn/security/1414485_REG.html">Modern Bank Heists 5.0</a>

core/image

<a href="https://news-editor.vmware.com/wp-content/uploads/2022/04/MBH-5.0-Infographic.pdf" target="_blank" rel="noreferrer noopener">Click here</a> to download the full-size interactive infographic.

core/list

Modern Bank Heists 5.0 findings should serve as a warning to the financial sector that attackers are moving from dwell to destruction.

https://news-editor.vmware.com/wp-content/uploads/2022/04/Modern_Bank_Heists_Facebook_1200x628.jpg

Tom Kellermann

VMware Research Reveals Agencies are Navigating Compliance, Security and Upskilling Employees Amid Cloud Adoption

Today, at the <a href="https://upgather.com/vmware/public-sector-innovation-summit/">Public Sector Innovation Summit</a>, VMware announced findings from a study on how government agencies are scaling use of multi-cloud environments for mission success. The study, titled “<a href="https://www.vmware.com/learn/1380503_REG.html?src=wb_624ed0c315228&cid=7012H000001KaLSQA0">Multi-cloud Is The New Frontier Of Government IT</a>," conducted by Forrester Consulting, found while the move to multi-cloud is a priority, agencies face challenges supporting growing cloud environments, including compliance standards, data security and upskilling employees.

A ‘Cloud‑Smart’ Approach for the Public Sector

The survey captures responses from more than 500 agency leaders and IT decision-makers at federal, state, and local governments in the United States and Canada and discovered that while agencies are accelerating cloud adoption, multi-cloud environments are far more diverse, complex, and distributed than anything organizations have managed in the past. This can create barriers or force trade-offs between moving fast and managing risk. The challenge lies in finding the right tools and platforms to meet agency demands and keep data and processes safe and compliant. The study found when selecting cloud platform providers, the top priorities for agencies were: 

Talent Paired with Technology

To achieve a faster and smarter path to multi-cloud, agencies are focused on scaling security and upskilling employees in tandem with cloud adoption. More than half of agencies (57%) expressed concern about data security as they look to increase cloud adoption and 65% of agencies have plans to increase their investment in professional development for their developers.

core/pullquote

“Multi-cloud is the new reality for government agencies but as they increase cloud investments, they also need to lay the technical and cultural foundation,” said Jennifer Chronis, vice president, public sector, VMware. “VMware is uniquely positioned to meet our customers wherever they are on their digital transformation journeys and help them take full advantage of multiple clouds. Across the public sector, we are giving our customers the power to accelerate innovation and improve resiliency on a trusted digital foundation.” (<a href="https://twitter.com/jenniferchronis">Twitter</a>,<a href="https://www.linkedin.com/in/jennifer-chronis-4a11745/"> LinkedIn</a>)

The full study, complete with recommendations for a ‘cloud-smart’ approach to the multi-cloud era can be downloaded <a href="https://www.vmware.com/learn/1380503_REG.html?src=wb_624ed0c315228&cid=7012H000001KaLSQA0">here</a>.

Learn more at the Public Sector Innovation Summit

VMware’s Public Sector Innovation Summit brings together leading technologists from the private sector, along with IT leaders and experts from federal, state, and local government. This year’s theme, “A Holistic Multi-Cloud for Mission Success,” explores how agencies can reimagine mission success innovating across clouds.

The summit will take place at the Ritz Carlton Pentagon City in Arlington, Virginia, from 8:30 a.m. – 1:15 p.m. ET. It will also be live streamed. To learn more or to register to attend, please visit: <a href="https://upgather.com/vmware/public-sector-innovation-summit/">Public Sector Innovation Summit 2022</a>.

To learn more about VMware is helping the public sector innovate, please visit:

Methodology

VMware commissioned a survey, undertaken by an independent research organization, Forrester Consulting, in March 2022. 501 agency leaders and IT decision-makers at federal, state, and local governments were surveyed on cloud practices including strategy, process, and solutions. The research was conducted in the United States and Canada.

This article may contain hyperlinks to non-VMware websites that are created and maintained by third parties who are solely responsible for the content on such websites.

Samantha Mayowa, VMware Global Communications, <a href="mailto:smayowa@vmware.com">smayowa@vmware.com</a>

Today, at the Public Sector Innovation Summit, VMware announced findings from a study on how government agencies are scaling use of multi-cloud environments for mission success.

Public Sector Innovation Summit 2022

https://news-editor.vmware.com/wp-content/uploads/2022/04/public_sector_innovation_1200x628.jpg

Pubic Sector Innovation Summit

MITRE Results Showcase Powerful Combination of VMware Endpoint and Network Security

PALO ALTO, Calif. – March 31, 2022 – Today, VMware, Inc. (NYSE:VMW) announced the results of its successful completion of the MITRE Engenuity ATT&CK® Evaluation. VMware security solutions were put to the test in their detection and prevention of attack techniques used by Wizard Spider, a financially motivated cybercriminal group, and Sandworm, a destructive threat group that the U.S. and U.K. have attributed to Russia.

Modern cyberattacks are sophisticated, multi-step assaults launched by bad actors who disguise themselves in the noise of multi-cloud environments. During the evaluation, VMware delivered critical preventions in 100% of the cases tested with zero configuration changes.  The combination of VMware endpoint and network security provides customers with effective security that is easier to operate and designed specifically for the threats businesses and governments face today.

“MITRE Engenuity’s rigorous testing reflects the type of threats that our customers are seeing in the real world, where there are no redo’s,” said Scott Lundgren, Chief Technology Officer of VMware’s Security Business Unit. “With highly effective detection and prevention, our results demonstrate the power of VMware’s comprehensive endpoint and network visibility, which not only works out of the box, but also works the first time.”

Key MITRE ATT&CK® Evaluation results include:

To view the full Wizard Spider and Sandworm evaluation, please visit <a href="https://attackevals.mitre-engenuity.org/enterprise/wizard-spider-and-sandworm/">MITRE Engenuity</a> for evaluation details.

MITRE Engenuity, a subsidiary of MITRE, is a tech foundation for the public good. MITRE’s mission-driven teams are dedicated to solving problems for a safer world. Through our public-private partnerships and federally funded R&D centers, we work across government and in partnership with industry to tackle challenges to the safety, stability, and well-being of our nation.

MITRE Engenuity brings MITRE’s deep technical know-how and systems thinking to the private sector to solve complex challenges that government alone cannot solve. MITRE Engenuity catalyzes the collective R&D strength of the broader U.S. federal government, academia, and private sector to tackle national and global challenges, such as protecting critical infrastructure, creating a resilient semiconductor ecosystem, building a genomics center for public good, accelerating use case innovation in 5G, and democratizing threat-informed cyber defense.

VMware is a leading provider of multi-cloud services for all apps, enabling digital innovation with enterprise control. As a trusted foundation to accelerate innovation, VMware software gives businesses the flexibility and choice they need to build the future. Headquartered in Palo Alto, California, VMware is committed to building a better future through the company’s 2030 Agenda. For more information, please visit <a href="http://www.vmware.com/company">www.vmware.com/company</a>.

Kerry Tuttle, VMware Global Communications, ktuttle@vmware.com 

Today, VMware, Inc. (NYSE:VMW) announced the results of its successful completion of the MITRE Engenuity ATT&CK® Evaluation. VMware security solutions were put to the test in their detection and prevention of attack techniques used by Wizard Spider, a financially motivated cybercriminal group, and Sandworm, a destructive threat group that the U.S. and U.K. have attributed to Russia.

VMware Prevents 100% of Critical Attacks Tested During MITRE Engenuity ATT&CK® Evaluation

https://news-editor.vmware.com/wp-content/uploads/2022/03/MicrosoftTeams-image-4.png

https://secure.gravatar.com/avatar/4d948efc2db683c0cb4aa50361a076f7?s=96&d=mm&r=g

ktuttle@vmware.com

The recent Presidential mandates and legislation aimed at strengthening public sector digital defenses are much needed reinforcements to ongoing challenges. Cybercrime is predicted to cost the world $10.5 trillion annually by 20251, up from $6 trillion in 2021. Added to this are the stressors caused by the global pandemic — requiring agencies to transition to remote workforces while still serving constituents. And while digital transformation, including cloud adoption, has been on the “to do” list for quite some time, the pandemic accelerated the timeline as agencies looked to modernize their infrastructure and build resilience.

With these forces in mind, VMware’s public sector experts weighed in on what should be at the top of mind for agencies this year.

The Journey to Zero Trust Cybersecurity

December’s discovery of the<a href="https://news.vmware.com/security/vmware-responds-to-log4j-vulnerability"> Log4j vulnerability</a> — which allowed hackers to run any code on vulnerable machines or hack into any application directly using the open-source Log4j framework — revealed the fragility of public and private digital architectures. Add to this, mainstream ransomware attacks targeting organizations in critical industries like Colonial Pipeline, JBS Foods and Kaseya made it starkly evident zero trust security needs to be a priority.

“Zero trust and supply chain risk management are at the top of the list,” says Jeremiah Sanders, Senior Federal Strategist at VMware. Zero Trust is the next-generation model for securely delivering IT services and solutions anywhere in the world, on any device or system. It’s not a single product but a security operations framework based on the notion of never trusting and always verifying.

Keith Nakasone, Federal Strategist at VMware added “Cybersecurity must be looked at holistically. It must become a part of the agency culture to include the people, process, and technology.”

Daniel Kent, Chief Architect, Public Sector, VMware notes that effective cybersecurity also requires agencies to practice good cyber hygiene. “IT security can’t be an afterthought, especially as we move to a devOps model, where analytics and automation will be critical to cybersecurity effectiveness,” he says.

The journey to Zero Trust security must be prioritized — and it’s now a<a href="https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/"> Presidential mandate</a>. Agencies need  a measured, phased approach to achieve this goal. For more information on cybersecurity mandates and adopting a Zero Trust framework, visit:<a href="https://techzone.vmware.com/blog/incorporating-vmware-zero-trust-presidential-executive-order"> Incorporating VMware Zero-Trust for the Presidential Executive Order</a>.

The Power of Public and Private Partnership

Developing and strengthening the ecosystem of public-private engagement, including the<a href="https://blogs.vmware.com/security/2021/11/biden-administration-directs-federal-agencies-to-patch-known-vulnerabilities.html"> Joint Cyber Defense Collaborative (JCDC)</a> and the<a href="https://news.vmware.com/releases/vmware-white-house-summit-open-source-software-security"> White House Open Source Software Security Summit</a>, is a key building block for technological and economic progress. Similarly, VMware is collaborating with NIST’s National Cybersecurity Center of Excellence (NCCoE) Zero Trust Cybersecurity Architecture Consortium to develop practical, interoperable cybersecurity approaches that address the real-world needs of the public sector’s complex IT ecosystem. These partnerships build trust and resiliency as agencies work towards modernizing critical infrastructure.

In December, President Joe Biden signed into law the National Defense Authorization Act of 2022, which codified an approach to cybersecurity that depends on the decisions of private-sector entities to protect the bulk of the nation’s critical infrastructure. This is yet another initiative that brings public and private worlds together to achieve a ‘whole of nation’ approach to combating cybersecurity threats.

“The best way to achieve the goals set by mandates is to work with the private sector — they can be trusted advisors,” says Nakasone.

Leveraging the power of public-private partnerships should be a priority for agencies this year as they look to keep up with the pace of legislation and innovation.

core/embed

A ‘Cloud-Smart’ Approach for the Multi-Cloud Era

The average organization in the private sector runs<a href="https://news.vmware.com/releases/vmworld-2021-cross-cloud-services"> about 500 apps</a>2 to drive their business, and those apps are distributed across clouds. Kent points out that the same forces will be true in the public sector as agencies look to the cloud and apps to digitize parts of their organizations.

It’s no longer about a ‘cloud first’ approach—it’s about being ‘cloud smart.’ A multi-cloud approach increases app velocity and innovation and will empower agencies to become much more agile and resilient. This year, agencies should focus on building a cloud strategy that provides freedom and control. The reality is across federal, state and local agencies are at different points in their digital transformation journeys. It will be important they have the freedom to choose the ’right’ cloud based on their strategic business goals. With a cloud-agnostic approach, agencies have the power to accelerate innovation and control their destiny in the multi-cloud era.

Nakasone noted, “the pandemic has created an opportunity for the public sector to consider alternative solutions to ensure that work can continue from any cloud, any application, and any device. Agencies will need to prioritize understanding cloud solutions moving forward to build a strategy that works for their organization.”

Upskilling and Reskilling Employees

With accelerated digital transformation initiatives, agencies are quickly realizing that new technologies require new employee skill sets. As agencies prioritize innovation, they must also prioritize upskilling and reskilling employees as part of the transformation.

“You can have the understanding of what you need — but not have access to talent,” Sanders says. As a result, agencies will need to focus on reskilling existing talent while also expanding their talent pool. Sanders points out that agencies now have access to a broader talent pool as the workforce continues with remote and distributed models, and there is further opportunity to ensure successful agency digital transformation by leveraging digital workforce upskilling partners like VMware to, “enable a new way of work.” 

To learn how VMware is working with the public sector around these priorities, visit:

With increased focus on digital transformation across the public sector, VMware’s experts discuss four innovation priorities across cybersecurity, partnerships, cloud adoption and employees.

Innovating for the Future: 4 Public Sector Priorities for 2022

https://news-editor.vmware.com/wp-content/uploads/2021/09/GettyImages-949580946.jpg

VMware enhances end-to-end security offering for cloud-native workloads with container runtime protection

PALO ALTO, Calif. — Modern applications require modern security. Today, VMware, Inc. (NYSE: VMW) <a href="https://www.vmware.com/products/carbon-black-cloud-container.html">unveiled</a> new container runtime security capabilities that build upon a strong end-to-end security offering to help customers better secure modern applications at scale. VMware’s portfolio of security solutions for modern applications spans the entire application lifecycle and leverages the company’s deep expertise in workloads, security, and Kubernetes.

Containerized applications present unique runtime security challenges, including how to only allow legitimate traffic in, how to enable least-privileged communications between services and defend against the lateral movement of attackers, and how to validate that the workload itself is operating within the expected guardrails. VMware provides customers with a robust end-to-end security offering that addresses these challenges at the edge, in the microservices network layer, and in the workload itself. This gives organizations greater visibility and control over both their overall security posture as well as the compliance of their containerized applications for improved protection from development to production.

“At VMware, we aspire to be the best in the world at protecting applications from within,” said Tom Gillis, senior vice president and general manager, Networking and Advanced Security Business Group, VMware. “Protecting the runtime is the foundation of securing the inner workings of a modern application. With the introduction of container runtime protection, our end-to-end security offering is now tightly integrated across the entire application lifecycle, protects all east-west traffic, and brings a new level of distributed visibility and security to APIs.”

Announcing Container Runtime Protection to Enhance End-to-End Security for Cloud-Native Workloads

As threat actors increasingly launch attacks targeting containers, 97 percent of technology leaders surveyed by VMware say they have concerns about Kubernetes security, and 1 in 5 cite securing containerized workloads at runtime as their biggest concern1. To help customers stay one step ahead of attackers, VMware is adding container runtime protection capabilities to enhance its end-to-end security offering for cloud-native workloads. These capabilities build upon the VMware Carbon Black Container solution <a href="https://news.vmware.com/releases/vmware-delivers-advanced-cloud-workload-protection-with-container-and-kubernetes-security">released</a> in April 2021.

VMware’s new container runtime security capabilities include:

Attackers often attempt to hide in the noise of an environment, so container runtime security helps to reduce the noise and alert on real, active events, or block the events immediately while minimizing impact to the application and user experience. By consolidating these events to a single dashboard, security teams can accelerate their investigation into incidents impacting endpoints, virtual machine workloads, and containerized workloads. This provides VMware’s customers with a better understanding their overall security posture while reducing alert fatigue, effectively managing risk, and easing enforcement of compliance.

VMware Breaks Down Silos for More Secure Applications

According to a <a href="https://news.vmware.com/releases/new-forrester-research-reveals-deepening-divide-between-developer-and-security-teams">recent study</a>, 70 percent of developer and security managers believe better alignment between their teams creates more secure applications2. <a href="https://www.vmware.com/welcome/cross-cloud-services.html">VMware Cross-Cloud services</a> helps customers reduce team silos to accelerate the development lifecycle and enable security to be built in from the beginning. For example, VMware Carbon Black is highly complementary with VMware Tanzu solutions in addressing the security challenges of modern applications. Together, the two solutions enable more secure applications and simplify operations for security and DevOps teams.

Discovery Limited is a financial services organization that operates in the healthcare, life assurance, short-term insurance, savings and investment and wellness markets.

“Security is a top priority for our organization given we provide services globally to make people healthier and enhance and protect people’s lives,” said Johan Marais, senior platform services manager at Discovery Limited. “With VMware, we’ve been able to better secure the entire development lifecycle and can protect all of the workloads within our environment with a single consolidated platform. We can now go from idea to production in a fast, secured, and reliable way, while tapping into a level of security dimension that we haven’t had access to previously. The powerful combination of VMware infrastructure and security capabilities has armed our organization with the critical context needed to protect our cloud-native workloads.”

OpenX is a pioneering leader in advertising technology, helping create a world where the open web thrives.

“As the only 100% cloud-based ad exchange in the industry, we require strong security to protect our Google Kubernetes Engine (GKE) environment,” said Joel Meyer, chief architect at OpenX. “VMware’s Kubernetes visibility mapping feature and threat detection capabilities have helped us to reduce our risk, simplify our operations, and embed security into the full application lifecycle. With VMware, we’ve unlocked a new level of GKE visibility and security.”

Container runtime protection is currently available through the VMware Carbon Black Cloud Container Advanced Bundle. For more information, please visit our <a href="https://www.carbonblack.com/products/vmware-carbon-black-cloud-container/">website</a>.

VMware, VMworld, Carbon Black, and Tanzu are registered trademarks or trademarks of VMware, Inc. or its subsidiaries in the United States and other jurisdictions.

Kerry Tuttle | VMware Global Communications | ktuttle@vmware.com | (470) 247-1987

VMware unveiled new container runtime security capabilities that build upon a strong end-to-end security offering to help customers better secure modern applications at scale.

https://news-editor.vmware.com/wp-content/uploads/2022/02/MicrosoftTeams-image-22.png

As the world cheers on the 2022 Winter Olympics, VMware is standing atop its own virtual podium with a medal count of nine golds. VMware is proud to announce it has won across nine categories at the <a href="https://cybersecurity-excellence-awards.com/">2022 Cybersecurity Excellence Awards</a>, demonstrating the company’s security innovation and commitment to keeping customers safe from cyberattacks.

“We congratulate VMware for the recognition as a gold award winner in the 2022 Cybersecurity Excellence Awards,” said Holger Schulze, CEO of <a href="https://www.cybersecurity-insiders.com/">Cybersecurity Insiders</a> and founder of the 500,000-member Information Security Community, which organizes the program and determines the award winners. “With over 900 entries in more than 250 award categories, the 2022 Cybersecurity Excellence Awards program is highly competitive. All winners reflect the very best in innovation and excellence in tackling today’s urgent cybersecurity challenges.”

“We congratulate VMware for the recognition as a gold award winner in the 2022 Cybersecurity Excellence Awards,” said Holger Schulze, CEO of <a href="https://www.cybersecurity-insiders.com/">Cybersecurity Insiders</a> and founder of the 500,000-member Information Security Community, which organizes the program and determines the award winners. “With over 900 entries in more than 250 award categories, the 2022 Cybersecurity Excellence Awards program is highly competitive. All winners reflect the very best in innovation and excellence in tackling today’s urgent cybersecurity challenges.”

core/media-text

The 7th annual Cybersecurity Excellence Awards recognize companies, products, and professionals that demonstrate excellence, innovation, and leadership in information security. Across nine competitive categories ranging from endpoint security and mobile device management to ransomware recovery and Secure Access Service Edge (SASE), the gold medals go to:

Cloud Workload Protection: VMware Carbon Black Cloud Workload

Organizations are innovating and delivering new applications that are built, scaled and operated differently in the modern cloud world. However, the modern enterprise faces a growing security challenge with protecting these apps and data amid an expanding threat surface. <a href="https://www.vmware.com/products/carbon-black-cloud-workload.html">VMware Carbon Black Cloud Workload</a> delivers advanced protection purpose-built for securing modern and traditional workloads to reduce attack surface and strengthen security postures. This innovative solution combines prioritized vulnerability reporting and foundational workload hardening with industry-leading prevention, detection and response capabilities to protect workloads running in virtualized, private and hybrid cloud environments. Tightly integrated with VMware vSphere, VMware Carbon Black Cloud Workload provides agentless security that alleviates installation and management overhead and consolidates the collection of telemetry for multiple workload security use cases. By delivering security as a built-in distributed service, VMware helps customers scale response with confidence, speed, and accuracy, and break down siloes on the journey to Zero Trust.

Endpoint Security: VMware Carbon Black Cloud Endpoint

VMware is pioneering modern endpoint security to help defend against cybercriminals who are innovating faster than traditional defenses can withstand. <a href="https://www.vmware.com/products/carbon-black-cloud-endpoint.html">VMware Carbon Black Cloud Endpoint</a> protects against the full spectrum of modern cyberattacks while reducing blind spots and detection and response time. As a next-generation antivirus (NGAV) and endpoint detection and response (EDR) solution with an easy-to-manage, cloud native EPPs, VMware Carbon Black Cloud Endpoint combines prevention and automated detection to defend distributed endpoints from today’s advanced cyberattacks. By going beyond just collecting data around malicious behavior, VMware Carbon Black Cloud Endpoint redefines traditional endpoint security and continuously gathers endpoint activity data to build a comprehensive dataset to analyze. The solution applies behavioral analytics to endpoint events to streamline detection, prevention and response to cyberattacks – empowering customers to protect their organization and contextualize threats.

Mobile Device Management (MDM): VMware Workspace ONE UEM

<a href="https://www.vmware.com/products/workspace-one/unified-endpoint-management.html">VMware Workspace ONE UEM</a> goes beyond mobile device management (MDM) and provides a comprehensive solution that enables companies to manage and secure any device across all platforms.  It incorporates modern device management, application management, and security that’s effective outside the corporate perimeter. It empowers IT to manage every device on every platform, automate the onboarding process over the air, and flexibly support all use cases – all while providing a seamless employee experience. VMware Workspace ONE UEM also makes data-driven decisions and automates important repetitive processes for the IT team. The solution reinvents device hygiene by addressing security on multiple fronts and providing rich management controls, device posture checks, and per-app tunnel capabilities as a foundation for an organization’s Zero Trust Network Access (ZTNA) initiatives.

Patch and Configuration Management: CloudHealth Secure State by VMware

Managing misconfiguration risk to prevent data breaches and improve cloud security posture is a key priority for IT and developer teams. But finding a solution that is easy to operationalize and can deliver actionable security insights to right teams quickly can be very challenging. Recognizing this solution gap in the industry, VMware launched <a href="https://www.cloudhealthtech.com/products/cloudhealth-secure-state">CloudHealth Secure State</a>, a real-time cloud native security platform, to enable cloud teams to better manage security & compliance risk. Since then, CloudHealth Secure State has transformed cloud security at many companies, ranging from born-in the-cloud startups to global conglomerates, delivering advanced security visibility and protecting over 50M assets in AWS, Azure, and Google cloud environments.

Ransomware Protection: VMware Carbon Black Cloud

Ransomware is proving effective, pervasive and profitable and it continues to be a dominant factor in today’s modern threat landscape. <a href="https://www.vmware.com/products/carbon-black-cloud.html">VMware Carbon Black Cloud</a> helps provide visibility into, detection of, and blocking of ransomware attacks along the kill chain, without impacting the performance of the endpoint. In a recent 90-day period, VMware Carbon Black Cloud stopped more than 1.1 million ransomware attacks. With VMware Carbon Black Cloud, organizations maintain visibility, protection and control over their endpoints, even if they are disconnected from the corporate network. In addition to protecting the endpoint, VMware Carbon Black Cloud can also detect known malicious IP addresses and trigger an alert to give the indication that an attack is underway. Actions to prevent ransomware taken in the VMware Carbon Black Cloud UI can also be taken by leveraging the VMware Carbon Black Cloud API.

Ransomware Recovery: VMware Cloud Disaster Recovery

VMware Cloud Disaster Recovery is an easy-to-use, on-demand disaster recovery solution, delivered as SaaS, with cloud economics. It provides the reliability, ease of use, and flexibility to support the unpredictable characteristics of disaster scenarios. <a href="https://www.vmware.com/products/cloud-disaster-recovery.html">VMware Cloud Disaster Recovery</a> delivers rapid ransomware recovery, as it provides immutable offsite backups, instant recovery of VMs for rapid testing and iteration, and workflow orchestration at scale in a clean environment. With VMware Cloud Disaster Recovery, customers get the ideal combination of cost-efficient cloud storage with simple SaaS-based management for IT resiliency at scale and a 'pay-as-you-go' failover capacity model — all with consistent VMware operations across production and disaster recovery sites.

Secure Access: VMware Secure Access

<a href="https://www.vmware.com/products/secure-access.html">VMware Secure Access</a> is a remote access solution that helps organizations traverse today’s hybrid work reality. Based on a Zero Trust Network Access (ZTNA) framework, the cloud-hosted solution offers multiple benefits over traditional VPN solutions. It provides users with consistent, optimal, and secure application access. VMware Secure Access, a key component of VMware SASE, combines the consistent, secure cloud application access functionality of VMware SD-WAN with the capability of VMware Workspace ONE to allow only trusted devices and users to access applications hosted on-premises, or in the cloud. In the cloud-hosted model, the tunneling headend capability is hosted in the VMware SASE PoPs, terminating sessions from Workspace ONE clients. This allows quick scaling and redundancy of the service. Traffic coming from Workspace ONE users can be chained with other services such as Cloud Web Security within the SASE PoPs, for additional security.

Secure Access Service Edge (SASE): VMware SASE

<a href="https://sase.vmware.com/">VMware SASE</a> is a cloud-native secure access service edge platform that brings together the network performance benefits of SD-WAN, integrated security services delivered from the cloud, and the ability to support modern distributed applications. In doing so, it allows enterprises to build a platform that provides branch, home, and remote users more secure, optimized, and reliable access to modern applications deployed in public and private clouds, SaaS, or at the enterprise edge. The uniqueness of the VMware approach is in its SASE points of presence (PoP), which are strategically distributed around the world and serve as an on-ramp to SaaS and other cloud services. The global footprint of VMware and partner PoPs deliver cloud-based networking and security services that scale customers’ SASE needs.

Security Platform: VMware NSX Network Detection and Response

<a href="https://www.vmware.com/products/nsx-network-detection-response.html">VMware NSX Network Detection and Response</a> (NDR) provides a tightly integrated set of network detection and response capabilities for east-west security within the data center and multi-cloud environments. The solution has the broadest set of detection capabilities that span network IDS/IPS, behavior-based network traffic analysis, and includes VMware NSX Sandbox, a sandbox offering based on a full-system emulation technology that has visibility into every malware action. Powered by AI, NSX Network Detection and Response correlates individual detection events across multiple assets and hops into fewer security-relevant intrusions, organizing them into a timeline for rapid threat hunting and response. Together, the detection capabilities provide the most effective prevention of lateral movement and comprehensive protection against a wide range of known and unknown advanced threats.

VMware has won across nine categories at the 2022 Cybersecurity Excellence Awards, demonstrating the company’s security innovation and commitment to keeping customers safe from cyberattacks.

https://news-editor.vmware.com/wp-content/uploads/2022/02/MicrosoftTeams-image-18.png

VMware report finds more than half of Cobalt Strike users are using the tool illicitly

PALO ALTO, Calif. – As the most common cloud operating system, Linux is a core part of digital infrastructure and is quickly becoming an attacker’s ticket into a multi-cloud environment. Current malware countermeasures are mostly focused on addressing Windows-based threats, leaving many public and private cloud deployments vulnerable to attacks that target Linux-based workloads.

Today, VMware, Inc. (NYSE: VMW) <a href="https://www.vmware.com/resources/security/exposing-malware-in-multi-cloud.html?utm_source=pr&utm_medium=referral&utm_campaign=linux-threat-report&utm_term=none&utm_content=none">released</a> a threat report titled “Exposing Malware in Linux-based Multi-Cloud Environments.”(1) Key findings that detail how cybercriminals are using malware to target Linux-based operating systems include:

“Cybercriminals are dramatically expanding their scope and adding malware that targets Linux-based operating systems to their attack toolkit in order to maximize their impact with as little effort as possible,” said Giovanni Vigna, senior director of threat intelligence at VMware. “Rather than infecting an endpoint and then navigating to a higher value target, cybercriminals have discovered that compromising a single server can deliver the massive payoff and access they’re looking for. Attackers view both public and private clouds as high-value targets due to the access they provide to critical infrastructure services and confidential data. Unfortunately, current malware countermeasures are mostly focused on addressing Windows-based threats, leaving many public and private cloud deployments vulnerable to attacks on Linux-based operating systems.”

As malware targeting Linux-based operating systems increases in both volume and complexity amid a rapidly changing threat landscape, organizations must place a greater priority on threat detection. In this report, the VMware Threat Analysis Unit (TAU) analyzed the threats to Linux-based operating systems in multi-cloud environments: ransomware, cryptominers, and remote access tools.

Ransomware Targets the Cloud to Inflict Maximum Damage

As one of the <a href="https://www.carbonblack.com/resources/global-security-insights-report-2021-intelligence-from-the-global-cybersecurity-landscape/?lp=1&utm_source=twitter&utm_medium=social&utm_campaign=social-organic&utm_term=none&utm_content=report">leading breach</a> causes for organizations, a successful ransomware attack on a cloud environment can have devastating consequences.(2) Ransomware attacks against cloud deployments are targeted, and are often combined with data exfiltration, implementing a double-extortion scheme that improves the odds of success. A new development shows that ransomware is evolving to target Linux host images used to spin workloads in virtualized environments. Attackers are now looking for the most valuable assets in cloud environments to inflict the maximum amount of damage to the target. Examples include the Defray777 ransomware family, which encrypted host images on ESXi servers, and the DarkSide ransomware family, which crippled Colonial Pipeline’s networks and caused a nationwide gasoline shortage in the U.S.

Cryptojacking Attacks Use XMRig to Mine Monero

Cybercriminals looking for an instant monetary reward often target cryptocurrencies using one of two approaches. Cybercriminals either include wallet-stealing functionality in malware or they monetize stolen CPU cycles to successfully mine cryptocurrencies in an attack called cryptojacking. Most cryptojacking attacks focus on mining the Monero currency (or XMR) and VMware TAU discovered that 89 percent of cryptominers used XMRig-related libraries. For this reason, when XMRig-specific libraries and modules in Linux binaries are identified, it is likely evidence of malicious cryptomining behavior. VMware TAU also observed that defense evasion is the most commonly used technique by cryptominers. Unfortunately, because cryptojacking attacks do not completely disrupt the operations of cloud environments like ransomware, they are much more difficult to detect.

Cobalt Strike Is Attackers’ Remote Access Tool of Choice

In order to gain control and persist within an environment, attackers look to install an implant on a compromised system that gives them partial control of the machine. Malware, webshells, and Remote Access Tools (RATs) can all be implants used by attackers in a compromised system to allow for remote access. One of the primary implants used by attackers is Cobalt Strike, a commercial penetration testing and red team tool, and its recent variant of Linux-based Vermilion Strike. Since Cobalt Strike is such a ubiquitous threat on Windows, the expansion out to the Linux-based operating system demonstrates the desire of threat actors to use readily available tools that target as many platforms as possible.

VMware TAU discovered more than 14,000 active Cobalt Strike Team Servers on the Internet between February 2020 and November 2021. The total percentage of cracked and leaked Cobalt Strike customer IDs is 56 percent, meaning that more than half of Cobalt Strike users may be cybercriminals, or at least using Cobalt Strike illicitly. The fact that RATs like Cobalt Strike and Vermilion Strike have become a commodity tool for cybercriminals poses a significant threat to enterprises.

“Since we conducted our analysis, even more ransomware families were observed gravitating to malware targeting Linux-based systems, with the potential for additional attacks that could leverage the Log4j vulnerabilities,” said Brian Baskin, manager of threat research at VMware. “The findings in this report can be used to better understand the nature of this malware and mitigate the growing threat that ransomware, cryptomining, and RATs have on multi-cloud environments. As attacks targeting the cloud continue to evolve, organizations should adopt a Zero Trust approach to embed security throughout their infrastructure and systematically address the threat vectors that make up their attack surface.”

Download the full report <a href="https://www.vmware.com/resources/security/exposing-malware-in-multi-cloud.html?utm_source=pr&utm_medium=referral&utm_campaign=linux-threat-report&utm_term=none&utm_content=none">here</a>.

The VMware Threat Analysis Unit (TAU) helps protect customers from cyberattacks through innovation and world-class research. TAU is composed of malware analysts, reverse engineers, threat hunters, data scientists, and intelligence analysts at VMware. To understand how to detect and prevent attacks that bypass traditional, file-centric, prevention strategies, TAU focuses on techniques that were once the domain of advanced hackers and are now moving downstream into the commodity attack market. The team leverages real-time big data, event streaming processing, static, dynamic and behavioral analytics, and machine learning.

TAU applied a composition of static and dynamic techniques to characterize various families of malware observed on Linux-based systems based on a curated dataset of metadata associated with Linux binaries. All the samples in this dataset are public and therefore they can be easily accessed using VirusTotal or various websites of major Linux distributions. TAU collected more than 11,000 benign samples from several Linux distributions, namely, Ubuntu, Debian, Mint, Fedora, CentOS, and Kali. TAU then collected a dataset of samples for two classes of threats, namely ransomware and cryptominers. Finally, TAU collected a dataset of malicious ELF binaries from VirusTotal that were used as a test malicious dataset. TAU started collecting the dataset in June 2021 and concluded in November 2021.

Kerry Tuttle, VMware Global Communications, ktuttle<a href="https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.carbonblack.com%2Fpress-releases%2Fvmware-releases-global-incident-response-threat-report-detailing-surge-in-sophisticated-cyberattacks-as-ecrime-groups-grow-more-powerful%2Fsmayowa%40vmware.com&esheet=52428830&newsitemid=20210513005727&lan=en-US&anchor=smayowa%40vmware.com&index=5&md5=1703d2fddc5b038b50c05f4ba6184693">@vmware.com</a>, (470) 247-1987

VMware Threat Analysis Unit (TAU) released a new threat report titled "Exposing Malware in Linux-based Multi-Cloud Environments."

Cybercriminals Target Linux-based Systems with Ransomware and Cryptojacking Attacks

https://news-editor.vmware.com/wp-content/uploads/2022/02/MicrosoftTeams-image-15.png

Cybercriminals Target Linux-Based Systems With Ransomware and Cryptojacking Attacks - VMware News and Stories

VMware Comment Letter in Advance of the White House Open Source Security Summit

corpnews-blocks/subhead

Last week, I attended the <a href="https://www.whitehouse.gov/briefing-room/statements-releases/2022/01/13/readout-of-white-house-meeting-on-software-security/">White House Open Source Software Security Summit,</a> along with VMware’s Chief Security Officer, Alex Tosheff, and Michael Kennedy, our VP of Global Government Relations and Public Policy. Led by Deputy National Security Advisor for Cyber and Emerging Technology Anne Neuberger, the summit was attended by both private industry leaders and government agencies.

This important gathering was precipitated by the Log4j vulnerability, but the real issue is — how can we ensure source code, build, and distribution integrity in <a>all open source</a> software (OSS)?

cybersecurity