index - VMware News and Stories

https://news-editor.vmware.com/wp-content/uploads/2021/09/logo_media_thumbnail.jpg

VMware News & Stories

VMware News and Stories

Home

VMware Enables Greater Security and Business Resilience for the Modern, Distributed Enterprise

index

Carbon Black - VMware News and Stories

VMware Named a Leader in Endpoint Security Software As A Service by Global Analyst Firm

Carbon Black

Security system

GettyImages-1296451458 - VMware News and Stories

Cybercriminals Manipulate Reality via Integrity and Destructive Attacks, VMware Report Finds

GettyImages-1296451458

Zoom-screen-2-04

Zoom-screen-2-04 - VMware News and Stories

Woman sitting at a table working on laptop.

Smiling businesswoman sitting at table using laptop

Smiling businesswoman sitting at table using laptop - VMware News and Stories

VMware Named a Leader in Zero Trust Network Access by Global Analyst Firm

Three men working together looking at a large computer screen.

Global-Incident-Response-Threat-Report-Story Feature Image - VMware News and Stories

Report: Cybersecurity Defenders Fight Back Against Manipulated Reality

Global-Incident-Response-Threat-Report-Story Feature Image

Mother working from home while children play on their smartphones.

Cyberattacks_Surge_Targets_Anywhere_Workforce_RADIUS_1280x675 - VMware News and Stories

Surge in Cyberattacks Targets the Anywhere Workforce

Cyberattacks_Surge_Targets_Anywhere_Workforce_RADIUS_1280x675

Datrium - VMware News and Stories

Datrium

carbon-black-modern-bank-heists-report - VMware News and Stories

carbon-black-modern-bank-heists-report

RSA 2021_Cybersecurity Lessons_VMware RADIUS - VMware News and Stories

3 Hard Truths About Cybersecurity

RSA 2021_Cybersecurity Lessons_VMware RADIUS

Man petting dog during a video conference call

5-Steps-to-Less-Risky-Remote-Work-Story Feature Image - VMware News and Stories

Security Alert! 5 Steps to Less Risky Remote Work

5-Steps-to-Less-Risky-Remote-Work-Story Feature Image

what-trust-means-to-consumers-Story Feature Image - VMware News and Stories

10 Things Consumers Really Mean When They Say Trust

what-trust-means-to-consumers-Story Feature Image

PALO ALTO, Calif.&#8211;(BUSINESS WIRE)&#8211;VMware, Inc. (NYSE: VMW) today announced global market research firm Forrester has named VMware a leader in The Forrester New Wave™: Zero Trust Network Access, Q3 2021. The report evaluated 15 zero trust network access (ZTNA) solutions, including VMware Secure Access.
<div class="q4default">
“Applications are moving to the cloud and employees are working from everywhere, rendering traditional security models for protecting the network perimeter obsolete,” said Shankar Iyer, senior vice president and general manager, End-User Computing, VMware. “Our Anywhere Workspace solutions, including VMware Secure Access, enable organizations to implement Zero Trust security by allowing only trusted devices and users to access applications hosted on premises or in the cloud. We believe this recognition by Forrester validates our strategy and we will continue to innovate in this area to support our customers’ journey to implementing an end-to-end Zero Trust security architecture.”
According to The Forrester New Wave™ report, “Our evaluation found that VMware has superior inline security inspection and device posture security. VMware offers a broad set of inline security techniques like watermarking, risk scoring, and behavioral analysis. VMware’s ZTNA solution integrates well with its own endpoint protection as well as major third-party suites.”
<a href="https://cts.businesswire.com/ct/CT?id=smartlink&#038;url=https%3A%2F%2Fwww.vmware.com%2Fsolutions%2Fanywhere-workspace.html&#038;esheet=52483494&#038;newsitemid=20210830005353&#038;lan=en-US&#038;anchor=VMware+Anywhere+Workspace&#038;index=1&#038;md5=abba213a2f06a4ab49cf912fd0d8bc2b" rel="nofollow">VMware Anywhere Workspace</a> brings together VMware Workspace ONE, VMware SASE and VMware Carbon Black Cloud to enable hybrid work. VMware Secure Access, as part of VMware Anywhere Workspace, integrates Workspace ONE endpoint management with VMware SASE capabilities, delivered from VMware’s global network of SASE points of presence (PoPs). This enables a modern, cloud-native approach to remote access with continuous authentication methodologies that:
<ul class="bwlistdisc">
<li>Shrinks the attack surface</li>
<li>Enables consistent user experiences irrespective of where they are accessing enterprise data</li>
<li>Improves application performance by avoiding routing cloud/SaaS traffic through legacy solutions</li>
<li>Reduces additional management overhead and cost</li>
</ul>
To learn more about VMware Secure Access:
<ul class="bwlistdisc">
<li><a href="https://cts.businesswire.com/ct/CT?id=smartlink&#038;url=https%3A%2F%2Fsase.vmware.com%2Fresources%2Fthe-forrester-new-wave-zero-trust-network-access&#038;esheet=52483494&#038;newsitemid=20210830005353&#038;lan=en-US&#038;anchor=Access&#038;index=2&#038;md5=34a833dafcbdddf64aabc67520e58184" rel="nofollow">Access</a> a complimentary copy of The Forrester New Wave™: Zero Trust Network Access, Q3 2021</li>
<li><a href="https://cts.businesswire.com/ct/CT?id=smartlink&#038;url=https%3A%2F%2Fwww.vmware.com%2Fcontent%2Fdam%2Fdigitalmarketing%2Fvmware%2Fen%2Fpdf%2Fproducts%2Fsase-platform%2Fvmw-sdwan-zero-trust-service-so.pdf&#038;esheet=52483494&#038;newsitemid=20210830005353&#038;lan=en-US&#038;anchor=Read&#038;index=3&#038;md5=c6a594990cfa551b3b5e08908007b850" rel="nofollow">Read</a> the VMware Secure Access solution overview</li>
</ul>
About VMware
VMware software powers the world’s complex digital infrastructure. The company’s cloud, app modernization, networking, security, and digital workspace offerings help customers deliver any application on any cloud across any device. Headquartered in Palo Alto, California, VMware is committed to being a force for good, from its breakthrough technology innovations to its global impact. For more information, please visit <a href="https://cts.businesswire.com/ct/CT?id=smartlink&#038;url=https%3A%2F%2Fwww.vmware.com%2Fcompany.html&#038;esheet=52483494&#038;newsitemid=20210830005353&#038;lan=en-US&#038;anchor=https%3A%2F%2Fwww.vmware.com%2Fcompany.html&#038;index=4&#038;md5=8bfb58a2300f25e57d8b05838ca6f630" rel="nofollow">https://www.vmware.com/company.html</a>.
VMware, Anywhere Workspace, Workspace ONE, VMware SASE, and Carbon Black are registered trademarks or trademarks of VMware, Inc. or its subsidiaries in the United States and other jurisdictions.
This article may contain hyperlinks to non-VMware websites that are created and maintained by third parties who are solely responsible for the content on such websites.
<img style="width: 0; height: 0;" src="https://cts.businesswire.com/ct/CT?id=bwnews&#038;sty=20210830005353r1&#038;sid=acqr8&#038;distro=nx&#038;lang=en" alt="" />
View source version on <a href="http://businesswire.com">businesswire.com</a>: <a href="https://www.businesswire.com/news/home/20210830005353/en/" rel="nofollow">https://www.businesswire.com/news/home/20210830005353/en/</a> 
Angela Leaf VMware Global Communications Phone: +1 860 480 3367 <a href="mailto:aleaf@vmware.com" rel="nofollow">aleaf@vmware.com</a>
Source: VMware, Inc.
</div>

core/freeform

VMware Named a Leader in Zero Trust Network Access by Global Analyst Firm - VMware News and Stories

https://news-editor.vmware.com/wp-content/uploads/2021/08/Forrester-Zero-Trust-Network-GettyImages-1138996179.jpg

Posts

The threat landscape changed in a number of ways as a result of the COVID-19 pandemic, and organizations are scrambling to defend against opportunistic cyberattacks.

core/paragraph

That was the key takeaway from <a href="https://www.carbonblack.com/resources/global-security-insights-report-2021-intelligence-from-the-global-cybersecurity-landscape/">VMware's 2021 Global Security Insights Report</a>, compiled from a survey of 3,542 CIOs, CTOs and CISOs from across the globe in December 2020.

core/image

Nearly 80% reported increased cyberattacks due to employees working from home. A similar percentage said that attacks had become more sophisticated, while 4-out-of-5 breaches were considered to be material. Sixty-one percent of respondents acknowledged the need to view security differently due to the expanded threat surface.<a href="https://www.carbonblack.com/resources/global-security-insights-report-2021-intelligence-from-the-global-cybersecurity-landscape/"> </a>

core/heading

Cyberattacks increased for a number of reasons during the pandemic. First, the threat surface expanded as organizations everywhere sent employees home to work remotely. Workers were suddenly sharing computers with their children for remote learning as well as a home network with any number of smart devices.

Additionally, traditional crime moved online. "Cybercrime cartels were empowered by the pandemic because traditional organized crime couldn't operate due to the lockdown," said VMware Head of Cybersecurity Strategy Tom Kellermann during the <a href="https://youtu.be/E8LVgaDsJ4A">Global Security Insights Report livestream</a> interview. Many cyber cartels created a sophisticated quasi-startup structure featuring developers and QA teams. Some even have the support of international governments.

core/embed

Kellermann reported that some countries consider cybercriminals to be national assets. "There is a protection going on there, because many times governments view these groups as a way to offset economic sanctions and a way to create proxies to create almost an insurgency against their geopolitical enemies," Kellermann said.

core/pullquote

And finally, organizations have been slow to change their security mindset, while simultaneously moving a lot of their infrastructure to the cloud. &#8220;Attackers are opportunists, so we have to be opportunists as well,” VMware Senior Security Strategist James Alliband said. “We have to change the status quo [and] make sure that the traditional security processes we have in place aren&#8217;t necessarily going to affect us for the future.”
So how can organizations protect themselves?
<h2>Not All Clouds Are Created Equal</h2>
While nearly all of those surveyed were employing a cloud-first strategy, there seems to be a degree of misplaced faith in public cloud security. Kellermann advised to think of a public cloud environment as &#8220;a very nice apartment building in a very tough neighborhood.” Security should be built from a zero trust perspective and needs to be incorporated from the ground up.
<img loading="lazy" class="size-full wp-image-32899 aligncenter" src="https://news-editor.vmware.com/wp-content/uploads/2021/08/vmw-banner-98-quote_081821.png" alt="98% of security professionals surveyed said they already use or plan to shift to a cloud-first strategy." width="775" height="600" srcset="https://news-editor.vmware.com/wp-content/uploads/2021/08/vmw-banner-98-quote_081821.png 775w, https://news-editor.vmware.com/wp-content/uploads/2021/08/vmw-banner-98-quote_081821.png?resize=300,232 300w, https://news-editor.vmware.com/wp-content/uploads/2021/08/vmw-banner-98-quote_081821.png?resize=768,595 768w" sizes="(max-width: 775px) 100vw, 775px" />
VMware Principal Cybersecurity Strategist Rick McElroy compared IT teams building infrastructure to the construction of an apartment building: &#8220;You have your architects that come in and they&#8217;re planning for things like plumbing, power, enough square footage. They&#8217;re not planning for somebody to run into that apartment building and kick your door in. That&#8217;s our job.&#8221;
Alliband agreed, saying, &#8220;You&#8217;ve got to secure these environments from the get-go and build that into your strategy.&#8221;
<h2>Build in Early Detection Systems</h2>
Organizations must find bad actors before they attack. Rather than putting all your faith in security processes that keep threats out of your environment, it&#8217;s crucial to find them if and when they get inside. And attacks don&#8217;t tend to happen immediately. Typically, attackers spend a couple of weeks exploring your infrastructure before the attack, so it&#8217;s possible to discover them before they take action.
Kellermann said, &#8220;You need to assume that prevention will fail at some point. When it does, how quickly can you detect and respond?&#8221;
CISOs are looking for a way to discover those threats. &#8220;What CISOs are really looking for are solutions out there that can give them visibility into these cloud environments,” McElroy said. They&#8217;re looking for controls that are uniform and auditable, and that can follow their data across various cloud environments.
<h2>Secure the Anywhere Workspace</h2>
Remote work exploded during the pandemic. And it appears that the anywhere workplace is here to stay. But with so many workers off-prem, the attack surface expands exponentially. With a number of devices operating on a home network, multiple vulnerabilities exist.
&#8220;There&#8217;s a lack of digital distancing in homes and really we need to pay attention to that. … Your work device should not be on the same network as your smart devices, period,&#8221; Kellermann said. Securing the remote environment is a must.
<h2>Simplify Security</h2>
Security has become complex, with a variety of controls and widgets that can be exploited by adversaries. &#8220;We have to start simplifying security, that&#8217;s number one. There are just too many tools that have too many gaps,&#8221; McElroy said.
As companies use a number of tools to secure various parts of their business, more risk develops if they don&#8217;t communicate with each other. One security app might not know that another security app has experienced a breach. &#8220;You should really standardize on one platform. And whatever platform that is, you should standardize on it soon,&#8221; Kellermann said.
<h2>Hit Attackers Where It Hurts</h2>
Ultimately, cybercriminals get into the business because it&#8217;s profitable. A strong driver of their business is that much of the work is automated. McElroy suggests that companies make it more expensive for cybercriminals to do business by forcing them to slow down and do more work manually.
&#8220;If every single piece of ransomware was custom written, now we&#8217;re starting to bust up that economy. Now they actually can&#8217;t get a massive [return on investment] because their time investment is too high,” McElroy said. “Simply put, we have to make them spend more time. &#8230; We have to deploy tech to start making it harder.&#8221;
<h2>The New Normal</h2>
Ultimately, the threat landscape has changed greatly and it&#8217;s not going back to the way it was.
&#8220;We have to realize that is the norm and it&#8217;s not going to change anytime soon. If I can start to shift my mindset, realize I do live in a bad neighborhood and I&#8217;m responsible for my own self-defense, then I&#8217;m going to change my own behavior,” McElroy said. “I&#8217;m going to change the culture of the organization that I&#8217;m with, and to do that I need something like a neighborhood watch.&#8221;

The pandemic has brought security front and center for business leaders. McElroy encouraged security leaders to seize that opportunity: &#8220;We helped organizations stay up and running during a global pandemic. The organizations are happy with a lot of the security leaders and the way we were able to do that. Let&#8217;s take advantage of that just like the attackers are taking advantage of this disaster, and let&#8217;s put a flag out a little further than we ever thought was achievable.&#8221;

VMware Staff

Cyberattacks are surging, according to VMware's Global Security Insights Report. Learn how to protect your organization against an expanded threat surface.

https://news-editor.vmware.com/wp-content/uploads/2021/08/Cyberattacks_Surge_Targets_Anywhere_Workforce_RADIUS_1280x675.png

Cybercriminals Manipulate Reality via Integrity and Destructive Attacks, VMware Report Finds - VMware News and Stories

https://news-editor.vmware.com/wp-content/uploads/2021/08/GettyImages-1296451458.jpg

VMware’s seventh annual <a href="https://www.carbonblack.com/resources/global-incident-response-threat-report-manipulating-reality">Global Incident Response Threat Report</a> analyzes how attackers are manipulating reality to reshape the modern threat landscape.
The report found a drastic rise in destructive attacks, where adversaries deploy advanced techniques to deliver more targeted, sophisticated attacks that distort digital reality. Examples include business communications compromise (BCC) or the manipulation of time. However, defenders are struggling to counter these complex attacks and gain visibility into new environments, such as the cloud, containers and business communication applications. This is leading to an embrace of active defense techniques as incident responders deal with the extreme stress of their jobs.
Check out the infographic below for key findings. <a href="https://www.carbonblack.com/resources/global-incident-response-threat-report-manipulating-reality" target="_blank" rel="noopener noreferrer">Dive deeper into the full Global Incident Response Threat Report here</a>.

Download the full report, check out our latest threat research and learn more about VMware security solutions.

corpnews-blocks/banner

Study shows drastic rise in destructive cyberattacks as adversaries deliver more targeted, sophisticated attacks to distort digital reality.

Study shows drastic rise in targeted, sophisticated attacks that distort digital reality.

Only 46% of senior business leaders felt their business continuity plans were effective during shutdowns caused by the pandemic, according to a recent <a href="https://www.vmware.com/co/cio-vantage/articles/mit-technology-review-insights-report.html">MIT Technology Review Insights survey</a>. Is that surprising? Not really, because IT wasn’t around during the last global pandemic.
Now, companies are sharing valuable lessons learned about IT resilience, risk and security. And these insights may prove essential for confronting future challenges and supporting ongoing digital transformation.
“With the pandemic, it wasn&#8217;t enough to plan for critical staff working from an alternate location or from home for a period of time,” said Angela Weinman, head of global governance, risk and compliance at VMware. “Those who could pivot fastest last year were the ones who had the broadest plans or who could mitigate [risk] by being furthest along their digital transformation journey.”
Weinman made her observation during the opening keynote session of <a href="https://www.rsaconference.com/">RSA Conference 2021</a>, “Telling Hard Truths to Impact Change in Cybersecurity.” She was joined by Jimmy Sanders, head of information security at Netflix DVD and a director for the <a href="https://www.issa.org/">Information Systems Security Association</a> (ISSA).
Weinman and Sanders encouraged IT security professionals to “zoom out, throw out and reach out” to build greater resilience.

The sharp rise in ransomware attacks during 2020 calls for a look at cybersecurity practices—both at the enterprise level and at home. Here are five steps to help reduce risk.

<h2>Hard Truth 2: Legacy Security Practices Are Slowing Things Down</h2>
The same way organizations need to zoom out to assess risk, including more points of view will drive better risk management practices.
“Create an environment where the best ideas win, and this improves our security posture overall,” Sanders said. “These diverse thoughts stem from allowing competing ideas and viewpoints to be voiced without the fear of ridicule and condemnation.”
At Netflix DVD, Sanders encourages his team to begin a regular process of presenting a proof-of-concept tool or technique every month. The result was an information security team with a resilient and nimble mindset, said Sanders—one that wasn’t easily rattled by change because it was always thinking outside the box.
For many security organizations, a need to appear “mature” leads them to automate many processes and build layer upon layer. “Like a geological formation,” Weinman said. “Hard and inflexible, weighing us down along with the business units we work with. How many things exist so that we can check a box for some long-forgotten reason?”
In the current landscape, as companies go wide angle to consider a spectrum of security threats, everything should be on the table. All security practices should be open to challenge and, if appropriate, be thrown aside. As long as an organization can map a security practice back to a business goal or a cyber-hygiene fundamental, it can validate its decisions. If it can’t, it needs to be open to new ideas, which often come from its newest employees.
“It’s not just a good idea to throw things out, it’s a survival tactic,” said Weinman.
To scale and remain agile, organizations must constantly challenge the “how” of cybersecurity, as well as the “why.”
<h2>Hard Truth 3: Security Is Not a Solo Sport</h2>
No single group or organization can stem the tide of security threats. Put simply, we’re all in this together. The security community must make best practices available to everyone. It’s one thing to lead the security team inside an organization and champion the tools that will protect the network and allow it to pass a security audit. It’s another thing to learn from others.

Get our most popular articles, videos and more—recommended just for you.

Sanders said his career began by enthusiastically doing the former, but really took off when he engaged outside organizations in doing the latter.
“Shared accountability, increased diversity and embracing innovative techniques together will allow us to make amazing progress,” Sanders said.
Weinman called it “community resilience,” in which the security community works together to solve problems.
“Throw out those old ways of doing things and reach out,” she concluded. “We&#8217;re more resilient and better at security when we leverage our relationships and collective knowledge.”

Companies are now sharing valuable lessons learned from the pandemic about IT resilience, risk and security—which may prove essential.

Experts from Netflix DVD and VMware share hard truths and valuable cybersecurity lessons learned from the pandemic.

https://news-editor.vmware.com/wp-content/uploads/2015/08/RSA-2021_Cybersecurity-Lessons_FB-LI.jpg

Lessons Learned About Cybersecurity During the Pandemic

VMware Releases 2021 Global Security Insights Report Detailing the Surge in Cyberattacks Targeting the Anywhere Workforce - VMware News and Stories

https://news-editor.vmware.com/wp-content/uploads/2021/09/vmware-intent-to-acquire-datrium-hero-banner.png

VMware Releases 2021 Global Security Insights Report Detailing the Surge in Cyberattacks Targeting the Anywhere Workforce

In early 2020, remote work skyrocketed by more than 70%. And cybercriminals took advantage immediately. From February to March 2020 alone, <a href="https://www.carbonblack.com/blog/amid-covid-19-global-orgs-see-a-148-spike-in-ransomware-attacks-finance-industry-heavily-targeted/">ransomware attacks increased by over 148%</a>. This sharp rise in activity calls for a look at cybersecurity practices—both at the enterprise level and at home.

To better protect distributed workforces, here are five steps to help reduce risk.

<h2>1. Take Security Operations Centers (SOCs) to the Cloud</h2>
Even office-bound SOC teams need a continuity plan. With a <a href="https://tanzu.vmware.com/cloud-native-security">cloud-native security</a> stack, teams can remotely:
<ul>
<li>Identify vulnerabilities.</li>
<li>Install patches.</li>
<li>Validate configurations.</li>
</ul>
<h2>2. Promote and Practice &#8220;Digital Distancing&#8221;</h2>
Personal phones, tablets, laptops and smart assistants are a web of opportunity for bad actors. To foster digital distancing among remote workers:
<ul>
<li>Isolate work to a separate network on home routers.</li>
<li>Limit access privileges on home routers.</li>
<li>Decouple work systems from connected devices.</li>
</ul>
<h2>3. Stop Island Hopping</h2>
Attackers hop from home networks to corporate assets. To detect threats to employee systems and corporate networks in real time from the cloud:
<ul>
<li>Utilize endpoint detection and response for real-time device assessment and remediation.</li>
<li>Apply micro-segmentation for malware isolation and damage minimization.</li>
</ul>
<h2>4. Harden Systems Used for Sensitive Conversations</h2>
To protect execs and employees working with sensitive data:
<ul>
<li>Upgrade home-office routers.</li>
<li>Deploy an <a href="https://www.vmware.com/solutions/anywhere-workspace.html">Anywhere Workspace</a> solution that spans all devices.</li>
<li>Implement multi-factor authentication.</li>
</ul>
<h2>5. Make Tuesday &#8220;Security Night&#8221;</h2>
Routines lead to good habits. In addition to traditional patches, make Tuesday about <a href="https://www.vmware.com/remote-work-solutions.html">remote work security</a>:
<ul>
<li>Reinforce best practices.</li>
<li>Share security updates.</li>
<li>Offer recommendations.</li>
</ul>
Now more than ever, it’s important to implement such strategies to keep our systems secure—no matter where we work from.

Now more than ever, it’s important to keep our systems secure. Here are 5 steps that minimize security risks when working remote.

Security Alert! 5 Steps to Reduce Remote Work Risks

https://news-editor.vmware.com/wp-content/uploads/2021/05/5-Steps-to-Less-Risky-Remote-Work-Story-Feature-Image.png

Businesses today have a trust problem. Every single industry received a less than 50% ranking when <a href="https://www.mckinsey.com/business-functions/risk/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative">McKinsey</a> asked consumers which industries they trusted with their data. Healthcare and financial services were named the most trusted—but only by 44% of consumers. Other sectors had even more dismal trust ratings including retail (18%) and media and entertainment (10%).
The stakes are high. And it’s not just because the costs of a data breach are exceedingly high and growing. It also means lost business. The same McKinsey study revealed that 87% said they would not do business with a company because of security concerns.
Here are 10 things customers want organizations to be mindful of when it comes to trust:

core/gallery

<h2>1. Cybersecurity: Don’t Let Criminals Get My Data</h2>
Consumers want businesses to keep their data private and secure from bad actors, nation states and other cyber criminals. But data breaches and ransomware keep coming. A full 70% of organizations say they suffered damage to their corporate image following a breach, according to a recent Global Incident Response Threat <a href="https://cdn.www.carbonblack.com/wp-content/uploads/VMWCB-Inforgraphic-Defense-in-Depth-17-Keys-to-Protect-Against-Ransomware.pdf">report</a>. That’s not surprising as 81% of people in a consumer trust <a href="https://www.businesswire.com/news/home/20191022005072/en/81-of-Consumers-Would-Stop-Engaging-with-a-Brand-Online-After-a-Data-Breach-Reports-Ping-Identity">survey</a> said they would stop engaging with a brand online after a data breach.
<a href="https://www.vmware.com/security.html#:~:text=Intrinsic%20security%20is%20not%20a,to%20a%20position%20of%20strength.">Enterprise security</a> isn’t a product. It’s a strategy. A proactive security approach can help ease consumer concerns. It involves using existing infrastructure in real time—across apps, clouds and devices—to adapt as it protects data. By learning how to use what is already there in new ways, organizations can unify security and IT teams, and prevent, detect and respond to threats swiftly and effectively.
<h2>2. Internal Threats: Don’t Let Employees See My Data Without Good Reason</h2>
Outsiders aren’t the only threat to customer data. The 2020 Cost of Insider Threats <a href="https://www.observeit.com/2020costofinsiderthreat/">report</a> identified that insider threats grew by 47% between 2018 and 2020. Negligent employees were responsible for most of the events. It took 77 days on average to contain insider threats. Often, insider security issues arise when employees get access to data that they shouldn’t—or misuse their clearances and authority.
Strict role-based access to data with strong, multifactor authentication can help ensure that even the highest-ranked insiders cannot access data they don’t absolutely need.
<h2>3. Transparency: What Are Organizations Really Doing with My Data?</h2>
Another top concern among consumers is that they’re never quite sure how their data is being used. But almost half (48%) <a href="https://www.rsa.com/content/dam/en/misc/rsa-data-privacy-and-security-survey-2019.pdf">surveyed</a> by RSA believe legitimate reasons exist for companies to collect and use their data. Yet, people are still distrusting.
Companies should be very clear when telling consumers how their data is being used or shared with others. It’s a requirement of the European Union’s General Data Protection Regulation (GDPR) and other new privacy laws. For transparency, information needs to be prominently displayed, not buried in small text at the end of long consent statements.
<h2>4. Choice: Let Me Opt Out of Using My Personal Data</h2>
Consumers don’t feel they can effectively protect or control their own data. Many can’t figure out how to do it. Others feel they have no choice if they wanted to make use of an app, service or website. Some just don’t understand their choices.
Consumers want options spelled out clearly, in easy-to-understand language. And they want privacy regulators to ensure companies are doing what consumers direct them to do. Organizations need to give consumers crystal clear choices of what data they can collect and what they do with it—and then stick to their word in implementation.

<h2>5. Ease of Use: Don’t Make Security Too Intrusive</h2>
A majority of consumers (65%) are frustrated by login experiences, according to the Trust and Accountability in the Era of Breaches and Data Misuse survey by <a href="https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf">Ping Identity</a>. That’s because of arduous security practices. One-third of consumers stopped using a device, app or service after a bad experience.
Here’s the conundrum: consumers want their data kept secure. But they get impatient when strong authentication methods prevent them from doing or getting what they want quickly. Governments, healthcare and other organizations are moving to identity and single sign-on methods that ease this frustration.
<h2>6. Personalization: Don’t Be Creepy</h2>
Over the past decade, consumers have agreed to share their data with brands in return for better customer experience. Today, personalization is a part of consumers’ lives—from recommendation engines to pop up ads to social media engagement. But cynicism is creeping in. According to a <a href="https://www.accenture.com/_acnmedia/PDF-110/Accenture-See-People-Not-Patterns.pdf#zoom=50">study by Accenture</a>, of the consumers served ads they deemed as “too personal,” more than 71% said the ads possessed information that they had not directly shared.
Increasingly, companies need to find common ground with consumers to meet their mutual needs while keeping privacy top of mind. This of course will become more difficult as artificial intelligence, machine learning (AL/ML) and Internet of Things (IoT) technologies go mainstream—both at work and at home. The pervasiveness of emerging tech and what it can reveal about people challenges ethical standards of how companies treat consumer data. Just because something can be done, doesn’t mean it should be.
<h2>7. Compliance: At a Minimum, Meet Standards</h2>
Privacy laws and regulations are multiplying. Many organizations struggle to keep up. Less than half of firms (45%) <a href="https://www.isaca.org/privacy-in-practice-2021">surveyed recently said</a> they felt “very” or “completely” confident that they will be in compliance with all the new privacy mandates. Such mandates include the EU’s GDPR, the Federal Privacy Act in Australia, Cybersecurity Law in China, the proposed Personal Data Protection Bill in India, Lei Geral de Proteção de Dados Pessoais in Brazil, and more.
Consumers generally approve of privacy laws, challenging companies not only to comply but to let customers know how. The onus is on organizations then to go beyond putting privacy safeguards in place for legal reasons only and do it for ethical reasons. To take the high road, enabling customers to reward them for it.

<h2>8. Responsibility: If Something Happens, Own Up to It and Make Amends</h2>
Almost half (46%) of consumers <a href="https://www.mckinsey.com/business-functions/risk/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative">told McKinsey</a> that companies that proactively report a hack or a breach gain their trust. Only slightly more important (50%), they said, was to act quickly to mitigate the effects of the breach.
The last thing a business should do is try to keep a breach secret. The truth always comes out—in investigations both criminal and civil. Organizations need to be upfront when they are exploited. Explain what is being done to mitigate the damage, and what help; resources; and if appropriate, compensation; will go to victims.
<h2>9. Innovation: Stay on Top of the Latest Security Technologies and Best Practices</h2>
Nothing begets trust as much as competence. Consumers want to know that teams are taking a modern approach to security and are aware of the latest security trends. Many cybercriminals are well funded. Most are innovative. It takes a nimble and savvy security team to keep up with them.
Consumers know this. And because customers want to shop with and employees want to work for brands that prioritize data privacy, they will follow the innovation. That means organizations must put proactive remediation in place. Attend cybersecurity webinars and events to stay abreast of new developments. Check vulnerability alert feeds. Patch systems immediately—and automate patching if possible, and more.
<h2>10. Due Diligence: Vet Partners Better to Ensure Strong Security Practices</h2>
In today’s interconnected world, a company is only as secure as its weakest link. <a href="https://www.carbonblack.com/resources/the-rise-of-island-hopping-and-counter-incident-response/">Island hopping</a> is trending up. That’s when an<a href="https://news.vmware.com/subscribe"><img loading="lazy" class="alignright wp-image-24111 " src="https://news-editor.vmware.com/wp-content/uploads/2021/04/RADIUS-Digest-Square-CTA-150x150.png" alt="" width="230" height="198" /></a> organization is attacked by a vendor through regular communications systems and mined for personally identifiable information and other opportunities to attack. Consumers are acutely aware that large ecosystems put their privacy at greater risk.
Reassure customers by having very public policies about rigorously investigating the security stances of everyone involved in doing business with the brand. Explain the ways that consumers’ data is kept safe with suppliers and distributors and other partners that touch systems, whether directly or indirectly.
<h2>Trust Is Precious. Don’t Waste It</h2>
Consumer trust, once lost, is difficult to regain. Consumers are getting savvier about knowing how much data about them exists in cyberspace, and are increasingly vocal about wanting more ethical, respectful and legal use of that data. Understanding what customers mean by trust helps organizations meet consumers’ increasingly stringent expectations of privacy and avoid losing the loyalty that every brand seeks.

Consumer trust, once lost, is difficult to regain. Here's what customers want organizations to be mindful of when it comes to trust.

https://news-editor.vmware.com/wp-content/uploads/2021/05/what-trust-means-to-consumers-Story-Feature-Image.png

VMware Enables Greater Security and Business Resilience for the Modern, Distributed Enterprise - VMware News and Stories

https://news-editor.vmware.com/wp-content/uploads/2021/05/index.png

VMware Named a Leader in Endpoint Security Software As A Service by Global Analyst Firm - VMware News and Stories

https://news-editor.vmware.com/wp-content/uploads/2021/05/Carbon-Black.png

The modern bank heist has escalated to a hostage situation over the past year. The new goal of attackers is now to hijack a financial institution’s digital infrastructure and to leverage that infrastructure against a bank’s constituents. As the world shifted to an anywhere workforce amid the pandemic, we witnessed attacker strategy evolve, becoming much more destructive and sophisticated than ever before.
In the fourth annual <a href="https://www.carbonblack.com/resources/modern-bank-heists-2021/" target="_blank" rel="noopener">Modern Bank Heists report</a>, we interviewed 126 CISOs, representing some of the world’s largest financial institutions, regarding their experiences with cybercrime campaigns. Given the nature of its business, the financial sector has established robust security postures and fraud prevention practices. However, they are facing an onslaught of sophisticated cybercrime conspiracies. <a href="https://www.carbonblack.com/press-releases/modern-bank-heists-threat-report-from-vmware-carbon-black-finds-dramatic-increase-in-cyberattacks-against-financial-institutions-amid-covid-19/" target="_blank" rel="noopener">Attacks against financial institutions more than tripled last year</a>. This stark reality can be attributed to the organized nature of cybercrime cartels and the dramatic increase in sophisticated cyberattacks. The goal of this year’s report was to understand how offense should inform the financial sector’s defense.
Here’s an overview of some key findings.
From Heist to Hostage
Thirty-eight percent* of financial institutions experienced an increase in island hopping, escalating a heist to a hostage situation. Cybercrime cartels understand the interdependencies of the sector and recognize that they can hijack the digital transformation of the financial institution to attack their customers. They use brand trust (oftentimes, trust that’s been built up over hundreds of years) against the bank’s constituents by commandeering its assets.
Increased Geopolitical Tension and Counter IR Triggering Destructive Attacks
There’s been a 118% increase in destructive attacks as we see geopolitical tension play out in cyberspace. Russia, China and the U.S. underground posed the greatest concern to financial institutions. It is also worth noting that cybercriminals in the financial sector will typically only leverage destructive attacks as an escalation to burn the evidence as part of a counter incident response.
The Digitization of Insider Trading
Fifty-one percent of financial institutions experienced attacks targeting market strategies. This allows for the digitization of insider trading and ability to front-run the market, which aligns with the strategies of economic espionage.
Cybercriminals Launch Chronos Attacks
Forty-one percent of financial institutions observed the manipulation of time stamps. This is occurring within a sector that’s incredibly dependent on time given the nature of its business. Because there’s no way to insulate the integrity of time once deployed in a time stamp fashion, this Chronos attack is quite pernicious.
As the threat landscape evolves, so will the tactics, techniques and procedures of cybercrime cartels, as seen in the above findings.
These groups have become national assets for the nation-states who offer them protection and power. In tandem with this, we’ve seen traditional crime groups digitize over the past year as the pandemic hampered them from conducting business as usual. This has popularized the industry of services provided by the dark web, increased collaboration between cybercrime groups, and ensured cyber cartels are now more powerful than their traditional organized crime counterparts. 
So, How Should the Financial Industry Respond?
To start, here are a few strategies for security teams:
<ul>
<li>Conduct weekly threat hunting and normalize it as a best practice to fuel threat intelligence. We were happy to hear from the CISOs we spoke with that 48% already conduct weekly threat hunts.</li>
<li>Integrate your network detection and response with your endpoint protection platforms.</li>
<li>Apply “just in time” administration.</li>
<li>Deploy workload security.</li>
</ul>
The game has changed and so must the financial sector’s security strategy. Safety and soundness will only be maintained by empowering the CISO. 2021 should be the year that CISOs report directly to the CEO and be given greater authority and resources.
Bob Parisi, head of cyber solutions, North America, Munich Re, echoed the importance of up-leveling the role of the CISO as cyberattacks surge.
“The report’s findings around an increased level of destructive attacks and island hopping makes it clear that financial institutions remain in the crosshairs,” Parisi said. “VMware’s recommendation that CISOs should be elevated to C-level aligns with the fact that cyber risk is an operational risk that needs to be managed across a spectrum of technology, process and people, including the use of financial instruments like cyber insurance.”
It’s no longer a matter of if, but when the next SolarWinds will occur. As a result, cybersecurity must be viewed as a functionality of business versus an expense. Trust and confidence in the safety and soundness in the financial sector will depend on it.
To learn more, download the full report: <a href="https://www.carbonblack.com/resources/modern-bank-heists-2021/" target="_blank" rel="noopener">Modern Bank Heists 2021</a>.
*Note: This excludes SolarWinds.

Tom Kellermann

Financial institutions are facing an onslaught of sophisticated cybercrime conspiracies.

Modern Bank Heists: Financial Institutions Are Being Held Hostage

Fourth Annual Modern Bank Heists Report

PALO ALTO, Calif.&#8211;(BUSINESS WIRE)&#8211;VMware, Inc. (NYSE: VMW), a leading innovator in enterprise software, today announced that Sanjay Poonen, VMware’s chief operating officer, customer operations will present at the UBS Virtual Summit on Cloud &#038; Infra Security Convergence on Wednesday, March 31, 2021 at 9:45 a.m. PT/ 12:45 p.m. ET.
A live webcast will be available on VMware’s Investor Relations page at <a rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&#038;url=http%3A%2F%2Fir.vmware.com&#038;esheet=52397841&#038;newsitemid=20210318005199&#038;lan=en-US&#038;anchor=http%3A%2F%2Fir.vmware.com&#038;index=1&#038;md5=7ebefb71fcd956f56897b3d41c492609" shape="rect">http://ir.vmware.com</a>. The replay of the webcast will be available for two months.
 About VMware
VMware software powers the world’s complex digital infrastructure. The company’s cloud, app modernization, networking, security, and digital workspace offerings help customers deliver any application on any cloud across any device. Headquartered in Palo Alto, California, VMware is committed to being a force for good, from its breakthrough technology innovations to its global impact. For more information, please visit <a rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&#038;url=https%3A%2F%2Fwww.vmware.com%2Fcompany.html&#038;esheet=52397841&#038;newsitemid=20210318005199&#038;lan=en-US&#038;anchor=https%3A%2F%2Fwww.vmware.com%2Fcompany.html&#038;index=2&#038;md5=6414b30d53036301dd2f9a5d2495333a" shape="rect">https://www.vmware.com/company.html</a>
 Additional Information
VMware&#8217;s website is located at <a rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&#038;url=http%3A%2F%2Fwww.vmware.com&#038;esheet=52397841&#038;newsitemid=20210318005199&#038;lan=en-US&#038;anchor=www.vmware.com&#038;index=3&#038;md5=1a6a963b78c184ce18d707fd3078e9e3" shape="rect">www.vmware.com</a>, and its investor relations website is located at <a rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&#038;url=http%3A%2F%2Fir.vmware.com&#038;esheet=52397841&#038;newsitemid=20210318005199&#038;lan=en-US&#038;anchor=http%3A%2F%2Fir.vmware.com&#038;index=4&#038;md5=8008f6084b08cb075aee3a8c643b2fe7" shape="rect">http://ir.vmware.com</a>. VMware&#8217;s goal is to maintain the investor relations website as a portal through which investors can easily find or navigate to pertinent information about VMware, all of which is made available free of charge. The additional information includes materials that VMware files with the SEC; announcements of investor conferences and events at which its executives talk about VMware&#8217;s products, services and competitive strategies; webcasts of our quarterly earnings calls, investor conferences and events (archives of which are also available for a limited time); additional information on VMware&#8217;s financial metrics, including reconciliations of non-GAAP financial measures to the most directly comparable GAAP measures; press releases on quarterly earnings, product and service announcements, legal developments and international news; corporate governance information; and other news, blogs and announcements that VMware may post from time to time that investors may find useful or interesting.
 <img alt="" src="https://cts.businesswire.com/ct/CT?id=bwnews&#038;sty=20210318005199r1&#038;sid=acqr8&#038;distro=nx&#038;lang=en" style="width:0;height:0"> 
 View source version on <a href="http://businesswire.com">businesswire.com</a>: <a href="https://www.businesswire.com/news/home/20210318005199/en/" rel="nofollow">https://www.businesswire.com/news/home/20210318005199/en/</a> 
Sandra Kerrigan VMware Investor Relations <a rel="nofollow" href="mailto:skerrigan@vmware.com" shape="rect">skerrigan@vmware.com</a>
Michael Thacker VMware Global Communications <a rel="nofollow" href="mailto:mthacker@vmware.com" shape="rect">mthacker@vmware.com</a>
Source: VMware, Inc.

VMware to Present at the UBS Virtual Summit on Cloud & Infra Security Convergence - VMware News and Stories

https://news-editor.vmware.com/wp-content/uploads/2021/09/300DPIxZoom-screen-2-04.jpg