Category Archives: Cloud security

Celebrating more industry recognition as the cloud security leader

by Ross Baker

At Trend Micro we’ve spent the past three decades and more honing our threat protection capabilities to make the connected world a more secure place. But we also know that our company can’t work in isolation to make this happen. That’s what makes industry partnerships so crucial — and they don’t come much more important than in the cloud space, where so much business-critical data is stored these days.

That’s why we’re delighted to have just been awarded 2019 Google Cloud Technology Partner of the Year for Security. It’s testament to our ongoing leadership in the space and commitment to simplicity and close integration for optimised cloud security.

Continue reading

How to beat cloud misconfiguration: Trend Micro @ Cloud Expo Europe

By Bharat Mistry

Cloud adoption is moving pretty fast. So fast, in fact, that sometimes organisations roll-out infrastructure without being able to fully support their end of the shared responsibility model. The bad news is that the vast majority of incidents still go unnoticed. That’s a compliance timebomb waiting to go off.

Fortunately, we have an answer. At Cloud Expo Europe this month, Trend Micro’s Cloud Security Architect, Ian Heritage, will be taking to the stage to explain all.

Clouds are everywhere
There was a time not so many years ago when the public cloud was only for the early adopters. It’s safe to say we’re well beyond that point now. In fact, Gartner predicts that the public cloud services market will grow 17% in 2020 to top$266 billion, and continue on to reach nearly $355 billion by 2022. 

However, as more firms build out hybrid cloud environments from multiple vendors, complexity rises. And as it does so, in-house teams find it increasing difficult to stay on top of the multiple competing protocols, policies and platforms they must manage. Sometimes they’ll have brought in different security vendors, which can create further complexity and allows coverage gaps to appear. 

Complexity means mistakes
The end result is inevitable: mistakes get made that can leave cloud data stores unprotected. You don’t have to go far to find an example. Whether it’s an online Elasticsearch database a MongoDB instance or an AWS S3 bucket, configuration incidents have impacted defence contractors like Boeing, big-name brands like Honda, and a whole host of companies and service providers in between.

The worrying news for CISOs is that, whereas over the past few years such leaks have usually been found and responsibly disclosed by security researchers, cyber-criminals are now starting to take notice. A growing number of cases have seen hackers probe for unsecured cloud databases, steal the data and hold it to ransom. One report even suggested that Magecart hackers are getting in on the act by trying to seed malicious digital skimming code in misconfigured buckets.

A cloud misconfiguration was also technically to blame for the mega-breach at Capital One which exposed data on 100 million customers and applicants.

Trend Micro at Cloud Expo
The cost to organisations could be massive. One vendor claims that over 33 billion records were exposed in leaks due to cloud misconfigurations in 2018 and 2019.

Fortunately, Trend Micro’s Cloud Conformity offers a solution: a cloud security posture management (CSPM) platform providing continuous monitoring, alerts and remediation of AWS and Azure environments. It will flag when configuration errors have been made and offer simple steps to get you back on track, all from a single pane of glass.

Join our Cloud Security Architect, Ian Heritage, at Cloud Expo Europe this month to hear how you can tackle the challenge of cloud misconfiguration, and in so doing drive DevOps and business growth. 

What: Cloud Misconfiguration Causes Breaches—How to Avoid it: Ian Heritage, Cloud Security Architect, Trend Micro. At Cloud Expo Europe.
Where: ExCel London, Keynote Theatre
When: Thursday, 12 March, 2020. 11.10-11.30 

Securing our cloud-connected world in 2020

By Ross Baker

It’s been a tough year for CISOs. The past 12 months has seen another spike in data breaches, cloud misconfigurations, and security threats at a DevOps layer. Ransomware is up, filelessmalware is on the rise, and business email compromise continues to increase. Trend Micro alone blocked over  26.8 billion unique threats in the first half of the year. With no let-up in store for 2020, cybersecurity leaders need to ensure they work with trusted partners — vendors with a clear vision of the future.

Continue reading

As Server 2008 is retired, there’s an obvious alternative to Microsoft extended support

By Ross Baker

On the 14th of January 2020, Microsoft will be retiring its popular Windows Server 2008 and Server 2008 R2 products. This leaves businesses with a difficult choice: stick with the OS and pay for expensive extended support, spend time and resources on migration, or leave the company exposed to cyber-threats.

The good news is that there’s a better, lower cost option that will enable you to keep running Server 2008 whilst mitigating cyber risk and avoiding major disruption – invest in comprehensive server security.

Wait-and-see won’t do
Speaking to numerous businesses over recent weeks, a worryingly high number are prepared to adopt a wait-and-see policy (WASP) following the end of Server 2008 support on 14 January 2020. This amounts to an extreme hedging of bets and something we would definitely not recommend.  

Without Microsoft support, customers will no longer have access to security updates for Windows 2008. Unsupported servers will become be exposed to attacks exploiting vulnerabilities found after January 2020. This is more likely than you think: the black hats know there will be many organisations that may be running exposed servers and will be putting more resources into finding these bugs.  

To make matters worse, Microsoft will continue to release fixes for vulnerabilities in current versions of its server OS products which may also affect Server 2008. That’s an open goal for a hacker.

What are the alternatives?
One way out of this bind is to pay for Microsoft extended support, which will deliver security updates beyond the retirement deadline. But be warned, this is not cheap. An analysis of Microsoft’s End of Service FAQs from CRN reveals:
• The cost of Extended Security Updates will be 75% of the Enterprise Agreement or Server & Cloud Enrolment license prices of the latest version of SQL Server/Windows Server
• Firms will be covered for three consecutive 12-month increments following end-of-support, but must pay up-front for the first year
• Organisations that sign-up in the middle of a year must pay for the full year
• Companies that decide not to sign-up for a year and then do so the following year must pay for both years

Why go through all this when there’s an easier and more cost-effective alternative? 

Trend Micro Deep Security features a next-generation intrusion prevention system known as “virtual patching” to protect servers and endpoints from threats that target vulnerabilities in critical applications. It will keep your Windows Server 2008 systems safe even from zero-day threats that Microsoft hasn’t yet encountered.  Virtual Patching will also:

Buy additional time: for security teams to assess vulnerabilities and test and apply the necessary patches. 

Avoid unnecessary downtime: by allowing enterprises to patch according to their own schedule. This mitigates the potential revenue loss caused by unplanned disruptions.

Improve regulatory compliance: such as Cyber Essentials and the Payment Card Industry Data Security Standard (PCI-DSS).

Provide flexibility: by reducing the need to roll-out workarounds or emergency patches. 

Given the current threat landscape, WASP is simply not a risk worth taking for your organisation. Whether you need to stick on Windows Server 2008 for financial reasons or because of legacy application support, look to third-party virtual patching to minimise cyber risk and support your business beyond January 2020.

Find out more and how much you could save by visiting https://resources.trendmicro.com/uk-windows-server-end-of-support.html and try out our Windows 2008 End-of-Support Cost Savings Calculator.