Active Defense

Earlier this month, we witnessed ( Reuters, TechCrunch, Washington Post, CNN etc. ) the US Department of Energy, several other government agencies, banks and other commercial organizations were hit in a global hacking campaign that exploited a vulnerability in widely used file-transfer software called MOVEit by Progress Software.

As discussed in this whitepaper, the MITRE ATT&CK framework is a critical technology resource that can help you systematically evaluate your security measures against the potential threats you may encounter. Understanding the weaknesses in your current cybersecurity posture is a crucial step in protecting your digital assets.

Today, Honeywell and Acalvio announced the launch of Honeywell Threat Defense Platform (HTDP) Powered by Acalvio. HTDP brings a new approach in the ongoing effort to secure Operation Technology (OT) networks including those networks running the health and safety systems in the buildings where we live, work and play. In a recent report, “Protecting Operational Technology in Facilities from Cyber Threats”, Honeywell notes that less than half (44%) of surveyed facility managers “have a cybersecurity system in place to protect their OT systems from potential threats”. This new partnership with Acalvio brings the most advanced form of cyber defense, known as Active Defense, to the security portfolio of Honeywell Building Technologies (HBT). For those without a cyber defense system, HTDP provides state-of-the-art capabilities for your initial foray into cyber security. For those with a cyber security program, well, your building’s defenses have just received a significant upgrade!

Today we are pleased to announce that Acalvio’s cloud-based ShadowPlex Active Defense platform has been awarded FedRAMP Ready status by the US Government’s General Services Administration. This award demonstrates to federal agencies, and the broader security community, Acalvio’s commitment to offering threat management solutions for even the most demanding environments. ShadowPlex is the first Deception solution to attain FedRAMP Ready status in the FedRAMP Marketplace, which gives federal agencies the assurance they need to proceed with evaluations or initial purchases of our solution. FedRAMP was initiated in 2011 as a national government-wide program to define mandatory security standards for cloud services. The intent was to accelerate federal government cloud adoption by establishing a marketplace for secure cloud service providers (CSPs). “FedRAMP Ready” requires CSPs to submit to an audit of dozens of security controls by an authorized third-party auditor (3PAO). The controls are under NIST 800-53 guidance, one of the most stringent controls sets in existence. “The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector”, says President Biden’s May 2021 Executive Order. FedRAMP has been tasked with Federal cloud-security strategy for Cloud Services. Federal agencies are under constant attack and require Active Defense strategies that go beyond passive approaches Acalvio ShadowPlex not only adheres to the strict FedRAMP security controls, but also helps implement stronger cyber security standards for Federal departments and agencies by providing Active Defense. Acalvio has passed the control evaluation at the FedRAMP Moderate level for our SaaS-based ShadowPlex Deception service, placing us in Ready status. The 3PAO has attested to our security capabilities, and a Readiness Assessment Report has been reviewed and deemed acceptable by the FedRAMP Program Management Office. We invite federal agencies and other public sector entities to trial and deploy the solution with confidence.

That just focusing security defenses on the most common means of penetrating an organization doesn’t cut it. Sure, you should guard against phishing, fortify your DMZ and Internet-facing applications, train your staff, and so on. That will at least give you a credible response if you get hacked and you’re asked what you were doing to prevent it (which I admit is nothing to sneeze at!). However as we’ve seen, that won’t keep you safe.

If you’re reading this blog, you likely know the basics of the cyber kill chain. You might even be able to name a few of the seven stages in the kill chain, which lays out the steps adversaries take to attack and exploit their victims. Where you might have a lot more difficulty is in explaining two things: how attackers actually execute these steps, and what you’re doing to detect and mitigate them.