One Platform, End-to-End Cybersecurity

Like any smart entrepreneur, threat actors know that their business is only as successful as their latest innovation. And when it comes to parting unsecured organizations from their money, those innovations never stop. The latest involves integrating attacks into a ransomware-as-a-service (RaaS) portfolio to create the so-called triple cyber extortion attack. It’s a little bit ransom, a little bit DDoS extortion, and a lot of trouble. Here’s how it works: File encryption With the traditional ransomware attack method, cybercriminals breach a network and encrypt valuable data, making it (and sometimes the entire system) unavailable to the victim organization. The attackers then demand payment in return for a decryption key. Data theft Here, cybercriminals exfiltrate the data before locking the victim out. They then threaten to expose and/or sell the stolen data publicly unless paid. This second level of extortion makes it harder for victims to ignore ransomware threats, because even those who can use backups to restore data remain at risk of data exposure. DDoS attacks Commonly used as a standalone extortion method, DDoS attacks now are on the list of services RaaS operators offer. This further ratchets up the pressure on the victim in a couple of ways: First, it emphasizes the seriousness of the adversary. And second, maintaining availability also adds another stressor to a security team already dealing with the first two events. By combining file encryption, data theft, and DDoS attacks, cybercriminals have essentially hit a ransomware trifecta designed to increase the possibility of payment. According to NETSCOUT’s latest Threat Intelligence Reports, in 2021 cyberattackers launched three worldwide, distributed denial of service (DDoS) extortion attack campaigns – a startling new achievement carried out by a REvil copycat, Lazarus Bear Armada (LBA) and Fancy Lazarus. From the threat actor’s perspective, adding DDoS attacks to a list of ransomware services is a smart business move. DDoS attacks are incredibly cheap and easy to launch, and they might increase the chance that a victim will pay. What’s not to like? After all, this is a very lucrative business, and bad actors are constantly adding new weapons to their multi-faceted attack campaigns. The good news is that stopping DDoS extortion attacks can be done with the right preparation in place. That is for volumetric attacks (larger than your Internet circuit) you need a cloud-based DDoS attack protection service such as one from your ISP or NETSCOUT Arbor Cloud. For smaller attacks, more specifically those that target application servers (e.g., web, DNS, mail, servers) or stateful infrastructure (e.g., firewalls, load balancers or VPN concentrators) the best approach is an on-premises, stateless DDoS solution such as NETSCOUT Arbor Edge Defense, that fronts this infrastructure. The combination of cloud-based and on-premises protection offers the industry best practice in DDoS defense. But how do you stop the other two facets of cyber extortion (e.g., data theft and ransomware encryption)?The answer is to look for early signs of reconnaissance, IoCs, lateral movement or data exfiltration that precede the dropping of ransomware as well as data breach and exfiltration. This requires comprehensive network visibility into north-south and east-west traffic. NETSCOUT’s Omnis Cyber Intelligence (OCI) is such a solution. OCI is a network-based cybersecurity solution that integrates with and fills the gaps left by other cybersecurity tools- namely Network Detection and Response (NDR) tools. OCI and CyberStream sensors support all types of network environments (e.g., legacy, virtual, private, public cloud), speeds (up to 100 Gbps), and hundreds of protocols and applications. This enables security teams to gain comprehensive network visibility across their entire digital infrastructure – a fundamental requirement for effective cybersecurity because you can’t protect yourself from what you can’t see. Omnis Cyber Intelligence provides security teams with an unmatched, continuous, robust source of packets and layer 3-7 metadata that are used for more effective and comprehensive network visibility, real-time cyber threat detection, as well as rapid and highly contextual investigation. The Four Main Use Cases for Omnis Cyber Investigator are: Early Warning System OCI is continuously monitoring packet-derived metadata looking for reconnaissance, IoCs or anomalous traffic and application behaviour that are signs of a future attack (e.g., a ransomware attack). Continuous Attack Surface Monitoring OCI has visibility into all network and traffic (e.g., east/west and north/ south traffic). Leveraging NETSCOUT’s patented ASI technology OCI can reconstruct the network attack surface within seconds of any change and detect vulnerabilities that may pose a threat (e.g., looking for anomalous network activity that indicates a network or data breach). Contact Tracing Since OCI knows all network communication inside and outside an organization’s network, it uses this intelligence to detect or investigate short-term lateral movement and stop the attacker before a data breach or ransomware attack occurs. Back-in-Time Investigation Detecting and investigating long dwell time attacks (e.g. more than 6 months) is difficult. OCI can conduct a retrospective analysis of NETSCOUT’s ASI-derived Smart Data with high fidelity and context, looking for evidence of a network or data breach that may have occurred months or even a year ago. Upon detection of such threats with Omnis Cyber Intelligence, the information gathered can be used to configure blocking devices on the network edges such as firewalls, or even better Arbor Edge Defense to stop the proliferation of attacker inside the environment before the data breach or ransomware attack occurs. The threat of triple extortion is real. You can rely upon NETSCOUT Arbor Edge Defense and Omnis Cyber Intelligence solutions to stop it before it’s too late. For more information, get in touch with your Help AG account managers, and we can have a detailed discussion. Bridging network and security operations requirements. Optimized Vulnerability Scanning Scheduling Assures Server Environment Performance. Overview This financial services leader successfully processes millions of business transactions every day, which has helped make the company a household name. This company is a long-time NETSCOUT customer, years ago standardizing on nGeniusONE as their service assurance platform of choice. The company had widely deployed InfiniStreamNG (ISNG) smart data sources and nGenius Packet Flow Switches (PFS) to provide service edge visibility across their network, with additional service assurance operations guidance provided by their contracted NETSCOUT Premium Support Services (PSS) engineering resources. Challenge Given the nature of this company’s business, regular Security Operations (SecOps) scanning to assure the environment was free of vulnerabilities was understandably an area of intense focus. The work-from-home (WFH) business era has seen exponential increases in cyberthreat attacks for all global companies, and the SecOps team wanted to take additional measures to safeguard the company’s server environment. In this case, SecOps wanted to increase the vulnerability scanning cadence to include weekday scheduling, during non-peak hours, in addition to its standard weekend processes. Traditionally, SecOps scanning had been coordinated to run on weekends using their industry-leading vulnerability reporting tool. This practice allowed vulnerability scanning to be conducted when network traffic volumes were lower, and bandwidth was readily available to accommodate the workloads that Network Operations (NetOps) believed were required for this SecOps testing. Adding vulnerability scans during off-hours Monday through Friday would simply offer more opportunities for SecOps to assure the security of their server environment. With more than 1,000 host servers operating across their environment, receiving executive endorsement of this modified testing plan was a major SecOps priority. For their NetOps colleagues, however, there was concern any weekday testing would impair performance of regular, daily business workloads by introducing additional network traffic that would be traveling across the network and through firewalls. Since this is truly a global business, “off-hours” in one geography are still “business hours” in another. As a result, when SecOps appealed to IT leadership to reconcile this issue, there was an identified need for network traffic modelling, analysis, and reporting that would provide the evidence necessary to assure NetOps that this modified testing schedule would not unnecessarily consume bandwidth or impact application responsiveness. In response, IT leadership agreed to a one- month trial of this modified vulnerability scanning approach to determine whether additional SecOps server testing cycles would hinder network performance. The company has reliably used nGeniusONE analytics and ISNG appliances for smart visibility to assure business performance across its enterprise environment, so approaching their long-time NETSCOUT PSS Engineer to assist them during this month- long trial was a logical extension of a strong track record in troubleshooting other service delivery issues. By using the NETSCOUT production environment, the PSS Engineer collaborated with IT Operations to visualize vulnerability scanning traffic, with real-time nGeniusONE service dashboard and monitor views into client/server performance that showed associated bandwidth consumption. In doing so, IT Operations and PSS took advantage of NETSCOUT smart visibility views across several service edges, including data center (which included firewalls, load balancers, and service enablers, as well as the host server environment) and network edges. Using NETSCOUT smart data (generated in real-time by ISNG smart visibility sources monitoring application packets from the company’s network traffic), nGeniusONE contextual views factored the multi-tier infrastructure, including MIB2 interfaces and firewall environments. This nGeniusONE performance snapshot enabled IT Operations to visualize how applications and servers at two key data centers handled the vulnerability scanning workload during a 10.00 PM to 05.00 AM schedule being used as a trial for modelling the vulnerability scanning’s performance impact. Through analysis and trend reporting conducted over the course of the month, as well as real-time monitoring occurring on a daily basis, IT Operations could view traffic impacts as scanning tests started and when network consumption peaked. This vendor-neutral analysis with nGeniusONE throughout their enterprise showed what SecOps had hoped – there was no major associated network load with vulnerability scanning during weekday “off hours.” Results The company’s earlier investments in NETSCOUT technology and consultative PSS Engineering resources enabled the collective IT Operations teams to benefit from informed decision-making about how increased vulnerability scanning practices would impact network operations – thus, the additional weeknight scans for its server network provided enhanced assurance that the business service and data center operations environment was running with integrity and better protected from cyberthreats. For more information about NETSCOUT network performance management solutions, please visit the website or get in touch with your account manager.

Help AG's Cybersecurity Analysis team has over 120 zero-day findings to its credit, placing it amongst the leading forces in UAE for cybersecurity research. The team has been conducting security assessments on various network infrastructures and has observed many attack vectors being deployed by black hat hackers. But some of the major weaknesses we see in organizations are mainly centered around the human factor, misconfiguration of default credentials, and missing patches. To make cybersecurity even more challenging, there are currently trends of Ransomware as a Service (RaaS).RaaS is a subscription-based approach that allows attackers to use already developed ransomware to execute attacks against their targets, which is increasing the scale of the attack. One of the players of the RaaS model delivery is DarkSide which provides professional operation and support to its users. Simple mistakes and the misjudgment of security has led many organizations to see huge losses to their financial assets, whether it is the result of a ransomware demand or service downtime. We have all witnessed what can happen when essential commodities are not available. In one instance, the fuel shortages that resulted from the ransomware attack that hit Colonial Pipeline caused havoc in the US. Another example is when REvil ransomware attackers managed to cause a huge ransomware spread across the web demanding around USD 70M. These incidents are an indication that cyberthreats are increasing and it is not cheap to deal with them. The combination of ransomware and availability is an issue in cyber connected networks that will cause a huge difference in our day-to-day operations as we are all becoming more interconnected. Organizations will continue to be attacked by targeted campaigns or large-scale attacks, but to defend against those attacks and ever-evolving threats, it is highly recommended to follow these precautionary steps: Perform regular patch management and updates Keep track of IT assets Perform regular cyber hygiene trainings against phishing attacks Conduct quarterly penetration testing on both internal and external networks If an organization or entity is operating in the financial sector, it should include Red Teaming at the top of their infrastructure penetration testings Change default passwords to more complex passwords Enable Multi Factor Authentication (MFA) for your organization users, even for personal login pages Don't use company laptop for personal purposes Our final advice is to never underestimate an attack, vulnerability or exposure of information as it can be a doorway for attackers to significantly ham your organization. Most exploited vulnerabilities CVE-2021-34527 - Print Nightware Vulnerability Impact Q2 of 2021 saw another devastating attack against Microsoft services which are actively used by end users and severs. This vulnerability affected the Pint Spooler service which allowed the attackers to un commands and preform remote code execution with system privileges. This one vulnerability alone could bring down the operation of IT or cause huge changes on the network. Remediation It is highly recommended to install the updates released by Microsoft as well as preform the tweaks on the critical severs or workstations. Registry settings to be set to 0 or not defined: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Pinters\PointAndPint NoWaningNoElevationOnInstall = 0 (DWORD) or not defined (default setting) UpdatePromptSettings = 0 (DWORD) or not defined (default setting) Option 1 - Disable the Pint Spooler service Stop-Sevice -Name Spooler -Force Set-Sevice -Name Spooler -StatupType Disabled Option 2 - Disable inbound remote printing through group policy In the group policy: Computer Configuration / Administrative Templates / Printers Disable the “Allow Pint Spooler to accept client connections:” policy to block remote attacks. For more information, visit this link. CVE-2021-26855-8 and 2021-27065 - MS Exchange Remote Code Execution Impact Another set of vulnerabilities was around one of the most critical services, MS Exchange Severs, which allow the remote attacker to perform code execution via a combination of multiple attacks on the severs. This also enables the attacker to create a backdoor or implant ransomware on the target affected systems. Remediation It is important to install the Microsoft release patch on the severs and follow guidelines set by Microsoft. CVE-2021-21972 – vSphere Remote Code Execution Impact The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Sever plugin. A malicious actor with network access to pot 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Sever. Remediation It is important to install the patch and updates from the vendor. CVE - 2021-1366 - AnyConnect Code Execution Vulnerability This was a vulnerability on a Cisco AnyConnect protect. The vulnerability is executed by crafting IPC message to AnyConnect Process. To execute this attack, the valid credentials must be obtained by an attacker. Remediation Currently there is no workaround, but an advisory and a patch are available. CVE-2021-33739 - MS DWM Core Library LPE Impact Here we are shifting away from Remote Code Executions to Local Privilege Escalation for a change. There has been a new working attack against MS DWM Core Library which would allow the attacker to execute commands with higher privileges. To perform this attack, the attacker must have a low level privileged access to the system.

The world is changing rapidly and so is our internet usage. Traditionally, the internet was all about browsing websites which have now changed majorly to the usage of SaaS applications. HTTP browsing has changed to 90% of HTTPS traffic and API communication. On-prem apps hosted in the customer's data center are moving to public clouds like AWS, Azure, and Google Cloud. Web-based attacks over the years have gained prominence with adware, malware, and phishing on the rise. The below chart indicates the rise in phishing sites as per Google until Jan 2021. Remote working has only made this problem worse. As per a repot from Kaspersky, Bute force attacks on RDPs (Remote Desktop Protocol) skyrocketed to 3.56 billion globally and reached 15.8 million in the UAE alone. Adversaries are always ahead in adopting the technological curve, and thus we see the usage of modern technologies in the way hackers plan attacks. Increasing crackdown on phishing and malicious sites is making it harder for hackers to attack and thus adversaries are finding new ways to lure victims. One of the prominent ways is the usage of cloud and SaaS services. Instead of using new domains and URLs, now adversaries use cloud services like AWS/Azure/GCP and SaaS apps like Box, Webmail, OneDrive, etc. to preform malicious activities. Most organizations do not block these trusted apps and thus fall victim to these attacks. Cloud-delivered campaigns could be used against any user regardless of what type of device they are on. Campaigns with that type of flexibility often have a greater chance of success, especially if they hit a target on a mobile device where it is harder to spot phishing attacks. Adversaries craft these attack campaigns utilizing cloud apps primarily for four objectives: Delivery: Cloud service is used to deliver malware or host a phishing page Examples from recent past: 18 Jun 2021 - Using Google Docs In this campaign, attackers used Google Docs to host a phishing page. As most of the organizations do not block Google Docs, the phishing page was accessible, and a lot of victims fell prey to these attacks. 12 Jan 2021 - Using Coronavirus-related info as a lure In this incident, targeted users are redirected to a Google Form landing page hosting the malicious website. A legitimate Google–registered URL can often convince even security-conscious users into handing over their information. The aesthetics of this campaign are solid and simple enough to reach users in environments protected by secure email gateways (SEGs). Exploitation: The cloud service is exploited to steal data, or launch other attacks Examples from recent past: 10 June 2021 - EA games were hacked using Slack The process stated by purchasing stolen cookies being sold online for $10 and using those to gain access to a Slack channel used by EA. 9 June 2021 - Crypto-mining attacks on Azure Kubernetes clusters Microsoft wans of an ongoing series of attacks compromising Kubernetes clusters running Kubeflow machine leaning (ML) instances to deploy malicious containers that mine for Monero and Ethereum cryptocurrency. 2 May 2021 - Microsoft wans of increasing OAuth Office 365 phishing attacks An application-based attack variant was observed where the attackers attempt to tick targets into providing malicious Office 365 OAuth apps (web apps registered by the attackers with an OAuth 2.0 provider) with access to their Office 365 accounts. 30 Mar 2021 - Upstox wans of a serious data breach on AWS Customers' names, contact information, date of birth, bank account information, and millions of KYC (Know Your Customer) details are believed to have been stolen by the ShinyHunters gang after they gained access to the company's Amazon AWS key. Command and Control: The cloud service is exploited as a Command-and-Control infrastructure Examples from recent past: 22 Apr 2021 - Using Telegram for C&C Malware authors are using the Telegram platform as an out-of-the-box command and control system for malware distribution into organizations. This system allows the malware to receive future command and control instructions remotely using Telegram, even when Telegram is not in use. 12 Jan 2021 - Abusing Google and Microsoft to host C&C Infrastructure Hackers stated using sub-domains under the parent domain appspot.com and azureedge.net in 2019 for hosting C&C infrastructure. The parent domain appspot.com is a domain owned by Google, and pat of Google's App Engine platform as a service. Azureedge.net is a parent domain owned by Microsoft, and pat of Microsoft's Azure content delivery network. Data Exfiltration: The cloud service is used to store the exfiltrated data Examples from recent past: 26 Mar 2021 - Using S3 buckets to store exfiltrated data Hackers gained access to the Microsoft 365 environment of SalusCare, a provider of behavioral healthcare services in Southwest Florida. Hackers downloaded sensitive data and uploaded the stolen data to two Amazon S3 storage buckets. 12 Jan 2021 - Dropbox, G-dive, and One-dive abused to store exfiltrated data. Adversaries were using a custom tool to compress and encrypt the data before securely exfiltrating it in allowed applications of the organization (i.e. Dropbox, Google, Microsoft). Recommendations With assets (i.e. data, identities, and applications) moving to the cloud, it becomes imperative to deploy security controls in the cloud as well. The solution should provide the capability to gain deeper visibility in cloud apps in addition to IaaS and PaaS environments so that modern cloud and web-enabled threats can be tackled. Help AG's recently launched Cyber Edge X, a SASE based security offering is one such offering. Cyber Edge X aims to simplify network security with the unification of perimeter security products like Secure Web Gateway, CASB, DLP and FWaaS delivered with one console, one agent approach, as well as unified threat protection through one single threat dashboard with advanced analytics delivering features like UEBA and ATP across all the network's perimeter controls. With its local presence in Etisalat data centers in UAE, the solution provides the least latency path to reach applications with compliance to local UAE regulations.

Year after year, cybersecurity teams across the globe are faced with new challenges to tackle. There has never been a dull moment for cybersecurity professionals in combating the increase and advancement of cybercrime, and this will remain the case for the upcoming years and decades. The increased adoption of technology in everyday life and in business, as well as the dynamic changes to how we conduct business, have expanded the attack service and changed the security perimeter, thus requiring organizations to rethink their IT security strategy. We will explore below some of the top modern drivers that will need attention in the upcoming period. Increased Adoption of Remote/Hybrid Workforce Since the pandemic, the workplace has changed forever – there has been a significant increase in the number of employees working remotely or in a hybrid model, introducing additional risks due to employees' utilization of their own uncontrolled home networks. Employers have coped with this change by adopting cloud security technologies, tightening policies, providing awareness, enhancing endpoint defenses, and enforcing stringent controls over authorization and authentication mechanisms, to name a few. Rise of Ransomware We have seen an unprecedented increase in ransomware attacks in the past couple of years, with global cybercrime damage predicted to hit $265 billion by 2031, up from $20 billion in 2021 as per a recent BCI publication. The key to mitigating the risks of ransomware is combining many security aspects such as adopting a Zero Trust approach, employee education, anti-malware tools, hardening the endpoints, implementing secure backup solutions, practicing effective monitoring, and having incident response plans in place. Cybersecurity Skills Shortage It continues to be a challenge for organizations across all sectors to hire and retain talent in the cybersecurity space, with an estimated shortage of 2.7 million resources in 2021 globally as per a recent ISC2 cybersecurity workforce study. Organizations are overcoming this challenge by creating a better work culture to attract the new generation of cybersecurity professionals, collaborating with universities to train the next generation, and identifying potential candidates that do not shy away from challenges. Cross-organizational transfer and competitive benefits are also used to retain talent. Advance In Phishing Attacks Phishing still remains one of the preferred easy-to-use attack vectors utilized by cybercriminals worldwide. 82% of breaches continue to rely on the human element as a key driver, according to the 2022 Verizon DBI Report, wherein these attacks are split between phishing and pretexting. Even though the click rate has declined over the past year due to organizations' efforts to educate their users, we simply cannot ignore that even a single phished user can cause significant harm to the entire organization. In addition to continuous education, there are several technologies and solutions adopted by enterprises to mitigate phishing risks, such as web filtering, encryption, email security, and spam filtering. Moreover, organizations need to strengthen their security posture to remain cyber resilient against a number of challenges that have come about in this era of digital transformation, and introduced by the increased adoption of IoT devices, the continuous shift of data and applications to the cloud and the increased usage of mobile devices to conduct everyday business. Do’s Don’ts Check the correctness of the recipients’ email addresses before sending an email, as errors could result in undesirable consequences. Click on links in emails that you are suspecting to be malicious. Inspect but don’t click. Hover over the link in an email before clicking on it to validate if it is legit. Fall for sudden urgent emails coming from your superior or colleague and share details without confirming with them. Report any malicious-looking emails to your cybersecurity help desk function immediately. Trust the sender's display name without a confirmation. Look for typos and bad grammar, these are indications of illegitimate emails. Divulge personal or company confidential information to any party. Keep an eye out for unfamiliar attachment file types and check for files with double extension. Respond or reply to spam in any way. Report any system slowness or device overheat to your IT support team. Install any untrusted software on your company provided assets. Report any virus detections in the system that are not automatically cleaned by the anti-virus to your IT support team. Keep your device unmonitored/unattended while working from a public area. Restart your laptop at the end of each working day or on weekends at the least. Enter your system's password and credentials when someone is watching. Report any outdated anti-virus programs to your IT support team. Attempt to install pirated software. Report any suspected security incident to your cybersecurity help desk function. Attempt jailbreaking or rooting your company provided phone.  

Today, users, applications, sensitive data, and critical business processes all reside within multi-cloud and distributed environments. Cloud hosts, SaaS providers, mobile devices, apps and the Internet of Things (IoT) all collect, process, and store data. With the evolution of new technologies, threat actors have also advanced by utilizing sophisticated tools and tactics to evade traditional detection mechanisms. Thus, an organization's detection and response strategy must develop to cater to this ever-changing threat landscape and increasing business demands. It is already known how difficult it is to get to scale and realize the value of your security operations with a traditional SIEM (Security Information and Event Management). Just imagine, with the complexity and volume of today's hybrid data centers, it is nearly impossible to depend on just your traditional SIEM to be successful. The prudent question is, how do you modernize your Security Operations Centre (SOC)? The answer is not simple and straightforward. Based on our experience through serving large enterprises and government customers, below are 5 tips that can help you transform your SOC. Utilize User and Entity Behavior Analytics (UEBA) as a Mandate, Not an Option Writing correlation rules for thousands of different possible scenarios with continuous fine-tuning is no longer practical. The use of anomaly detection reduces alerts to a manageable level for SOC analysts, allowing them to work more efficiently and focus their attention on the threats that matter the most. UEBA also helps in providing a context to raise alerts based on risk profiles of users and entities, which in turn helps in the prioritization of events. With remote working and the increased adoption of cloud, the capability to perform risk scoring of users or entities and detecting threats like malicious insiders and data exfiltration has become a necessity and no longer an option. Is Cloud the Right Option for Your SOC? Maybe you still have this confusion and are considering building a data lake on-premise. Unless you are a hyper-sensitive organization subjected to mandatory requirements to host all services on-premise, a cloud option for SOC is preferred. Opting for a cloud service that is delivered in-country, allows you to comply with local regulations, scale as per need, and utilize modern data lakes to run advanced analytics – AI/ML, without the need for a heavy investment to set up an on-premise SOC. When users are working from anywhere and everywhere, the entire network perimeter is moving to the cloud, so why restrict your SOC to on-premise? Process Automation is a Valuable Investment SOC burnouts, alert fatigue, and poor Mean Time To Detect and Respond (MTTD/MTTR) are detrimental to SOC investments. Process automation help reduce the workload and optimize the most valuable asset of any SOC – humans. Automation, when applied correctly, can reduce human intervention in time-consuming and often mundane tasks like enrichment, response, and reporting – work that can contribute to burnout. Thus, we see that usage of technologies like SOAR (Security Orchestration, Automation and Response) has become an essential part of a SOC. It is a Platform, Not a Point Product SOC operations don't end with one product or just security logs. As UEBA becomes an essential component, other technologies that also provide more insight and data boost the effectiveness of a SOC. Technologies like EDR (Endpoint Detection and Response), NTA (Network Traffic Analysis) /NDR (Network Detection and Response), CSPM (Cloud Security Posture Management), and SSPM (SaaS Security Posture Management) help to increase visibility and response capabilities across the organization. Hence, customers now require a SOC platform that can unify multiple products, provide more visibility and simplify operations to ultimately deliver much more value than a standalone SIEM product. Managed Detection and Response is Mainstream and Expanding Given the shortage of cybersecurity skills in the market, most organizations are now looking for not just a tool but a service with tangible deliverables. This can help augment the skills organizations already have and allow them to focus on more strategic security initiatives. It takes skilled people, mature processes, and next-generation technology to run an effective SOC, and an MSSP-delivered MDR (Managed Detection and Response) service is the best way to reach this maturity. At Help AG, we continuously innovate and create new value propositions for our customers. With Next-Gen Cloud SOC, we can help you modernize your security operations, where we do all the heavy lifting with our Managed Detection and Response service so that customers focus on 'what really matters' i.e., high fidelity threats and response. For more information, please reach out to us to connect with our experts on Next-Gen Cloud SOC.

Over the last decade, Help AG has continuously monitored DDoS attacks targeting the UAE and keenly observed attack patterns and types, considering we protect thousands of customers from being targets of DDoS attacks. Each time we collate, investigate and analyze DDoS attack data for our statistical modelling and future planning, the inference always shows an increasing upward trend. It often feels like a broken record when I highlight that last quarter, we again saw an increase in DDoS attacks impacting customer infrastructure and application availability. In line with this, we have witnessed a new record for the largest DDoS attack towards UAE. Help AG successfully mitigated a volume of 238.6 Gbps in a single distributed attack, targeting a customer in the UAE. Of the 60,000+ attacks that targeted UAE this year alone, more than 8,000 attacks surpassed a volume higher than 1 Gbps, of which, 72% of attacks lasted longer than 10 minutes. DDoS (Distributed Denial of Service) attacks have been a preferred attack method for hackers since the dawn of the 21st century. Attackers have utilized them for various purposes that test your perimeter defenses such as deception techniques to launch more sinister attacks or as genuine DDoS attacks. Post the pandemic, DDoS attacks have gained greater traction and have been observed as part of double and triple extortion attacks. To deal with DDoS attacks, enterprises need to consider various elements such as the destination, origin, attack vector, motives behind the attack, the risks they pose and more. Identifying and quantifying these factors play a crucial role in building effective countermeasures to safeguard their online presence. For DDoS protection service providers, apart from acting quick during an attack and providing a SLA driven service, it is key for us to provide intelligence to customers to predict the probability of a DDoS attack. As a service provider, we will try to narrow this down into three major components: Number of Attacks Volume of Attacks Duration of Attacks DDoS Attacks: H1 2022 Total Number of Attacks Observed: 66,780 Max Attack Volume Observed: 238.6 Gbps Increase Observed Over H1 2021: 24% Longest Attack: 30 Days, 23 Hours, 8 Minutes Top Attack Type: UDP Flood Source of Data Etisalat by e& NETSCOUT Arbor Deployment Interpretation of Data Data reported by Etisalat by e&'s NETSCOUT Arbor deployment is by observing internet traffic flowing through Etisalat EMIX routers towards UAE and internal UAE traffic only. This data doesn’t cover traffic flowing through transit connectivity or other ISP present in UAE. DDoS attack numbers for Q2 spiked at 5% compared to Q1 2022 and for H1 2022 spiked at 24% compared to H1 2021. Over 8000 attacks were observed above 1Gbps in volume, which translates to an average of 46 DDoS attacks per day. In H1 2022, we observed an increment in duration of DDoS attacks. This is depicted from the sharp decline on <10 minutes attacks and increase in 10–60-minute attacks in 2022. An increment in attack duration can be inferred as attackers moving from testing the perimeter defenses to launching persistent DDoS attacks targeting UAE customers. While the top 5 DDoS attack patterns have remained a constant, DDoS attacks targeting UDP have remained the most preferred attack vector. 58% of the DDoS Attacks observed in UAE are multi-vector attacks. Government and private enterprises remain the top targeted verticals within UAE. DDoS News From Across The World One of the most powerful DDoS attacks ever hits a Crypto platform Norway faces cyberattack, pro-Russian hacker group accused behind activity Mantis Botnet behind the record-breaking DDoS attack in June Closing Remarks With the digital boom, complex infrastructures are being built, 5G is coming up, more content is being shared, requiring more bandwidth, all while more attack variants and vectors occur. All of these in one way or the other are contributing to an increase in DDoS attacks. Post-pandemic, we are observing record breaking number of DDoS attacks towards UAE businesses every quarter. DDoS attacks are not just increasing in number, volume and duration, but have become more persistent and even used in extortion campaigns. Carrier grade mitigation engines combined with dedicated, trained and trusted operational resources are the way forward to dealing with such volume and complexity. Help AG’s multi-layered DDoS protection offering, hosted within the country, is well equipped for UAE based enterprises to handle this ever-growing threat.