VMworld 2020: VMware on Rising Attacks, Island Hopping and Security in ASEAN

For organisations everywhere, cybersecurity remains the top worry. Large enterprise or small firm, a business that relies on little or only old-style protection is, in effect, laying out an open buffet for cybercriminals. Companies have been taking precautions and adding security products, yet plenty of hurdles remain. Some are simple to clear, while others need closer attention.

New workload protection from VMware

VMware used VMworld 2020 to announce a number of additions to its security portfolio, among them VMware Carbon Black Cloud Workload. The product is built specifically to protect modern workloads, shrinking the attack surface and improving security posture. It pairs prioritised vulnerability reporting and basic workload hardening with prevention, detection and response capabilities that VMware calls industry-leading, covering workloads that run in virtualised, private and hybrid cloud environments.

Speaking to journalists from across Asia Pacific, Tom Kellerman (CEH, CISM), head of cybersecurity strategy at VMware Carbon Black, said cyberattacks in the US alone had risen by 400%. Attackers are turning to more advanced methods, and custom malware now features in half of all attacks. Custom malware, he noted, is difficult to stop and causes serious trouble.

The company's Global Threat Report found that cyber threats worldwide had intensified since COVID-19 struck. Of the security professionals surveyed globally, 91% said overall attacks had grown because staff were working from home. A further 32% reported very significant gaps in how well they could see threats coming, and over a quarter felt there were severe and significant gaps in their ability to support a remote workforce.

Island hopping moves to the top

Kellerman said island hopping is on its way to becoming criminals' favoured method. In this kind of campaign, attackers go after a company's less secure third-party partners, using them to weaken the target's defences and get into its network. Organisations in the middle of digital transformation are being singled out, with their cloud, network, endpoints and mail servers turned into routes to mining marketplaces.

He listed five main difficulties organisations face in detecting and responding to security incidents:

• Detection: spotting that an incident has happened at all.
• Investigation: working out where it happened and how.
• Incident response: reacting and acting on it.
• Time: how long it takes to deal with the threat.
• Distributed enterprise: making sure the incident stays contained.

Kellerman described cybercrime as having moved on from burglary to home invasion. Companies, he said, should concentrate on shortening the time it takes them to react to attackers, calling reduced dwell time "the true ROI". He urged them to think about suppressing intrusions through an intrinsic security approach, and to know the point at which all their data has to go into the panic room, which he said is what intrinsic security makes possible.

VMware XDR is the company's answer on the operations side: a single platform for detecting and responding to security incidents. It gives businesses visibility across their whole infrastructure, automatically gathering and correlating telemetry from several sources and enforcing policy at several kinds of control point. According to VMware, that cuts noise, speeds up detection and allows a more sophisticated response. It covers any environment, integrating with third-party products as well as VMware's own.

Uneven readiness across ASEAN

Companies around the world sit at different points in their digital transformation, and ASEAN is no exception. Sanjay K. Deshmukh, VMware's vice president and managing director for Southeast Asia and Korea, said the region brings its own set of cybersecurity challenges. The largest is its diversity, which VMware is working hard to address in every country.

Maturity also differs from economy to economy. Singapore, he said, is better prepared than Indonesia, which is the region's largest economy and the least ready. Singapore is also the most targeted country in the region, ahead of other ASEAN nations such as Malaysia, Thailand and Vietnam.

In Deshmukh's view, most Southeast Asian businesses still treat cybersecurity reactively and remain on what he called a "1.0 security paradigm". They need to accept that security must extend past the data centre, because applications and data alike have moved out to the edge and into the cloud. The threat radius has grown, and meeting the new threats takes a new approach that the region does not yet have. He called for a transformative, intrinsic approach to security, and said VMware sees a huge opportunity in the region.

Matt Bennett, VMware Carbon Black's vice president for Asia Pacific and Japan, agreed that security has to shift away from reacting. Based on how many incidents companies had dealt with over the previous few months of the pandemic, he said, remote workers are the easiest targets, since most use personal or company devices that have not been patched.

Bennett said spear phishing remains a threat, but more incidents now involve criminals exploiting unpatched applications and then island hopping. He urged businesses to build cybersecurity into their IT controls, and said VMware provides top-grade capabilities that find and prevent risk automatically.

Many small businesses, he added, assume nobody will target them. Yet a single customer, the right one or the wrong one, is enough to open the way for island hopping. Attackers know which companies a small firm works with and use it as a way into larger organisations, which is how they exploit digital transformation in smaller companies. Bennett said small businesses can automate much of their security through the IT controls they already have and so defend against 95% of threats.

Deshmukh made the point that cost is not what holds small businesses back on cybersecurity. Many, he said, still depend on the traditional firewall model. He gave the example of a Singapore customer whose partner field agents used their own devices to market its business. Those agents carried compromised Android devices, which made the problem hard to fix. An intrinsic approach, he said, would have let the company avoid the whole incident.

What the pandemic changed

Kellerman said COVID-19 produced two effects. Threats increased and attacks became much broader, and businesses had to work out how to make remote working possible and secure it properly.

The period after COVID-19 is likely to bring a second pandemic, this time of cybercrime, because remote workers offer attackers an enormous opening. Less visibility over those workers will only create more chances for island hopping once the pandemic is over.

Kellerman closed by asking how both security staff and everyone else can be brought along. His answer was that everyone has a part to play and must accept that threats are dynamic and keep changing. Security, he said, has to be "a team sport" rather than a silo, with every person and every system connected to it.