Back to news

June 13, 2024 | International, Security

Why SaaS Security is Suddenly Hot: Racing to Defend and Comply

Are your third-party SaaS risks under control? Discover the four-step process to secure your SaaS ecosystem.

https://thehackernews.com/2024/06/why-saas-security-is-suddenly-hot.html

On the same subject

  • This training tool could be the answer to stop mass cyberattacks

    July 9, 2020 | International, C4ISR, Security

    This training tool could be the answer to stop mass cyberattacks

    Mark Pomerleau At air bases across Europe, networks are under attack. Malicious hackers have gained access to sensitive systems, information, controls and critical infrastructure. But cyber operators from U.S. Cyber Command, in concert with Five Eyes partners, have been called in to thwart these attempts in real time. This was the main scenario for this year's capstone cyber training exercise put on by Cyber Command, Cyber Flag 20-2. The exercise, which took place June 15-26 and was exclusively defensive in nature, saw more than 500 participants and 17 teams participating from five countries across nine time zones, and it included America's National Guard, the U.S. Energy Department and the Five Eyes alliance — Australia, Britain, Canada, New Zealand and the U.S. Australia, however, did not participate during this iteration. Officials told reporters this week that the purpose of Cyber Flag 20-2 was to continue building the community of defensive cyber operations and to improve the overall capability of the Five Eyes countries to defend against cyber aggressors. The drill involved teams defending IT and operational security networks against a live, opposing force trying to disrupt, deny and degrade the air bases' operations. The networks under attack were industrial control systems simulated to generate network traffic for an aviation fuel farm, power grid, air traffic control radars and electronic access control systems. The attacks came in the form of malware that targeted devices responsible for fuel and power. But the unique aspect of this year's exercise, as C4ISRNET previously reported, was the use of a new remote cyber training tool called the Persistent Cyber Training Environment. PCTE is an online client that allows Cyber Command's cyber warriors, as well as partner nations, to log on from anywhere in the world to conduct individual or collective cyber training as well as mission rehearsal, which to date had not existed for the cyber force as it does for physical troops. The program is run by the Army on behalf of the joint cyber force. The platform not only allowed the exercise to continue as planned amid the coronavirus pandemic, but it enabled collaboration and simultaneous training across the world. A new way to train Officials say PCTE is providing Cyber Command with an entirely new way to train cyber forces, which previously was difficult given a lack of infrastructure and the time needed to set up ranges and scenarios. It also allows Cyber Command and military units to conduct more frequent training. Cyber Flag typically was Cyber Command's largest and only holistic tactical training event, held annually during June. For units, aside from Cyber Flag, there were no other ways to stay sharp on their skills unless they built their own environments. Now, Cyber Command plans to hold more exercises, with Cyber Flag 20-3 occurring in the fall. “The delivery of the Persistent Cyber Training Environment absolutely allows us to increase the frequency and the complexity of exercises that are conducted by the command itself,” Coast Guard Rear Adm. John Mauger, director of exercises and training at Cyber Command, told reporters. “Going forward, I would expect you to see a series of exercises throughout the year where we are reaching out to the different teams to test their capabilities or to focus on specific issues that are of concern or interest to us. “Going forward, we're going to get the benefits of both those distributed exercises along with increasingly complex exercises as PCTE is instantiated across both the secret network and the top-secret network.” Scenarios and environments can be stored, saved, reused and modified if needed in the system for later exercises. Smaller units will also be able to leverage these scenarios to practice whenever needed. The PCTE virtual environment for this year's exercise included 25 interconnected ranges of more than 3,000 virtual machines — a high-fidelity network that simulated and emulated open internet traffic with more than 4,000 static websites that store and share data. The simulated air base networks created in PCTE had fully configured Windows active directory domains with over 100 nodes running more than 10 types of major operating systems, along with 35 simulated user control workstations actively surfing the internet and using Microsoft Office products to access, create and transfer files. Moreover, officials also explained PCTE can be integrated into larger, multi-combatant command-type exercises to simulate the cyber effects, such as Global Lightning and its companion Cyber Lightning. Global Lightning is an annual global exercise run by Strategic Command to test integration across several geographic and functional combatant commands. Cyber Lightning is Cyber Command's portion to the exercise. “We think that is the next evolution of the Persistent Cyber Training Environment and how we take to the tier 1 exercises, incorporate cyber effects. They're no longer white-carded,” Col. Tanya Trout, Cyber Command's PCTE director and acting director of the Joint Cyber Training Enterprise, told reporters. White carding involves telling exercise participants that a certain action has occurred. This was typical of cyber effects, given it was difficult to realistically simulate them, which diminished the training value in exercises because participants didn't experience the full breadth of these actions. Now, these activities can play a real role in exercises increasing the overall fidelity of training across the joint force and continuity of all operations of warfare. The system will also be able to be used for mission rehearsals. A Cyber Command official said the force can input prior operations, such as those used against the Islamic State group, to train against. Additionally, they'll be able to upload to the platform malware discovered in operations. The PCTE program office, which is in the prototyping phase despite delivering the first portion to Cyber Command in February 2020, also learned valuable lessons in Cyber Flag. Officials said the two-week exercise provided the program office with six months' worth of data it can use to make significant improvements. Prior to the February delivery, the program office leveraged several smaller-scale training events at the unit level to incrementally increase capabilities and scalability as well as help geographically dispersed teams prepare for tier 1 exercises like Cyber Flag. Overall, officials are happy with how the system performed in its first tier 1 exercise, pointing to little to no latency issues, though there were periodic improvement tickets. “What we found through the rapid development and use of the Persistent Cyber Training Environment is that we really have a unique capability to move forward with,” Mauger said. https://www.c4isrnet.com/dod/cybercom/2020/06/25/this-training-tool-could-be-the-answer-to-stop-mass-cyberattacks

  • German lawmakers greenlight $344 million support package for future P-8 fleet

    July 15, 2022 | International, Aerospace

    German lawmakers greenlight $344 million support package for future P-8 fleet

    Questions are still swirling here about how many additional Poseidon aircraft, if any, the government will move to buy.

  • Army Seeks New JLTV Competition In 2022

    February 12, 2020 | International, Land

    Army Seeks New JLTV Competition In 2022

    The service is already slowing production of Oshkosh's Joint Light Tactical Vehicle and now wants to find an alternative manufacturer —which could create logistical or legal headaches. Other Oshkosh programs are also ramping down. By SYDNEY J. FREEDBERG JR. PENTAGON: As the Army moves billions into new high-tech weapons, truck-maker Oshkosh is feeling the pinch. The 2021 budget request not only decreases spending on three Oshkosh vehicles, the 10-wheel FHTV, the 6-wheel FMTV, and 4×4 JLTV: It also calls for a new competition the following fiscal year for JLTV, the Joint Light Tactical Vehicle originally meant to replace the Humvee. That's especially worrying for the Wisconsin company, because JLTV is the youngest program of the three and the most important for the company's long-term future. But then-Army Secretary Mark Esper — now Secretary of Defense — has publicly criticized JLTV as overly specialized for the kind of counterinsurgency conflicts the Pentagon is no longer focused on. While the Army insists it will still buy the planned total of 49,099 trucks, eventually, it keeps slowing down the annual rate and extended the deadline to complete production, which now won't end until 2042. (That leaves the Humvee in service, at least with some units, indefinitely). Why recompete? “We do that to drive the price down,” said Deputy Assistant Army Secretary John Daniels this morning, when my colleague Jen Judson asked about the proposal. But any new competition would be two fiscal years from now and Daniels declined to give any details. The only other information about the plan is buried on page 102 of the fifth volume of the Army's newly released procurement request for 2021, which also includes projections for 2022 and beyond. Under JLTV, the “justification book” says that: “Current contract options may be exercised through 30 November 2023 assuming contractual quantity headspace is still available. Current funding indicates headspace quantity of 16,901 may be achieved in FY 2021, with competitive follow on contract award anticipated in FY 2022. A split procurement will occur between the existing Oshkosh contract and the new competitively awarded contract based on the approved acquisition strategy. The Program Office continues to gather insight from industry partners to better understand their position to ensure strong competition for the follow on contract.” In plain English, this means Oshkosh's current contract to build Joint Light Tactical Vehicles runs though fall 2023. Since production will continue for decades, the Army will have to award a new contract to buy more JLTVs for itself, the other services and allies. But when it comes time to award that follow-on contract, the service doesn't want Oshkosh to be its only option: It wants at least one competitor to drive down costs. https://breakingdefense.com/2020/02/army-seeks-new-jltv-competition-in-2022

All news