Information Security Blog

When it comes to predicting the future, how do you anticipate the moves of our world’s underground cyber criminals, hackers and rogue nations? While they don’t all agree, Exabeam’s top security sleuths share their predictions for 2019.

How to build an incident response plan around the SANS incident response process, examples to get you started, and a peak at incident response automation.

Insider threats are a growing concern for all organizations—one that is increasingly difficult to manage using conventional security technologies. Unlike other types of security threats, insider threats are complicated by the fact that only some are caused by intentional malicious insiders. When you consider all the risks, you can understand why insider threats require a comprehensive cybersecurity strategy.

In part one of this ransomware blog series, we examined how ransomware has evolved over the years. From[…]

Many enterprises are joining the rush to set up data lakes for handling petabytes of security data and logs. But many executives and architects assume that once they finish setting up log sources, applying parsers, and arming their SOC analysts with reports, their data lake will deliver the goods.

Now more than ever, organizations must utilize cloud-based security solutions to ensure their customer information and data are secure, as well as having expertise on the security and regulatory issues involved. Now let’s examine the specific steps you can take to ensure you’re keeping your cloud deployments secure.

UEBA stands for User and Entity Behavior Analytics. We explain every word of the acronym and provide a 5-minute primer with everything you need to know about UEBA.

You might have a good handle on your on-premise network security, but what do you know about cloud security and threats to your cloud operations? Do you even have a list of all of the deployed cloud assets within your organization, and who is responsible for each? Most organizations don’t have a handle on their cloud security.

Not just a nuisance anymore, ransomware is now ranked as one of the top cyber threats, wreaking havoc on organizations around the world. Today, hackers are executing calculated, dangerous, and costly attacks on enterprises and governments that can threaten public safety. And ransomware’s sophisticated delivery is designed to fool even the most savvy users.

Lateral movement refers to techniques cyber attackers use to progressively move through a network, searching for targeted key data and assets. In today’s security landscape, hackers are becoming more sophisticated. They use multiple ways to get basic access, such as a phishing attack or malware infection, then impersonate a legitimate user while looking to elevate their privileges. They typically aren’t concerned with being detected—most organizations don’t have the staff, tools, or bandwidth to detect that anything unusual is going on.

The right mix of IR automation and IT orchestration can drastically cut the time analysts spend on manual steps—often from many days to mere minutes. While far from being a silver bullet, automation and orchestration are proven approaches to improving the security, efficiency, cost, and morale of security teams and organizations that depend on them.

Many modern enterprises—like the airlines, cruise ship, and retail industries—produce massive amounts of data on a daily basis. Given this threat landscape, it’s important for businesses to ingest all their security logs in near real-time, process it, and make it available for intelligent cyber threat analysis. Exabeam’s Data Lake is designed for exponential log data growth and the complexity of cybersecurity analysis.