<!DOCTYPE html>
<html>
<head>
<title></title>
</head>
<body><div>"I spent a million bucks buying things to sign off on a list and still allowed an uncontrolled device to send SMB via VPN to my network".<br></div>
<div><br></div>
<div>Doesn't matter how much shiny vendor-tin you buy, process failure's going to get you every time.<br></div>
<div><br></div>
<div>James</div>
<div><br></div>
<div><br></div>
<div>On Sun, 25 Jun 2017, at 13:58, Jason Ross wrote:<br></div>
<blockquote type="cite"><div>This is just the first on many such attacks IMHO.<br></div>
<div><br></div>
<div>I’ve been saying for quite a while that next generation AV and firewalls are not going to save/protect you. I wonder how many people listen to the vendor hype around some of these solutions and leave it at that.<br></div>
<div><br></div>
<div>FWIW, I believe that multiple vendors is a good approach, still not enough for emerging threats though.<br></div>
<div><br></div>
<div><span class="highlight" style="background-color:rgb(255, 255, 255)"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:georgia, 'times new roman', times, serif"><span class="size" style="font-size:17px">Six years ago, Mr. Ben-Oni had a chance meeting with an N.S.A. employee at a conference and asked him how to defend against modern-day cyberthreats. The N.S.A. employee advised him to “run three of everything”: three firewalls, three antivirus solutions, three intrusion detection systems. And so he did.</span></span></span></span><br></div>
<div><br></div>
<div><span class="highlight" style="background-color:rgb(255, 255, 255)"><span class="colour" style="color:rgb(51, 51, 51)"><span class="font" style="font-family:georgia, 'times new roman', times, serif"><span class="size" style="font-size:17px">But in this case, modern-day detection systems created by Cylance, McAfee and Microsoft and patching systems by Tanium did not catch the attack on IDT. Nor did any of the 128 publicly available threat intelligence feeds that IDT subscribes to. Even the 10 threat intelligence feeds that his organization spends a half-million dollars on annually for urgent information failed to report it. He has since threatened to return their products.</span></span></span></span><br></div>
<div><br></div>
<div><div> <br></div>
<div> <br></div>
<div><blockquote type="cite"><div>On 24 Jun 2017, at 2:51 pm, Mark Prior <<a href="mailto:mrp@mrp.net">mrp@mrp.net</a>> wrote:<br></div>
<div><br></div>
<div><div><div><<a href="https://www.nytimes.com/2017/06/22/technology/ransomware-attack-nsa-cyberweapons.html">https://www.nytimes.com/2017/06/22/technology/ransomware-attack-nsa-cyberweapons.html</a>><br></div>
<div>_______________________________________________<br></div>
<div>AusNOG mailing list<br></div>
<div><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br></div>
<div>http://lists.ausnog.net/mailman/listinfo/ausnog<br></div>
</div>
</div>
</blockquote></div>
</div>
<div><u>_______________________________________________</u><br></div>
<div>AusNOG mailing list<br></div>
<div><a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br></div>
<div><a href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br></div>
</blockquote><div><br></div>
</body>
</html>