conix
3 years ago
3 Cybersecurity Myths to Bust
Deeply rooted cybersecurity misconceptions are poisoning our ability to understand and defend against attacks.
"Every lie is a poison; there are no harmless lies." Leo Tolstoy said this over 100 years ago, and who am I to argue with the great author? His observation holds as true today as ever — in many aspects in life, including cybersecurity.
I attend many cybersecurity presentations in my work, and one thing that has bothered me the past several years is the (over)use of clichés, myths, and misconceptions. There are many cybersecurity myths out there, but the three that are the most deeply rooted in the cybersecurity world (and therefore are the most "poisonous," as Tolstoy would say,) relate to People, Process, and Technology.
Myth #1: Sophisticated Threat Actors Use Sophisticated Tools
One misconception I run into a lot is the notion that sophisticated nation-state actors always use sophisticated cyberweapons when they breach organizations. While threat actors may indeed use zero-day exploits and advanced techniques to breach systems and access networks, in almost all cases, the initial vector is a (relatively) simple attack against humans. Why? Several reasons: a) it works, b) it's very cost-effective, and c) it's much harder to attribute. When attackers use an advanced capability like a zero-day exploit, they have a higher risk of being attributed to the attack. After all, there are only so many organizations that can develop or purchase zero days.
On the other hand, a relatively simple attack against a person, using a combination of social engineering techniques and open source intelligence (OSINT) can yield devastating results. Some of the most notorious breaches started just like that: the RSA hack, the Sony hack, the Associated Press hack, the Target hack, the DNC hack … and the list goes on.
In 2018, Verizon estimated that 33% of all breaches start with a social engineering attack. This is a very conservative estimate. Some researchers estimate the number to be closer to 90%. While security vendors push for more products, we must remember that not all cybersecurity gaps are technological. Most are related to people.
Myth #2: Attackers Need to Be Right Only Once; Defenders Must Be Right All the Time
I probably hear this process-related misconception the most. Claiming that an attacker needs to be right only once oversimplifies an attack life cycle from the point-solution vendor's point of view. In actuality, the attacker has to be right many times, and the defender has many opportunities to detect, mitigate, or prevent the attack.
To illustrate this, I suggest looking at the MITRE ATT&CK framework. For virtually any threat actor or attack type, the ATT&CK Navigator shows multiple techniques that can be used as part of the 14 tactics. Pick, for example, REvil ransomware. Notice how many different actions the attacker takes from Initial Access to Impact. The attackers don't have to be right once; they have to be right many times. The defenders will remain unaware of the attack if they miss all these opportunities to detect it.
True, the attackers likely will not give up if one technique fails or is stopped, and sophisticated threat actors are nearly impossible to stop. However, there is a lot to be said about early detection, attack mitigation, and incident response time. Saying that the attacker needs to be right only once is an easy out. We can do better than that if we break the siloed view.
Myth #3: You Need More Security Products to Stop All the New Threats
In terms of technology, we are learning the hard way that less is more. (Why not use a cliché to refute a cliché?) The average organization has 50 to 80 security products, yet most of them don't communicate with each other, some are partially integrated, and together they create huge management and monitoring burdens on security teams. Analysts and researchers suffer from alert and monitor fatigue, and there are good reasons practitioners in all disciplines are looking for easy-to-use, converged systems.
Vendor overload is directly related to the People and Process myths above. More chief information security officers (CISOs) are looking to cut back on the number of solutions they have while maintaining their security capabilities and operational readiness. This can be backtracked to the layered-security approach: The notion is true; you do need multiple layers for defense. Yet this does NOT mean you need more and more disparate systems to achieve it! The number of systems that analysts need to work with has become a burden. We don't need more tech — we need smarter, easier-to-use tech. We need to develop muscle, not fat.
It's Time to Bust These Myths for Good
To sum things up, we have to acknowledge these misconceptions about cybersecurity. If you read reports from almost 20 years ago, you will see the same problems and issues. Now is a great time to turn things around and bust these myths forever.
The adoption of cloud architectures gives us an opportunity to change the way we think and approach cybersecurity challenges. We can take these myths and put them behind us. As another great thinker, Albert Einstein, said, "The measure of intelligence is the ability to change."
conix
4 years ago
CrowdStrike (NASDAQ:CRWD) Raised to Buy at Jefferies Financial Group
Posted by ABMN Staff on Jan 11th, 2021
CrowdStrike logoCrowdStrike (NASDAQ:CRWD) was upgraded by research analysts at Jefferies Financial Group from a “hold” rating to a “buy” rating in a research note issued on Monday, AnalystRatings.net reports. The firm presently has a $275.00 target price on the stock, up from their prior target price of $160.00. Jefferies Financial Group’s price objective suggests a potential upside of 25.24% from the company’s current price.
Other analysts also recently issued reports about the company. Oppenheimer lifted their price target on CrowdStrike from $164.00 to $190.00 in a report on Thursday, December 3rd. Barclays lifted their price target on CrowdStrike from $193.00 to $221.00 and gave the stock an “overweight” rating in a report on Wednesday, January 6th. JMP Securities lifted their price target on CrowdStrike from $160.00 to $180.00 and gave the stock an “outperform” rating in a report on Thursday, December 3rd. Credit Suisse Group lifted their price target on CrowdStrike from $125.00 to $150.00 and gave the stock a “neutral” rating in a report on Friday, December 4th. Finally, Piper Sandler lifted their price target on CrowdStrike from $180.00 to $240.00 and gave the stock an “overweight” rating in a report on Tuesday, January 5th. Five research analysts have rated the stock with a hold rating, eighteen have assigned a buy rating and one has issued a strong buy rating to the stock. The stock currently has a consensus rating of “Buy” and an average price target of $182.96.
NASDAQ:CRWD opened at $219.58 on Monday. The firm has a market cap of $48.59 billion, a PE ratio of -466.09 and a beta of 1.32. The stock has a fifty day moving average price of $182.89 and a 200 day moving average price of $137.31. CrowdStrike has a 12-month low of $31.95 and a 12-month high of $228.82.
CrowdStrike (NASDAQ:CRWD) last released its earnings results on Wednesday, December 2nd. The company reported $0.08 earnings per share (EPS) for the quarter, beating the Zacks’ consensus estimate of ($0.15) by $0.23. The firm had revenue of $232.50 million during the quarter, compared to analyst estimates of $214.36 million. CrowdStrike had a negative return on equity of 12.79% and a negative net margin of 13.40%. CrowdStrike’s revenue was up 85.9% compared to the same quarter last year. During the same period last year, the business posted ($0.07) earnings per share. Equities analysts anticipate that CrowdStrike will post -0.37 earnings per share for the current fiscal year.
In related news, CEO George Kurtz sold 24,951 shares of the business’s stock in a transaction dated Tuesday, October 13th. The stock was sold at an average price of $152.50, for a total value of $3,805,027.50. The sale was disclosed in a legal filing with the SEC, which is available at the SEC website. Also, Director Gerhard Watzinger sold 30,000 shares of the business’s stock in a transaction that occurred on Monday, October 26th. The stock was sold at an average price of $133.89, for a total value of $4,016,700.00. The disclosure for this sale can be found here. Insiders sold a total of 1,128,070 shares of company stock worth $201,840,006 in the last 90 days. 11.32% of the stock is currently owned by insiders.
A number of hedge funds and other institutional investors have recently added to or reduced their stakes in the business. BlackRock Inc. increased its position in CrowdStrike by 67.6% during the 3rd quarter. BlackRock Inc. now owns 9,136,950 shares of the company’s stock worth $1,254,685,000 after purchasing an additional 3,685,952 shares during the period. State Street Corp increased its position in CrowdStrike by 41.1% during the 3rd quarter. State Street Corp now owns 2,834,562 shares of the company’s stock worth $389,242,000 after purchasing an additional 825,093 shares during the period. First Trust Advisors LP increased its position in CrowdStrike by 12.9% during the 3rd quarter. First Trust Advisors LP now owns 2,013,711 shares of the company’s stock worth $276,523,000 after purchasing an additional 230,491 shares during the period. FMR LLC increased its position in CrowdStrike by 6.4% during the 2nd quarter. FMR LLC now owns 1,307,235 shares of the company’s stock worth $131,102,000 after purchasing an additional 78,251 shares during the period. Finally, Charles Lim Capital Ltd increased its position in CrowdStrike by 14.4% during the 3rd quarter. Charles Lim Capital Ltd now owns 1,188,292 shares of the company’s stock worth $163,176,000 after purchasing an additional 149,405 shares during the period. Institutional investors own 60.00% of the company’s stock.