Open Security Management Platform (OSMP) Delivers On “Urgent” Need For SMB Cyber Protection

Comprehensive cyber protection for SMBs has emerged as the next great revenue driver for IT service providers, with 60% of SMBs looking to outsource cybersecurity to a third party, according to a new report by Frost & Sullivan.

The report, commissioned by ASX-listed global cybersecurity company FirstWave Cloud Technology, showed SMBs were in “urgent” need of comprehensive cyber protection and were increasingly relying on managed service providers to deliver unified, centralised and automated solutions that offer enhanced threat remediation.

“Security, though a priority, often slips through the cracks, making it difficult to intentionally and continuously establish a security-forward organisational stance from their IT service providers,” the report said.

To fill this gap, FirstWave developed the CyberCision™ Open Security Management Platform (OSMP), described by Frost & Sullivan as the first of its kind. Designed to equip service providers with low-cost, high-revenue security services for their SMB customers, the platform enables SMB customers, in turn, to benefit from an enterprise-grade Cybersecurity-as-a-Service solution.

FirstWave CEO Danny Maher said it was no secret that cybersecurity had become one of the most pressing issues for businesses of all sizes, particularly SMBs.

“With high-profile data breaches making headlines on an almost weekly basis, it is clear that traditional security measures are no longer enough to protect organisations from sophisticated cyber attacks,” he said.

“As a result, more and more businesses are turning to outsourcing as a way to improve their cybersecurity posture. Those service providers need to have a solution ready for their customers.”

SMBs’ Unique Cybersecurity Challenges 
The global upheaval of the last two years that disrupted societies, governments, businesses, and the technologies that support them, also forced organisations worldwide to shift to remote working practically overnight. Consequently, organisations have adopted new operational infrastructures as data has multiplied exponentially—all opening up a much wider attack surface.

Moreover, cyberattacks have grown smarter, scaling in both sophistication and speed, to penetrate the weak defences of solutions struggling to protect increasingly digital economies.

A recent Frost & Sullivan survey of SMBs found most were targeted by preventable threats, including ransomware (47%), vulnerabilities from unpatched systems (44%), web defacements (43%), insider threats from employees (31%), and phishing attacks (27%).

The Opportunity For Service Providers
Frost & Sullivan finds that while only 14% of enterprises report outsourcing more than half of their cybersecurity operations, a much higher percentage (60%) of SMBs outsource.

“This presents a natural fit for partnerships between SMBs and their service providers. By adding cybersecurity to their existing services, SMBs can bolster existing connectivity assets with the critical protections they need, all through a single provider,” the report said.

However, for many service providers, while lucrative, delivering cybersecurity solutions to enterprise customers can involve significant cost and complexity. FirstWave’s world-first OSMP, CyberCision™, was explicitly designed to address this problem.

“CyberCision™ enables service providers to provision enterprise-grade security services to enterprise and SMB customers at scale, opening the door to new revenue opportunities with a lower cost-to-serve,” the report said.

“With CyberCision™, service providers can build as-a-service cybersecurity packages of enterprise-grade, including a range of management and operational services such as multi-tenanting, billing, and provisioning that enable them to streamline the sales and delivery process at a minimal cost.”

Essentially, CyberCision™ serves as a platform that service providers can depend on to scale their managed security services business and operations profitably, drastically reducing the time to market for cybersecurity and serving SMB customers, which was not previously possible.

​Download a free copy of the Frost & Sullivan report, Embracing Delivery of Cybersecurity and Scaling Via Service Providers

Uncategorized

CyberCision Mobile App: Visibility and Real-time Monitoring of Cybersecurity Threats

Cybersecurity threats are on the rise and businesses need to be taking steps to protect themselves. Our CyberCision Mobile App offers Visibility and real-time monitoring of cyber-security threats so that you can rest assured that your business is safe. With our app, you can also access historic reporting, all available to be white-labelled for our Partners.

Released as part of our Phase II CyberCision Launch, the CyberCision Mobile App offers unparalleled visibility into the cyber-security threats facing businesses today. With real-time monitoring and historic reporting, the app provides clients with a comprehensive view of the risks they face. Available to be white-labelled for service providers and telco partners, this powerful app gives visibility and control to those who need it to stay ahead of the cyber-criminals.

For End Users

With the tap of a finger, end users are able to review current and historic incidents within their email security posture in the palm of their hand, including real-time alerting to ensure any urgent matters are addressed instantly. This allows businesses to quickly identify and resolve any potential issues before they become damaging breaches. In addition, the ability to review past incidents helps businesses to learn and adapt, helping to prevent future attacks.

For Service Providers

Eliminating the need to replicate app development work, our platform is fully customisable for our service provider and telco partners. This allows you to put these powerful tools into your customer’s hands, branded as your own. What’s more, this added visibility helps to reinforce the value of the email security offering in place, so you can lead informed conversations with your customers about how to best protect their business from cybersecurity threats.

Uncategorized

Deploying email security at scale and speed with Frictionless Email Security

Cybersecurity has always been a tough sell. It’s an intangible product that’s often seen as a necessary evil – something that businesses have to invest in, but don’t really want to think about. This is especially true when it comes to deployments at scale. Imagine trying to sell cyber security to thousands of Microsoft 365 customers. Not only do you have to convince them of the need for the product, but you also have to ensure that it’s properly deployed across their entire organization. This is no small feat, and it’s one that service providers have been struggling with for years.

That’s where FirstWave comes in. Our CyberCision platform is the world’s first open cyber security platform, made specifically to help service providers and telcos provide cybersecurity solutions to their customers. CyberCision is committed to making email security as seamless and painless as possible for its customers. That’s why we’re excited to offer our new Frictionless Email Security solution. This automated activation method enables service providers and Microsoft customers to deploy email security at scale and at speed, without manual DNS and MX changes. That means you can rest assured that your emails are protected from viruses, phishing attacks, and other cyber threats.

Frictionless Email Security on FirstWave’s CyberCision platform:

  • Deploys in minutes
  • Provides extra layers of protection
  • There is no MX record to change
  • It is advanced security out of the box
  • Rapidly onboards thousands of customers with APIs
  • Service Providers can white label the platform to support their brand
  • And includes ADR to mitigate targeted email attacks in the mailbox

Service providers simply log in to the CyberCision platform and follow the prompts to activate the service. It’s that easy! So if you’re looking for an email security solution that won’t cause headaches, look no further than CyberCision. We’ll take care of everything for you.

​Finally, service providers and telcos can onboard email security customers at scale, at speed, and with
minimal effort, opening new channels to market.

Uncategorized

Frictionless Email Security: The Solution to Onboarding Email Security

In the race to stay ahead of the latest cybersecurity threats, email security is more important than ever. However, traditional methods of onboarding email security solutions have been slow and costly, preventing many businesses from implementing these vital protections. CyberCision from FirstWave changes all that with Frictionless Email Security. This innovative new approach removes the barriers to onboarding email security, making it easier and faster for service providers and telcos to add these essential protections to their customers’ networks. With Frictionless Email Security, you can be confident that your business is protected from the latest threats!

Email is one of the most important communications tools for businesses, so it’s essential to have a secure platform in place. However, onboarding customers to an email security platform can be time-consuming and fraught with potential for human error. In the past, service providers have had to dedicate significant amounts of time, often after hours, from senior technical staff to make manual changes to DNS and MX records. Even with the best intentions, there’s always the chance that something will go wrong.
Between the finite ‘change windows’ available after hours for service providers to lean on their senior staff before burning them out, and the additional cost this incurs and will almost certainly need to be passed onto their customers, traditional email security onboard is full of barriers.

That’s where FirstWave’s Frictionless Email Security comes into its own. With automated activation, not beholden to manual DNS and MX record changes, as well as API integrations to enable the ability to deploy at scale, FirstWave empowers service providers and telcos to deploy world-class email security to their customers with ease.

Finally, service providers and telcos can onboard email security customers at scale, at speed, and with minimal effort, opening new channels to market.

Uncategorized

FirstWave Extends and Expands Contract With Telstra

FirstWave Cloud Technology Limited  (ASX: FCT) (FirstWave), the global cybersecurity technology company, announces the extension and expansion of its contract with key customer Telstra, Australia’s largest telecommunications company.

The contract has been extended for an additional two years with a further two-year option, and the scope has been expanded to include additional cybersecurity services provided through FirstWave’s CyberCision platform.

In FY21 approximately $6.5m revenue was generated from the Telstra agreement with over 95% being recurring revenues.

FirstWave CEO Danny Maher said ”We are pleased to deepen our longstanding relationship with Telstra, our largest customer. The expanded scope of our extended contract reflects Telstra’s increased focus on its cybersecurity offerings and confidence in FirstWave’s capabilities to provide its customers with best-in-class cybersecurity technology.”

Telstra CEO, Andy Penn recently noted the significant increase in malicious cyber activity Telstra has seen across its networks and the deteriorating threat environment being faced by its customers. We look forward to protecting more Telstra customers from cyberattacks and growing our revenues together with Telstra through the wider implementation of our CyberCision platform.

In addition to the extended agreement, FirstWave and Telstra have commenced a collaborative marketing campaign to strengthen the marketing and sales of the contracted products through Telstra’s sales teams and channels. The joint effort, led by FirstWave Chief Marketing Officer Ehsan Jahandarpour, is expected to deliver an enhanced customer experience for Telstra customers and increase revenues for both companies.

Following its recent restructure driven by the acquisition of Opmantek, FirstWave is prioritising Telstra as a key account and is focused on improving its sales enablement process with key account management to open significant new revenue streams.

Download the FirstWave ASX announcement here

 

Supplementary notice – Telstra Contract Renewal FirstWave Cloud Technology Limited (ASX: FCT)

(FirstWave), the global cybersecurity technology company wishes to provide further information about its extended and expanded contract with key customer Telstra.

Telstra has been a key client for FirstWave throughout FirstWave’s history. Revenues from the contract comprise of recurring fees to FirstWave from Telstra for administrative, support and infrastructure services of around $2m per annum with the remaining revenues being derived on a per-user fee for licensing and support from Telstra’s resale of FirstWave’s security services to Telstra’s end customers.

Telstra’s end customer contracts vary in length from one to five years and hence in some instances are longer than the current FirstWave / Telstra agreement. These contracts would survive termination generating future revenue and requiring continuing licensing and support even if the Telstra agreement was not renewed in the future and these contracts were still current.

Under the terms of the reseller agreement with Telstra, FirstWave retains exclusive rights to FirstWave’s intellectual property. This contract renewal also provided an opportunity to define and agree to additional new security products and services aligned with Telstra’s security product growth strategy.

Download the FirstWave ASX announcement here

Uncategorized

Using Configuration Management to Detect Unwanted Software

The Log4j vulnerability is the latest cyber exploit, bringing a CVSS critical score of 10. It allows attackers to execute arbitrary Java code on remote computers, including accessing sensitive information.

Only a year since the world addressed the SolarWinds supply chain attack, it’s another  confirmation that network professionals must adopt long-term risk-management strategies.

Are Opmantek products affected? Opmantek does not release software written in Java or Log4J, nor do the projects we depend on directly utilize Java or Log4J. 

Leverage Configuration Data to Identify Risk

It can be difficult to identify if Log4j is being used, as it’s often bundled with other software. A configuration management system provides means to audit a resource configuration and inventory elements against a defined security policy.

Gather Configuration Data

Get data into the system through integration or direct collection

Extract Operational Information

Process the data to extract information about change and compliance

Gather Configuration Data

Get data into the system through integration or direct collection

Detecting Log4j on a Server with opConfig

Like any organization, our internal teams use a variety of third party software. In the case of the Log4J vulnerability, we needed to confirm if the library was installed on our servers, patch it, and ensure it wouldn’t then be installed in future.

Between our product, development and test servers we had about 50 Linux servers to check, so we needed to find a quick, automated solution.

Detection

Unfortunately, the software does not use a Linux package manager, so we can not use RPM and APT commands.  There is a simple way to verify if the software was installed, look in / (root directory and all child directories) to see if there were any files containing the name log4j.

The Linux command we needed was:

  • sudo find / -name “*log4j*”

We wanted to run this command quickly and easily on 50 Linux servers.  A new command set was needed which we called “Linux_Log4j”. We created a new command set file for this and similar things called “Linux_Software_Installed.nmis”.

Linux_Software_Installed Command Set

Command sets in opConfig are stored in /usr/local/omk/conf/command_sets.d by default.  We copied an existing one and edited it to make it reflect what we needed. ​​This change could also be made in the GUI, editing an existing command set and adding a new command collection.  Most importantly, this needed to have os_info matching Linux only and we needed to change the two commands. In the most recent version of opConfig for NMIS9 these files are JSON.

To understand the contents it is quite straightforward, os_info means only run these commands when these os_info conditions are met.  Each of the command sections are simple and the tagging system is powerful:

  • privileged: means does this require elevated privileges to run, e.g. sudo access
  • command: the command you want to run, which is also how the data is saved into the system
  • exec: optional if you want to save the command as some other name, use the exec as the command which is actually executed and the command item will be the name of the command to run.
  • tags: HOURLY means this will automatically run every hour, Linux and operations are handy for finding the command, detect-change and report-change means that opConfig will monitor this command output for change and if a change is found raise an event.

Linux_Software_Installed.json

The final command set looks like this:

{

“Linux_Log4j” : {

“commands” : [

{

“privileged” : “true”,

“command” : “Log4jSearch”,

“exec” : “sudo find / -name \”*log4j*\””,

“tags” : [

“HOURLY”,

“Linux”,

“operations”,

“detect-change”,

“report-change”

]

}

],

“scheduling_info” : {

“run_commands_on_separate_connection” : “false”

},

“os_info” : {

“os” : “/(Linux|CentOS|Ubuntu)/”

}

}

}

Running the Command Set

Because it is tagged with “HOURLY” the command set will run automatically every hour.  If you want to run it manually for testing, you run the following command:

sudo /usr/local/omk/bin/opconfig-cli.pl quiet=1 nodes=NODE-TO-TEST-WITH act=run_command_sets tags=HOURLY debug=true

Check for any errors, if all good, run manually for all nodes or wait an hour or so.

You may need to increase the timeout if you see the console lines as below.

[2021-12-22 03:58:48.21513] [23682] [warn] failed to make session privileged: read timed-out

[2021-12-22 03:58:48.21573] [23682] [warn] Failed to run command Log4jSearch: Could not make session privileged: read timed-out

[2021-12-22 03:58:48.21587] [23682] [warn] Command timed out – partial response was: “”

The /usr/local/omk/conf/opCommon.json file can be edited and the value for opconfig_command_timeout increased to a suitable number of seconds.

Running as Non-Privileged

You may not have (or want to use) the privileged user (using sudo). In this case, a more suitable exec string is below (and remember to set “privileged”: “false”).

“exec” : “find / -name \”*log4j*\” 2>/dev/null”,

Diagnose

Now we can go to the opConfig GUI and find the matching nodes.

Access the Commands Overview

From the opConfig menu, select “Views → Recent Commands” and you should see a screen which looks like below.

First we can see how many instances of “Log4jSearch” we have collected.In the box enter “Log4jSearch” change the select to “Command” and click “Go”. You will have a list of nodes and the command name.

Next, click on the “Advanced” button on the right.

Click on the Node Name to see the command output.

Here we can see this node has some possible files of concern.

Remediation

In this case remediation requires one of the operations team to install updated versions of Log4j or the packages from vendors using it. The Opmantek development team use Vagrant to automate this kind of activity and the issue was quickly resolved.

Conclusion

Using the Operational Process Automation methodology of detect, diagnose and act, Opmantek was able to identify which of our servers required change within 15 minutes.

Ready to see what opConfig can do for your organization?

Get in touch to speak with a network engineer. We’re a technically led team, so prepare for a conversation about solutions, not sales.

Or, get started straight away with a time-unlimited 20 node license.

Uncategorized