Fortinet competing to provide cybersecurity for Thai banks

With Thailand making serious strides towards creating a digital economy United States-based cybersecurity firm Fortinet is striving to capture a bigger bite of the Thai cybersecurity market, particularly among the Kingdom’s banks and telecoms companies, as recent security breaches have Thai firms seeking additional defenses for their cyber operations.

“Cyber attacks have become the number one threat to many Thai businesses because their systems are accessible and vulnerable,’’ said Prathan Phongthiproek, Cyber Security Manager at KPMG in Thailand. “In the past two or three years we’ve seen an increasing number of cyber attacks, including those using ransom-ware, and so the issue is gaining in importance.”

Thailand is the fifth-largest market for cybersecurity in Southeast Asia, according to Global research firm Frost & Sullivan, but Thai spending on cybersecurity has lagged behind many other countries in the region. Fortinet executives believe that makes Thailand a potentially high-growth marketplace for cybersecurity solutions. Thai firms spent an estimated $68 million on cybersecurity in 2017, the company said.

Chanvith Iddhivadhana, Fortinet’s Thailand country manager, said that many Thai firms have created what he calls a “Frankenstructure” of cybersecurity, a play on the term Frankenstein’s monster. As companies expand their cyber-defenses to different departments with different functions and needs, they source different security products from different firms. This patchwork is often difficult to manage and not always effective, he said.

He believes Fortinet can excel in the Thai market by offering customized and comprehensive cybersecurity solutions to replace those patchworks. He refers to these solutions as a ‘fabric’ woven from different security products into a tightly knit platform.

The fabric can include between 30 and 100 of the leading cybersecurity products favored by corporate customers in Thailand and around the world. Among them are products from IBM Security, McAfee, Micro Focus and NEC Corporation.

“With the cybercrime landscape becoming increasingly complex, collaboration between cybersecurity leaders is more important than ever,” Rich Telljohann, IBM Security’s director of business and corporate development, told the Bangkok Post.

“The creation of open API ecosystems like Fortinet’s Fabric-Ready Partner program makes it easier for cybersecurity teams to create a more seamless line of cybersecurity defense,” he added.

Before 2015, large cybersecurity providers like Fortinet and Cisco were losing market share to small niche players. But that has changed during the past three years. More firms have been searching for comprehensive solutions, and the five largest security vendors should increase their share to 40 percent of the market, translating to an average growth rate of 20-30 percent, according to Morgan Stanley.

資料來源:
http://thaiembdc.org/2018/05/14/fortinet-competing-to-provide-cybersecurity-for-thai-banks/

Fortinet Doubles Down on Mobile Core Security and Managed Security Services at Mobile World Congress

he Mobile Security and Managed Security Services Zone area that we’re setting in up in our booth at this year’s Mobile World Congress (MWC) places Fortinet at the center of one of the most innovation-intensive sectors of Communication Service Providers (CSPs). The dawning era of 5G is about much more than speeds and availability. Rather, it opens a new era of much richer applications, services, and user experience. While it would be great to have the specifics when it comes to what will be possible, these are still developing—namely, we must remain vague in terms of what 5G will ultimately deliver because it is impossible to predict what will emerge from it. In short, when it comes to 5G, the future is unwritten.

Although 5G standards are still being defined and wide-scale commercial deployments are not expected before 2020, one safe bet is that paving the way to the market acceptance and success of 5G services will require a step-function improvement in security safeguards. Any perception that 5G rests on uncertain security foundations will eat away at user confidence and expose system operators and service providers to disappointing investment returns, not to mention legal and regulatory repercussions.

So, what are some of the 5G security challenges? Following are some of the most prevalent:

• How to secure an agile and virtual mobile core with 5G.

• How to integrate security services in the innovative new services offered with 5G such as Mobile Edge Computing (MEC) and network slicing. 

• How to provide a complete ecosystem of security services to generate new revenue, create competitive advantage, and increase customer loyalty.

5G holds the promise for increased bandwidth, multitenant-edge computing, and a multitude of innovative services, that will likely empower immersive virtual reality, autonomous ground and air vehicles, machine learning, and artificial intelligence. To successfully launch and maintain customer confidence in these new capabilities, 5G infrastructures will require security that is powerful, scalable, integrated, and agile.

Digital transformation at the CSP and their customers also amplifies the role of managed security service providers CSPs and MSSPs in safeguarding organizations infrastructures, applications,  and services. The complexity and dynamic nature of the threat landscape, the pace of adversary innovation, and the global security practitioner shortage provide CSPs and MSSPs an opportunity to provide more managed security services that add value and generate savings for their customers while enabling their digital transformation. To do so, MSSPs need to leverage a security-fabric infrastructure that enables the provisioning of a wider range of integrated and automated managed security services in a variety of delivery and consumption modes to satisfy their customers’ requirements.

In addition to engaging visitors to the Fortinet booth in productive conversations about the future of mobile core security and managed security services, we’re planning practical demonstrations of some core capabilities such as:

·LTE and 5G mobile core security

·Security service chaining

·Ways in which MSSPs can leverage the Fortinet Security Fabric as part of their services-delivery framework

We also plan formal presentations in our booth theater on topics focused on delivering services for next-generation mobile networks:

Security in LTE/5G Mobile Core

Synopsis: The mobile core network requires high performance security solutions to ensure service level attainment without compromising security. With the move to 5G and the virtualization of mobile infrastructure, bandwidth and data volumes will grow, and new services and technologies will take hold. Security must meet all these changes and provide an answer in this new environment. This presentation will briefly touch on the challenges and solutions in securing the mobile core.

Security Services for Mobile Edge Computing

Synopsis: Enabled by 5G and driven by the digital economic/social transformation, MEC will drive innovation in many industries and market segments. The promise of the mobile edge to provide multitenant, high bandwidth and low latency computing, cloud services, machine learning and more, can fully blossom only when security services are part of this environment. This presentation will look at different security services that cellular service providers must take into effect when delivering MEC.

The ABCs of Delivering Security as a Service (SECaaS)

Synopsis: The growing complexity and sophistication of threats and threat actors, stringent new government regulations, and a growing security practitioner shortage, pose significant challenges to organizations in achieving their security and posture goals. Organizations looking to CSPs/MSSPs to provide a growing number of security services, value-add, and knowledge, all in an integrated and automated fashion to meet needs for agility and security. This presentation will describe basic building blocks for delivering a powerful and competitive security-as-a-service (SECaaS) to enterprises and organizations of all sizes.

These presentations will take place once daily over the four main days of the Congress, February 26, 27, 28 and March 1, in the Fortinet Booth, Hall 7, Stand 91 at the Congress. For full details on Fortinet’s appearance at the 2018 Mobile World Congress, visit our webpage dedicated to this subject. You can also use this site to review to see our presentation schedule and set up meetings with Fortinet representatives. The Mobile World Congress website contains, of course, official information on the event itself.

Barcelona is one of the great cities of the world and should be on everyone’s “bucket list.” By visiting Fortinet at this year’s Mobile World Congress, you can combine business, pleasure, and cultural enrichment. And who can beat that kind of value proposition?

Source:
https://www.fortinet.com/blog/business-and-technology/fortinet-doubles-down-on-mobile-core-security-and-managed-security-services-at-mobile-world-congress.html

Strengthening the Security Fabric of Blockchain

Strengthening the Security Fabric of Blockchain

by Hemant Jain  |  Jun 20, 2017  |  Filed in: Industry Trends

 

Blockchain is a shared and continuously reconciled database used to maintain a list of digital records, called blocks. It is quickly becoming an important tool not just for financial information, but also for managing and recording virtually all types of data, such as medical and other records, identity management, and transaction processing.

Because a blockchain database is distributed and interconnected, it provides several essential services. The first is transparency. Because data is embedded within the network as a whole, it is by definition public. The second is that it is difficult to corrupt because altering any unit of information on the blockchain would also modify all subsequent blocks unless huge amounts of computing power are used to override the entire network. Next, because it is distributed, it cannot be controlled by any single entity. And for that same reason, it also has no single point of failure.

While blockchain was first adopted by BitCoin to manage and secure transactions, mainstream organizations were skeptical and slow to adopt it. But according to the recent PwC Global Fintech Survey 2017, blockchain is now moving out of the lab.  77% of organizations surveyed now expect to adopt blockchain as part of an in production system or process by 2020.

Key capabilities of blockchain include:

• Mutual:
  • A blockchain is shared across organizations,
  • Owned equally by all, and
  • Dominated by no one.
• Distributed:
  • Blockchain inherently uses a multi-locational data structure,
  • And any user can keep his or her own copy.
• Ledger-based:
  • Blockchain units are immutable, meaning that once a transaction is written it cannot be erased,
  • And because the ledger is public, its integrity can easily be proven.

 

Blockchain technology by its nature establishes assurance, and significantly reduces the need for processes and controls for reconciliations, confirmations, and identity.

As a result, a Blockchain infrastructure is essentially a permanent timestamping engine for computer records. These timestamps can be used for such things as proving that data elements were entered at or before a certain time, and that they have not been altered.

Attack Surface of a Private, Permissioned, or Consortium Blockchain

Blockchain technology does not include the built-in functionality of user roles or access controls. Because everyone has the ledger, everyone can read it. Roles and access controls are something that can always be added at the application layer.

In an un-permissioned blockchain, like those used for cryptocurrencies such as BitCoin, anyone can access and update the blockchain. Everyone has permission. New transactions are added to the ledger and inconsistencies resolved by a scheme in which users with the most resources win.

For permissioned or consortium based blockchains, however, organizations will need to run them within a secure environment, such as a security fabric architecture, that can provide essential services across the entire distributed environment, such as access control, privacy, key management, and protection against attacks such as denial of service.

Security Fabric Component 1: Access Control and Privacy

When used by a consortium or private entity, most enterprise blockchains will be permissioned. In such blockchains, a governance structure has to be defined. This structure ensures which users can view or update the blockchain, and how they can do it. This establishes a consensus process that is controlled by a pre-selected set of nodes and predefined rules of governance. For example, if you have a financial organization of 25 institutions, you may want to establish a rule requiring that at least 15 of them must sign a block in order for the block to be valid.

While blockchain technology guarantees integrity, security components such as access control and privacy are things that need to be overlaid. It is important that all participants be protected from unauthorized access. So, in a permissioned blockchain, outsiders should not be able to tamper with the ledger. Therefore, the administrator of the permissioned blockchain must minimize its attack surface. In practical terms, this means that every participant is a target, and that traffic to and from participating entities must be protected using policies.

Security Fabric Component 2: Secure Key Management

A secure blockchain application requires the secure management of user private keys. Insecurity of keys can severely impact the confidentiality and integrity of data. Therefore, the same technologies that are typically put in place to address such concerns elsewhere should be used to secure these keys. Blockchain by itself doesn’t make establishing this sort of control any easier or harder than with other technologies. The protection of these can be ensured using a variety of methods, including physical access control, network access control, and a key management solution that includes generation, distribution, storage and escrow, and backup etc.

Security Fabric Component 3: Distributed Denial of Service (DDoS)

Blockchain transactions can be easily denied if participating entities are prevented from sending transactions. A DDoS attack on an entity or set of entities, for example, can totally cripple the blockchain organization and the attendant infrastructure. Such attacks can introduce integrity risks to blockchain by affecting such things as consensus. Therefore, blockchain architects must work with their security counterparts to ensure the availability of the infrastructure via such methods as building strong DDoS attack mitigation directly into the network.

Conclusion

Blockchain is a critical component of the digitalization of the economy. When adopted, it will certainly revolutionize a variety of businesses. But the success of blockchain will greatly depend on how robust cybersecurity is to ward off threats from all directions.



資料來源: Fortinet
https://blog.fortinet.com/2017/06/20/strengthening-the-security-fabric-of-blockchain

Fortinet FortiGuard Labs Cyber Threat Research Helps Uncover Fraudsters Behind Thousands of Online Scams Totaling More than $60 Million

Fortinet FortiGuard Labs Cyber Threat Research Helps Uncover Fraudsters Behind Thousands of Online Scams Totaling More than $60 Million

Successful Operation to Combat Cybercriminals is the Result of Close Cyber Threat Information Cooperation Between Fortinet and INTERPOL

SUNNYVALE, Calif. – August 1, 2016

Derek Manky, Global Security Strategist, Fortinet
“Fortinet is taking action to fight cybercrime not only via product and services innovation with our Fortinet Security Fabric, but also global public and private sector relationships. It’s been a long tradition in the security world to share information on applied threat research, such as intelligence and analytics as well as newly discovered threats or vulnerabilities. But to help us all get ahead of threats instead of just chasing them, security vendors have a responsibility to share threat findings between public and private organizations. The best way to combat the negative impact of cybercriminals is partnership based on actionable intelligence from wide and diverse sources. Cybercrime has no borders, and this is an excellent example of a global collaborative effort to solve what is indeed a complex problem. We need to set examples and go after the Achilles heel - the malicious actors and their assets.”
 

Noboru Nakatani, Executive Director of the INTERPOL Global Complex for Innovation
“The public, and especially businesses, need to be alerted to this type of cyber-enabled fraud. It is exactly through this type of public and private sector cooperation that INTERPOL will continue to help member countries in bringing cybercriminals to justice no matter where they are.”
 

News Summary:
Fortinet® (NASDAQ: FTNT), the global leader in high-performance cyber security solutions, today announced that Fortinet FortiGuard Labs threat research helped uncover a global cybercrime fraud ring behind thousands of online scams.
 

News Highlights:

• Fortinet FortiGuard Labs cyber threat research helped uncover a group of online fraudsters behind thousands of online scams totaling more than $60 Million and involving hundreds of victims worldwide. The group runs 419 scam, dating scam, Alibaba scam, financial account hi-jacking and payment diversion fraud with worldwide targets. They also leveraged an extensive money laundering network in order to disburse funds.
   
• The fraudsters deployed two types of social engineering scams targeting businesses through either payment diversion fraud or CEO fraud. This reinforces the prevelance of an advanced threat technique called “behavior blending.” Behavior blending is a technique used by criminals that allows them to blend in on a compromised network, which has a lot of potential for thwarting detection over sustained periods of time.
   
• As a result of Fortinet’s actionable cyber threat intelligence, the head of the international criminal network was arrested in a joint operation by INTERPOL and the Nigerian Economic and Financial Crime Commission (EFCC) in June 2016.
   
• The successful operation is the result of close threat information cooperation between Fortinet and INTERPOL.
   

Fortinet Directs Future of Cyber Threat Intel Through Strategic Global Partnerships

Fortinet is actively directing the future of threat intelligence standards and protocols through its ongoing collaboration with global law enforcement, government and industry organizations. Actionable threat intelligence cannot be achieved without a strategic methodology and standardization in place to define global cybersecurity standards.

Fortinet has been an active member of an expert working group with INTERPOL for more than a year to provide the cyber threat intelligence that helped discover and identify this latest cybercrime fraud ring. Additionally, Fortinet earlier this year announced an industry partnership agreement within the framework of the NATO Industry Cyber Partnership (NICP) with the NATO Communications and Information (NCI) Agency. Fortinet is also a founding member of the Cyber Threat Alliance (CTA) and a member of the OASIS Cyber Threat Intelligence (CTI) group, helping drive collaborative threat intelligence and information sharing forward for the benefit of global welfare and economies.
 

Additional Resources:

• Learn more about the Fortinet Security Fabric.
• Read more about information sharing on our blog.
• Follow Fortinet on Twitter and LinkedIn and Facebook.  

資料來源: Fowtinet 網站
https://www.fortinet.com/corporate/about-us/news-events/press-releases/2016/fortiguard-labs-cyber-threat-research-helps-uncover-fraudsters.html