VM Backup, Hornetsecurity’s award-winning virtual machine backup and replication solution, received recognition in a recent comparison study by SoftwareReviews.

SoftwareReviews named Hornetsecurity a market leader in Backup and Availability as we proved to be the top contender, setting the benchmark with a category-leading composite satisfaction score of 9.1/10.

Earning the top overall feature satisfaction score as well as being the leading provider in both virtual machine backup and deduplication implementation, is something we are proud to have achieved.

We at Hornetsecurity are committed to providing a reliable, no-fuss backup solution when needed. Therefore, our VM Backup service is designed specifically for small and mid-market businesses, and we have put a lot of thought and care into creating a product that meets the needs of our customers.

Outstanding Feedback: VM Backup Is The Top Value Driver

Adding to this, customers acknowledged us and our product as an important value driver for their businesses. They commended Hornetsecurity’s VM Backup and disclosed that the product was critical to their professional success.

It gives us great pride to have attained such a high level of customer satisfaction. Customers said they were likely to recommend us to others and were super satisfied with the premium-level support we deliver. This rate of satisfaction is a true testament to the quality of our product and the level of service we provide.

Get VM Backup V9 And Experience It For Yourself

Discover 9 reasons why choosing VM Backup V9 as your backup solution for Microsoft Hyper-V and VMware virtual machines is the right thing to do and how this will benefit your business.

Ransomware attacks on the rise – companies are in need for high level data security & disaster recovery

As the number of cyber-attacks is increasing, more and more companies are becoming the prime targets for cybercriminals seeking to access sensitive data. According to our recent Cyber Security Report nearly 6 in 10 ransomware attacks originated from malicious email or phishing attacks.

What makes ransomware attacks especially lucrative for cybercriminals is the fact that 7% of victims end up paying the ransom. While cybercriminals benefit, the costs of downtime, data loss and paid ransoms, can easily reach $ 1 Million for targeted businesses.

Even more concerning is the fact that our 2022 Ransomware study brought to light that up to 15% of ransomware attacks specifically targeted backups. This highlights the need for resilient backup solutions for Microsoft Hyper-V and VMware virtual machines.

Here is why VM Backup is the perfect solution to back up and replicate your data

Although the number of ransomware attacks is increasing, backup and disaster recovery are often neglected. However, if you ask IT professionals, there are some key functionalities that are mentioned again and again when it comes to best practice backup solutions:

A backup and replication solution must provide flexibility and power to give you confidence in your backup strategy. The user interface must be user-friendly, the setup needs to work quickly – and ideally, everything can be managed via a central platform.

You need to be able to replicate data to an offsite location or a removable drive, to be able to restore individual files or emails, restore from different points in time, verify backup integrity, and minimize downtime.

After all, corporate data must be reliably protected against the latest cyber threats and, in the event of an emergency, must be able to be restored quickly and effortlessly at any time.

 1. Easy to install

2. Centralized management

3. Ransomware protection leveraging Immutable Cloud Storage

4. Massive storage savings – up to 65 percent – by using Augmented Inline Deduplication

5. WAN-optimized replication

WAN-optimized replication enables users to be back up and running in minimal time should disaster strike. It enables administrators to replicate ongoing changes on their VMs to a remote site and to seamlessly continue working from the replicated VMs, should something go wrong with the live VMs.

6. Continuous Data Protection (CDP)

Continuous Data Protection (CDP) enables customer to set automatic scheduled backups of virtual VMs as frequently as every 5 minutes. CDP ensures that, should a data loss scenario occur, only a few minutes of data are lost. This quick disaster recovery ensures dramatic reduction in data loss, saving companies time and money while minimalizing hassle.

7. The 3-2-1-1 backup strategy

8. 24/7 outstanding support

9. Seamless cloud backup to Microsoft Azure, Amazon S3 and Wasabi

Users can simply enter their account details and store their offsite backup copies with their provider of choice. This way, customers can easily make a backup copy of their data direct to Azure, S3 or Wasabi, as well as to a local disk, network path or a Hornetsecurity Offsite Backup Server. Using cloud storage services should definitely be part of your backup and disaster recovery strategy (see also 7.).

We at Hornetsecurity work hard perpetually to give our customers confidence in their VM Backup strategies.

Ready to use the best solution to back up your Microsoft Hyper-V and VMware virtual machines (VMs) and physical Windows servers?

Download a full trial of VM Backup for 30 days and see how easily you can securely back up and replicate your virtual machines. 24/7 support included.

FAQs

A severe security vulnerability has been discovered in Microsoft Outlook, which is currently being exploited by cybercriminals. The vulnerability, identified as CVE-2023-23397 with a CVSS score of 9.8, permits a remote, unauthorized attacker to compromise systems simply by transmitting a specifically crafted email. This malicious email enables the attacker to gain unauthorized access to the recipient’s credentials. Hornetsecurity detects emails that exploit the vulnerability and quarantines them to prevent emails from reaching the victim’s inbox.

The exploit is initiated by fetching and processing a malicious email by the Outlook client, potentially leading to exploitation even before the email is displayed in the preview pane. It triggers a connection from the victim to a location controlled by the attacker. This results in the leakage of the victim’s Net-NTLMv2 hash, a challenge-response protocol used for authentication in Windows environments. The attacker can then relay this information to another service and authenticate as the victim, further compromising the system.

The complexity of the attack is low and it has been seen in the wild according to Microsoft, with the exploit being used to target the European government, military, energy, and transportation organisations. It was initially reported to Microsoft by CERT-UA (the Computer Emergency Response Team for Ukraine).

A proof-of-concept created by the Hornetsecurity’s Security Lab team demonstrates that the exploit is hard-to-detect since all anti-malware and sandbox services incorporated into VirusTotal were unable to recognize it as malicious.

Affected Versions

The critical Microsoft Outlook vulnerability impacts both 32-bit and 64-bit versions of Microsoft 365 Apps for Enterprise. Additionally, Office 2013, 2016, and 2019, as well as LTSC editions, are susceptible to the attack.

Recommendations

Hornetsecurity’s users are protected by the Spam and Malware Protection and Advanced Threat Protection services against inbound threats. To better protect your organization, we recommend the following steps in accordance with Microsoft’s advice:

1. Administrators should block TCP 445/SMB outbound traffic to the internet from the network using perimeter firewalls, local firewalls, and VPN settings. This action prevents the transmission of NTLM authentication messages to remote file shares, helping to address CVE-2023-23397.
2. Add users to the “Protected Users Security Group” in Active Directory to prevent NTLM as an authentication mechanism. This approach simplifies troubleshooting compared to other methods of disabling NTLM. It is particularly useful for high-value accounts, such as domain administrators.
3. Microsoft has provided a script to identify and clean up or remove Exchange messages with UNC paths in message properties. The script can be found at https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/. Administrators should apply the script to determine if they have been affected by the vulnerability and to remediate it.

The likelihood of more widespread attacks targeting the CVE-2023-23397 vulnerability is expected to increase as public proof-of-concepts are already released. We therefore highly recommend that all users of Microsoft Outlook apply the security patches provided by Microsoft as soon as possible.

The Security Lab at Hornetsecurity continues to monitor the threat landscape to ensure that our customers are protected from the latest cyber threats.

1 in 5 I.T. pros say remote workers are not secure, survey finds

Key takeaways from the 2022 Remote Management Survey by Hornetsecurity

• 18% of I.T. professionals believe that remote employees are not working securely and that company data is at risk
• 8 out of 10 I.T. professionals believe that remote working conclusively introduces cybersecurity risks that are otherwise not present.
• According to 3 out of 4 I.T. professionals, employees are using personal devices to access sensitive company data
• 1 in 3 organizations does not provide cybersecurity awareness training to remote employees
• 1 in 6 organizations has suffered a cybersecurity incident directly related to remote working

About the 2022 Remote Management survey

Remote Working in 2022

Close to 1 in 5 I.T. professionals (17.9%) say workers are not secure when working remotely

3 in 4 IT professionals (73.8%) say that employees can access sensitive work-related data through their personal devices

14% of respondents said their organization suffered a cybersecurity incident related to remote working

What are the main sources of remote work related cybersecurity incidents?

28.1% of our remote management survey respondents reported that ‘compromised endpoints’ and ‘compromised credentials’ were the main reason for security incidents.

When it comes to compromised endpoints, the explanation is fairly obvious – as users travel and work in different locations, there is a higher possibility of losing devices that contain sensitive data. The risk of this is intensified when one considers the relatively high amount of personal devices that have access to sensitive data that do not have any endpoint configuration to help protect against unauthorized access.

Credentials becoming compromised through the threats of social engineering and email phishing attacks are also equally common. Remote working exacerbates this risk as users are more isolated and less likely to be able to identify threats alone. In comparison, those in the office may have more instant access to other colleagues who can help verify communication before communicating sensitive information. The solution to this particular issue is two-pronged. Firstly, a robust email security suite can eliminate a significant portion of inbound threats before they even reach end-users. For the threats that do reach their intended target, cybersecurity awareness training such as the programs offered by Hornetsecurity can hugely impact the potential of a data breach.

15.7% of respondents also cited uncontrolled file sharing as a source of cybersecurity incidents. Cloud storage platforms have become essential for remote work operation, but sharing access to files on these platforms with third parties introduces significant risks. User error that results in access being provided to sensitive company data to unauthorized individuals is a serious risk, and is relatively common. Stringent access and authorization processes need to be put in place in order to avoid such occurrences.

Just over 1 in 10 (11.6%) of respondents that reported a remote-work related cybersecurity incident said that unsecured or public networks were the root cause. While endpoint security might be in the control of most I.T. departments, the networks that users connect to add another layer of risk that is not always accounted for. While relatively uncommon, users could be victim to attacks such as Wi-Fi spoofing in public areas. For example, a cybercriminal may name a remote Wi-Fi hotspot the same name as a local coffee shop, tricking users into joining said network and compromising their endpoints.

The least common source of cybersecurity incidents per this survey was lack of physical security or privacy in public places. While this is an extremely low-tech form of cyber attack, it was still reported by nearly 1 in 10 of incident victims. This serves as a reminder that there are some security considerations that cannot be handled through any digital remote management tool, and rely solely on users’ awareness of their surroundings.

Which companies are most at risk of remote work cybersecurity incidents?

Almost half (47.6%) of employees in the respondents’ organizations work remotely

4 in 5 IT professionals (79.5%) think that remote work introduces cybersecurity risks that are not present when working on-premise

1 in 3 organizations do not provide any cybersecurity awareness training to users who work remotely

How confident are IT professionals in their remote security measures?

What are the most commonly used security features for remote management?

How do organizations handle device management for their remote employees?

What is the most popular endpoint management tool used for remote employees?

Group policy (60.7%) is the most popular endpoint management tool used by organizations, followed by RMM Tools (43.4%).

Over 1 in 10 respondents (10.9%) say that they do not use any endpoint management system.

Employees are less confident in their company’s remote IT security than I.T. professionals.

Psychological profiles of hackers and I.T. professionals

Full 2022 Remote Management survey results

If you’d like to take a look at the ransomware data, feel free to peruse the survey results here.

About the 2022 Remote Management survey respondents

How is IT handled in the surveyed organizations?

What is the size of the organization the survey respondents work for by number of employees?

How many years of IT experience do the respondents have?

How many years of IT experience do the respondents have?

Conclusion

In the age of the internet, cyber security has become an increasingly important issue. With so much of our lives now taking place online, it’s more important than ever to make sure our business and personal information is safe from hackers. In this article, we will be discussing the future of cyber security to help you ensure that your company is well-prepared to combat cyber threats in 2023.

Cyber security professionals are constantly battling and trying to stay on top of the latest trends and threats in the industry.

What are the major future concerns in cybersecurity?

• More sophisticated attacks: As technology becomes more advanced, so do the techniques of those who wish to do us harm. Attackers are always looking for new vulnerabilities to exploit.
• Increase in the number of connected IoT Devices, increasing chances of cyber security threats
• Ransomware continues to tarnish businesses
• Phishing is still the most effective way for an attack to happen

1. More Sophisticated Attacks

We can expect that cyber attacks will continue to become more sophisticated in the future of cyber security. Cyber criminals are always finding new ways to exploit vulnerabilities in systems, so cyber security experts must always stay one step ahead for the future of cyber security. As long as there are people who want to take advantage of businesses and others online, there will be a need for strong cybersecurity measures.

Since the technology landscape is getting more complex each and every day, it is impossible to have products and environments that are 100% secure. There is no such thing as a 100% secure environment or a business/individual that will not get attacked.

Think about the numerous online accounts you have – banking accounts, social media accounts, email accounts, services, gaming services, work accounts, etc. Chances are some of these services you use have appeared in the news for data breaches or cybersecurity incidents.

The reality is no organization is safe from an attack. Organizations must have a cyber security plan in place that provides data security – data redundancy and multiple layers of defense to mitigate the impact left of a attack.

The future of cyber security will continue to be complex. More use of the cloud, increasingly complex APIs, and deep dependence on these systems easily allows for areas of mistakes and misconfigured settings to be overlooked by security teams and security architects. Due to these unseen items, multiple opportunities for attackers to exploit these vulnerabilities are available.

Sometimes, the attackers know about vulnerabilities before the organizations that manufacture the products find out about the vulnerabilities themselves, these are called Zero Days – Vulnerabilities that have no patch currently available from the organization.

TThe most recent vulnerability like this was for an open-source software package called Log4J that is/was widely used throughout the industry. The Log4J utility was found to contain one such zero day vulnerability that caused havoc among the cyber security community and had security teams and security experts working constantly trying to resolve the issue.

Other notable Common Vulnerability Exposures (CVEs) are – Microsoft Exchange Server Elevation of Privilege Vulnerability[1] – October 2022 and Apple Memory Handling Issue – CVE-2022-32932[2]

As we create more complex technologies, cyber criminals will be on the lookout to understand these complexities and find ways to continue to exploit them for their advantage.

2. Increase in the number of connected IoT Devices

A second item we can look for in the future of cyber security, is the number of Internet of Things (IoT) devices that will be connected. IoT devices are hardware that connect wirelessly to a network.

These can range from smart thermostats, clocks, refrigerators, washing machines, etc. As IoT devices become more affordable and popular with smart home enthusiasts, and the general population implementing these in their home, the numbers are expected to increase.

This increasing number of devices also brings an increase in vulnerabilities. In 2022 there were over 10 billion devices[3] that were connected to the internet.

The issue with these devices is that they usually come with default usernames and passwords from the manufacturer. The average user is not familiar with how to change the default credentials to something stronger. This leads to attackers searching for devices using websites like shodan.io trying to force their way in with a standard username and password combination that is available on the web, directly from the manufacturer.

Additionally, some devices have vulnerabilities that attackers can exploit to control or steal personal information.

There have been instances of IoT devices that are used to be part of a bigger operation, such as botnets to create Denial of Service (DoS) attacks.

With these vulnerabilities present in IoT devices, the number will only be increasing. What we anticipate in the future of cyber security for IoT devices is that by 2030, the number of IoT devices is projected to rise to 29.4 billion connected devices[4].

3. Ransomware continues to tarnish businesses

Ransomware continues to be a top cyber threat to businesses and individuals alike. According to one of our recent surveys regarding ransomware[5] one out of every five companies falls victim to ransomware with the average downtime associated with the attack being 21 days. Despite the fact that ransomware attacks have been on the rise in recent years, many businesses are still not taking the necessary steps to protect themselves.

This is often because businesses underestimate the threat or believe that they will never be targeted. However, as we have seen time and time again, no business is safe from cyber-attacks, especially small to medium-sized businesses – around 50% of SMBs implement cybersecurity measures[6].

Ransomware has evolved so much that it is now a business model for threat actors. Appearing on the scene is Ransomware as a Service (Raas). This service allows potential buyers to attack their victims with much ease. Instead of having to code your own program and trying to infect a computer. You can purchase software that does this dirty work for you.

Supply Chain attacks are another method that ransomware uses to disrupt everyday business processes and flows. Businesses that use a certain service might notice the website or services of that third party have stopped working. At times this is due to a ransomware attack on a third party or supply chains. This disrupts the business flow of the affected party and any other clients or organizations the third party does business with.

Not surprisingly as ransomware attacks have increased, so have the payments. Ransomware payments continue to rise and are projected to cause around $30 billion in damage by 2023. [7]

The reason why payments have gone up depends on the criticality of the data, helping attackers set a valuable price on these assets. Additionally, when businesses pay the ransom, the attackers see this method of attack working effectively, leading to more software being developed and pushed to cripple users and businesses by making them pay for their valuable data.

Even if a victim decides to pay the ransom demands, there is no guarantee that they will be receiving the data. Some attackers have even made victims pay the ransom, then refuse to decrypt the files, only to demand payment a second time!

Notable companies that have suffered ransomware attacks are – NVIDIA, JBS, and Garmin.

So for the future of cyber security, we can expect this trend to continue.

4. Phishing is still the most effective way to launch a cybersecurity attack. For the future of cybersecurity, this will continue being a top attack vector.

With work from home on the rise, it’s hard to train users on practices related to good cyber hygiene. Particularly, when it comes to phishing emails and how to spot them. Phishing is still one of the most effective ways for an attacker to infiltrate an organization’s network and access sensitive data.

According to an analysis of 25 billion emails by Hornetsecurity[8] nearly 40% of attack methods via email were phishing related.

It’s become readily apparent, that end-users continue to be the weakest link in the defense chain. By providing regular end-user security awareness training, businesses can help to mitigate this very popular attack method.

The same report found that no organization is immune to these style of attacks. While it is true that there is a perception that SMBs fall victim more often (likely due to less budget for IT security), our study found that all industry verticals are at risk.

There are plenty of scams out there that try to trick users into providing their work information, and personal information, or duping them out of their money. Most notable are the urgent emails from the CEO asking for you to purchase gift cards or for users to download malicious files in the form of PDFs, Word, or Excel files.

As provided by a survey conducted by Hornetsecurity on the topic of email security [9], here are some statistics on Phishing attacks –

• 62% of all breaches are caused by compromised passwords & phishing attacks
• Companies between 201-1000 employees are the most vulnerable to email security breaches like phishing.
• Phishing attacks lead to data loss, and malicious software being installed. Some frequently targeted industries are healthcare, manufacturing, and finance, but again our data shows that all industries are a potential target. Critical public infrastructure (such as power, food, and supply chains) have also been attacked through phishing attacks.

Attackers have gotten noticeably better with their phishing attacks. So much so that for the year 2022 and the future of cyber security, attackers are looking at ways to send emails that look like they have been sent from inside your organization. This is known as spoofing. Additional methods of phishing methods are Business email compromise (BEC), social engineering attacks, and finally human error.

Humans play a vital role in understanding and protecting their organization from cyber security incidents. You are either your first line of defense or your last – it doesn’t matter how you look at it. In 2021, 44% of security events were caused by employees being tricked by a phishing campaign. [10]

As phishing threats have evolved over the years and have done more damage than before, phishing has no sign of slowing down. A simple yet effective way for attackers to gain access to a system, steal personal data or breach an entire company are through sending carefully crafted emails that users will not think twice about clicking.

Wrapping up the future of cyber security

In conclusion, we can expect the future of cyber security to be more complex and challenging than ever before. New technologies, complex designs of security architecture, and mis-configurations of software can lead to an increase in cyber risks and cyber threats that violate the confidentiality, integrity, and availability of corporate resources.

Statistics show that old attack techniques are still relevant and increasing every year. The threats we face will continue to evolve, and we will need to adapt our defenses and cyber security strategies accordingly to combat new threats and old threats.

Our best hope is for cybersecurity professionals to stay ahead of the curve by investing in research and development, staying informed about the latest developments in the field, and being one step ahead of threat actors.

In the future of cyber security, you can expect the four trends above to make a significant impact.

Learn more about the future and current state of cyber security in our Cyber Security Report 2023.

The Basics of Machine Learning Capabilities

What is Machine Learning?

Types of Machine Learning

Machine Learning Use Cases in Cybersecurity

Wrap up