Defensys has updated Defensys Threat Intelligence Platform (TIP) to version 2.5. Key changes have affected the logic of enriching Indicators of compromise, working with the bulletin tool and vulnerability cards, and there have also been major changes in the system interface.

In the new version of Defensys TIP, the logic of enriching IoCs has been improved with additional context. Now users can configure the maximum number of days for storing enrichment data. After the specified period, the system will automatically re-request the enrichment data, which will help users process information related to indicators more accurately.

A significant part of the improvements in the new version of Defensys TIP is related to improvements in the bulletin tool. Threat and vulnerability bulletins are used to inform employees / community / customers / colleagues about new security threats, current vulnerabilities in software and hardware relevant to a particular infrastructure or organization. The platform now has the ability to create bulletins for multiple vulnerabilities, while in the new version it has become even more convenient to work with the vulnerabilities section: the presence of a bulletin and its identifier are displayed for each vulnerability.

Sometimes it is rather hard to briefly explain what threat intelligence means since many things depend on the context in which the term is used: this may be both a process and an action. There is a number of academic terms, for example, from Gartner and SANS Institute.

TI definitions

Cyber threat intelligence is a knowledge about adversaries and their motivations, intentions, and methods that is collected, analyzed, and disseminated in ways that help cybersecurity and business staff at all levels protect the critical assets of the enterprise.

Definitive Guide to Cyber Threat Intelligence

Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.

Gartner, McMillan (2013) from Tactics, Techniques and Procedures (TTPs) to Augment Cyber Threat Intelligence (CTI): A Comprehensive Study

The set of data collected, assessed and applied regarding security threats, threat actors, exploits, malware, vulnerabilities and compromise indicators.

SANS Institute

Defensys announces the out-of-the box support of SAMA framework and GDPR since the current version of the SGRC platform. Now users can perform audits with these standards along with other preinstalled entities and add new requirements to the existing control checks framework.

“During the latest projects of the SGRC in the GCC region especially in the KSA we’ve seen the demand in compliance procedures with these frameworks, so we made it available for all our customers. These are not only lists of requirements but also customised assessment scales, fields for each of the requirements and a possibility to add these requirements into the existing control checks framework, when similar requirements from different standards are mapped with a control, that you assess once and this information is used by Defensys SGRC to automatically set the proper assessment for the requirement inside a specific compliance procedure with a specific standard.

And our customers still have the ability to add their own frameworks and check-lists just using Settings menu of the system without any programming. In our opinion this feature will help cybersecurity specialists to save even more time for performing compliance campaigns with all the local and worldwide standards. In the nearest future we plan to expand this list with frameworks from UAE” – says Andrey Chechetkin, Deputy CEO of Defensys.

Cybersecurity news

• Elementor, a WordPress website builder plugin with over five million active installations, has been found to be vulnerable to an authenticated remote code execution flaw, that could be abused to take over affected websites.
• Threat actors have launched a new marketplace called Industrial Spy that sells stolen data from breached companies, as well as offering free stolen data to its members. Industrial Spy promotes itself as a marketplace, where businesses can purchase their competitors’ data to gain access to trade secrets, manufacturing diagrams, accounting reports, and client databases.
• Hackers are increasingly targeting DeFi cryptocurrency platforms. In 2021 alone, about $3.2 billion worth of digital assets were stolen, which was already an explosion compared to previous years.

Defensys took part in the main information security event in the Gulf region – the GISEC-2022 exhibition, which was held on March 21-23 in Dubai, United Arab Emirates (UAE).

During the GISEC-2022, Defensys team presented key products of its own ecosystem: SOAR Platform, Security GRC Platform, Threat Intelligence Platform, and SENSE – high-tech products for building SOC, automating cybersecurity processes, and early detection of suspicious activities. In addition, visitors of Defensys’s booth were the first ones to see the presentation of the new Defensys Threat Deception Platform (TDP) product, a set of technologies for digital imitation of IT infrastructure for detecting intruders and preventing attacks at early stages.

At the event, Defensys experts held quite a lot of business meetings with our existing clients in the Middle East market, discussed current projects and possible further development of a business cooperation. In addition, many distributors and IT companies, who are particularly careful about what information technology vendors they add to their product portfolios showed interest in the expertise of Defensys.

Throughout the days of the exhibition, the guests of the Defensys stand were invited to take part in the discussions on the latest trends in the field of cybersecurity and received qualified answers to their questions.

Defensys has announced the commercial release of the Defensys Threat Deception Platform. Defensys TDP belongs to a class of Distributed Deception Platforms (DDP) that use active deception techniques. It allows you to detect intruders and mislead them by distorting the perception of the corporate network with fake elements.

At the heart of all Deception technologies is the concept that any company is compromised by default. Classical perimeter protection and monitoring tools in today’s reality lose their effectiveness. Sooner or later intruders penetrate an organization’s infrastructure and can spend months exploring it without being detected.

Deception technologies act as one of the last lines of defense, capable of slowing down and identifying the cybercriminal. Using a set of interconnected traps and lures, the system allows you to mislead the hacker, detect his presence on the corporate network early on, and enables you to prevent the attack from developing before it causes significant damage.

The updated Defensys SGRC platform has a new process for handling summary audits. The term «summary audit» refers to an audit that is used to perform a comprehensive audit of one or more assets according to one or different standards. This is a handy tool that allows you to significantly save time when you need to aggregate information from multiple audits. In version 4.7, the summary audit interface became the center from which an expert can manage all the included audits. The user can edit the workgroup, change the status, evaluate requirements, manage remarks, and generate a processing plan from the summary audit. There is now an option to quickly view the asset card included in the assessment area, which displays general information about the category, responsible persons, related assets, and others. A new tab Summary was added that includes a customizable mini-dashboard that contains information on the audit results, check progress, created reports, statistics on open and processed issues.

The platform’s integration capabilities have been significantly increased. Defensys SGRC now includes integration with Skybox and the Tenable Security Center vulnerability scanner. Universal integration using Python has also been added to import asset and vulnerability data from any information source using a script. Asset data can also be obtained through integration with Excel/CSV, JSON, and XML files.

Defensys introduced Threat Intelligence Platform (TIP) version 2.0. This release introduces key changes in the mechanism of ranking indicators of compromise, integration with the Defensys SOAR, and the ability to obtain quality threat intelligence data from new sources.

One of the major updates to the platform was the improvement of the scoring model that calculates the score of the indicators of compromise (IoC). This new model calculates the score based on the statistical metrics. During the calculation a number of parameters are taken into account, such as IoC’s interconnections and all related context, how complete was the received data, and how timely it was delivered in comparison to the other connected sources.  Also, the system takes into account if the indicator was found in the exception list or not. With this advanced TIP scoring model, monitoring center analysts can easily identify the most relevant and malicious IoCs and work with threats that are relevant to them.

Defensys, a global provider of cybersecurity solutions, will participate in the international Gulf Information Security Expo & Conference (GISEC) that is going to be held in Dubai from March 21-23, 2022.

GISEC-2022 is the largest and most significant event dedicated to cybersecurity in the Middle East region. Bringing together more than 300 leading cybersecurity compamies from more than 40 countries, the event will be a major platform for initiating an international dialogue on combating cyber threats, including discussion of key market needs and existing innovative solutions in the field of cybersecurity.

We would like to invite you to visit Defensys booth (D46), where we can demonstrate you all the features of Defensys ecosystem products: SOAR Platform, Security GRС Platform, Threat Intelligence Platform, Defensys SENSE – our products that are specializing in building SOC, automation of cyber security processes and early detection of suspicious activities. And, of course, we would like to tell you in detail about the latest technologies that underlie all of our solutions to protect your business. Our team is always ready to demonstrate the latest versions of Defensys products to everyone and share our implementation cases across various industries.

Defensys has released a new version of its cybersecurity analytics platform Defensys SENSE 1.5. This version introduces several new features compared to the commercial release, which was out in May 2021. The key changes are in the behavioral analysis system. The platform is now capable of training and retraining itself to update behavior patterns in a timely manner. The user can adjust the intervals of automatic re-training to the specific conditions of his infrastructure, so that the programmatic experts receive new information in time and reduce the number of repeated false positive anomalies. Also, by adjusting the retraining intervals, the user can set the frequency of resetting obsolete context across objects, which will avoid the effect of rights accumulation, for example, in the case of employee role changes in the company.