Compromised computers are often exploited for data and identity theft and provide ways for ransomware to enter your network. Early Warning Service (EWS) carries out early detection of potential threats so that you can take appropriate corrective actions.
Cybercriminals are already aware of the known weaknesses in networks, services, and devices. Don't you want to be better informed than they are to stay protected? Early Warning Service (EWS) carries out early detection of the potential threats to a system, highlighting the scope for malicious behavior so that you can take appropriate corrective actions. When it comes to cybercrime, time can be the enemy, but with continuous monitoring and reporting of threats, EWS enables you to get ahead of the criminals.
How can EWS help higher education information security be more effective?
It is sound security strategy to prioritize taking care of the security risks that are easily seen from the outside. The compromised computers and vulnerable services reported by EWS are already visible on the internet to anyone who knows where to look, including malicious actors.
But in higher education, just as in many other sectors today, IT and security teams often have limited resources and more tasks than they can handle. EWS helps them triage issues and prioritize their activities, ensuring that these high-risk issues are not overlooked. Therefore, security threat information available from EWS is high-value for higher education institutions, allowing them to take action to ensure the issues cannot escalate.
EWS's high-value data is also high-quality, as documented by your peers in a higher education white paper released earlier this year. The study found EWS data to be 98 percent accurate—meaning subscribers won't be spending precious time chasing down false positives.Footnote1
How does EWS help with threat data processing?
EWS automatically collects and processes over 15,000,000 observations of cyber incidents and threats worldwide on a daily basis. Observations are collected from over one hundred external sources. This information can be hard to come by, and having access to it can be costly. Responding to threats in a timely matter requires fully automated, large-scale data collection and processing, as well as targeted incident notification.
Why should I use this many sources?
Our service brings together data from multiple third-party data providers. Each provider offers information on specific cybersecurity issues. Data collection methods vary between data providers, and overlap between data sources is generally very low. Different collection methods and geographical locations result in unique datasets, so relying on just one data provider cannot guarantee sufficient coverage. In addition, when a substantial amount of data of the same threat is reported from numerous sources, the signal regarding the specific security issue gets stronger.
Why should I be worried about compromised endpoints?
Compromised computers are often exploited for data and identity theft and provide ways for ransomware to enter your network. Missing just one compromised computer can leave a backdoor that will allow cybercriminals to maintain their foothold within your organization.
Compromised computers make your systems vulnerable to data breaches. According to research conducted by Ponemon Institute, the average cost of a data breach in 2020 was $3.86 million. The most common causes were malicious attacks (52 percent), human error (23 percent), and system glitches (25 percent).Footnote2
Time is the biggest enemy of compromised computers and vulnerable systems. Someone will inevitably exploit them. The key is to spot the problems early and fix them.
Why should I be concerned about vulnerable and open services?
Vulnerable and open services reported by the EWS may indicate a publicly accessible weak point in your network. For instance, these systems may be misconfigured or outdated. Cybercriminals exploit vulnerable computers for data theft and ransomware attacks. They also use the hijacked computers as stepping stones for additional attacks. Unfortunately, breach prevention systems do not usually catch exploitable services, and the communications with those services from the outside may appear as perfectly normal network traffic.
What information is relevant for me from the EWS point of view?
EWS collects cybersecurity information about compromised computers and vulnerable and open services that can adversely affect your organization's security. This information is already available publicly. Cybercriminals know this, and so should you. EWS matches all threat observations to the information we know about your organization. Whenever a match is found, we notify you regarding the specific findings related to your networks.
How hard is EWS to implement?
It's very easy! Just fill out a simple form letting us know your domains and IP addresses and who in your organization should receive the notifications and reports. We will then turn the service on for you.
How affordable is EWS?
EWS is very affordable. If you had to go out and buy this level of intelligence on your own, it would cost you tens of thousands of dollars per month, including the additional staffing to sort through the massive amount of data. We know you do not have that kind of money or time, so we have made this extremely cost-effective. The service also comes with notifications already aligned to your specific assets so that you can act on them immediately.
In addition, our partnership with EDUCAUSE provides you with the chance to get this service at a highly discounted rate.
What are the benefits of EWS?
EWS automatically finds unattended, known security problems that put your organization in danger.
- Periodic notifications about your issues: EWS helps you catch incidents that have passed through other security measures and gives visibility of issues that could be leveraged to effect a breach.
- Quick recognition and prioritization of risks: EWS reduces time to discovery and provides you with ready-to-use information immediately.
- Easy setup and maintenance: Simply tell your assets and start receiving information without complicated configuration or installation processes.
- Centralized coverage: EWS covers your entire network infrastructure and all of your services, including those running in the cloud.
- An additional layer of protection: EWS provides protection that complements your existing cybersecurity investments.
- Low costs: EWS is incredibly affordable.
Try EWS for yourself. It's easy to deploy, and it's free to get started!
To learn more about EWS, reach out to Patrick Healy, [email protected], in North America, or Ashley Benn, [email protected], in Europe.
To learn more about our partnership with EDUCAUSE, visit https://www.arcticsecurity.com/educause.
Notes
- Early Warning Service for Cyberecurity Incidents: A Case Study in Higher Education, white paper, (Oulu, Finland: Arctic Security, January 2021). Jump back to footnote 1 in the text.
- Cost of a Data Breach Report, research report, (Cambridge, MA: IBM Security, July 2020). Jump back to footnote 2 in the text.
Juha Haaga is a Solutions Architect at Arctic Security.
© 2021 Arctic Security.