di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Storage

Prevention for Endpoints

Products

Data Security

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Threat Research

Voice Of SecOps

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

There is a contentious relationship between budgets and cybersecurity.

General consensus has it that bigger budgets equate to better security, but 

cost-of-a-data-breach.png

There is a contentious relationship between budgets and cybersecurity.
General consensus has it that bigger budgets equate to better security, but undoubtedly the security analysts at Desjardins Group would beg to differ. The Canadian lender revealed that it had spent $70 million CAD on its security operations prior to an attack that ended up exposing the personal data of 2.9 million of its members.
A <a href="https://www.csoonline.com/article/3434601/what-is-the-cost-of-a-data-breach.html#:~:text=The%20average%20cost%20of%20a,over%20the%20last%20five%20years." target="_blank" rel="noopener">report conducted by the Ponemon Institute</a> confirmed the upward path in the cost of a data breach, that in 2020 was at $3.86 million. While the impact of suffering from a cyber-attack remains high for all companies, irrespective of how big they are, where they are or what they do, the report did confirm that companies can exert some control in managing the cost of a data breach.
Interestingly, the study found that while there has been a 10% rise in cybersecurity costs over the last five years, 2019 saw a decrease in costs by 1.5%. The researchers attributed this decrease to companies who had taken effective precautions and processes, which contributed to coming out of 2020 relatively unscathed, and yet still in budget.
&nbsp;
<h3>The Costs of a Data Breach that can be Controlled</h3>
Depending on the configuration of a SOC, there are numerous aspects where the costs can be kept under control with the right combination of technological capabilities and processes.
<ul>
<li>Time Managing Endpoint Protection</li>
</ul>
This cost is born out of inordinate management overhead due to the use of multiple endpoint products, burdensome maintenance work, constant updates, and patching required. SOC teams should seek out <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">cybersecurity solutions</a> that have wide platform play and provide protection across different devices, OS, and environments. They should require only the occasional update (ideally, just once or twice a year). This relieves SecOps employees of many of these manual and mundane processes.
&nbsp;
<ul>
<li>Time Investigating Endpoint Threats</li>
</ul>
This includes costs associated with the manual investigation of alerts and addressing false positives. Activities redressing alerts that are ultimately found to be benign, conducting triages and threat hunting activities contribute to a significant consumption in security analysts’ time. To address this security analysts should be using solutions that provide a high degree of detection accuracy (best-in-breed is a 99% and a 0.1% false-positive rate). Also, when considering a new vendor solution, it’s worthwhile to check what manual processes are automated and the degree to which <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener">threat analysis</a> is provided in bite size actionable slices.
&nbsp;
<ul>
<li>Time Remediating Endpoint Attacks</li>
</ul>
This cost includes all the activities undertaken by security engineers in remediating endpoint attacks, such as restoring from back-ups, re-imaging machines, and so on. The coronavirus pandemic upscaled the risk profile of endpoint attacks, not only due to the increase in attempted attacks but also due to added difficulties of remediating attacks on a remote workforce. As the perimeter no longer really exists anymore, SecOps need to refocus their attention on where events are occurring, and that is on the endpoint.
&nbsp;
<ul>
<li>Minimizing the financial loss due to user downtime</li>
</ul>
Endpoint attacks not only create remediation work for an organization’s IT security analysts, but they also impact the productivity of affected employees with the result of causing an organization even further financial loss. With employees working remotely, COVID-19 even further amplified the detrimental impact of an attack. Over the course of the pandemic, average user downtime per endpoint attack went up to 12 hours, as now the affected employee would have to cease work until they were able to obtain a replacement computer and set it up for usage. One of the ways SecOps can minimize the impact of these consequences of being breached is by retiring legacy solutions. Whether it be a legacy EDR or anti-malware software, these solutions simply cannot keep up with the modern threat landscape.
&nbsp;
<ul>
<li>Minimizing Likelihood of a Material Breach</li>
</ul>
Weaknesses in vendor products combined with a remotely located workforce that make it difficult to define the norm in user behavior, create loopholes for attackers to gain a foothold within an organization, especially through endpoint devices. By establishing a security operation that is not constantly flooded with alerts and overwhelmed by investigation activities help to close this window of opportunity. Eliminating alert fatigue allows security operations to pounce on the fewer threats that may manage to still get through.
Beyond these costs, there are also harder to quantify sources of financial loss to business operations. The non-direct impact of a security breach can include brand reputation damage, customer attrition, regulatory fines, customer reacquisition costs, and compensation payouts.
&nbsp;
<h3>Avoiding a Budgetary Journey to Bust</h3>
Despite the multiple moving parts that contribute to the cost-efficiency of a cybersecurity operation, with the right combination of technology, automation and optimal processes, the cost of securing an organization can be brought down. A <a href="https://info.deepinstinct.com/en/mof/deep-instinct-tei-study" target="_blank" rel="noopener">Forrester Total Economic Impact Study</a> found that customers of Deep Instinct were able to reduce their costs by 446%. The study which compiled the responses of customers into a representative organization of 7,000 endpoints managed by a SecOps team of 15 employees, calculated that they were able to reduce security operation costs by $3.5 million.
A break-down of the cost savings for each of the elements listed above can be found here:
<img class="alignnone wp-image-10307 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec2a9521525815ed/611a79d8005cd416221b4b23/cost-of-a-breach-pie-chart.jpg" alt="" width="716" height="416" />
Figures are indicated in terms of thousands of dollars. The biggest cost saving was $1,300 million in time saved in threat investigation work, retiring legacy solutions was another big cost-saver at $860.7K.
Through the investment in <a href="https://www.deepinstinct.com/" target="_blank" rel="noopener">Deep Instinct</a>, the interviewed customers reported both quantitative and qualitative benefits against the backdrop of enhanced endpoint security. The early prevention through deep-learning predictive algorithms meant that the representative organization was able to prevent more attacks from occurring pre-emptively, they were able to get better visibility and control over the far fewer attacks that still managed to slip through, and SecOps employees were able to reallocate their time towards higher-value tasks and projects. The implementation of Deep Instinct reduced the number of false positives by 99% and significantly alleviated the workload placed on SecOps.
To learn more about how these customers were able to optimize their cybersecurity environment and put their budgetary figures in the green, we recommend <a href="https://info.deepinstinct.com/en/mof/deep-instinct-tei-study" target="_blank" rel="noopener">checking out the full Deep Instinct TEI Study</a>.

How Companies are Successfully Bringing Down the Cost of a Data Breach

With the advancement of technology and artificial intelligence in the 21st century, AI applications are being introduced in a myriad of sectors. Parti

shutterstock_394552096-1.jpg

With the advancement of technology and artificial intelligence in the 21st century, AI applications are being introduced in a myriad of sectors. Particularly in the Covid era, digital transformation has been rapid in many sectors that are not yet equipped to deal with advanced and increasing cyber threats, putting valuable digital assets at risk of malicious AI attacks.To cope with these increased threats, an efficient Advanced Threat Protection (ATP) security system is required that can filter malicious breaches and prevent user data from falling into the wrong hands. ATP security is an <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">advanced malware protection</a> system designed to protect sensitive data from complex and malicious <a href="https://www.deepinstinct.com/2019/05/19/how-ai-can-be-used-for-malicious-purposes/" target="_blank" rel="noopener">AI malware attacks</a>.Among ATP security solutions are <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener">artificial intelligence antivirus products</a> that are purposed to protect organizations to achieve ongoing security of digital assets and valuable data. Different vendors have introduced highly innovative <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener">endpoint security platforms</a> to help users improve organizational and corporate digital security. ATP Security provides the best adaptive system for organizations to deal with various cyber-attacks and malware, providing detection and prevention before a cyber attack strikes. By taking a preventative approach, files are analyzed before they get the chance to execute, keeping the risk profile of an organization as low as possible, while easing the endpoint management of the threats that still manage to get through.&nbsp;<h3>How Does ATP Security Work?</h3>Despite their focus on preventing cyber threats, ATP security solutions should address the entire cybersecurity protection lifecycle, from prevention, detection and response, and finally remediation. It has three main goals.<ol><li>Early detection: It scans for access vulnerabilities to critical data before the risks are noticed</li></ol><ol><li>Swift defense: Automatically scans all files to defend against AI-based malware attacks.</li><li>Response:&nbsp; Proactive response&nbsp;to mitigate risks and respond to offensive events.</li></ol>To achieve these goals an ATP security solution will need several components and functions. Such as;Real-time visibility:Provides real-time visibility into events occurring behind your network programs. Without real-time visibility, it will be too late to detect attacks before the damage is already done.Deep Learning capabilities:&nbsp;Ideally, the ATP operation should involve an automated deep learning algorithm that can detect and prevent not just known malware, but more importantly new, never-seen-before malware variants.Data awareness:The system must be aware of data sensitivity, value, and other factors, to determine risk severity and respond accordingly.Further study may be required when a risk is found. The ATP's security services typically handle risk analysis and enable the business to carry on as usual with minimal downtime. File analysis, minimizing threat surfaces, and detection and response functions are all carried on behind the scenes.&nbsp;<h3>Key Features of an ATP Operation:</h3>ATP products have various features that make them stand out from traditional detection or antivirus products. Some of their key features are:Automatic File Analysis:The most important feature is to combat and deal with imminent threats swiftly. ATP products monitor data traffic and <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">prevent zero-day attacks</a> with strong artificial intelligence deep learning models. They analyze data in real-time to automatically mitigate threats that are indicated to be above a set risk threshold.Attack Surface Reduction:ATP products eliminate risk by minimizing the attack surface area of the organizational work environment with hardware-based and file isolation, exploit and network protection, and application control (particularly for smartphones), etc. This is particularly important given the expansion of attack surfaces due to the rapid and widescale move to work from home.Protection and Detection:ATP security prevents ongoing attacks and mitigates threats before system breaches occur. However, even after an attack has been able to execute, it provides some level of protection by continuously monitoring behaviors with a dynamic analysis engine to protect against advanced, and highly threats that managed to get through the prevention-focused solutions. This includes advanced threat hunting, intrusion detection, and providing analysis tools that enable the security analyst to pivot and quickly narrow down suspicious activity.&nbsp;ATP security is a comprehensive <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener">endpoint protection</a> system that mitigates the threat of cyberattacks and protects sensitive business or organizational data from breaches. Artificial intelligence antivirus, with its focus on prevention, is one of the most vital applications used in an ATP security operation. The cost of cleaning up a security breach, rather than mitigating it proactively, is enormous. Without a robust preventative defense, an attack can bring business to a halt, cause brand damage, and contribute to customer attrition. In the present era, as digital adoption increases and more sensitive is hosted on the cloud, ATP is undoubtedly a leading asset of any security operation and a necessity for organizations.

What is ATP Security?

As originally published in VMblog

How is the cybersecurity landscape shaping up for 2021? With the wholesale structural shift to WFH, we provide so

blog3-copy-12.jpg

As originally published in <a href="https://vmblog.com/archive/2021/01/25/deep-instinct-2021-predictions-connected-world-means-many-challenges-for-cybersecurity.aspx#.YA7-T-gzZPZ" target="_blank" rel="noopener">VMblog</a>
How is the cybersecurity landscape shaping up for 2021? With the wholesale structural shift to WFH, we provide some cybersecurity predictions into how this rupture will continue to pan out in 2021. Cyber leaders will need to keep their proverbial ‘finger on the pulse’ to keep pace with the new risks, priorities, and considerations that are emerging in this rapidly evolving arena.
<h3>Covid19 After Effects</h3>
While all the <a href="https://www.deepinstinct.com/2020/03/26/attackers-abuse-the-covid-19-pandemic-to-spread-malware/" target="_blank" rel="noopener noreferrer">Covid19 themed Mal-spam</a> that we’ve seen will eventually die down, the new arrangement of Working From Home (WFH) is going to become the industry norm. The concern is that in the time that it takes companies to upscale their security to meet the changing location and form of the office network, we will see hackers taking advantage of this window of exposure. Previously, an organization’s network and all its data were sitting securely behind fortifications of the organizational security network. All of a sudden, the transition of moving to a wide and varied mess of different work environments makes it far more complex for defenders to keep protecting the enterprise at the same level. Naturally, the organization’s attack surface is amplified. While in the past only one attempt was all a hacker could get of successfully breaking in using a new variant of malware, now they have multiple attempts, all with equally good chances. And for an attack to cause damage, it only needs to succeed once.
An example of this was the <a href="https://www.zdnet.com/article/cognizant-expects-to-lose-between-50m-and-70m-following-ransomware-attack/" target="_blank" rel="noopener noreferrer">Cognizant incident</a> that hit the company early on in the work from home transition. The IT Service provider was attacked by ransomware that managed to bring business to a halt for a period of time and is alleged to have cost the company between $50 and $70 million.
<h3>The Proliferation of Botnets and Access as a Service</h3>
Botnets have become one of the biggest cyber threats today and by that nature a major cause for concern to those charged with cybersecurity. What makes botnets so dangerous is the size of their network, where the more infected online devices that a botnet has under its command, the wider its pool of malware delivery, and therefore the bigger its impact. And considering, a hacker’s ultimate goal is financial gain, malware infiltration, or just disruption, the bigger the pool, the better. In 2021, we expect to see more malware creators sell access to their botnets, and thereby access into their network of millions of infected connected devices. In an exchange that researchers at Deep Instinct have coined ‘Access-as-a-Service”.
The implication of this is bad. These botnets have market value in the dark web for their ability to break down the attack chain into several components, so that a smaller scale hacker can just focus their efforts on fewer components of the attack chain, and thereby become more skilled in just those limited components. For example, the botnet will provide the initial access, while the hacker will focus their effort on becoming better at information theft or the ransomware logic.
<h3>Organized Cybersecurity Co-operation Between Government and Private Enterprise</h3>
Combatting the growing complexity of attacks has necessitated the collaboration between private companies and government security departments. This was particularly observed in the lead up to the US elections this past November where the U.S. Cyber Command branch of the Department of Defense collaborated with multiple security companies in an effort to <a href="https://www.bleepingcomputer.com/news/security/trickbot-botnet-targeted-in-takedown-operations-little-impact-seen/" target="_blank" rel="noopener noreferrer">take down Trickbot</a>. The malicious botnet which is known to be one of the most active and dangerous, had many of its infected computers liberated, as the combined effort worked to put the brakes on the attempt to interfere with electoral systems.
Furthermore, Microsoft was able to clear a legal pathway to sabotage the botnet on the basis that the writers of Trickbot malware are infringing their terms of service. Instead of writing their own code from scratch, they’re abusing Microsoft code, an activity that almost every malware writer is bound to do.
We expect to see this collaboration continue and escalate as more nation-states engage in cyber warfare and support both the development and defense efforts of APTs, zero-day exploits, and machine learning-based adversarial attacks.
<h3>Continued Adoption of Adversarial Machine Learning Malware</h3>
As knowledge on adversarial machine learning continues to grow, that knowledge is disseminating among both sides of the cyber battleground. 2020 saw the increased adoption of machine learning academic knowledge being used in adversarial attacks in private industry research. As this knowledge gradually makes the transition from academia to the wild, we expect to see malware campaigns attempting to evade products based on machine learning models, either by fooling the model, learning how to subvert it, or by forcing it to shut down. Since machine learning-based products are becoming the market-dominant solution, it makes sense that they represent the next target for well-resourced hackers. We expect that those perpetrating the attacks will be only a select few of very sophisticated and highly capable threat actor groups who most likely will be acting as part of a nation state-sponsored campaign. The bar of entry to AI based attacks is still very high, and we, therefore, don’t expect it to become “run-of-the-mill” malware next year.
<h3>Ransomware to Target Mission-Critical Organizations</h3>
2020 saw <a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/" target="_blank" rel="noopener noreferrer">ransomware attacks</a> increasingly amplify their leverage to coerce ransom pay-outs by not only stealing a victim’s sensitive data but also threatening to expose it. It appears that the lesson learned for hackers is that the test of a good ransomware attack is its method of extortion. The greater the stakes the better likelihood of a payday. For this reason, in 2021 we expect to see a move towards targeting mission-critical organizations, i.e. those organizations that have the minimal risk tolerance to having their digital systems shut down or their data stollen and exposed.
Hospitals and educational institutions are a good example of this, with both sectors having already suffered from a wave of ransomware infections, both schools and hospitals are under enormous pressure to keep their doors open. In the crossroads between ransomware and data privacy regulations, private companies are also more susceptible to being breached, with the added risk of being hit with large fines if found to have exposed data.
<h3>Rising Cybersecurity Company Valuations</h3>
During the recent worldwide economic downturn, cybersecurity was one of the few industries to record growth. In 2021 we expect to see cybersecurity stock prices and company valuations continue this upward trajectory, with multiples expected to reach new heights. This development appears to reflect a changing market perception of cybersecurity products no longer seen as a discretionary item, but rather as a staple.
For more insights download Deep Instinct’s “2020 Cyber Threat Landscape Report” which includes an analysis of the latest malware trends and developments, insights on the past year’s cyber threat landscape, and predictions for this year, all based on empirical research findings. A full copy of the 31-page “<a href="https://info.deepinstinct.com/en/tof/cyber-threat-report" rel="noopener noreferrer">2020 Cyber Threat Landscape Report</a>” is available. In addition, anyone interested can join a live webinar “<a href="https://info.deepinstinct.com/en/tof/the-pandemic-and-its-manipulation-by-the-cyber-underworld" rel="noopener noreferrer">The Pandemic and its Manipulation by the Cyber Underworld</a>” scheduled on Tuesday, February 23 at 1 pm Eastern. Featuring the Deep Instinct security intelligence researchers who contributed to the study, participants will also have an opportunity to ask questions on the report findings.

Cybersecurity Predictions for 2021

The FBI has released a public service announcement that K-12 schools should expect a surge of cyberattacks, particularly ransomware infections, during

FBI-alert-blog.jpg

The FBI has released a public service announcement that K-12 schools should expect a surge of cyberattacks, particularly ransomware infections, during the ongoing uptick in remote-learning as a result of the coronavirus pandemic.
Schools, colleges, and universities have all experienced an increased reliance on technology, they have opened up their infrastructure to enable remote learning connections, yet their resources dedicated to network defense haven’t grown accordingly. With their attack surfaces wider than ever before, schools have come to represent prized ransomware victims.
Schools are tempting targets for hackers for two important reasons; they hold troves of sensitive student data. and have minimal defense mechanisms - effectively making them the “low hanging fruit” of cyber-attack targets.
According to the report, the number of attacks targeting K12 schools in 2019 was 1,233, with another 422 schools being attacked just within the first quarter of 2020. This represents a huge increase from previous years. Some of these schools lost total access to their computer networks, files, and communication systems as a result.
The Bureau also raised awareness on the increased proliferation of <a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/" target="_blank" rel="noopener noreferrer">ransomware</a> gangs that steal data from infected networks and then threaten to publish that sensitive data if the school refuses to pay the ransom. This added risk “may create an elevated urgency for schools to pay ransoms” and thereby perpetuate the practice. For this reason, the FBI advised schools to pay particular attention to attacks involving Ryuk ransomware which exploits RDP endpoints to gain an initial point of entry.
Unlike what most people think, when ransomware hits, decrypting the ransomware with a special key won’t necessarily help you return to a clean state or be enough to stop the impact of having been attacked - because the machine is still infected. This means that any new files, files restored from a backup, or decrypted files are still vulnerable to the ransomware logic that is still lying dormant within the system. Paying the ransom doesn’t put you out of harm’s way, there is still every risk of getting encrypted again.
The ransomware persistence methods, for example, those used by Ryuk, entail that stopping the process of the ransomware won’t be enough since after a period of time or even after a reboot, the ransomware will still be active.
According to Guy Propper, Threat Intelligence Team Leader at Deep Instinct, it’s critical for schools to realize the threat, but that there are also solutions available to help defend against it, “your school doesn’t have to become another statistic, forced to close its doors on students.”
“Probably the most effective and reliable way to get rid of ransomware is to reimage or format the machine, but that’s of course very expensive, especially when there is a lot of data that is likely to be lost” advises Propper. This approach necessitates that a school network’s typically short-staffed IT team needs to know and be familiar with all the places or methods that malware (not just ransomware) gains its persistence. For example, recovering or reverting to a previous mode before the registry key was changed.
Therefore, the most effective way to handle ransomware attacks is to prevent them from happening, an approach that has been pursued and successfully deployed by <a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a>. Deep Instinct offers powerful solutions, based on the advanced A.I technology of deep learning to enable resilient prevention against even the most advanced malware and ransomware threats.
To trial the efficacy of Deep Instinct’s preventative approach, school networks can <a href="https://info.deepinstinct.com/education_30day_threatanalysis" target="_blank" rel="noopener noreferrer">schedule a free threat analysis</a> that is currently available at Deep Instinct. This analysis is designed to provide <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint security</a> teams with sufficient insight on how school networks can be kept secure, even as more educational activities go virtual.
<a href="https://info.deepinstinct.com/education_30day_threatanalysis" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-7329 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/08/education_security_solution_lIn_2-002-1000x523.jpg" alt="" width="1000" height="523" /></a>
&nbsp;
&nbsp;
&nbsp;

Schools on Red Alert After FBI Issues Cybersecurity Warning

Over the past 3 months, Zoom, a video conference solution, jumped from 10 million active users to 200 million users. Any software solution that has a 

Zoom.jpg

Over the past 3 months, Zoom, a video conference solution, jumped from 10 million active users to 200 million users. Any software solution that has a large user base, becomes a target for attackers, in a simple equation where the more users on a platform, the larger the number of successful attacks achieved using the platform. This is the situation in many software domains; in cybersecurity, there are more evasion techniques used in the wild to undermine and bypass the more commonly used security tools. The same rule applies to OS platforms; Windows, the most common OS platform in the market, is also the most targeted.
And Zoom is no exception. This same pattern has been noticed with Zoom’s rapid jump in its user base. During 2018-2019, only three security vulnerabilities in Zoom were exposed, while over the past few weeks many more were observed:
<ol>
<li>Bruteforce: An attacker can perform a brute-force attack by entering a meeting they’re not invited to by finding an open meeting ID to connect to.</li>
</ol>
The problem: A problematic product design was implemented, with a weak ID mechanism.
The solution: Approve only valid users to join a call.
<ol start="2">
<li>Data leakage: Zoom shared information with Facebook.</li>
</ol>
The problem: Manipulated usage of a Facebook SDK.
The solution: Zoom has removed the relevant SDK that shared information with Facebook. Other protection measures can include limiting connectivity to Facebook from the workspace.
<ol start="3">
<li>End-to-end encryption: Zoom is not performing E2E encryption.</li>
</ol>
The problem: Attackers can perform Man-in-the-Middle attacks while hearing or watching live calls.
The solution: An E2E encryption is to be incorporated into Zoom. As an alternative, either a VPN can be used to a secured location (although ISPs would still be able to inspect the traffic) or alternatively, monitor for network attacks in the internal network. Android, Chrome OS, and iOS devices can be protected by Deep Instinct from these and other various network attacks.
<ol start="4">
<li>Un-secured network route: Zoom calls are routed through China.</li>
</ol>
The problem: Countries like China which intercept the traffic of its citizens, can now hear or watch calls of any participant, even if they are not located physically in China.
The solution: Zoom has fixed this unsecured network route by changing the traffic route, so it doesn't pass through China.
<ol start="5">
<li>Credential theft: Zoom has a common vulnerability in UNC links.</li>
</ol>
The problem: Attackers can steal Window’s credentials.
The solution: Zoom has fixed this security vulnerability.
<ol start="6">
<li>Dropping technique: Zoom can be installed on macOS devices in a way that lets it skip the need to insert a root password by the user.</li>
</ol>
The problem: By modifying the Zoom installer, an attacker can hitch additional malicious tools to the installation.
The solution: By using Deep Instinct, devices are protected from any malicious file that can be dropped as part of a Zoom installation. Deep Instinct can even scan the Zoom installer that might contain malicious files inside, before the installation itself happens.
<ol start="7">
<li>Code injection: Zoom gains access permissions to use webcam and microphone.</li>
</ol>
The problem: An attacker can inject itself into Zoom in order to get permissions to these resources.
The solution: By using Deep Instinct, devices are protected from various code injection techniques.
The security vulnerabilities listed here are not particularly unique to Zoom and many of them may also be found within other video conferencing tools as well, like Microsoft Teams and Google Hangouts. However, the critical factor is to have a robust security tool in place that works to eliminate many of these potential threats.

The Zoom Security Vulnerabilities to Join Your Every Meeting

The cybersecurity industry is nothing if not crowded. If you ever attended a security event, like RSA “crowded” is an understatement, both figurativel

cybersecurity-Economy.jpg

The <a href="https://www.deepinstinct.com/">cybersecurity industry</a> is nothing if not crowded. If you ever attended a security event, like RSA “crowded” is an understatement, both figuratively and literally.  There are hundreds of vendors and many more attendees, all hoping to find that missing piece to their security stack puzzle. Yet more often than not, attendees are likely to leave a conference awash with brochures all promising to deliver very similar, if not the same, benefits.
However, this hyperbole contrast greatly with the sober reality that increased spending trends have <a href="https://www.deepinstinct.com/2020/01/29/cutting-cybersecurity-budgets-in-a-time-of-growing-threats-2/">not equated to improved security</a>. Over the past ten years or so, the budget organizations have allocated for cybersecurity strategies have tripled. This increased budget must mean cybersecurity challenges are finally solved. We can all go home now, trusting organizations are now secure. Of course, that is not the case.
Recently we partnered with the Ponemon Institute to survey IT and security professionals on their perceptions and impacts of prevention during the cybersecurity lifecycle. With over 600 participants from many different industries providing feedback, we believe the results of the survey to be representative of the security landscape. Review the full report <a href="https://info.deepinstinct.com/value-of-prevention">The Economic Value of Prevention in the Cybersecurity Lifecycle</a>.
Survey respondents have found that delivering a continuous and consistent level of prevention is difficult, with 80% rating prevention as the most difficult to achieve in the cybersecurity lifecycle. So, it is no surprise that almost 80% of budget funds non-prevention priorities (containment, detection, remediation, and recovery). Here is where things get frustrating and confusing. 70% of respondents believe the ability to prevent would strengthen their security posture. When asked how much preventing attacks could drive down costs, respondents estimated savings between $396,675 and $1,366,365 (for ransomware and nation-state attacks respectively). Couple this information with the fact that 40% of the respondent feel their security programs are underfunded, and you find yourself scratching your head. Why are organizations spending their scarce budget in ways that seem contrary to their interests?
I am a big fan of examples, so let us use one here to crystallize the situation.
You are a CISO for a company with 1,500 employees and 2,000 endpoints, servers, mobile devices, etc. spread across several geographies. You have a $10 million budget for security; $6 million of that budget is spent on a security stack of products focused on reacting to an active threat and $2 million is spent on an AV “prevention” solution that you know is not very effective.
Let’s say, for argument sake, that you have three significant security incidents a year. Not hair on fire incidents, but incidents that require calling in outside help to return to a normal state. These three incidents (two phishing, one ransomware) set you back roughly $2 million in containment and remediation costs. By its end, you’ve essentially used your entire budget and improved your cybersecurity posture by 0%.
You know that if you were able to prevent these security incidents from happening, let’s even be conservative here and say you prevent two of the three incidents (one phishing, one ransomware) you could avoid spending $1.5 million yearly. Your “effective” security budget would keep its value and not drop to $8.5 million, and you could argue your cybersecurity posture has improved by 66% (with two of the three security incidents being non-events).
If the definition of insanity is doing the same thing over again and expecting a different result, this current pattern begs critical evaluation. I propose two reasons why the results of this survey indicate a dysfunctional relationship between budget allocation and resulting security posture.
<h3>The failed expectation of machine learning prevention tools</h3>
The understanding of attackers of how to circumvent even advanced <a href="https://www.deepinstinct.com/">machine learning</a>  prevention tools has developed and proven successful. While many of these solutions do a relatively better job at preventing successful attacks compared to legacy AV solutions, the illusion of near-complete prevention never materialized, especially in regards to zero-day, or unknown, threats. As a result, budgets are back into the detection and response mode. In fact, respondents report they are more confident in their ability to contain an active breach (55%) over other tasks along the cybersecurity lifecycle.
<h3>Plan B: Speeding-up detection and response</h3>
Perceiving continuous prevention as a “fool’s errand,” organizations are taking a “cause least harm” approach to secure their organization. This involves a focus on technologies aimed at shrinking attacker dwell time to limit the impact of the inevitable attack. This approach makes perfect sense, considering the constant refrain across the security vendor landscape that “it’s not if, but when” an attack will succeed. If an attack is inevitable, it would be irresponsible for security departments to prioritize investment in any other way. To that end, an overwhelming percent of respondents (76%) are no longer even considering improving their prevention efforts given the perceived inherent fallibility.
<h3>Sea-Change</h3>
The joint research with Ponemon could be considered a gloomy picture of security and IT professionals tasked with the enormous responsibility of keeping their organizations secure with a limited budget, facing unlimited threats. They work with security vendors who repeatedly fail to deliver on expectations, while a continuous stream of new vendors make the same promises they have heard for years.
So, why take another look at prevention? Prevention has evovled in the last few years with deep learning technology enabling an advanced predicitive analysis of threats that has to date achieved unparallel accuracy and speed. Unlike machine learning, that requires a human expert to effectively guide the machine through the learning process by extracting features that need to be learnt, deep learning skips the human process to analyze all of the available raw data. This results in the ability to prevent new first seen attacks, like zero-days, and achieve a better detection rate against a broader range of attack vectors. The predictive capabilities of the <a href="https://www.deepinstinct.com/machine-learning-vs-deep-learning/">deep learning ai</a> algorithm are also platform agnostic and can be applied across most OS and environments.
Over the past decade or so, total spending on cybersecurity has more than tripled with some forecasting overall spending to eclipse $1 trillion in the next few years. 50% of respondents say their organization makes budgetary decisions that deliver limited to no improvement to their overall security posture. Furthermore, the licensing on expensive but ineffective technology can lock in portions of future budget dollars, inhibiting the security team’s ability to take advantage of better security solutions as they enter the market.  Sadly, unless something changes radically, I’d suspect a similar survey completed in 2024 or 2025 may show the same kind of results we see today.
It’s time for wide-scale change that addresses the root of the problem, I propose a sea change that begins earlier in the cybersecurity lifecycle – prevention.
Preventing more attacks from succeeding will have a knock-on effect across your entire security investment. More time will be available for security analysts to think strategically, making better use of the security tools at their disposal. Management can also benefit from better prevention over time, analyzing the value of their entire security investment, optimizing both technology and resource allocations, with a focus on process improvements rather than constant repair and recovery.
The good news for security professionals is that there are advanced prevention technologies in the market today that provide real value. Security professionals need to demand more from their security vendors when it comes to prevention, and if they are not able to improve prevention, then look for someone who can.
Prevention is by no means a cure-all for everything security. However, with a constantly evolving threat landscape and ever-changing business priorities, rethinking prevention can make everyone involved more effective.
Deep Instinct and the Ponemon Institute will be hosting a joint webinar discussing these and other key findings on April 30th at 1pm EST. Click here for more <a href="https://www.brighttalk.com/webcast/16681/397814?utm_source=Deep+Instinct&amp;utm_medium=brighttalk&amp;utm_campaign=397814">information and to register</a>.

The Cybersecurity Paradox

In this testimonial video Matthew Fredrickson, the Director of IT for Council Rock School Districts explains what a huge difference Deep Instinct’s au

School-testimonial.jpg

In this testimonial video Matthew Fredrickson, the Director of IT for Council Rock School Districts explains what a huge difference Deep Instinct’s automated <a href="https://www.deepinstinct.com/what-is-deep-learning/">deep learning</a>-based solution has made for managing day-to-day security tasks for him and his team.
The Council Rock School District is located in Newtown, Pennsylvania, and is comprised of 15 Kinder to year 12 schools which comprise around 13,000 end users. Deep Instinct has been deployed into the production environment for Windows OS and servers. Matthew advises that the deployment of Deep Instinct compared to other products he has used was remarkably quick and easy. The environment currently has about 3k+ agents deployed, all of which are functioning in prevention mode.
<iframe src="https://www.youtube.com/embed/7gCQMvkq3hI" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe>
To see the Deep Instinct agent in action you can <a href="https://www.deepinstinct.com/request-a-demo/">request a demo</a>, and start your school’s long-awaited journey to become one of the Learned Few.

"Deep Instinct is Like Having a Cybersecurity Analyst Observing Users All the Time"

Educational institutions are a massive storehouse of information. Starting from student's test results and research papers to personal records and sta

Educational institutions are a massive storehouse of information. Starting from student's test results and research papers to personal records and staff payroll details, schools store a lot of data that necessitates adequate security. Protecting a financial organization from malicious threats is a typical scenario, but the need for cybersecurity in education has gained additional momentum in the 'double-whammy' of increased digitalization of classrooms and the targeting of schools and colleges by hackers in recent ransomware campaigns. More than thousands of educational institutions have already been a victim of cyberattacks, with the most devastating ransomware attacks costing schools hundreds of thousands of dollars, where the alternative is being forced to close.
With the prevalence in remote learning, Cybersecurity has become more critical now than ever before with educational hubs at high risk of being attacked and their data misused. The day is not far away when cybersecurity in the education sector will be an important criterion amidst funding, regulation, and other approval processes. With hackers' objectives varying from altering students' grades, stealing breakthrough research, to seizing the personal data of students and administrators, there are many possible reasons to interest cyber hackers to focus their surveillance and effort towards educational institutions.
As schools and universities increase their reliance on remote connection and access for teachers and students alike, they are also inadvertently expanding their threat surface by providing attackers with many more touch points which attackers can manipulate to gain access. We expect that both K-12 and universities, will be specifically targeted by cybercriminals in the coming weeks, who won’t necessarily have advanced their techniques, but will have uncovered the most accessible points from which they can gain penetration.
The main point of focus for ransomware is to target a network, replicate itself, and cripple the organization. Remote learning provides the perfect opportunity for threat actors to install Trojans and malware on machines being used by students and teachers that are not owned, or protected, by the school. This malware can then be transferred into the school’s network, as users will be granted access to resources normally only accessible from inside the network. And since threat actors have lots of time to wreak their damage (the average time from infection to detection is 111 days), schools may not know they've been infected until it's too late.
<h3>What are the major threats to an educational institution?</h3>
As part of preparing your initial Information Security Risk Assessment, we've compiled a list of some of the most significant threats that tend to target the educational sector:
<ul>
<li>Malware</li>
</ul>
Ransomware, spyware, worms, back-doors, droppers and coino miners are all various types of malware that have been known to pose a threat to educational institutions. All mobile devices connected to the system need to be secured with <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">next-gen anti-virus software</a> to protect from threats. However, ransomware in particular should be of significant concern to IT school staff. The FBI recently released a public service announcement raising awareness on the increased proliferation of <a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/" target="_blank" rel="noopener noreferrer">ransomware</a> gangs that steal data from infected networks and then threaten to publish that sensitive data if the <a href="https://www.deepinstinct.com/2020/08/06/schools-on-red-alert-after-fbi-issues-cybersecurity-warning/" target="_blank" rel="noopener noreferrer">school refuses to pay the ransom</a>. This added risk “may create an elevated urgency for schools to pay ransoms” and thereby perpetuate the practice. For this reason, the FBI advised schools to pay particular attention to attacks involving Ryuk ransomware which exploits RDP endpoints to gain an initial point of entry.
Unlike what most people think, when ransomware hits, decrypting the ransomware with a special key won’t necessarily help you return to a clean state or be enough to stop the impact of having been attacked – because the machine is still infected. This means that any new files, files restored from a backup, or decrypted files are still vulnerable to the ransomware logic that is still lying dormant within the system. Paying the ransom doesn’t put you out of harm’s way either as there is still every risk of getting encrypted again.
<ul>
<li>Phishing</li>
</ul>
In an educational institution, phishing emails pose a severe threat as they work on human susceptibility to error and fear. Often providing a false pretext, such as as a fabricated payslip email notice or a request to fill out a leave form, cyber attackers make email accounts look authentic, effectively trapping students and employees to providing sensitive information or inadvertently giving access to data.
&nbsp;
<h3>What sort of damage can be inflicted by a successful attack?</h3>
In the worst situation, where their entire systems have been brought down, a school could be forced to close its doors. However, the level of damage that is inflicted is likely to be in line with the attacker’s objectives, typically attackers have two main objectives when targeting schools:
The first is to gain access to the student information system, where the attacker’s goal is likely to be to acquire student data and perhaps change grades.  Most students do not have established credit ratings, which makes their personal information especially valuable.  The second target is the school’s network.  By encrypting the entire network, schools can become completely non-functional.  With so many resources being focused on providing a worthy educational experience for students at home, malicious content could slip through the cracks - it's this lack of focus and staffing that the threat actors are going to maximize.
In a ransomware attack, the damage is likely to be the high ransoms that schools will be coerced to pay. Attackers appear to be aware of the greater vulnerability that schools are in, where their educational resources are stretched to cover their greater security needs, and they aren’t hesitating to manipulate the situation to coerce schools to pay high ransom amounts to resume normalcy.
&nbsp;
<h3>What aren't schools doing that they should be doing to protect themselves?</h3>
First, backups of key systems need to be made that are immutable when they are created (to include de-duping and compression), then written in an encrypted format off-site.
Secondly, cannot emphasize enough the importance of building awareness of students, teachers, and really, any and all users. The weakest link in any organizational security structure are almost always users.
Patch cycles must also be quicker and focus on systems with distributed access.
Having adequate endpoint protection systems in place is crucial. Unlike the corporate environment that may have heaps of money to spend on products and a large SOC team, schools should be focused on having solutions that prevent the widest possible range of attacks. There simply isn’t the time or resources available to investigate every incident that occurs, and endpoint protection really needs to be geared towards preventing those attacks from the outset.
<h3>Approach to ensure cybersecurity in educational institutions</h3>
After studying the potential threats, you must be wondering how to implement the best protection from such cyberattacks? Our cybersecurity product provides the best endpoint protection in the industry, our multi-layered approach to security proves to be the best solution to preventing malicious threats, whether they be known traditional malware, or never seen before zero-day threats. The superior protection is enabled by its end-to-end encrypted Deep Learning framework that works to detect threats from an endless number of file types and with greater levels of accuracy, reducing the number of false-positives typically experienced with other products.
Security experts do not have it easy. At Deep Instinct we take our hats off to these unsung heroes that are defending the educational frontiers against cybercrime. Since 2016 over 1,000 school districts, colleges, and universities have fallen victim to successful cyberattacks, and that number is on the rise. With such a diverse user base with varying levels of cybersecurity awareness, <a href="https://www.deepinstinct.com/education/" target="_blank" rel="noopener noreferrer">educational IT and security teams</a> need solutions that prevent attacks with little to no human expertise required. Our aim at <a href="http://www.deepinstinct.com" target="_blank" rel="noopener noreferrer">Deep Instinct</a> is to armor and support education IT security staff with the best technology out there.
Our solution is designed to reduce their workload and automate as many tasks as possible, allowing educational security experts to focus on strategic measures rather than constantly running after crises.  By delivering high detection rates and minimal false positives, the alert fatigue of security staff is greatly minimized, as is their work stress.
In this testimonial video Matthew Fredrickson, the Director of IT for Council Rock School Districts explains what a huge difference Deep Instinct’s solution has made for managing day-to-day security tasks for him and his team.
“The primary reason that I selected Deep Instinct is, 1, in my mind having Deep Instinct on every single <a href="https://www.deepinstinct.com/endpoint-protection/">endpoint</a> is like having a cybersecurity analyst sitting there looking over the shoulder of the end user all the time. And the other reason, there is no other product out there on the market that does what it does, the way that it does it, and to the degree that it does it well.” – Matthew Frederickson, Director IT of Council Rock School District
The Council Rock School District is located in Newtown, Pennsylvania, and is comprised of 15 Kinder to year 12 schools which comprise around 13,000 end users. Deep Instinct has been deployed into the production environment for Windows OS and servers. Matthew advises that the deployment of Deep Instinct compared to other products he has used was remarkably quick and easy. The environment currently has about 3k+ agents deployed, all of which are functioning in prevention mode.
<iframe src="https://www.youtube.com/embed/7gCQMvkq3hI" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe> 
To see the Deep Instinct agent in action you can <a href="https://www.deepinstinct.com/request-a-demo/">request a demo</a>, and start your school’s long-awaited journey to become one of the Learned Few.
At Deep Instinct, we prevent what others can’t find.
&nbsp;

How to Ensure Cybersecurity in Educational Institutions

For many people around the world, a new, unexpected phase in their working career begins this week – working from home. Now under normal circumstances

workfromhome.jpg

For many people around the world, a new, unexpected phase in their working career begins this week – working from home. Now under normal circumstances, the decision to work from home, or the development of a corporate policy that allows employees to work from home, come after all addressing and documenting all potential issues/concerns. Sadly, thanks to the Coronavirus Pandemic, we are not living under ordinary circumstances; therefore, the move to work from home may put your company and employees on uneasy footing.  Since a majority of the workforce may already be working remotely, you may think it is too late to roll out a new IT policy, but in the immortal words of Yogi Berra, "it ain't over 'till it's over." Here are three simple, yet essential policy steps you should rollout out asap to your staff.
Before we discuss the policies, let's talk about what your employees are probably facing when working from home:
<ul>
<li>The security measures implemented in the company network, such as the corporate firewall and anti-phishing security controls, are not present when working from home</li>
<li>The router the employee connects through at home is most probably not secured and may contain vulnerabilities since no one monitors it for any scanning or any backdoors on a regular basis</li>
<li>If the company does not issue a corporate laptop, the employee will use their personal computer. Their computer doesn't contain security products used by the company, is not actively monitored by the company, and might already contain malware and exploits</li>
<li>Working from home might cause a mix of saved passwords between the employee's accounts and their company accounts.</li>
</ul>
<h3>Hands Off</h3>
If working from home is new to your employees, you need to make sure they understand that the corporate laptop is for work purposes only. Of course, you don't need to worry about the employee getting weather or news updates on the computer, that is normal, but what you don't want to find out is that their 14-year-old son used it to stream FIFA 2020 on Twitch from midnight to 4 am. While he may have no malicious intent, his use of the computer opens up the potential for an attacker to entice him to click on a link or open a document that could silently install a malicious application. Now the attacker has struck gold with a backdoor into a broader corporate environment. It is worth noting here that an <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">endpoint security product</a>, such as Deep Instinct, can mitigate this risk as it has the built-in ability to analyze and prevent malicious files from reaching a computer's hard drive without any connection to the corporate environment. The remedy here is an easy, non-technical one. Grab a large sticky note and write in big, bold letters – WORK COMPUTER – DO NOT TOUCH – and affix to screen.
<h3>VPN to the very end</h3>
In the age of the cloud, we are routinely used to accessing essential company data via cloud apps. Our task management, product development, and other productivity tools are cloud-based. It is so common today that we think nothing of it when working in the office. However, when we leave the safe confines of our <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener noreferrer">corporate network</a>, it's easy for employees to forget that it's a dangerous world out there. Ensure every employee knows to use their Virtual Private Network (VPN) when working from home.
In some cases, the need for a VPN will be evident since, in certain situations, the apps/data themselves will be inaccessible without the VPN connection. Still, in other cases, employees could be sending sensitive company information into the wild without the VPN active. The answer is simple, when in doubt, VPN.
<h3>Clear the set</h3>
Good computer hygiene dictates closing off any company assets accessed on your laptop during your typical day. This practice remains in effect whether the employee is in the office or working from their kitchen table. Even if your workforce has scattered to the wind, make sure they continue to clear their cache regularly. On a related note, it's not uncommon for many employees to take advantage of convenient features in their favorite web browser to store their login credentials for any sites they visit. While this may be something they do with their home computers, it is not something you want them to do with their corporate asset. If you can, deploy a password storage solution across the workforce.
<h3>Honorable Mention: The Phisher King</h3>
Recently we have noticed an uptick in new phishing campaigns targeting employees eager for the latest information on the Coronavirus outbreak. These phishing emails promise to offer information on new testing facilities, infection maps, or information on new closings in the employee's area.  The attacks go something like this:
The employee will receive an email from what they think is a trusted source, such as a local news organization or even a trusted friend. The email aims to look legitimate in style and design, often using a trusted logo in the header. The email body will be short (by design), and the attacker will be assuming the employee will initially review the email on their phone. Seeing the subject line related to the outbreak, the employee will eagerly read the email and, without hesitation, click on a link offering the information noted in the subject line. Unfortunately, instead of getting up-to-date outbreak information, malicious applications may be installed silently on the computer, or the attacker may gain a foothold into the machine to use at a later date.
The moral of this story – make sure all employees, whether in the office or now working remotely, keep their guard up at all times.
Finally, it's essential to provide employee's with a simple to follow checklist for do's and don'ts when working from home:
<h3>Do's:</h3>
<ol>
<li>Only connect to trusted wifi connections and networks</li>
<li>Only install approved applications on your corporate laptop</li>
<li>Maintain communication between your co-workers and manager</li>
<li>Inform IT immediately if you see any suspicious activity on your computer</li>
<li>Ensure that the only VPN that you are connected to is that of your workplace</li>
<li>Make sure there is an <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">endpoint security tool</a> installed on your computer. Ensure that it is updated and configured correctly</li>
</ol>
&nbsp;
<h3>Don'ts:</h3>
<ol>
<li>Share your corporate laptops with anyone, even family members</li>
<li>Don’t connect to a Public WIFI</li>
<li>Don’t save any company confidential information to your personal accounts</li>
<li>Don’t leave your computer unlocked at any time, even when at home</li>
<li>Don’t save any company passwords to your personal web browser</li>
<li>If you receive a suspicious email, do not open any links or download any attachment</li>
</ol>

Working From Home in the New Era of COVID19

Come to the dark side.

The dark side has Google Chrome, Safari, Mozilla Firefox or Microsoft’s Edge browser, the temptation is clearly strong.

I

Darth-Vader.jpg

Come to the dark side.
The dark side has Google Chrome, Safari, Mozilla Firefox or Microsoft’s Edge browser, the temptation is clearly strong.
If that’s not enough, Twitter, Reddit, YouTube, Google maps, Outlook, Facebook’s Messenger and Gmail all have dark themes. Last year Apple introduced the Mojave OS as well as key features of iOS 13. (This design announcement received more applause at Apple's Worldwide Developer Conference than anything else for their new iOS.)
Google and Apple have updated all their design practice guidelines (Google’s Material Design and Apple’s Human Interface Design) to work with dark mode (and most of their apps too), including accessibility guidelines and other design tools.
Here are some examples of recent version releases by Apple and Google products:
<img class="alignnone wp-image-6692 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc796a764568c0a50/611a7d204cdb8e163746e4ef/Apple.jpg" alt="" width="635" height="293" />
<h6>Apple’s latest products all with a dark mode interface.</h6>
<img class="alignnone wp-image-6694 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf41b73498ec5fd3b/611a7d1effd778164aa23668/Google.jpg" alt="" width="512" height="359" />
<h6>Google’s latest app designs.</h6>
<img class="alignnone wp-image-6691 size-medium" src="https://www.deepinstinct.com/wp-content/uploads/2020/03/tech-pltfms-450x397.png" alt="" width="300" height="265" />
<h6>Dark mode for business and technology platforms.</h6>
<img class="alignnone wp-image-6693 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1aefe99830edc61e/611a7d1d88364616aedea093/dark-them.jpg" alt="" width="596" height="335" />
<h6>Example of the Material Design guide for dark themes. [Image: Google]</h6>
<img class="alignnone wp-image-6695 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt202dfe26ebc0ab93/611a7d1bcc91a61675b04db1/iOS-dark-mode.jpg" alt="" width="596" height="335" />
<h6>Apple’s Human Interface Design guidelines for iOS Dark Mode. [Image: Apple]</h6>
<h3></h3>
&nbsp;
<h3>In the Dark and Lovin’ It</h3>
Like all the major industry influencers mentioned above, at Deep Instinct we also weighed up the value of dark versus light mode for our products. The decision to go with dark mode was partially based on the developing trend, but also the result of considerable thought on how dark mode will resonate with our users, both consciously and at an unconscious level.
At the conscious level, the dark mode has its functional value, wherein some user contexts dark mode can be particularly useful. According to <a href="https://developer.apple.com/design/human-interface-guidelines/macos/visual-design/dark-mode/" target="_blank" rel="noopener noreferrer">Apple’s human interface guidelines</a>, dark mode allows the “content to stand out while the surrounding UI recedes into the background.” For this same reason, dark mode works well when the user needs to quickly scan stats and focus on key data points, such as when referencing charts or graphs.
A <a href="https://www.fastcompany.com/90169654/two-fascinating-things-salesforce-discovered-when-it-studied-color" target="_blank" rel="noopener noreferrer">Salesforce study</a> suggested that there may be some functional benefits when it comes to reading charts and graphics. After asking study participants to compare charts in both light and dark themes, they were then asked which would be “worth the least or most if they had to pay for each type.” The Salesforce team found that respondents would pay more for the dark theme compared to a light one. They found the dark interface more conducive to making decisions faster, and just as accurately.
Interestingly, the claim that dark mode relieves eye strain, improves focus and productivity, is still inconclusive. Although dark mode has often been billed as an accessibility feature for decades in digital products, there is no conclusive study that confirms this assertion.
At the unconscious level, color has the power to influence our psychological responses; where black implies authority, power, and control. Applying dark shades to a physical or digital product sends a subtle message that the product is powerful, authoritative, luxurious, elegant and sophisticated, and sometimes also, mysterious.
<h3>Keeping Focus on Our Customer’s Focus</h3>
Security staff – The users who interact with the management console tend to have a very high technical background. Most technical users including developers and security experts tend to prefer working with a dark theme background (check out how most terminals look on security platforms). The dark theme helps them to focus on critical information at any point. Our objective was to make the workload of security professionals easier to manage with a platform that could offer a very intuitive experience. This becomes a major challenge due to the range and complexity of the product’s abilities. As it turns out, making the complex simple can be deceptively complex.
Enterprise end-users – These users who interact with the ‘D-Client’ the agent installed on devices, have only minimal interaction with the product and may not necessarily have any technical background. In this case, the dark theme provides a sense of the solution’s power to protect, in all circumstances. The primary objective here was to make the product aesthetically pleasing to enhance user satisfaction.
&nbsp;
<h3>An Agile Process: From Plan to Product</h3>
The selection of dark theme for our product was a calculated decision that we intend to continue testing and iterate as our knowledge of how we meet our customer’s needs expands and develops. Our major priority as a user-facing product is to minimize our end-users pressures by easing their decision-making process. Considering that most organizations have hundreds of threats thrown at them daily, threat analysts need to rapidly scan a lot of information, while identifying critical data that needs to be acted upon.
<h3>The Dark Side Has Proven Hard to Resist</h3>
<iframe class="giphy-embed" src="https://giphy.com/embed/7guVjhMF9qBKE" width="480" height="270" frameborder="0" allowfullscreen="allowfullscreen"></iframe>
<a href="https://giphy.com/gifs/darth-vader-star-wars-7guVjhMF9qBKE">via GIPHY</a>
Certainly, the preferred choice of Darth Vader, it appears dark mode has become all too irresistible for most of us as well.
Although the benefits of dark mode versus light mode continue to be debated, a general rule of thumb, particularly for content-heavy websites, is that dark mode works well when you want to encourage the reader to quickly scan stats and focus on key data points, like when looking at charts, or graphs. Likewise, darker colors also support the subtle message of the product being powerful, elegant and sophisticated.
For <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener noreferrer">Deep Instinct’s products</a>, the selection of dark mode was part of a thorough and calculated process, where the guiding insight of Obi-Wan Kenobi was our target audience of end-users.

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)

Deep Instinct

From Deep Instinct.