Machine learning algorithms detect and prevent the spread of ransomware across Cato customer networks, creating a multilayered enterprise ransomware defense
Cato Networks, provider of the world’s first SASE platform, introduced network-based ransomware protection for the Cato SASE Cloud. Using heuristic algorithms and deep network insight, Cato detects and prevents the spread of ransomware across the enterprise without having to deploy endpoint agents. Infected machines are identified and immediately isolated for remediation.
“Ransomware protection has become job one for every CISO and CIO, but too often enterprise defense strategies remain vulnerable whether by threat actors bypassing endpoint defenses or by manipulating insiders to spread ransomware,” says Etay Maor, senior director of security strategy at Cato Networks. “By identifying ransomware by its underlying network characteristics, security teams can protect the enterprise regardless of the threat vector.”
Latest ITechnology News: Cloudflare Expands Its Zero Trust Platform to Become the Only Cloud-Native Provider with Network Scale
Extending Ransomware Protection from the Endpoint to the Network
With today’s announcement, Cato’s heuristic algorithms inspect all SMB (Server Message Block) protocol flows for ransomware. SMB is the protocol used by Windows to share files and folders.
Cato researchers trained and tested these algorithms against Cato’s massive data warehouse, a data lake of end-to-end attributes for all traffic flows processed by the Cato SASE Cloud. Being the network, Cato has visibility into data normally blocked by firewalls and NATs. More than a trillion flows from all Cato-connected edges – sites, users, IoT devices, cloud-connected resources, and the Internet resources – populate Cato’s data lake.
Once trained, the machine-learning heuristic algorithms inspect live SMB traffic flows for a combination of network attributes including:
- File properties such as specific file names, file extensions, creation dates, and modification dates,
- Shared volumes access data such as metrics on users accessing remote folders,
- Network behavior such as creating certain files and moving across the network in particular ways, and
- Time intervals such as encrypting whole directories in seconds.
Latest ITechnology News: Telit Partners with MicroEJ on Software Development Solutions to Enable a Broader Development Ecosystem
When ransomware is identified, Cato automatically blocks SMB traffic from the source device, preventing lateral movement or file encryption, and notifies the customer.
Cato Delivers a Multilayered Ransomware Mitigation Strategy
Today’s announcement is just part of Cato’s broader, multilayered malware mitigation strategy of disrupting attacks across the MITRE ATT&CK framework. As part of this strategy, Cato security researchers follow the techniques used by ransomware groups, updating Cato’s defenses, and protecting enterprises against exploitation of known vulnerabilities in record time.
Latest ITechnology News: TELUS Deploys 3500 MHz 5G Spectrum Accelerating Canada’s Digital Economy
[To share your insights with us, please write to sghosh@martechseries.com]
