The IT Nerd

Digital Defense, Inc., today announced a new Managed Service Provider (MSP) partner program that empowers partners to raise their brand profile, service offerings and proof of value to their clients in the new economics of cloud and on-premises security solutions.

By 2026, 77% of cybersecurity spending is expected to be for externally managed security services.* The Digital Defense MSP Partner Program, along with Digital Defense’s cloud-native SaaS platform, Frontline.Cloud, supports the growing trend of clients procuring Security-as-a-Service from MSPs and creates actionable opportunity for MSP, MSSP (managed security service providers) and MDR (managed detection and response) partners to capture their piece of this rapidly growing market.

Proof of value is essential for MSPs who are under increasing pressure to prove their worth as clients reevaluate spending and adjust to new business models.

Frontline.Cloud boasts a true multi-tenant architecture that streamlines administration of multiple clients so MSPs can operate at scale. The platform also enables quick and easy deployment for rapid monetization. Other benefits include easy productization with an open framework of APIs, documented integrations with leading ISV solutions and robust customizable reporting that enhances the MSP’s brand and demonstrates proof of value. Building on the company’s established success with its existing partner program for global telecom service providers and VARs, Digital Defense is asserting a new value message to the MSP channel and the buying journey of their clients.

The Digital Defense MSP Partner Program offers benefits such as flexible billing cycles that align to MRR business models, self-provisioning on the Frontline.Cloud platform and procurement directly or through cloud marketplaces including AWS, Azure, Oracle and Google. To learn more about the program, benefits and how to apply, visit: https://www.digitaldefense.com/partners/channel-partners/.

*2020 Roundup of Cybersecurity Forecasts and Market Estimates, Forbes, April 5, 2020

Digital Defense, Inc. today announced the release of Frontline Threat Landscape^™, a unique feature within the company’s vulnerability management technology that incorporates threat intelligence to prioritize critical vulnerabilities that can be exploited. Accessible within Frontline.Cloud^™, the company’s proprietary software as a service (SaaS) security assessment platform, the feature leverages machine-based learning to provide threat intelligence data that delivers a more granular determination of risk for vulnerabilities identified in an organization’s network.

According to Gartner’s Market Guide for Vulnerability Assessment, “Not all vulnerabilities are created equally. Exploitability, prevalence in malware and exploit kits, asset context, and active exploitation by threat actors are critical qualifiers in assessing cyber risk.” The report further describes the incorporation of threat intelligence into vulnerability management technologies. “Methods are applied that analyze and prioritize vulnerabilities by using threat intelligence, organizational asset context, and risk modeling approaches such as attack path analysis. This is also an area in which advanced analytics methods are also being used, such as ML [machine learning]. This permits more granular and intelligent remediation strategies than the more simplistic severity approaches, especially at scale and when remediating with constrained resources.”*

Frontline Threat Landscape empowers organizations to prioritize remediation and optimize resources by combining:

• Real-world vulnerability exploitation metrics
• Industry-standard severity scores  
• Digital Defense Vulnerability Research Team analyst insight 

*Gartner, Market Guide for Vulnerability Assessment, Craig Lawson et al, 20 November 2019 (Gartner subscription required).

Learn more about Frontline Threat Landscape here.

A critical severity authentication bypass vulnerability in certain configurations of Palo Alto Networks PAN-OS devices using Security Assertion Markup Language (SAML) authentication has been discovered.

On June 29, 2020, Palo Alto issued a security advisory for PAN-OS versions with SAML authentication enabled and the ‘Validate Identity Provider Certificate’ option disabled (unchecked). Improper verification of signatures in PAN-OS SAML authentication could allow an unauthenticated network-based attacker to access protected resources.

Mark Bell, EVP of operations at Digital Defense, Inc., a provider of vulnerability and threat management solutions had this comment:

The fact that these devices are generally externally facing and the simplicity of exploiting the Palo Alto PAN-OS vulnerability significantly increases the threat exposure. Bad actors are probably already scanning the internet looking for vulnerable instances.

Here’s some specific details about this issue. Affected versions of PAN-OS are:

• PAN-OS 9.1 versions earlier than PAN-OS 9.1.3
• PAN-OS 9.0 versions earlier than PAN-OS 9.09
• PAN-OS 8.1 versions earlier than PAN-OS 8.1.15
• All versions of PAN-OS 8.0 (EOL)

This issue does not affect PAN-OS 7.1

This issue cannot be exploited if SAML is not used for authentication.

This issue cannot be exploited if the ‘Validate Identity Provider Certificate’ option is enabled (checked) in the SAML Identity Provider Server Profile.

Palo Alto Networks provided a patch for this vulnerability and indicated they are not aware of any malicious attempts to exploit this vulnerability at this time.

The Digital Defense Vulnerability Research Team is developing checks for the condition for its Frontline.Cloud vulnerability management solution as more information is made available.