Cato aims to bust cyber myths as it extends network protections

As secure access service edge (SASE) specialist Cato Networks burnishes its cyber credentials with the addition of multiple features to its platform, the company’s senior director of security strategy, Etay Maor, has urged users to challenge some of their preconceptions around security, using data drawn from Cato’s global network to counter some established cyber “truths”.

In June 2022, Cato became the first SASE supplier to add network-based ransomware protection to its platform, combining heuristic algorithms that scan server message block (SMB) protocol flows for attributes such as file properties and network or user behaviours, with the deep insights it already has into its network traffic from its day-to-day operations.

The algorithms were trained and tested against the firm’s existing data lake drawn from the Cato SASE Cloud – which holds over a trillion flows from Cato-connected edges.

The firm claims this will let it spot and stop the spread of ransomware across an organisation’s network by blocking SMB traffic to and from the source device to prevent lateral movement and file encryption.

Speaking to Computer Weekly, Maor, who joined Cato from IntSights, and is also an adjunct professor at the Woods College of Advancing Studies at Boston College, described a Black Basta ransomware attack to which he responded, in which the victim – an unnamed US organisation – could have benefited from this.

When he gained access to the victim’s security logs, Maor found that all the information that a ransomware attack was incoming was there, the security operations centre (SOC) team had just not been able to see it.

“I know it’s cool to get to sit in front of six screens, but what SOC analysts are trying to do is gather so much information and put it all together, so I understand why stuff is missed,” he said.

“In this case, it was remote desktop [RDP] to an Exchange server. Yes, they said, but that Exchange server doesn’t exist anymore so why attack a server that’s not there? So I had to introduce them to ransomware as a service [RaaS].

“What happened was someone else who attacked them sold their network data to someone else who wrote a script to automate the attack. They weren’t there for weeks, they were there for a minute, they didn’t know the victim had changed their Exchange server, but got lucky somewhere else.

“So if you can see east-west traffic, like an attempt to connect to a server that isn’t there, that should be a red flag to the SOC,” he explained. “We created our heuristic algorithms to look for these quirks.”

Maor said he wanted to explode the myth – favoured by presenters at security conferences – that attackers need to get lucky only once, while defenders need to get lucky all the time.

“When you look at MITRE ATT&CK and see how attackers operate, you soon see that saying is the opposite of the truth. Attackers have to be successful at phishing, gaining an endpoint, lateral movement, privilege escalation, downloading malware payloads, et cetera.

“You actually realise that attackers need to be right all the time, but defenders need to be right only at one point to protect, defend and mitigate,” he said.

Cato is now going further still, adding a data loss prevention (DLP) engine to protect data across all enterprise applications without needing to implement “complex and cumbersome” DLP rules. It forms part of Cato’s SSE 360 architecture and is designed to solve for what the firm describes as the limitations with which traditional DLP solutions are fraught.

For example, legacy DLP may have inaccurate rules that block legitimate activities – or, worse still, allow illegitimate ones – while a focus on public cloud applications is leaving sensitive data in proprietary or unsanctioned applications exposed.

Added to that, investment in legacy DLP solutions does not help provide protection from other threat vectors.

Cato believes it has these problems licked by introducing scanning across the network for sensitive files and data that is defined by the customer. It is capable of identifying more than 350 distinct data types, and once identified, customer-defined rules will block, alert or allow the transaction.