Trustwave Holdings

From Wikipedia, the free encyclopedia
  (Redirected from Trustwave)
Jump to: navigation, search
Trustwave Holdings, Inc.
Trustwave
Private
Industry Managed Security Services, Information Security, Cloud computing
Founded 1995 (1995)
Headquarters Chicago, Illinois, United States
Area served
Worldwide (Customers in 96 countries)
Key people
Robert J. McCullen, Chairman & CEO
Products
Brands
  • Trustwave
  • Trustwave TrustKeeper
  • Trustwave SpiderLabs
Services
Revenue US $216 million [1] (2014)
Number of employees
1,200+
Slogan Smart security on demand
Website www.trustwave.com

Trustwave Holdings is a privately held information security company that provides on demand threat, vulnerability and compliance management services and technologies for more than 3 million business customers in 96 countries.[2] In 2014, industry analyst firm Forrester Research named Trustwave one of the leaders in the managed security services market. [3] The company’s international headquarters is located in downtown Chicago,[4] and regional offices are located in London, São Paulo, and Sydney. The company also operates Security Operations Centers in Chicago, Denver, Manilla, Minneapolis, and Warszawa. Trustwave is currently the only company that is an authorized PCI Forensic Investigator in all geographic regions.[5]

History[edit]

In April 2011, Trustwave Holdings filed for its IPO[6] though the company remains private today. Trustwave's website says the company has more than 1,200 employees.

On April 8, 2015 (SGT), Singapore Telecommunications Ltd (Singtel) announced it had entered into a definitive agreement to acquire Trustwave Holdings, Inc. for a fee of $810 million--Singtel with a 98% stake in the company leaving 2% with Trustwave's Chairman, CEO and President.[1][7] According to media reports and Singtel filings on the Singapore Exchange, the enterprise value of Trustwave at the time of the deal was $850 million. [8]

Acquisitions[edit]

  • Cenzic, Inc. (18 March 2014)
  • Application Security, Inc. (12 November 2013) [2][9]
  • SecureConnect, Inc. (3 April 2013) [2]
  • M86 Security. (6 March 2012) [2][10]
  • Breach Security. (22 June 2010) [2]
  • Intellitactics. (3 March 2010) [11]
  • BitArmor Systems. (12 January 2010) [2]
  • Vericept. (10 September 2009) [12]
  • Mirage Networks. (17 February 2009) [13]
  • ControlPath. (27 August 2008) [2]

Products and Technologies[edit]

TrustKeeper is a cloud-based platform that ties together Trustwave's various managed security services. Through TrustKeeper businesses can access a variety of Trustwave "apps" ranging from enterprise-class managed security services to PCI compliance automation tools designed to help credit card merchants protect themselves against unauthorized access.

Managed Security Testing is an application within TrustKeeper that provides an interactive way to view and track penetration test reports as an alternative to conventional PDF based reports. Earlier versions were called Trustwave PenTest Manager, and it won the 2012 SC Magazine Europe Innovation award.[14]

Secure Web Gateway (formerly Finjan): an appliance-based secure Web gateway that uses real-time code analysis technology, URL filtering and antivirus scanning to prevent malware and Web-based threats.[15] In May 2011, the M86 Secure Web Gateway was designated as Visionary in the 2011 Gartner Magic Quadrant Report for Secure Web Gateways.[16]

Secure Email Gateway (formerly M86 MailMarshal): an email security solution, available as software or through a cloud-based service, that protects against malware, spam and data leakage. It also provides reporting, analyzes inbound and outbound content and assists with policy control.[17] In April 2010, the M86 MailMarshal SMTP product was designated Visionary in the 2010 Gartner Magic Quadrant Report for Secure Email Gateways.[18]

Associated Technologies:[19]

  • Deep Content Inspection
  • SpamBotCensor
  • Blended Threats Module

Managed Security Services is a service offering from Trustwave that involves remotely managing its and third-party products such as Network Access Control, SIEM, and United Threat Management for companies who wish to outsource their security needs. According to the The Forrester Wave: Managed Security Services: North America, Q4 2014, Trustwave is a market leader in managed security services.

SpiderLabs is the advanced security services and research team at Trustwave that was developed by well-known security researcher, Nicholas J. Percoco. The team specializes in forensic investigations, penetration testing, education services, and security research that is used to update Trustwave's products and services with threat intelligence. SpiderLabs also authors the Trustwave Global Security Report, an annual report detailing the latest security trends and risk areas.[20] SpiderLabs also actively develops the open source web application firewall, ModSecurity, and a supplementary commercial rule set available for purchase.[21]

Significant Discoveries[edit]

  • RIG 3.0 Malvertisement Campaign (2015) – Security researchers from Trustwave monitored the operations of the RIG 3.0 exploit kit over about six weeks, during which attackers attempted to exploit more than 3.5 million potential victims and succeeded with about 1.25 million – an infection rate of 34 percent. RIG 3.0 is a the next generation of a service for distributing malware. RIG 3.0 works by infecting users who are simply browsing the web through malicious advertisements (known as a malvertisement). Trustwave determined that nearly 70 percent of the traffic being delivered to RIG could be directly linked to a number of malicious ad campaigns. [22]
  • "Punkey" point-of-sale malware (2015) -- Security researchers from Trustwave SpiderLabs discovered RAM-scraping point-of-sale threat they named "Punkey" during an investigation with the U.S. Secret Service. The malware uses a variable called 'unkey' to send the data to the C&C server, and the data is sent using an 'HTTP POST' command. So Punkey is a portmanteau of 'POST' and 'UNKEY': P(ost)unkey. [23]
  • “Backoff” point-of-sale malware (2014) -- Trustwave SpiderLabs investigators were the first to identify and name the Backoff point-of-sale malware that infected 1,000+ businesses in North America. The malware targeted point-of-sales systems by exploiting weak passwords on remote access software. Trustwave found it to be a unique new family of malware.[24]
  • Reflected File Download (2014) -- Trustwave SpiderLabs researcher Oren Hafif identified a new method of attacking web clients dubbed Reflected File Download. The new attack method allows attackers to piggyback on the trust given to a valid website to send malware to their victims. [25]
  • Same Origin Method Execution (2014) -- Trustwave SpiderLabs researcher Ben Hayak identified a new method of attacking web clients dubbed “Same Origin Method Execution” (SOME). The method capitalizes on a flaw in JavaScript Object Notation with padding (JSONP) that allows an attacker to execute arbitrary methods on affected websites. A victim that clicks on a specifically malicious link could expose confidential data to an attacker utilizing this attack method. [26]
  • Magnitude (2014) -- Trustwave SpiderLabs researchers found an instance of the Magnitude exploit kit that shed light on how the exploit kit’s business model works and how exactly it infects its victims. [27]
  • Pony Botnet Discoveries (2014 and 2013) -- Twice in 2013 and again in 2014 Trustwave SpiderLabs did an analysis of primary Pony bontnet controllers. The results of the analysis found that the botnets had gathered more than two million passwords and credentials for accounts on ADP payroll, Facebook, Twitter, Yahoo and more, [28] and over $220,000 USD in crypto-currency like Bitcoin. [29]
  • Redkit (2012) -- Trustwave SpiderLabs researchers discovered a new exploit kit they named RedKit. The exploit kit was one of the first to provide a constantly changing attack URL to make it difficult for organizations to block the exploit kit. [30]

Congressional Testimony[edit]

In February 2014, Trustwave SVP Phillip. J. Smith offered expert testimony related to data breaches and malware as part of a Congressional hearing for The House Committee on Energy and Commerce. In his prepared testimony, he presented observations based on the company's experience investigating thousands of data breaches, ongoing malware and security research and other forms of threat intelligence. [31]

Unrestricted sub-CA Incident[edit]

Trustwave operates an X.509 certificate authority ("CA") which is used as the top level of trust by many web browsers, operating systems, and other applications (a "trusted root CA"). In 2011, Trustwave sold a certificate for a subordinate CA which allowed a customer to present SSL certificates identifying as arbitrary entities, in a similar mechanism to (a "Man in the Middle Attack"). This type of action is similar to the practice of running an SSL proxy on a corporate network, though in this case a public subordinate CA (valid anywhere) was used instead of an internal corporate-generated domain CA (valid only for machines that accept it as part of organizational policy), making the risk of abuse much higher.

Though Trustwave asserts that special precautions were put in place to ensure that the customer attached its device only to a particular customer-owned network on which it was acceptable for the customer to impersonate other entities and to intercept traffic, this cannot be independently verified as Trustwave is unable to disclose the customer due to a Non-Disclosure Agreement.[32]

As a result, there was some brief discussion as to whether it was an egregious enough action to have Trustwave's root CA removed from the Mozilla Firefox browser. However, no action was taken.[32]

Allegations against Trustwave[edit]

In March 2014, Trustwave was named in a lawsuit filed by Trustmark National Bank and Green Bank N.A. The lawsuit alleges that Trustwave failed to provide the promised level of security to Target, and for failing to meet industry security standards.[33][34] In April 2014, a notice of dismissal was filed by both plaintiffs, effective withdrawing their earlier allegations. [35][36] Trustwave Chairman, CEO and President Robert J. McCullen also stated in a letter that "Contrary to the misstated allegations in the plaintiffs' complaints, Target did not outsource its data security or IT obligations to Trustwave. Trustwave did not monitor Target's network, nor did Trustwave process cardholder data for Target.".[37]


References[edit]

  1. ^ a b Aravindan, Aradhana (7 April 2015). "Singtel buying U.S. cyber security firm Trustwave for $810 million". Reuters. Retrieved 9 April 2015. 
  2. ^ a b c d e f g "Trustwave Holdings". Crunchbase. Retrieved 9 April 2015. 
  3. ^ "Trustwave Named a Leader in Managed Security Services by Independent Research Firm". Trustwave. 24 November 2014. Retrieved 9 April 2015. 
  4. ^ "Company Overview of TrustWave Holdings, Inc.". Bloomberg. Retrieved 9 April 2015. 
  5. ^ "PFI Companies". Payment Card Industry Security Standards Council. Retrieved 9 April 2015. 
  6. ^ Lennon, Mike (22 April 2011). "Trustwave Files for IPO, Reveals Finances". SecurityWeek. Retrieved 8 April 2015. 
  7. ^ "Singtel to Acquire Trustwave to Bolster Global Cyber Security Capabilities". Trustwave. 7 April 2015. Retrieved 9 April 2015. 
  8. ^ Shu, Catherine (7 April 2015). "Singtel Acquires Chicago-based Cybersecurity Firm Trustwave For $810M". TechCrunch. Retrieved 13 April 2015. 
  9. ^ "Trustwave Acquisition Bolsters Data Protection". Trustwave. 11 November 2013. Retrieved 8 April 2015. 
  10. ^ "Trustwave Completes Acquisition of M86 Security". Trustwave. 19 March 2012. Retrieved 8 April 2015. 
  11. ^ "Trustwave Acquires Intellitactics/". Trustwave. 3 March 2010. Retrieved 8 April 2015. 
  12. ^ "Trustwave Acquires Vericept". Trustwave. 10 September 2009. Retrieved 8 April 2015. 
  13. ^ "Trustwave Acquires Mirage Networks". Trustwave. 17 February 2009. Retrieved 8 April 2015. 
  14. ^ Raywood, Dan (24 April 2012). "SC Magazine Awards Europe 2012 - winners announced". SC Magazine UK. Retrieved 8 April 2015. 
  15. ^ Stephenson, Peter (1 April 2010). "M86 Security Secure Web Gateway Review". SC Magazine US. Retrieved 8 April 2015. 
  16. ^ Lawrence Orans & Peter Firstbrook (25 May 2011). Magic Quadrant for Secure Web Gateways (PDF) (Report). Gartner. p. 2. Retrieved 8 April 2015. 
  17. ^ "MailMarshal Email Content Security and Anti-Spam". Messagingsolutions.com. Retrieved 8 April 2015. 
  18. ^ Peter Firstbrook & Eric Ouellet (27 April 2010). Magic Quadrant for Secure Email Gateways (PDF) (Report). Gartner. p. 2. Retrieved 8 April 2015. 
  19. ^ "Email Security » MailMarshal SMPT, providing services to the City of London Police Force". Secure Content Technologies. Retrieved 8 April 2015. 
  20. ^ "Trustwave SpiderLabs". Retrieved 8 April 2015. 
  21. ^ "ModSecurity Commercial and Community Support/Services". ModSecurity. Retrieved 8 April 2015. 
  22. ^ "Newest RIG exploit kit driven by malicious advertising". CSO Magazine. 3 August 2015. Retrieved 3 August 2015. 
  23. ^ "New malware program Punkey targets point-of-sale systems". Network World. 16 April 2015. Retrieved 17 April 2015. 
  24. ^ "Alert (TA14-212A) Backoff Point-of-Sale Malware". US-CERT. 31 July 2014. Retrieved 8 April 2015. 
  25. ^ "Reflected File Download: New Attack Vector Enables File Downloads Without Upload". Security Week. 14 October 2014. Retrieved 21 April 2015. 
  26. ^ "Black Hat Europe: Hijacking Clicks With Same Origin Method Execution". Security Week. 16 October 2014. Retrieved 21 April 2015. 
  27. ^ "Exposed: An inside look at the Magnitude Exploit Kit". CSO. 5 August 2014. Retrieved 21 April 2015. 
  28. ^ "Two million stolen Facebook, Twitter, Yahoo, ADP passwords found on Pony Botnet server". ZDNet. 4 December 2013. Retrieved 21 April 2015. 
  29. ^ "'Pony' botnet steals bitcoins, digital currencies: Trustwave". Reuters. 24 February 2014. Retrieved 21 April 2015. 
  30. ^ "New Exploit Kit RedKit Discovered in Wild". ThreatPost. 7 May 2012. Retrieved 21 April 2015. 
  31. ^ "Protecting Consumer Information: Can Data Breaches Be Prevented?". United States House Committee on Energy and Commerce. 5 February 2014. Retrieved 8 April 2015. 
  32. ^ a b "Bug 724929 - Remove Trustwave Certificate(s) from trusted root certificates". Mozilla. 7 February 2012. Retrieved 8 April 2015. 
  33. ^ Schwartz, Mathew J. (26 March 2014). "Target, PCI Auditor Trustwave Sued By Banks". Darkreading. Retrieved 9 April 2015. 
  34. ^ Heun, David (25 March 2014). "Banks Sue Security Vendor Trustwave After Target Data Breach". American Banker. Retrieved 9 April 2015. 
  35. ^ Kirk, Jeremy (1 April 2014). "Banks withdraw data breach claim against Target". ComputerWorld. Retrieved 9 April 2015. 
  36. ^ "Security firm Trustwave says Target data breach claims baseless". Reuters. 29 March 2014. Retrieved 9 April 2015. 
  37. ^ "A Letter to our Valued Customers". 29 March 2014. Archived from the original on 18 March 2015. Retrieved 9 April 2015.