Palo Alto Networks Recognized by TSIA for Outstanding Commitment to Customer Support and Success
On the heels of receiving the 2014 TSIA Star Award for Innovation in the Delivery of Support Services, Palo Alto Networks was again honored by the TSIA when it received a “Rated Outstanding Assisted North America” rating. This distinction recognizes industry leaders in assisted support – including remote phone, email and live chat support – that exhibit best practices as measured by an extensive list of detailed criteria.
To achieve this distinguished certification, Palo Alto Networks participated in a rigorous audit process that evaluated over 160 best practice criteria for delivering industry-leading technical support. The audit was developed by over 50 leading technology companies. Auditors conducted a thorough inspection of Palo Alto Networks support organization at several locations, including our headquarters in Santa Clara, CA, and our offices in Austin, TX and Chennai, India. Audits included listening to support services calls, reviewing procedures, conducting extensive team interviews, and inspecting support outcomes. Following the audits, we are happy to announce that the TSIA has determined that Palo Alto Networks assisted technical support processes exceed industry benchmarks.
Our primary focus at Palo Alto Networks is exceptional customer service and we could not be more proud to receive this distinguished certification from TSIA. Read the full announcement press release here.
Please let me know if you have any comments or questions, or contact me via Twitter anytime at @CicconeScott.
Và đêm nay tôi đã gặp lại ký ức của mình, khi bắt gặp một đứa bé trai lang thang dưới trời mưa như trút nước của Sài Gòn, như một đêm mưa hằng nhiều năm về trước ở Huế. Đứa bé rét run và toàn thân ướt đẫm vì cơn mưa nặng hạt, khẽ đến bên tôi và rụt rè xin ít tiền, khi tôi đang ngồi ăn ở một quán bún bò ở dọc đường. Tôi rút ra một ít tiền lẻ cho nó, rồi lại tiếp tục cắm đầu vào tô bún bò đang ăn dở, nhưng diễn biến tiếp theo đã phải khiến tôi không thể không dõi theo. Đứa bé sau khi cám ơn tôi đã cho nó ít tiền, đã đi đến cạnh cô chủ quán và khẽ hỏi liệu cô có thể bán cho nó một ít bún bò với số tiền lẻ mà tôi vừa cho nó hay không, và dĩ nhiên những gì nó nhận được chỉ là cái lắc đầu. Đứa bé lặng lẽ đi ra và ngồi dưới mái hiên nhà cạnh quán. Và dù dưới tiếng mưa nặng hạt, tôi vẫn có thể nghe văng vẳng được tiếng khóc ấm ức và uất nghẹn của nó. Và ngay lúc đó, ký ức của tôi chợt ùa về một cách mạnh mẽ và bất ngờ. Hình như tôi đang là đứa bé đó, cũng định bỏ nhà ra đi vào một đêm mưa nặng hạt với cái bụng đói meo, bỏ nhà ra đi để không còn phải nghe những lời khinh miệt từ người khác đổ lên đầu nó, lên gia đình nó. Nhưng đứa bé ngày xưa vẫn còn may mắn là nó vẫn còn đó một mái ấm gia đình, để nó khao khát quay về trong đêm mưa lạnh giá. Đứa bé đêm nay, tôi không biết nó có một mái ấm để quay về hay không, nhưng tôi thấy vẫn còn đó đôi mắt đỏ hoe cùng tiếng khóc uất nghẹn, và nước mắt của nó hình như đã hoà lẫn vào cùng với những giọt mưa đang lăn dài trên má. Tôi gọi tính tiền và kèm theo một lời nhắn cho cô chủ quán: “Cô bán giùm tôi một tô bún bò cho cháu bé vừa nãy.”
Tôi bước đến bên cạnh đứa bé, khẽ nói với nó: “Vào ăn bún bò đi cho nóng rồi hãy về nhà, đừng dầm mưa nữa. Chú mua cho cháu rồi.” Nó ngẩng đầu lên, bất ngờ và bối rối, lí nhí nói lời cám ơn tôi, khi những bước chân tôi đã xa dần dưới cơn mưa nặng hạt…
Tôi đã nghe nhiều về việc có những đứa trẻ giả vờ tội nghiệp và đáng thương để khiến người khác động lòng bố thí ở cái xứ Sài Gòn này. Nhưng tôi đã nghĩ, nếu đứa bé tối nay lừa tôi, cùng lắm tôi cũng chỉ mất một tô bún bò. Nhưng nếu không phải thì sao? Ít nhất nó cũng đã có được một tô bún bò ấm lòng lấp đầy cái bụng đói mốc meo kia. Ít nhất nó cũng có được một chút gì đó ấm áp giữa đêm mưa lạnh lẽo này. Và quan trọng hơn, tôi chỉ mong nó sẽ vượt qua đêm mưa, sống tốt và nhiều năm sau nếu nó có gặp một đứa bé khác giữa đêm mưa lạnh giá như thế này, ký ức của nó về đêm nay sẽ sống lại và hy vọng rằng nó cũng sẽ làm như những gì tôi đã làm đêm nay….
“Một ngày nào đó có thể bạn sẽ quên, nhưng ký ức vẫn còn luôn theo bạn mãi…”
Advanced Persistent Threat (APT) Solution of the Year for Traps
Security Company of the Year
These awards, organized by Computing Security Magazine, were set up to recognize the solutions and the solution providers helping to keep organizations secure.
Do you like our technology? Do you think Palo Alto Networks should win? Our fate is in your hands, so please vote now.
Chances are your organization is either working feverishly to field a cyber risk management program or improve your current program to make it more efficient. The recognition of the importance of risk-based security appears consistent across organizations. A 2013 Ponemon and Tripwire study reported that 81 percent of security and risk professionals in the US said their organizations had a significant or very significant commitment to risk-based security management. Unfortunately, the same study said that only 29 percent of those respondents felt their organization had a formal security risk management strategy that was applied consistently across the enterprise.
There are many challenges with implementing a cyber risk management program. These challenges may differ if the organization is starting a program from scratch, working to incorporate cyber risk into an already established risk program or perhaps working to transition from a compliance-based security program. No matter where your organization sits in this spectrum, there are some key actions that can be taken to strengthen an organization’s risk posture.
Incorporate cyber risk into the organization’s existing risk program Although many organizations already have an existing risk program, it is not uncommon to find a cyber risk program started and managed external to that structure. Often times this is due to the cyber risk effort evolving from the organization’s cybersecurity program. This does provide the benefit of a great deal of technical expertise but at the detriment of risk and line-of-business expertise. The result is misunderstood or poorly developed risk tolerances that do not align with business objectives and the organization’s inability to properly prioritize risk mitigation actions across the organization.
The key here is to arrive at a structure that has, or at least is based upon, a single, common language, risk tolerance criteria and risk catalog/register. The structure needs to include risk managers, security managers and business unit executives. Organizing the cyber risk program at this higher organizational level and out of IT can also aid in developing a cyber-aware culture in the organization.
Focus on the correct assets The first major component of any risk methodology is identification. An organization’s specific risk methodology may refer to this step as resource profiling, information system categorization, identification of IT services or something else entirely. The goal, however, is the same—identification of those information assets that must be secured to meet business objectives. If you do not know what is important, not only will you not know what to focus your defenses on, but you will have a harder time justifying a risk assigned to an asset. This discussion should not start with routers and servers, but with the information and services upon which the business depends. Once those are defined, prioritized and agreed upon, then IT can begin cataloging the relevant critical hardware and software. Few organizations have sufficient resources to implement all desired security practices. Identifying critical assets first focuses your risk program and your scarce resources. Doing this wrong could mean cyber risk ends up being defined in terms of compliance and will impact criticality of the asset at risk.
Expand the use of non-technical controls On one hand, it only makes sense that technology seems to have become the default answer when protecting information assets. The variety and effectiveness of technical solutions available for consideration have never been greater than they are today. Unfortunately, this focus has come at the cost of neglecting the human layer of our information systems. Focused, recurring awareness training and exercises, behavior management, and incentivizing desired actions can build an organization’s workforce’s ability to prevent, accurately detect, and quickly react to cyber incidents.
I have only just begun to touch on these considerations for more effective cyber risk management. I will be diving deeper and looking forward to the dialog during my presentation at the CSX North America 2015 Conference. Hope to see you there.
Douglas Rausch, CISSP President, Aurora CyberSecurity Consultants, Inc.
Cybersecurity is a hot topic these days. Corporate breaches in the headlines have turned hackers into the new super villains. “Revenge of the Nerds” is alive and well, and hacking is their super power. It’s no wonder that every customer meeting I attend starts with a concerned voice: “what can we do to protect ourselves and our customers” from these new super villains? Secretly, they’re wishing to hear about a shiny new product that will solve all of their security problems, providing new protection for every new attack.
We all want our data and networks to be secure, with no effort or risk, but there are no shortcuts to success in the territory of cybersecurity.
As surprising as it may sound, these villains’ new tactics are not as new as you might think; in fact, many of the so-called new attacks could have been prevented by correctly using existing security technologies as part of an end-to-end cybersecurity plan.
What is the plan? Think like a hacker.
Change the way you approach protection, what would you steal?
Start by thinking about what you need to protect, not about protecting the road to it. In other words, build protection to match your data and your processes, not just the network architecture. Learn about your business’s unique patterns of people-data interaction; what and how it needs to be protected, who needs access to it and when, and what is the expected interaction they will have with the data. Only then can you start building your data-centric security.
Look for the gaps – what is the easiest way to get your data?
All networks are built to provide a service that is dependent on multiple systems both internally and externally. Hackers look for gaps, the path of least resistance. Why break down the front door, if you can easily get in through an open window? Your security solution must prevent as much as possible across multiple phases of the cyberattack lifecycle.
2.1 When you think about gaps, look at the borders of your systems and processes internally and externally, as gaps have more to do with interoperability and less with physical objects (Internet of Things). Work to close those gaps and think outside of the security box. Your inventory list should include computing, storage and network equipment.
2.2 The human factor: social engineering attacks are rising, with high success rates. Training and education is the key to defending on this front. Adding tools and scripts to catch users’ mistakes can help reduce the risk.
Uncover deception – what and whom do you trust?
Your answer should be nothing and no one. Look to uncover and inspect as many compression and encryption protocols as possible, making sure that the data entering your network is what you expect it to be, and from whom you expect it to arrive. You must detect new unknown attack components across all traffic.
Look holistically, what are your blind spots?
As you plan to add new products or processes, strive to reduce complexity and keep it simple: simple to manage, simple to monitor, simple to update, and simple to control. Any blind spot or unattended system can and will be used against you, especially in multi-step attacks. Keeping it simple is probably the most challenging aspect of this process. It is a daunting task. As you look under the hood of many customers’ networks, most have been built over long periods of time with highly heterogeneous platforms, languages and tools. Remember that you have more than one environment to manage, as mobile devices and public/hybrid cloud infrastructure are two of the biggest attack vectors. Your solution should detect new, unknown attacks across all traffic.
Keep getting better – how can you be even more secure tomorrow?
New security protections can become outdated quickly, if they are not attended to and updated regularly. Threats are constantly changing, requiring continuous monitoring, tracking and assessments in order to keep your security up to date. Timing is everything. You must be able to turn detection data into prevention very quickly.
Sun Tzu and his “The Art of War” guidelines are more relevant than ever. In order to beat cybercriminals, you need to understand the battlefield, know the enemy and know yourself. Build a security ecosystem designed to fit your unique data mix and data consumption patterns, predict the enemies’ next move, counter it, and strive to be one step ahead of them.
