Rajat Mohanty the Co-founder, Chairman and Chief Executive Officer for Paladion Networks discusses the importance of Security Analysis
How does the left and right brain theory apply to cyber security monitoring
I frequently get asked by clients whether they should invest in security analytics projects. Over a period of time, I have built up a conceptual framework to put security analytics in the context of overall security operations. Although there are many areas for applying analytics, including risk and compliance or vulnerability management, I will concentrate on threat management where I feel it has maximum applications.
At the broadest level, I try to picture it as a left brain/right brain metaphor. While there may not be strong scientific evidence, the popular notion is that the right brain is involved in identifying patterns, connecting dots and getting the bigger picture while the left half is used for logical, analytical, and deductive thinking. In security parlance, right brain analytics would be used for discovering new things such as abnormal patterns, outlying behaviors, unknown attacks or trying to complete the jigsaw puzzle of an attack campaign when parts of the attacks may be missing from alerts. Meanwhile, left brain analytics would be used to dig deeper once an alert is found to deduce how and when the attack happened, who attacked, and what damage was done.
You can break security analytics in threat management into discovery analytics –right brain and investigative analytics –left brain. These are the fundamental pillars in an active cyber security framework.
When it comes to discovery analytics, there are a plethora of products today which have established the capabilities to detect attacks. Every AV, Firewall, IDS/ IPS, SIEM, and anti-APT have security analytics for this. In addition, there are a variety of threat intelligence products and separate big data analytics, user behavior, and entity behavior analytics. Again, I have tried to create a conceptual framework for this concept.
One can break up the threat into 2 parameters- attack vector and threat actor (attackers) – and plot the four quadrants as known and unknown for actors and vector. Known actors would mean we know something about the attacker, for example, the typical TTPs in a known attack has obvious meaning.
The right half of the graph is all about rules- attacks are known and hence a rule can be created for security devices like IPS, WAF, DLP, SIEM or anti-malware products. Because the attacks are getting more complex and because there are stages to attacks, these rules can be more than just one signature. While purists may not deem such rule writing as analytics, nevertheless, modelling the correct rules is an important part of threat detection. Many of the existing products in this segment are building more and more complex rules when they say security analytics.
The segment quadrant is where the attacks are not known a-priori, but we have some knowledge of the attacker. There is an entire industry that has grown around external threat intelligence. In addition, large enterprises are building up threat intel from their own internal SOC data. Such threat intel can be applied to a variety of data sources including logs, flows, packets, URL access, machine configuration files, etc to generate alerts. Tactical threat intel gets applied directly while strategic threat intel gets modeled into attack trees.
The most classical application of analytics however is in the unknown-unknown quadrant. This is where the statistical and probabilistic models are used for finding outliers, patterns, abnormalities, and attack sequencing. Machine learning is getting widely used for this quadrant and the concept of big data is most relevant here since the underlying data is beyond logs, ingesting a wider variety of machines, networks, packets, and unstructured data.
However, the last quadrant is also the area where you could end up chasing the tools rather than the output. There are so many models, algorithms, and software packages that do machine learning, statistics, and probability calculation that often the discussion is more about the tools and platform capabilities rather than the use cases. Even if you are trying to find unknown-unknowns, it’s still important to pin down the use cases for them.
The Cyber Kill Chain – Determining when rules are needed
That brings us to my third conceptual model – using cyber kill chain to understand why we are building what we are building in security analytics. As the diagram shows, there are some areas of kill chain like exploit and recon and some parts of execute where rules are available in current products. These are represented by red dots. Several other areas like the deliver phase or the install phase are difficult to have rules and hence need analytical models, which are shown as black dots.
These detect waterhole attacks, unknown forms of beaconing, unknown malware installation, lateral spread in networks, data exfiltration without the data being labeled, etc, and are the areas that need analytics as well as rules to solve them. For other places where rules can solve, it is overkill to build analytics. (The red and black dots are only for illustrating the idea and not the exact measurement of what rules are available). So, one way to approach use cases would be to determine what threats you want to detect and whether any rules exist in any of the deployed products before taking up a security analytics project.
I am trying to build a framework regarding left brain analytics, security investigative analytics, what analytics are needed following an alert or incident, or as Gartner says, “hypothesis driven analytics.” I will address this concept in a future post.
Sony MEA Intros Three New High-Performance G Lenses
Sony has announced three outstanding G Lenses to its impressive E-mount line-up – the FE 50mm F2.5 G (model SEL50F25G), FE 40mm F2.5 G (model SEL40F25G), and FE 24mm F2.8 G (model SEL24F28G). All three lenses deliver the high image quality and beautiful bokeh in a lightweight and compact design, perfect for photographers and videographers alike who strive for standout shots and easy mobility.
When paired with a Sony full-frame camera or APS-C, all three lenses boast high resolution, intuitive operability and fast, precise and quiet autofocus capabilities. The lenses have been introduced as the perfect set for photo and video for a wide range of uses including snap shooting, portraiture and landscape shots.
“At Sony we are constantly innovating to produce the tools that creators need to capture the beauty of this world” said Murat Gebeceli, Head of Digital Imaging, Sony Middle East & Africa. “With superb resolution and mesmerising bokeh, all housed in a compact and sophisticated design, the FE 50mm F2.5 G, FE 40mm F2.5 G and FE 24mm F2.8 G enable users to experience the joy of owning lenses that capture different perspectives of the same scene”. These three prime lenses each deliver a focal length for any shoot with the 50mm best for portraits, the 40mm optimal for still or movie snap shooting, and the 24mm ideal for landscapes. With their intuitive operability and superb build quality they are a fantastic set of three.
What’s more, the three lenses are of the same size (68mm diameter x 45mm), have the same filter diameter (49mm) and are almost the same weight (FE 50mm F2.5 G 174g, FE 40mm F2.5 G 173g and FE 24mm F2.8 G 162g) and internal focus so lens interchange is easy – even when using a gimbal. They feature the same stylish exterior design, but focal lengths are clearly marked for quick switches.
The FE 50mm F2.5 G, FE 40mm F2.5 G, and FE 24mm F2.8 G deliver the high image quality of a G Lens, whilst being compact and lightweight. The image quality is achieved by state-of-the-art optics using aspherical elements and ED (Extra-low Dispersion) glass elements, delivering high resolution and suppressing colour fringing. The aspherical elements ensure high-resolution performance in every corner of the image, even from the widest aperture with shallow depth of field. Enjoy shooting in high resolution using a compact design.
The stunning bokeh of the G lens is achieved with the optimisation of a circular aperture and is delivered at the widest point of each lens (FE 50mm F2.5 G F2.5 at 50mm, FE 40mm F2.5 G F2.5 at 40mm, and the FE 24mm F2.8 G F2.8 at 24mm). All three lenses were carefully designed for optimum mobility and are compact and lightweight enough to suit any location. Whether shooting with a full-frame or APS-C body for portraiture, landscape, snapshots or movies with a gimbal and more, the size and weight are balanced perfectly. Experience the benefits of interchanging lenses to suit any scene or subject.
As well as the 50mm angle of view is perfect for portraits and snap shooting stills or movies, the FE 50mm F2.5 G has a minimum focus distance of 0.35m (AF) / 0.31m (MF) and a maximum magnification of 0.18x (AF) / 0.21x (MF), meaning it’s ideal for a variety of scenes and objects. The FE 40mm F2.5 G 40mm angle of view is ideal for snap shooting stills or movies with a minimum focus distance of 0.28m (AF) / 0.25m (MF) and a maximum magnification of 0.20x (AF) / 0.23x (MF). Particularly for movie shooting, 40mm is the preferred angle of view as it corresponds to the natural field of vision and for stills, 40mm allows subjects to stand out against backgrounds.
With a wide 24mm angle of view, the FE 24mm F2.8 G lens is perfect in situations where the background is included, such as gimbal or selfie shooting with a grip attached. And with a minimum focus distance of 0.24m (AF) / 0.18m (MF) and maximum magnification of 0.13x (AF) / 0.19x (MF), you can also shoot close-ups with a blurred background.
Despite their compact size, the lenses feature a focus hold button, focus mode switch, aperture ring, and Aperture click switch for ideal operability. The focus hold button is customisable from the camera menu and can be assigned a function that the user prefers. The aperture ring provides a more intuitive and direct feel, compared to operating the aperture from the camera body when shooting either stills or movies.
The aperture also provides switchable click stops that can be turned off for movie shooting using the aperture click switch. Furthermore, with Linear Response MF, the focus ring responds precisely and linearly when focusing manually so control feels immediate and intuitive, directly reflecting the intent of the photographer and allowing delicate focus adjustments.
The aluminium exterior and engraved Sony logo ensure a premium, sophisticated finish as well as increased strength and durability. Conveniently, the diameter of the filter threads on the hood and the lens barrel are equal (49mm), allowing the same cap and filter to be attached to both the hood and the lens barrel. The lenses are also designed to be dust and moisture resistant to ensure usability in any outdoor environment.
The FE 50mm F2.5 G, FE 40mm F2.5 G, and FE 24mm F2.8 G feature two linear motors to deliver fast, precise autofocus (AF) with excellent tracking performance which is maintained despite instantaneous changes in subject motion – making the lens ideal snapping moving subjects. The AF is also quiet, so works for both still and movie shooting.
The FE 50mm F2.5 G, FE 40mm F2.5 G, and FE 24mm F2.8 G will be available in selected countries in the Asia Pacific from April 2021.
Review: ASUS ROG Flow X13 (GV301)
The new ASUS ROG Flow X13 is the company’s ultra-slim gaming laptop that measures just 15.8mm thin and weighs just 1.3-kgs.
As soon as we took it out of its packaging, we were quite surprised at how thin the laptop was. This 13-inch gaming laptop comes with a 360-degree hinge, which ASUS calls Ergolift.
This hinge lets you use the laptop in multiple form factors to fit your needs. You can use it in the clamshell mode for the usual laptop usage. You can also flip the screen all the way to the back to use it as a tablet. In addition, you can even switch it to tent or stand modes to increase cooling that according to ASUS, lowers processor temperatures by up to 8°C.
And the Flow X13 looks pretty! You get textured lines across its surface for added grip for easy carrying. We also liked the fact that it has the metallic ROG badge on it, which makes it even cooler to look at. The ROG Flow X13 also supports the ROG XG Mobile external GPU, which is sold separately.
In terms of connectivity, you get plenty. On the left edge, you get a ROG XG Mobile interface, one HDMI 2.0b port, the 3.5mm audio combo jack, the activity LED and the power LED. On the right edge, you get one USB 3.2 Gen 2 Type-A port, two USB 3.2 Gen 2 Type-C ports which come with DisplayPort 1.4 + PD support, and the power button, which also doubles-up as a fingerprint reader.
Around the edges of the Flow X13, you will find plenty of cooling vents to keep the device cool, even during your intense gaming sessions. The laptop also comes with two Speakers and a Smart Amp, with support for Hi-Res Audio and Dolby Atmos. In terms of battery, you get the 62Whr variety and ASUS bundles a smaller power adapter rated at 100W. The charger uses the USB-C connector to charge up the device.
As soon as you open the top lid of the laptop, you come face to face with a 13.4-inches UHD touch display that offers an aspect ratio of 16:10. The screen offers a refresh rate of 60Hz, is Pantone validated, and comes packed into 4.9mm slim side bezels. For extra protection from drops or scratches, the display is equipped with Corning Gorilla Glass. You also get a webcam on top of the display that offers a resolution of 720P.
Everything displayed on the Flow X13’s screen looked awesome. You also get the ASUS Pen inside the box, which is bundled along with the Flow X13. Since the display is protected with Gorilla Glass, you don’t have to worry about scratches when you tap, swipe, and scribble on it. The ASUS Pen offers a smooth stylus action whether you’re sketching, writing, or just jotting down on the screen.
Under the hood, the ROG Flow X13 is powered by AMD Ryzen 9 5900HS processor with Radeon Graphics, running at a clock speed of 3.30GHz. You also get 16GB of LPDDR4X 4266MHz Dual Channel RAM, and 1TB of M.2 2230 PCIe SSD storage. The laptop is also equipped with Wi-Fi 6 (802.11ax) and Bluetooth v5.2 wireless connectivity.
The 15-inch keyboard on this 13-inch laptop comes with curved keys that make typing on it a breeze. The keys offer a 1.7mm travel distance that allows for effortless keystrokes. The keyboard also comes with a white backlit that offers better visibility of the keys under low-light conditions.
The performance offered by the ASUS ROG Flow X13 is top-notch, especially for a gaming laptop this thin and light. The AMD Ryzen 9 5900HS processor, coupled with 16GB of RAM, lets you run graphics-hungry applications with ease. Even CPU-intensive workloads such as video editing and 3D rendering become effortless.
For a price of AED 6999, the ASUS ROG Flow X13 seems like a very good deal, considering the form factor it is available in. It is thin, light and is also a gaming laptop. It also comes packed with an outstanding specs sheet, which offers brilliant overall performance. If you are a road warrior who is heavily into content creation or hardcore gaming on the go, the ASUS ROG Flow X13 won’t disappoint.
Price: AED 6999
Photography by Ranbir Sen
Nubia Launches the RedMagic 6 Series Tencent Edition Gaming Smartphone
Developed together with Tencent Games, RedMagic announced the latest iteration of its mobile gaming flagship line, the Tencent edition of RedMagic 6 and 6 Pro devices.
Featuring an ultra-smooth 165Hz refresh rate gaming display, a unique active cooling system and cutting-edge mobile gaming performance, the Tencent RedMagic 6 Series aims to bring a new level of performance to mobile gaming. The company also unveiled the first ever wearable product from RedMagic, the RedMagic Watch as well as other gaming accessories.
A Revolutionary Screen Brings an Unprecedented Display Experience
The Tencent RedMagic 6 and 6 Pro adopts the industry’s highest refresh rate AMOLED screen at 165Hz, which refreshes with 21 more frames a second than the 144Hz panels. It reduces the lag and makes visuals even smoother, creating the industry’s smoothest and most stable screen display. The Tencent RedMagic 6 Series also supports Touch Choreographer, an intelligently adaptive technology that selects the most accurate refresh rate between 60Hz/90Hz/120Hz/165Hz based on your activity, resulting in a more comfortable visual experience, and saving battery power. Users can also manually lock the screen refresh based on their own preferences and activity, such as when playing games.
The Tencent RedMagic 6 and RedMagic 6 Pro also features the industry’s highest touch sampling rate – with a single finger touch sampling rate of up to 500Hz and a multi-finger touch sampling rate of up to 360Hz. The response time is as low as 8ms, which makes the device extremely responsive, enabling players to hit and play faster and more accurately.
To ensure these truly incredible display speeds do not impact battery life, NUBIA has implemented a mobile device CPHY-DSI Technology for the first time in the industry, increasing the transmission rate for high quality images by twice as much as before and uses 20-50% less power.
The display of RedMagic 6 Series Tencent Edition is also perfect for all kinds of entertainment. The visual experience is supreme. The 6.8” FHD+ AMOLED display also has a screen ratio of 20:9, a resolution of 2400*1080, and a screen-to-body ratio of 91.28%. The color performance is excellent with the stunning depth of color of 10bit and full DCI-P3. The peak brightness is 630 nits, and the contrast ratio is as high as 1000000:1. Every detail is vivid and sharp even in sunlight. This display is also certificated by SGS for eye care, low smear, and high refresh rate. The 6th generation fingerprint sensor sits under the display and unlocks 50% faster compared to the last generation. Press, unlock, and play quickly and smoothly.
Upgraded to ICE 6.0 Cooling System Ensures Top Core Performance
Tencent RedMagic 6 series uses the new ICE 6.0 Multi-dimensional Cooling System with a built-in turbofan. The built-in high-speed centrifugal turbofan can reach up to an astounding 20,000 rpm and the canyon air duct design for airflow increases the air heat transfer coefficient by 500%. There’s also a large copper foil, covering the battery, while a vapor chamber (the world’s thinnest at 0.33mm) sits behind the motherboard, connected by thermal paste. Even the intense graphically demanding games run smooth and cold on Tencent RedMagic 6 Series.
The back of the RedMagic 6 Pro adopts an aero-grade heat dissipation ice blade design. The material selected is a high thermal conductivity aviation aluminum alloy material with a thermal conductivity of 200W/(mK). It greatly enhances the heat dissipation and thermal conductivity of the back cover, and can reduce the tactile temperature of the fuselage surface by 3-5 degrees on average.
Go a step further and complete the ultimate cooling solution with the new Dual-core Ice Dock. As the name implies, it is a dual system with dual fans and dual semiconductors for improved cooling. Not only does it keep the phone cool, but it looks cool too with its RGB lights and wing-shaped design, it’s a no-holds-bar cooling machine. Pair up with Bluetooth to control the fan and lights to fit your style and cooling needs.
Top Spec Supports Elite Gaming Adventure
The Tencent RedMagic 6 and Tencent RedMagic 6 Pro are empowered by Qualcomm Snapdragon 888. The CPU part uses the latest Kryo 685 architecture and adds a new Cortex-X1 super large core and can clock up to 2.84GHz, increasing the CPU performance of Qualcomm Snapdragon 888 by 25%.
The Tencent RedMagic 6 Series is equipped with LPDDR5 RAM and UFS 3.1 Storage. Faster application retrieval and caching speed, even if multiple apps are opened in the background, the phone can still run smoothly, without worrying about running into memory performance limitations.
RedMagic gaming phone 6 Pro is also equipped with a new UFS3.1 flagship flash memory, supporting HS-G4 specifications, and has a single-channel bandwidth of 11.6Gbps, which is twice the performance of UFS 2.1.
In terms of network, the Qualcomm Snapdragon 888 5G mobile platform integrates a complete 5G solution from Qualcomm’s third-generation 5G modem to the antenna-Snapdragon X60 5G modem and radio frequency system. It has stronger performance, wider coverage and higher speeds.
The 5G solution uses dual-mode SA and NSA, supports n1/n3/n41/n77/n78 and other network frequency bands, allowing you to experience high-speed mobile communication anytime, anywhere.
RedMagic OS 4.0, Intelligent Software Optimization for a Fluid Experience
The Tencent RedMagic 6 Series edition adopts a deeply customized software system based on the Android 11 version and has carried out more than 100 in-depth game adaptations and optimizations to create the RedMagic OS 4.0. Based on the deep optimization of the software and hardware of the game’s bottom layer, Tencent RedMagic 6 series also cooperates with Tencent Games, using the SolarCore 3.1 gaming engine, bringing a better gaming experience.
RedMagic OS 4.0 can learn user habits and preloads frequently used applications in advance to achieve the effect of faster use. The intelligent scheduling of CPU, GPU and memory can quickly respond when performance is required, shortening loading times such as booting, application startup, game loading, and touch screen response; in addition, the rendering system can trigger related resources for scenes with different refresh rates to ensure a stable frame rate for high-refresh scenes, and intelligent power saving for low-refresh scenes.
RAM Boost memory compression technology, expands virtual memory, so that 12G memory is used like 18G memory. The more memory, the faster the system responses and the smoother the game.
Magic Write 2.0 is a fast read-write optimization patented technology developed exclusively by RedMagic. Through the intelligent classification of file content and characteristics, it can realize the systematic optimization of disk write synchronization and asynchronous mixed dispatch, taking into account asynchronous concurrency and serial writing. The long-lasting performance improvement brings faster, more stable and safer disk read and write performance. In addition to increasing the writing speed of small files by up to 10 times as fast, it also optimizes file reading and writing for Tencent applications such as WeChat and QQ, increasing the reading and writing speed by 50% and accelerating reading and writing.
RedMagic OS 4.0 also improves the Touch Choreographer feature which can make the frame rate more stable by up to 50% to always get the smoothest experience without worrying about screen tearing or battery life.
Through the all-around performance optimizations and upgrades of Red Magic OS 4.0, the game performance and user experience of RedMagic phones have been maximized. The RedMagic 6 Series Tencent edition is also empowered by Tencent’s Solar Core game engine, which solves the three major pain points of competitive mobile game response speed, frame rate stability, and network latency.
Review: WD My Passport SSD (1TB)
WD’s new My Passport SSD is a gorgeous-looking external SSD storage device that offers storage capacities ranging between 256GB to...
Review: Honor 50
The new Honor 50 is the company’s first major smartphone launch since Honor spun out of its parent company Huawei...
Video: HUAWEI nova 9 – Will This Be the New Camera King?
The Huawei nova 9 offers a flagship-grade 6.57-inch, 120Hz OLED panel and 10-bit colour depth, potent Qualcomm Snapdragon 778G processor,...
Review: Xiaomi 11T Pro
Xiaomi launched a series of new smartphones on the regional market including the 11 Lite 5G NE, the 11T, and...
Review: Fitbit Charge 5
Fitbit launched the Charge 5 on the regional market a month ago and I have been using one for the...