The Philippines continues to experience a flurry of cyberattacks targeting businesses and industries, as evidenced by the increasing number of attacks detected and identified by Kaspersky’s detection systems.
Kaspersky blocked 26,164,698 web attacks, which correspond to nearly 72,000 per day, and 22,731,157 local infection attempts (or more than 62,000 per day) against its users last year. And despite the country’s favorable economic forecast, it is still exposed to danger brought about by cybersecurity challenges such as phishing, disruptions, and other forms of cyberthreats.
In the 2024 threat forecast for the Southeast Asian region, which includes the Philippines, Kaspersky predicted that financial service outages, DDoS attacks, and website defacements will continue to exist where endpoint security is no longer enough to protect computers against threats. In this case, the cybersecurity firm highlights the urgent need for enterprises, government, and the private sector to level up the protection of their systems.
To address these challenges, Kaspersky launched the Kaspersky Unified Monitoring and Analysis (KUMA) platform, with its integrated software solution that includes a set of functions for security information and event monitoring and management. Designed for the B2B segment, KUMA helps businesses stay safe in cyberspace while embracing digitalization.
Using KUMA, Kaspersky detected a vulnerability in iOS devices, distributing zero-click exploits via iMessage to run malware that gains complete control over the devices and user data.
Yeo Siang Tiong, general manager for Southeast Asia at Kaspersky, warned that when it comes to cybersecurity, even the most secure operating systems can be compromised as APT actors are constantly evolving their tactics and searching for new weaknesses to exploit.
For this reason, Yeo encourages businesses to prioritize the security of their systems by providing employees and technical teams with the latest tools to effectively recognize and defend against potential threats as well as timely remediation of incidents.
KUMA is a unified console for monitoring and analyzing information security incidents. The fundamental program includes the following components:
- One or more Collectors that receive messages from event sources and parse, normalize, and, if required, filter and/or aggregate them.
- A Correlator that analyzes normalized events received from Collectors, performs the necessary actions with active lists, and creates alerts in accordance with the correlation rules.
- The Core that includes a graphical interface to monitor and manage the settings of system components.
- The Storage, which contains normalized events and registered incidents.
As a security information and event management (SIEM) platform, KUMA offers the following advantages: high performance of 300k + EPS (events per second) per KUMA instance, low system requirements, scalability, unified web console interface, out-of-the box, and low entry threshold.
SIEM is a central element of most mature information security systems. Hence, it must meet all relevant market requirements and take into account the changing landscape of cyber threats. KUMA expands the capabilities of analysts, allows businesses and organizations to optimize the budget for cybersecurity, providing protection at the optimal level.
“Threat actors increasingly use diverse tactics to launch sophisticated targeted attacks. Therefore, it is essential to use a platform that can provide a centralized view of security events in quickly identifying and responding to potential threats such as the Security Information and Event Management System (SIEM). SIEM is commonly used for compliance support with internal security policies and external regulatory requirements,” said Victor Chu, head of systems engineering for Southeast Asia at Kaspersky.
He explained that KUMA empowers cybersecurity teams’ efficiency in detecting, investigating, and responding to complex cyber incidents with the approach of XDR (Extended Detection and Response) capabilities.
