Transcript

If your computer breaks in one town, someone in another can fix it in seconds without even leaving their desk. That's the beauty of remote monitoring and management software, or RM. Businesses put it there on purpose, and cyber criminals know that all too well. They want that same access, and the easiest way for them to get it is simply to ask. The end users are often socially engineered into downloading a file, clicking a link, running some sort of a payload. Oh, you have an invite for a party and it's an invite.exe, and they execute it. And guess what? It's not an invite, and they immediately give the attacker access. Instead of writing their own malware that conducted these command and control functions for them, they've actually moved over to using these. Legitimate RMM solutions, I mean, why rebuild from scratch when you have tools that you can just pull off the shelf? If this organization already has an RMM solution in place, they're often going to overlook it as a compromise. Attackers abuse RM is because they can use a trusted tool to blend in with routine support tasks. So how do you know when it's being used as intended and when it isn't? It's all about being able to give application control with things like rogue RM, and what RMM Guard does is identify as what are these remote management applications that are already running within your environment. So this is a great way for us to be able to immediately provide more visibility, more control, and better outcomes. Let's terminate it. Let's prevent it from running. This moves us into a prevention mode, moves us left of boom ahead of the attacker actually gaining that foothold.