What's the frequency of the letter "h" in:
Last week I wrote about the SolarWinds Orion breach and how Armis can identify anomalous traffic indicative of the presence of the SUNBURST malicious code that was inserted into affected Orion builds. And as more information comes to light about this breach, I wanted to share how Armis is able to provide complete visibility to compromised and potentially compromised systems, the activity history of those systems, and the attacks themselves.
To recap, identifying the presence of the malicious SUNBURST code requires that you can identify the vulnerable version of SolarWinds in your environment. Additionally, to see if the exploit is active, you want the ability to look for anomalous behavior such as traffic going to known command and control (C2) servers. Armis can alert you when it sees traffic going to the already identified domains and IP addresses associated with the malware.
Vulnerable to SUNBURST – This detects SolarWinds Orion version 2020.2. These devices receive the highest risk score as they are vulnerable and haven’t been patched.
Potentially Vulnerable to SUNBURST 2 – This detects any devices running SolarWinds Orion other than the versions above.
Using Armis Standard Query (ASQ), Armis has the ability to query for and identify vulnerable and potentially vulnerable devices, providing risk scores, and the ability to drill into each device.
As I mentioned last week, for the latest updates on IOCs regarding the SUNBURST malware, please refer to the CISA advisory. Also note that SolarWinds has provided a security advisory and hot fixes, and is asking customers with any affected versions of the Orion platform to upgrade as soon as possible to ensure the security of their environment.
We are learning more about this breach every day and Armis will continue to provide you with updates on how to leverage Armis to find and remediate vulnerable devices. Armis has 100% visibility to everything here – the compromised product, the activity history of the compromised product, and the attacks themselves.
Armis offers a risk assessment to aid in the identification of devices vulnerable to the SolarWinds/SUNBURST malicious code. This risk assessment provides access to Armis platform features including device inventory, classification, and device risk assessment as well as a report on the number of vulnerable devices and their overall risk.
user
The given text has seventy-two "h"s.
assistant