Trustwave Holdings

Last updated
Trustwave Holdings, Inc.
Trustwave
Company type Subsidiary
Industry
Founded1995;29 years ago (1995)
Headquarters
Chicago, Illinois
,
United States
Area served
Worldwide
Key people
Eric Harmon, CEO [1]
RevenueUS $216 million [2]  (2014)
Number of employees
1,600+ [3]
Parent
  • Independent (1995–2015)
  • Singtel (2015–24)
  • The Chertoff Group (2024–present)
Website www.trustwave.com

Trustwave is an American [4] cybersecurity subsidiary of The Chertoff Group. It focuses on providing managed detection and response (MDR), managed security services (MSS), database security, and email security to organizations around the globe.

Contents

With costumers in 96 countries, it has its international headquarters in downtown Chicago [5] and regional offices in London, São Paulo, and Sydney. The company also operates Security Operations Centers in Chicago, Denver, Manila, Minneapolis, Singapore, Sydney, Tokyo, Warsaw, and Waterloo, Ontario. [6]

As of 2015, the company was a standalone business unit [7] cybersecurity independent subsidiary and brand of multinational telecommunications company Singtel. [8] In January 2024, it was announced that The Chertoff Group had completed its acquisition of the firm for $205 million. [9]

History

In April 2011, Trustwave Holdings filed for its IPO [10] , though it never completed the process. In May 2014, Trustwave withdrew its application [11] , citing unfavorable market conditions. Trustwave's website says the company has more than 1,600 employees. [3]

In February 2014, Trustwave SVP Phillip. J. Smith offered expert testimony related to data breaches and malware as part of a Congressional hearing for The House Committee on Energy and Commerce. In his prepared testimony, he presented observations based on the company's experience investigating thousands of data breaches, ongoing malware and security research and other forms of threat intelligence. [12]

On April 8, 2015 (SGT), Singapore Telecommunications Ltd (Singtel) announced it had entered into a definitive agreement to acquire Trustwave Holdings, Inc. for a fee of $810 million—Singtel with a 98% stake in the company leaving 2% with Trustwave's CEO and President. [2] [13] According to media reports and Singtel filings on the Singapore Exchange, the enterprise value of Trustwave at the time of the deal was $850 million. [14]

In October 2021, Trustwave sold its PCI compliance business to cybersecurity firm Sysnet for $80 million. [15] The sale gave Trustwave the ability to invest more in its core capabilities of managed detection and response (MDR) and managed security services (MSS), according to research firm IDC. [16]

Significant Discoveries

In 2013 and again in 2014 Trustwave SpiderLabs did an analysis of primary Pony botnet controllers. The results of the analysis found that the botnets had gathered more than two million passwords and credentials for accounts on ADP payroll, Facebook, Twitter, Yahoo and more, [17] and over US $220,000 in crypto-currency like Bitcoin. [18]

In June 2020, Trustwave SpiderLabs discovered a new malware family, which they named GoldenSpy, embedded in tax payment software that a Chinese bank requires corporations to install to conduct business operations in China. [19] Trustwave said it was uncertain whether the malware was embedded in all of the tax software or if it was deployed against specific targets. The FBI sent a subsequent warning about this malware threat to companies in healthcare, chemical, and finance industries. [20]

Leading up to the 2020 U.S. presidential election, Trustwave SpiderLabs found a hacker selling info on 186 million U.S. voters during its Dark Web and cybercriminal forum research. [21] Trustwave turned this information over to the FBI. [22]

In February 2021, Trustwave SpiderLabs discovered two "severe" vulnerabilities in SolarWinds Orion. One of the flaws could’ve allowed a hacker to gain complete remote control of a targeted SolarWinds system. Patches were released January 25 and customers of SolarWinds were urged to patch immediately. [23]

Criticism

Trustwave operates an X.509 certificate authority ("CA") which is used as the top level of trust by many web browsers, operating systems, and other applications (a "trusted root CA").[ citation needed ] In 2011, Trustwave sold a certificate for a subordinate CA which allowed a customer to present SSL certificates identifying as arbitrary entities, in a similar mechanism to a "Man in the Middle Attack". This type of action is similar to the practice of running an SSL proxy on a corporate network, though in this case a public subordinate CA (valid anywhere) was used instead of an internal corporate-generated domain CA (valid only for machines that accept it as part of organizational policy), making the risk of abuse much higher.

In March 2014, Trustwave was named in a lawsuit filed by Trustmark National Bank and Green Bank N.A. The lawsuit alleges that Trustwave failed to provide the promised level of security to Target, and for failing to meet industry security standards. [24] [25] In April 2014, a notice of dismissal was filed by both plaintiffs, effectively withdrawing their earlier allegations. [26] [27]

Recognition

In May 2019, Trustwave was named a leader in the Gartner Magic Quadrant for Managed Security Services, Worldwide. [28]

In August 2019, Trustwave won Threat Indicator Top Contributor Award from Microsoft. [29]

Trustwave was named a winner in the Best Managed Security Service category of the SC Awards for the second consecutive year in February 2020. [30]

In March 2020, Trustwave was named a leader in both the IDC MarketScape: Asia/Pacific Managed Security Services 2020 Vendor Assessment and the IDC MarketScape: Asia/Pacific Professional Security Services — Advisory, Assessment, and Awareness 2020 Vendor Assessment. [31]

In August 2020, Trustwave was named a leader in the Forrester Wave: Global Managed Security Services Providers, 2020 report. [32]

Trustwave joined the Microsoft Intelligent Security Association (MISA) in April 2021. [33]

In March 2021, Trustwave was named a Strong Performer and one of the top 9 "Providers That Matter Most" to clients in terms of current capability in the Forrester Wave for Managed Detection and Response (MDR). [34]

Trustwave was recognized as a Microsoft Security 20/20 Partner Award Winner for Top Managed SOC in May 2021. [35]

Related Research Articles

A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less secure elements in the supply chain. A supply chain attack can occur in any industry, from the financial sector, oil industry, to a government sector. A supply chain attack can happen in software or hardware. Cybercriminals typically tamper with the manufacturing or distribution of a product by installing malware or hardware-based spying components. Symantec's 2019 Internet Security Threat Report states that supply chain attacks increased by 78 percent in 2018.

SolarWinds Corporation is an American company that develops software for businesses to help manage their networks, systems, and information technology infrastructure. It is headquartered in Austin, Texas, with sales and product development offices in a number of locations in the United States and several other countries. The company was publicly traded from May 2009 until the end of 2015, and again from October 2018. It has also acquired a number of other companies, some of which it still operates under their original names, including Pingdom, Papertrail, and Loggly. It had about 300,000 customers as of December 2020, including nearly all Fortune 500 companies and numerous agencies of the US federal government.

Trellix is a privately held cybersecurity company that was founded in 2022. It has been involved in the detection and prevention of major cybersecurity attacks. It provides hardware, software, and services to investigate cybersecurity attacks, protect against malicious software, and analyze IT security risks.

<span class="mw-page-title-main">Kaspersky Lab</span> Russian multinational cybersecurity and anti-virus provider

Kaspersky Lab is a Russian multinational cybersecurity and anti-virus provider headquartered in Moscow, Russia, and operated by a holding company in the United Kingdom. It was founded in 1997 by Eugene Kaspersky, Natalya Kaspersky and Alexey De-Monderik. Kaspersky Lab develops and sells antivirus, internet security, password management, endpoint security, and other cybersecurity products and services.

The Mariposa botnet, discovered December 2008, is a botnet mainly involved in cyberscamming and denial-of-service attacks. Before the botnet itself was dismantled on 23 December 2009, it consisted of up to 12 million unique IP addresses or up to 1 million individual zombie computers infected with the "Butterfly Bot", making it one of the largest known botnets.

Cyberwarfare by China is the aggregate of all combative activities in the cyberspace which are taken by organs of the People's Republic of China, including affiliated advanced persistent threat (APT) groups, against other countries.

<span class="mw-page-title-main">Palo Alto Networks</span> American technology company

Palo Alto Networks, Inc. is an American multinational cybersecurity company with headquarters in Santa Clara, California. The core product is a platform that includes advanced firewalls and cloud-based offerings that extend those firewalls to cover other aspects of security. The company serves over 70,000 organizations in over 150 countries, including 85 of the Fortune 100. It is home to the Unit 42 threat research team and hosts the Ignite cybersecurity conference. It is a partner organization of the World Economic Forum.

A cyberattack is any offensive maneuver that targets computer information systems, computer networks, infrastructures, personal computer devices, or smartphones. An attacker is a person or process that attempts to access data, functions, or other restricted areas of the system without authorization, potentially with malicious intent. Depending on the context, cyberattacks can be part of cyber warfare or cyberterrorism. A cyberattack can be employed by sovereign states, individuals, groups, societies or organizations and it may originate from an anonymous source. A product that facilitates a cyberattack is sometimes called a cyber weapon. Cyberattacks have increased over the last few years. A well-known example of a cyberattack is a distributed denial of service attack (DDoS).

<span class="mw-page-title-main">Gameover ZeuS</span> Peer-to-peer botnet

GameOver ZeuS (GOZ), also known as peer-to-peer (P2P) ZeuS, ZeuS3, and GoZeus, is a Trojan horse developed by Russian cybercriminal Evgeniy Bogachev. Created in 2011 as a successor to Jabber Zeus, another project of Bogachev's, the malware is notorious for its usage in bank fraud resulting in damages of approximately $100 million and being the main vehicle through which the CryptoLocker ransomware attack was conducted, resulting in millions of dollars of losses. At the peak of its activity in 2012 and 2013, between 500,000 and 1 million computers were infected with GameOver ZeuS.

Cozy Bear, classified by the United States federal government as advanced persistent threat APT29, is a Russian hacker group believed to be associated with one or more intelligence agencies of Russia. The Dutch General Intelligence and Security Service (AIVD) deduced from security camera footage that it is led by the Russian Foreign Intelligence Service (SVR), a view shared by the United States. Cybersecurity firm CrowdStrike also previously suggested that it may be associated with either the Russian Federal Security Service (FSB) or SVR. The group has been given various nicknames by other cybersecurity firms, including CozyCar, CozyDuke, Dark Halo, The Dukes, Midnight Blizzard, NOBELIUM, Office Monkeys, StellarParticle, UNC2452, and YTTRIUM.

<span class="mw-page-title-main">Itzik Kotler</span>

Itzik Kotler is an Israeli entrepreneur, inventor, and information security specialist who is the co-founder and CTO of SafeBreach, an Israeli cybersecurity firm. Kotler was previously the Security Operation Center Team Leader at Tel Aviv-based Radware. He has given multiple talks at DEF CON, the world's largest hacker convention.

Lazarus Group is a hacker group made up of an unknown number of individuals, alleged to be run by the government of North Korea. While not much is known about the Lazarus Group, researchers have attributed many cyberattacks to them between 2010 and 2021. Originally a criminal group, the group has now been designated as an advanced persistent threat due to intended nature, threat, and wide array of methods used when conducting an operation. Names given by cybersecurity organizations include Hidden Cobra and ZINC or Diamond Sleet. According to North Korean defector Kim Kuk-song, the unit is internally known in North Korea as 414 Liaison Office.

Dridex, also known as Bugat and Cridex, is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word.

CrowdStrike Holdings, Inc. is an American cybersecurity technology company based in Austin, Texas. It provides cloud workload and endpoint security, threat intelligence, and cyberattack response services. The company has been involved in investigations of several high-profile cyberattacks, including the 2014 Sony Pictures hack, the 2015–16 cyber attacks on the Democratic National Committee (DNC), and the 2016 email leak involving the DNC.

<span class="mw-page-title-main">Anomali</span> American cybersecurity company

Anomali Inc. is an American cybersecurity company that develops and provides threat intelligence products. In 2023, the company moved into providing security analytics powered by artificial intelligence (AI).

<span class="mw-page-title-main">Sandworm (hacker group)</span> Russian hacker group

Sandworm is an advanced persistent threat operated by Military Unit 74455, a cyberwarfare unit of the GRU, Russia's military intelligence service. Other names for the group, given by cybersecurity researchers, include Telebots, Voodoo Bear, IRIDIUM, Seashell Blizzard, and Iron Viking.

Ryuk is a type of ransomware known for targeting large, public-entity Microsoft Windows cybersystems. It typically encrypts data on an infected system, rendering the data inaccessible until a ransom is paid in untraceable bitcoin. Ryuk is believed to be used by two or more criminal groups, most likely Russian, who target organizations rather than individual consumers.

<span class="mw-page-title-main">2020 United States federal government data breach</span> US federal government data breach

In 2020, a major cyberattack suspected to have been committed by a group backed by the Russian government penetrated thousands of organizations globally including multiple parts of the United States federal government, leading to a series of data breaches. The cyberattack and data breach were reported to be among the worst cyber-espionage incidents ever suffered by the U.S., due to the sensitivity and high profile of the targets and the long duration in which the hackers had access. Within days of its discovery, at least 200 organizations around the world had been reported to be affected by the attack, and some of these may also have suffered data breaches. Affected organizations worldwide included NATO, the U.K. government, the European Parliament, Microsoft and others.

Emsisoft Ltd. is a New Zealand-based anti-virus software distributed company. They are notable for decrypting ransomware attacks to restore data.

References

  1. ↑ "Trustwave Leadership".
  2. 1 2 Aravindan, Aradhana (7 April 2015). "Singtel buying U.S. cyber security firm Trustwave for $810 million". Reuters . Retrieved 9 April 2015.
  3. 1 2 "Trustwave: Our Story" . Retrieved 25 May 2016.
  4. ↑ "Singtel acquires Trustwave in $810M security services deal". ZDNet .
  5. ↑ "Company Overview of TrustWave Holdings, Inc". Bloomberg . Retrieved 9 April 2015.
  6. ↑ "Trustwave security firm opens first Canadian security operations centre in Kitchener-Waterloo". Global News. 12 August 2015. Retrieved 30 September 2015.
  7. ↑ "Trustwave: Our History".
  8. ↑ "TRUSTWAVE PTE. LTD. (200616191R) - Singapore Business Directory". SGPBusiness.com. Retrieved 30 August 2017.
  9. ↑ "Chertoff Group Affiliate Completes Trustwave Acquisition". Dark Reading. Retrieved 2024-01-26.
  10. ↑ Lennon, Mike (22 April 2011). "Trustwave Files for IPO, Reveals Finances". SecurityWeek. Retrieved 8 April 2015.
  11. ↑ "Trustwave pulls filing for initial public offering". Reuters. 2 May 2014. Retrieved 14 April 2024.
  12. ↑ "Protecting Consumer Information: Can Data Breaches Be Prevented?" United States House Committee on Energy and Commerce. 5 February 2014. Retrieved 8 April 2015.
  13. ↑ "Singtel to Acquire Trustwave to Bolster Global Cyber Security Capabilities". Trustwave. 7 April 2015. Retrieved 9 April 2015.
  14. ↑ Shu, Catherine (7 April 2015). "Singtel Acquires Chicago-based Cybersecurity Firm Trustwave For $810M". TechCrunch. Retrieved 13 April 2015.
  15. ↑ Novinson, Michael (2021-10-24). "Trustwave Sells PCI Compliance Business To Sysnet For $80M". CRN. Retrieved 2022-04-27.
  16. ↑ "IDC Report | A Strategic Move to Make Trustwave Laser-focused in its Core Offerings". Trustwave. Retrieved 2022-04-27.
  17. ↑ "Two million stolen Facebook, Twitter, Yahoo, ADP passwords found on Pony Botnet server". ZDNet. 4 December 2013. Retrieved 21 April 2015.
  18. ↑ "'Pony' botnet steals bitcoins, digital currencies: Trustwave". Reuters. 24 February 2014. Retrieved 21 April 2015.
  19. ↑ "The Golden Tax Department and the Emergence of GoldenSpy Malware". Trustwave. Retrieved 2022-04-27.
  20. ↑ "FBI warns US companies about Chinese tax software embedded with hidden malware: Report". FOXBusiness. 2020-07-24. Retrieved 2022-04-27.
  21. ↑ "Massive US Voters and Consumers Databases Circulate Among Hackers". Trustwave. Retrieved 2022-04-27.
  22. ↑ "Cybersecurity company finds hacker selling info on 186 million U.S. voters". NBC News. 22 October 2020. Retrieved 2022-04-27.
  23. ↑ Brewster, Thomas. "'Severe' SolarWinds Vulnerabilities Allow Hackers To Take Over Servers". Forbes. Retrieved 2022-04-27.
  24. ↑ Schwartz, Mathew J. (26 March 2014). "Target, PCI Auditor Trustwave Sued By Banks". Darkreading. Retrieved 9 April 2015.
  25. ↑ Heun, David (25 March 2014). "Banks Sue Security Vendor Trustwave After Target Data Breach". American Banker. Retrieved 9 April 2015.
  26. ↑ Kirk, Jeremy (1 April 2014). "Banks withdraw data breach claim against Target". Computerworld . Retrieved 9 April 2015.
  27. ↑ "Security firm Trustwave says Target data breach claims baseless". Reuters. 29 March 2014. Retrieved 9 April 2015.
  28. ↑ "What's Changed: The 2019 Managed Security Services, Worldwide Magic Quadrant". Best Information Security SIEM Tools, Software, Solutions & Vendors. 2019-05-08. Retrieved 2022-04-27.
  29. ↑ "Trustwave Wins the Threat Indicator Top Contributor Award from Microsoft". Trustwave. Retrieved 2022-04-27.
  30. ↑ "Trustwave Wins Best Managed Security Service for Second Consecutive Year at 2020 SC Awards". Trustwave. Retrieved 2022-04-27.
  31. ↑ "Trustwave Named a Leader in Two IDC MarketScapes on Asia Pacific Cybersecurity". Trustwave. Retrieved 2022-04-27.
  32. ↑ "The Forrester Wave™: Global Managed Security Services Providers, Q3 2020". Trustwave. Retrieved 2022-04-27.
  33. ↑ "Trustwave Nominated to Join Microsoft Intelligent Security Association (MISA)". Trustwave. Retrieved 2022-04-27.
  34. ↑ "World-Class MSS DNA Makes MDR All the More Powerful". Trustwave. Retrieved 2022-04-27.
  35. ↑ "Trustwave Recognized as a Microsoft Security 20/20 Partner Award Winner for Top Managed SOC". Trustwave. Retrieved 2022-04-27.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.