Context for anti data exfiltration pioneer, BlackFog, with Spamhaus Intelligence API

Getting to know BlackFog

BlackFog is a global cybersecurity company specializing in on-device anti data exfiltration technology. The pioneering software protects SMEs through to enterprises from security threats such as ransomware, malware, phishing, unauthorized data collection and profiling. Yet, what really sets BlackFog apart is its preventative approach to cyber security, using behavioural analysis to pre-emptively identify and neutralize attacks before they occur.

With most solutions on the market being cloud-based, they rely on a centralized cloud console or a SIEM solution to identify anomalies remotely before raising an alert. BlackFog is different. The behavioural analysis occurs on the device in real time, allowing the threat to be stopped immediately.

To achieve this BlackFog requires rich data with an accurate ruleset that is constantly updated, validated and refined.

Getting to know the solution

BlackFog’s anti data exfiltration technology crowdsources dozens of different datasets, ranging from IP and domain reputation to ransomware feeds and real-time dark web scans.

BlackFog’s behavioural based technology not only blocks threats immediately, but also determines intent based on over 20 different parameters, including process injection, anomalies in communication patterns, baseline data volume, etc.

This behavioural analysis operates at the endpoint, rather than being sent to the cloud. By gathering as much context and information as possible, the technology is trained against potential threats and continuously developed to devise new rule sets and behavioural techniques.

The outcome? Not one customer has been breached by ransomware since installing the software, highlighting the effectiveness of the proactive data-driven approach.

How does BlackFog use Spamhaus data?

Two words: validation and context. The IP and domain data available via the Spamhaus Intelligence API (SIA) enriches the BlackFog data pool providing additional insight and signal. When an anomaly is highlighted at the endpoint, the information is returned to the cloud console, and the decision is then validated against the Spamhaus data.

SIA also adds value in providing new context BlackFog didn’t previously have, particularly valuable for the virtual CISO service. Aimed at smaller companies that cannot afford full-time IT professionals, the service analyses a company’s security environment, providing a detailed report. SIA provides context and insight to help interpret the data, identifying those potential threats or weaknesses in the company’s security posture. As Dr. Darren Williams, Founder and CEO of BlackFog explained “Our Virtual CISO customers have really appreciated the extra insights and details relating to why we’re blocking a specific resource or activity.”

Unique data

As we’re all aware, when it comes to data, quality is king. The diverse datasets collected internally and via API provide multiple points of validation, building accuracy and context.

Nonetheless, there are valuable data points that BlackFog is unable to obtain or that require a significant investment to create, therefore it’s a sensible commercial decision to partner with a third party. This is where Spamhaus comes in.

Having known about Spamhaus as a reputable vendor for years, BlackFog was on the hunt for feeds to give additional context and validation to their rich data. Fortunately, SIA was launched, offering something different to the rest of the market – unique sets of reputation data relating to IPs and domains, including domain authority scoring and the time a domain was registered.

For BlackFog, the availability of such data was a huge win, because let’s face it, creating this dataset would have been a huge undertaking. So, who better to buy it from, than the leaders in IP and domain reputation.

And the benefits for BlackFog?

Easy to use, plenty of time saved and even more data!

As SIA uses the latest standards – RESTful API – BlackFog hooked up and started consuming the data within the hour. In their own words, “implementation was easy and trivial”. But the true value is in the data itself.

By effortlessly adding an extra layer of validation and context, BlackFog’s analysis is reinforced in quality and reliability. This both empowers virtual CISOs with more detail and results in fewer unnecessary queries regarding blocked potential threats. Ergo, time is saved internally, and a clear picture of potential threats is provided, ultimately leading to better decision-making!

Great work BlackFog – we’re proud to be on this journey with you!

You can learn more about the Spamhaus Intelligence API and start a free 30-day trial here.