Skip to content

加入 DeLorean：隨著時間的推移進行數字化轉型！

We travel back in time in search of the first digital transformation

“-Jimmy! Define Digital Transformation!
-I haven’t studied it…
-There are no excuses, it is a very intuitive and well-known concept, even for an elementary school student.
-Mmm…
-Come on, Jimmy! Or I’ll give you an F that will give you blisters!
”

It was right then that Jimmy rose like a spring, and with his mind blank and his gaze clouded, he snapped a sonorous and mechanical sound to the horizon:

“Digital transformation is that change or advance relative to any application of new digital technologies in all aspects and aspects of human society.”.


“-BRAVO, JIMMY! BRAVO!”, applauded the whole class.

That day they carried Jimmy out of the building on their shoulders and immediately instituted summer vacations for the entire school, in the middle of October. From here we can only say: Thanks, Jimmy. We will use your neat and undeniable definition to trace today, on Pandora FMS blog, a journey through time in search of the first notions about digital transformation and its consequent repercussions. So join us, if you like, on our tuned, hybrid, and full of diesel DeLorean, to make an absolute reference to Back to the Future.

Digital Transformation in 2011, 2013 and 2015

We have already burned wheels in two parallel lines of fire with our DeLorean and we have reached 2015. Do you remember? Jorge Lorenzo won his third MotoGP World Championship and Juan Goytisolo received the Cervantes Award. That same year the research center MIT Center for Digital Business and the private firm Deloitte declared: “mature digital businesses are focused on the integration of digital technologies, such as social, mobile, analytics and cloud, at the service of the transformation of how business is done. In contrast, less mature businesses are focused on solving discrete business problems with individual digital technologies.” Is it clear enough? If you are not applying digital transformation, your chances of being left behind are high then.

In 2013, the Year of Faith according to the Catholic Church and the year of Luigi according to Nintendo. Not that long ago, not even a line on our DeLorean’s tank marker, we found a very uneven analog-digital conversion, according to Booz & Company, the global strategy consulting team. We are talking about sectors and countries lagging behind in converting from analog to digital. I am sure that if you look back, you will remember the uncertainty and slowness of analog technology. Politicians and strategists at the helm around the world had to step up the development ladder in this paradigm shift. The economy depended on it!

In 2011, with the death of Steve Jobs and the beatification of Pope John Paul II, we find that only a third of the companies around the world have a particular program of truly efficient digital transformation. Sad, yes, but as we travel backwards we will feel this crudeness more strongly.

Digital Transformation in 2000

We refuel our DeLorean in 2000, big milestones of the year? I got Pokemon Gold with Typhlosion at level 91. At that time, digital transformation was a fact very much in mind and in which they were already working, but the arrival of the three Ws (World Wide Web) changed, profusely, the speed and scope that digitization would show. There was increased pressure from societies to pass this process.

Digitization had become a concept/argument that was used at all times. And of course, it had to do with the increased use of the Internet and IT at all scales. This climate, already so common in companies, made us all aware of the issue and even the EU, for example, created the Digital Single Market. From this place arose many of the ideas with which the political agendas of the different countries of the Union were nurtured. The transformation of their different societies began gradually.

Digital Transformation much further back in time

I know you didn’t expect our DeLorean to be past eighty. After all, many believe that from there, apart from the unquestionable Back to the Future franchise, comes all the magic of digitization. However, it is time to accelerate. The Flux Condenser will fume but it will be worth it. If we get stuck in the past, with no possibility of returning, we will learn its customs and form a new family while we make ends meet by investing in aspirin or the gramophone.

In 1703, the King of Portugal, Pedro II, declared himself opposed to the cause of Philip of Anjou and Tsar Peter the Great founded the city of Saint Petersburg. However, the digital transformation has to give thanks at that time to Gottfried Wilhelm von Leibniz, who, attentive, gave birth to the concept of digitization in one of his most transcendental publications: “Explication de l’Arithmétique Binaire”. Years later, 1854, 1938, approx, geniuses as renowned as George Boole and Claude Elwood Shannon complemented and developed it.

In 1939, World War II begins and Gaby, Fofó and Miliki decide to form a comic trio of clowns. But we also have George Stibitz, known in the trade for his work on the development of digital logic circuits and, nothing more and nothing less, than for laying the foundations of the first digital computer. In addition to popularizing the term “digital”, very important for this article.

In 1961, Yuri Gagarin becomes the first human being to travel to outer space and Roy Orbison releases his debut album, “Roy Orbison at the Rock House”. But who interests us is Leonard Kleinrock, the American, engineer and science teacher who conceives the Internet in his work “Information flow in large communication networks”. To this day (the day the article is published), this man is still alive. Better go pay tribute to the door of his house. He resides between New York and Los Angeles and likes camellias.

In 1969, the arrival of Apollo 11 to the Moon and the Beatles’ last public performance. The ARPANET network was also created, commissioned by the US Department of Defense, and which is basically the seed of what we now know as the Internet.

Now that we have returned, unscathed, from our journey in search of the past milestones and nuances of the “Digital Transformation” concept, and now that the DeLorean is parked, until the next adventure (in which we will undoubtedly go see a Tyrannosaurus Rex or a Queen concert), we can resolve that the digital transformation has led to important changes within business models, social and economic structures, political and legal decisions, culture and other organizational patterns that guide us in the present. The concept went from a small and private sector to reach the hands of a huge public, always eager to master new technologies. The question is: In this new kingdom, as we have seen, new and old at the same time, what is your place?

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

ESET 在關於威脅情報和零信任威脅檢測和響應的兩份分析報告中獲得認可

BRATISLAVA — July 20, 2021 — ESET, a global leader in cybersecurity, has been included in two Forrester reports: The Forrester Tech Tide™: Zero Trust Threat Detection And Response, Q2 2021 and The Forrester Tech Tide™: Threat Intelligence, Q2 2021. ESET was included as a sample vendor in both reports, which ESET believes highlights its powerful endpoint detection and response and threat intelligence services.

The Forrester Tech Tide reports examine the maturity of an ecosystem of technologies, and help organizations make decisions on which technologies to invest in and when. The “Zero Trust Threat Detection and Response” report analyzes 17 technology categories and includes sample vendors that support Zero Trust threat detection and response capabilities. These capabilities “have become even more critical for identifying ongoing attacks that may have evaded preventive controls and tools.” As such, this report complements The Forrester Tech Tide™: Zero Trust Threat Prevention, Q3 2020.

“The Forrester Tech Tide: Threat Intelligence” report analyzes 15 technology and service categories that  enable an effective and intelligence-driven security program.

ESET believes its inclusion in the reports reflects the high business value of its products and services, in particular, ESET Enterprise Inspector and ESET Threat Intelligence, which are backed by strong malware research (published on ESET’s security blog WeLiveSecurity).

Zero Trust threat detection and response is critical to all modern businesses. As Forrester points out in its report, endpoint detection and response solutions “are the next generation of endpoint protection, providing more visibility and control than has ever been available.”

With the threat landscape evolving and cyber breaches increasing, Forrester also identified threat intelligence as a critical component of a business’s security stance. Organizations from every industry should use cyber threat intelligence to track threat actors and help build robust security systems. ESET has been identified as an expert in the field of threat intelligence, providing detailed cyber threat intelligence and indicators of compromise feeds that are applied across the whole portfolio of its products, and are assembled and assessed by its vast network of research teams across the globe.

Zuzana Legáthová, Analyst Relations Manager at ESET, commented, “We are thrilled to be included in not one, but two Forrester Tech Tide reports for our endpoint detection and response offering and our threat intelligence services. We believe inclusion in these kinds of reports reflects our continued investment in our own technologies and research, and our commitment to ensuring our customers are always one step ahead in the threat landscape. Strong threat detection and response and threat intelligence capabilities are now more than ever of vital importance to all businesses and organizations, and we are proud to be recommended by Forrester as a vendor that supports organizations in building resilient security architectures underpinned by these technologies.”

To find out more about ESET’s business offerings, click here.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

為什麼 GREYCORTEX Mendel 是您的網絡安全產品系列的重要成員

There are several basic tools for securing network infrastructure that should not be missing from any organization. Let’s take a look at the role of GREYCORTEX Mendel in all those products protecting the data and network in your company.

Antivirus software, firewalls and intrusion prevention systems (IPS) should be an integral part of any organization’s cybersecurity solution. Nowadays, however, they are often not enough. That’s where Mendel steps in.

GREYCORTEX Mendel stands on several levels:

  • It is a unique tool that sees, visualizes and analyzes everything in your network – devices, access and all communications.
  • It is a great extension to the functionality of standard cybersecurity tools: antivirus, firewalls and network performance monitoring. They are crucial, but there are some threats that even they cannot detect. The reason is simple: attackers are often ready for these standard systems.

Mendel Sees and Visualizes in the Context of Time and Events

Imagine a tool that sees all the devices in your network, how they are communicating together, what protocols they are using and where your data is going. With Mendel, you can see all of that. You can also view the details of a specific device, its communication and where it is connected to at the moment, and also yesterday or a year ago.

With this unique analysis, you can uncover a sophisticated attack on your infrastructure before it really happens. That’s because you can relate current events to events that happened before, even in the more distant past.

Let’s take a look at an example of an attack that may go unnoticed by a standard detection mechanism: Advanced malware is not detected on the end device, but that device shows behavior that could endanger the network – for example, trying to access somewhere it has not accessed before. It could be spyware or an APT in your internal domains that is gradually spreading across your network through a domain, while the infected machines start accessing unusual devices and data sources and performing lateral movement. Mendel can identify and notify you of such unusual behavior.

More Reliable End-Point Security

Because end-points are an easy target, often provide valuable data and are an entry point for gaining deeper access to your network, they are the frequent initial targets of cyber-attacks.

Commonly known end-point attacks include:

  • network mapping
  • data exfiltration (sending data in non-standard or encrypted channels, communication with control devices)
  • Dictionary attacks, password data breaches
  • Data mining (reading important information, mining data from a database, mining users from information systems or from a domain controller)

Mendel flags such attacks as dangerous behavior and recognizes the threat that might not have been recognized by endpoint security or that is well hidden by the attacker. Even if antivirus software is deployed, Mendel monitors the communication of your devices and reveals any anomalies in it. All of that using a broad database specializing in network cyber threats that include not only known threats but also signatures of unusual behavior.

A Smarter Firewall

We can understand a few things that fall under the term firewall: standard firewalls and smart solutions known as an IPS.

Traditional firewalls stand first in the line of defense and secure broad traffic filtering. They adjust network transitions and the availability of network services and are mostly used on the external perimeter – in some cases within the internal network. They are often open or insufficiently configured.

In such cases, Mendel plays the role of an auditing tool – controlling the function of the firewall itself and checking its configuration. You can use this feature for verifying and controlling the communication matrix in your internal network and critical systems. It helps you understand who is connecting where, who is using what and who is behaving differently than they should.

Smart solutions such as IPS see more deeply into your network, can detect known threats and block them. Also here, Mendel provides you a double-check by monitoring the operation of web proxies and email gateways. This means no potential threat can pass. Even in this case, Mendel’s advantage is its extensive database of threats, consisting of multiple sources and signatures that verify not only known attacks but also security policies and potentially dangerous access to data sources, such as administrative sharing. This approach is much more effective for the detection of vulnerabilities than just a database of known threats from one vendor.

This way, Mendel shows much more – not only what needs to be blocked but also unwanted or insecure applications and access to risky services. You’ll get a much better overview of what is going on and what is going through your network and how.

The Danger of Unknown Threats

In all mentioned cases, Mendel not only deals better with detecting known threats, its strength lies in also detecting unknown threats. How? Mendel recognizes different types of actions using behavioral analysis.

Right after anomalous behavior or an unknown threat is detected, the system notifies you, for example, by email. It’s then your choice. You can either take the necessary steps or you can connect Mendel to the firewall API and it will block the unwanted communication automatically for you.

A Huge Help for Monitoring Network Performance

At the next level, there are tools for internal system monitoring. In this case, Mendel shows a clear overview of the network – how it is loaded and used, who is accessing it, what services are operating and what the performance of applications and transmission lines is.

Imagine seeing just how loaded your information system, domain controller, Wi-Fi network or data center are!

GREYCORTEX Mendel helps you increase the reliability of your network. Even industrial control systems can get the right amount of control, so any attack or even a major network failure has no catastrophic consequences.

Antivirus software shows you current threats. A firewall displays the current settings and whether it is leaking something or not. But nothing will clearly show you events in your network an hour, a week or a year ago. In a nutshell, Mendel sees, visualizes and (thanks to data storage of up to the last several years) also analyzes current as well as past events.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

您知道什麼是 VMWare 以及如何將其包含在監控中嗎？

Find out what VMWare is and how to include it in monitoring

Background

Before we dive into how to monitor virtualized environments with VMWare, let’s clarify a couple of concepts for those who are less into the subject, starting withWhat is VMWare?.

VMWare is a software product development company, mostly related to virtualization, and more recently to containerization, although this is beyond the scope of this article. Today, we are going to focus on monitoring virtualized environments with VMWare.

To do this, the first step would be to know what virtualization is. A quick summary, and a bit imprecise I must say, but that will give you a general idea. We can claim that virtualization is like dividing the components (CPU, Memory, Disk, etc.) of a physical computer or server (which we will refer to from now on as Bare-Metal) into virtual or emulated components. This will allow us to share the same component between different instances which we will call “virtual machines.” That way, using a single set of hardware, you may have different virtual machines running different versions of operating systems, applications, libraries, etc. simultaneously and separate from each other.

The interesting thing about this is that, for the virtual machine (which we will refer to as VM from now on), the resources that have been assigned to it are only from it and are real elements. This opens a world of possibilities, it allows you to have many services and virtual machines running on a single hardware device with the energy, space and cost savings that this implies. In addition, since it is all at software level, it will allow you to manage the machine as one more file inside the computer, being able to copy it, modify it or even package and distribute it.

The advantages of virtualization are more than proven and today almost any service and infrastructure runs mostly on virtual servers. A very clear example is when you go to your favorite cloud provider and click a button to activate an instance of a database or a server, actually what you’re doing is activating a virtual machine that it already had pre-configured and that can work for you in a matter of seconds, thanks to this technology.

Due to these types of advantages, and because of the massive distribution of virtual machines in most ecosystems, it is so important to have a monitoring tool capable of adapting to this type of environment efficiently.

Now that we know what virtualization is, we will see a new concept. We already said that from a physical machine we can emulate and subdivide its components to create instances of smaller virtual machines, and it is true, although there is a small nuance, we require software devoted to this, we call this software hypervisor.

There are different types, manufacturers and features we are not going to delve into today. If you are interested in this topic and want us to do a more detailed article on virtualization leave it in the comments

vSphere

Today we will focus on one of VMWare’s most widespread and well-known products: the vSphere suite which, according to Wikipedia, “is VMware’s core business suite, the cornerstone on which almost all the business products they offer rely on. It consists of the ESXi virtualization software that is installed directly on the servers and the centralized management console vCenter.2020 ”

As we have seen, vSphere is the name of the set of tools that VMWare offers for device virtualization, there is a range of different vSphere environments, from a single ESXi server that works as a hypervisor as well as management.

ESXi

Stand alone ESX [esxi.jpg]

To much more complex environments where several ESXi work in parallel being managed by a centralized administration software called vCenter.

vsphere

vSphere Vcenter [vsphere.png]

Virtual environment monitoring

To monitor virtual environments, whether it is from VMWare or not, there are two main ways.

The first is to treat each virtual machine as an independent machine, attacking its operating system with standard protocols or using some monitoring agent.
This approach does not require for the tool have a special or devoted management, since it will deal with each VM as any other machine. Along this approach, we can say that we will interrogate the operating system, therefore, in heterogeneous environments, we must define metric captures for each system.

The second way is more general and allows deploying monitoring very quickly and efficiently. In this case we will integrate the hypervisor, since it has information on all the machines it contains and we can interrogate it directly. For each manufacturer the protocol, the responses and the format with which we will interrogate the hypervisor may vary, but in most cases they have an interface to communicate with it. Along this approach, it is the monitoring tool that must be adapted and have a connector to communicate with the supervisor in a centralized way.

Of course, Pandora FMS has both types of monitoring, being able to combine them if necessary if deep and detailed monitoring is required.

In today’s case, we will see the monitoring integrated in Pandora FMS Enterprise Discovery tool. That will allow us, in a very simple way, to connect well, either with a standalone ESX or with a vcenter, through the vmware SDK.

vSphere Monitoring with PandoraFMS

Starting from the fact that we have a Pandora FMS Enterprise instance, the steps are very simple: by default Pandora FMS has the necessary libraries to connect to a VMWare environment, you only need a user account with reading permissions and connectivity with the ESX or vCenter as the case may be.

Once you fill in the simple form with the data from our VMWare environment:

discoveryapp

[discoveryapp]

form2

[form2]

You will see a window to configure some monitoring data, such as the scan interval for new machines, the execution threads that you will devote to this task, if you want to activate network monitoring and (only for vcenter), if you want to capture the environment events.

You will also have a field for extra configurations that will allow you to add advanced configurations related to the task (you can see the possible configurations:
https://pandorafms.com/manual/en/documentation/03_monitoring/05_virtual_environment_monitoring?s[]=vmware#vmware 1 plugin ocnfiguration ).

form3

[form3]

Once finished, you will be able to see that a task has been added to Pandora FMS task list, where you will be able to see its last execution, enable it, disable it or force task execution manually.

form4

[form4]

The default task will give you information about all the ESXs (in the case of vcenter), virtual machines and datastores available in the vmware environment that you configured, returning the following metrics:

Default monitoring for Datacenter:

  • Ping
  • Check 443 port

Default monitoring for Datastore:

  • Capacity
  • Free Space
  • Disk Overallocation
  • Free Space Bytes

Default monitoring for ESXi:

  • CPU Usage
  • Memory Usage
  • Received data
  • Transmitted data
  • Disk Read Latency
  • Disk Write Latency
  • Host Alive
  • Disk Rate
  • Net Usage

Default monitoring for virtual machines:

  • CPU Usage
  • Memory Usage
  • Tools Running Status
  • Host Alive
  • Disk Free
  • Disk Read Latency
  • Disk Write Latency
  • Received data
  • Transmitted data
  • Net Usage

In addition to the metrics described, you will also have a specific view for monitoring vSphere environments that has compilation information on the general state of the environment and each monitored ESX and even a map of the monitored infrastructure.

vmwareview1

[vmwareview1]

view2

[view2]

view3

[view3]

As you can see, it is very easy to start monitoring a vSphere environment with Pandora FMS, just follow a few steps and you will have your VMWare monitoring integrated quickly and easily.

If you are interested in knowing in more detail how synthetic transactions are configured and executed with Pandora FMS, do not hesitate to visit our YouTube channel, where you may find different contents such as tutorials, workshops and a lot of other resources devoted to this and many other topics related to monitoring.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

冠狀病毒和雲——黑客的雙贏組合

Originally posted on People and Computers

“The combination of changing work patterns due to the coronavirus, with the increasing migration to cloud environments, creates a new and significant challenge for corporate information security managers,” said Ofer Amitai, one of the founders and CEO of Portnox, explaining how it can be answered at the identification stage.

“One day, a food supplier from abroad called me. One of the company’s employees, who was fired, connected to the organization’s operating systems, changed the temperature of the meat refrigerators and caused damage and loss of goods worth millions of dollars. That’s how they understood that more vital identification is needed on the network and contacted us, “Ofer Amitai, one of the founders and CEO of Portnox, told People and Computers.

“The coming period will be characterized by hybrid work. This format makes remote work an integral part of all workers’ activities, and those who have not yet dealt with a remote work method will do so today or tomorrow. It will enable regular work alongside the protection of the organization and its resources. The combination of changing work patterns due to the coronavirus, with the growing migration to cloud environments, creates a new and significant challenge for corporate information security managers, and is a winning combination for hackers,” continued Amitai.

What is the main challenge for information security managers?

“Above all the challenges facing the information security manager, there is a major challenge, and that is that he must understand who and what threats he is facing,” Amitai noted. “One of the most difficult challenges for the organization is the migration to the cloud – how the systems and data will be kept secure in this new environment on the one hand, and that all systems will work on the other. Israel is slightly behind cloud adoption compared to the US market. It will be like the main headquarters so that one day everything will be connected to the cloud, and the services will be consumed from it, without the need to join the offices to the branch. ”

He added that “when setting up secure access control to the corporate network, make sure that application-level privileges are managed – whether via remote connection (VPN) or user management (VDI), which allows remote, virtual access to the desktop. Connection security must also be ensured via MFA – multi-step authentication of the user. Then the end station must be handled, including personal devices that employees bring from home. The goal is to maintain a consistent level of information security, regardless of the identity of the end device.”

A significant promise – but also risky

Portnox was established in 2007 to help organizations protect their corporate networks through the use of technology that allows them to see all devices connected to the network and to perform preventative and corrective actions that defend it from risk-prone devices. “This is a technology that makes life easier for information security managers in their day-to-day work,” Amitai explained.

“When someone accesses the network – via a remote, local connection or cable – Portnox knows how to make a strong identification of the device and the user. We do not manage the end component, but its risks,” said Amitai. “Our product in the cloud, Portnox CLEAR, enables organizations to protect the enterprise network via the cloud. The solution complements the security layer for VPN and VDI solutions. Through continuous risk monitoring capabilities on end stations and devices, information security principles are maintained and enforced – regardless of physical location. The end station, whether inside or outside the organization, and owned by it, or whether it belongs to the company or the employee, thus, all stations become secure and authenticated devices, which comply with the organizational security policy – all through enforcement, by the policy definition The organization, which changes according to its needs. ”

In conclusion, Amitai stated that “all the trends in the market bring with them a great promise – but also risks. They expose organizations to more hacks into their network, which makes them look for security solutions like ours – smart, easy to manage, and those who make sure the corporate network is secure. We have a wide range of enterprise and SMB clients who come from many sectors, including the medical, banking, and high-tech sectors. In the past year, we have experienced a 30% increase in revenue, and I estimate that the growth trend, which continues this year, will continue in 2022.”

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Android/FakeAdBlocker 濫用 URL 縮短服務和 iOS 日曆，並將木馬分發到 Android 設備

BRATISLAVA, KOŠICE — July 20, 2021 — ESET Research has analyzed an aggressive advertising-based threat — Android/FakeAdBlocker — which downloads malicious payloads provided by its operator’s command and control server. Android/FakeAdBlocker usually hides its launcher icon after initial launch, delivers unwanted scareware or adult content advertisements, and creates spam events for upcoming months in iOS and Android calendars. These ads often cost their victims money by sending premium rate SMS messages, subscribing to unnecessary services, or downloading Android banking trojans, SMS trojans and malicious applications. Additionally, the malware uses URL shortener services to create links to ads, which in some cases monetize their clicks.

Based on ESET telemetry, Android/FakeAdBlocker was spotted for the first time in September 2019, and from January 1 to July 1, 2021, more than 150,000 instances of this threat were downloaded to Android devices. The most affected countries are Ukraine, Kazakhstan, Russia, Vietnam, India, Mexico, and the United States. Although in most cases the malware displays aggressive ads, ESET has identified hundreds of cases in which different malicious payloads were downloaded and executed, including the Cerberus banking trojan, which was variously disguised as Chrome, Android Update, Adobe Flash Player, or Update Android, and downloaded to devices in Turkey, Poland, Spain, Greece, and Italy. ESET also saw the Ginp trojan being downloaded in Greece and the Middle East.

“Based on our telemetry, it appears that many users tend to download Android apps from outside Google Play, which might lead them to download malicious apps delivered through aggressive advertising practices that are used to generate revenue for their authors,” explains ESET researcher Lukáš Štefanko, who analyzed Android/FakeAdBlocker. Commenting on the monetization of the shortened URL links, Štefanko adds, “When someone clicks on such a link, an advertisement will be displayed that will generate revenue for the person who generated the shortened URL. The problem is that some of these link shortener services use aggressive advertising techniques such as scareware ads informing users their devices are infected with dangerous malware.”

ESET Research has identified link shortener services pushing events to iOS calendars and distributing the Android/FakeAdBlocker malware that can be launched on Android devices. On iOS devices, besides flooding victims with unwanted ads, these links can create events in victims’ calendars by automatically downloading an ICS calendar file.

“It creates 18 events happening every day, each of which lasts 10 minutes,” says Štefanko. “Their names and descriptions suggest that the victim’s smartphone is infected, the victim’s data is exposed online, or a virus protection app has expired. Descriptions of each event include a link that leads the victim to visit a scareware advertisement website. That website again claims the device has been infected and offers the user an option to download shady cleaner applications from Google Play.”

For victims using Android devices, the situation is more dangerous because these scam websites may provide a malicious app to download from outside the Google Play store. In one scenario, the website requests to download an application called “adBLOCK,” which has nothing to do with the legitimate application and indeed does the opposite of blocking ads. In another scenario, when the victims proceed to download the requested file, they are shown a web page describing the steps to download and install a malicious application with the name “Your File Is Ready To Download.” In both scenarios, a scareware advertisement, or the Android/FakeAdBlocker trojan, is delivered via a URL shortener service.

For more technical details, and to learn how to uninstall Android/FakeAdBlocker, read the blog post “Some URL shortener services distribute Android malware, including banking or SMS trojans” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

ESET detection telemetry for Android/FakeAdBlocker

Top 10 countries with Android/FakeAdBlocker detections (January 1, 2021 – June 1, 2021)

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

GREYCORTEX 團隊在 NVIDIA 黑客馬拉松中獲得第三名

During the 30-hour NVIDIA DPU virtual hackathon, participating teams worked on technologies for furthering advancements in AI , cloud and accelerated computing. Our GREYCORTEX team was among them, and our solution was awarded third place.

The goal of the hackathon was to validate the potential of using DPU (Data Processing Unit) accelerator cards for AI , networking, security and storage. The teams worked on developing a solution demonstrating the possibilities of using DPU in a data centre infrastructure.

In a competition made up of teams from all over Europe, the jury awarded third place to the project of the GREYCORTEX team, consisting of Petr Chmelař, Marek Brychta, Ondřej Kvasnica, Marina Volkova and Jozef Mlích. Our team used NVIDIA BlueField DPU cards for a DDoS attack detection and mitigation system.

With the DPU , Mendel will be able to process traffic faster, smarter and at a lower cost than before.

“ At GREYCORTEX , we are involved in a number of research projects outside of Mendel product development, trying to anticipate where market and customer needs will go. We are looking for ways to solve these problems and challenges,” says Pavel Jurka, CTO of GREYCORTEX .

One of the topics we have been working on over the past year is the processing of big data streams and their analysis using advanced methods that leverage machine learning and artificial intelligence. At the same time, we are looking at how to actively defend against such advanced attacks, which can be aided by hardware-level acceleration.

Participation in the hackathon followed our testing of the latest generation of NVIDIA BlueField DPU cards, which allowed us to demonstrate our intentions for how to use DPU in practice.

“ We hope that this technology will move into production deployment in the near future and we will be able to use it to provide better security for our customers,” concludes Pavel Jurka.

For more technical information, please contact our research team.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

REvil 勒索軟件攻擊說明 IT 系統需要進行流行病學調查

Originally posted on CTECH

The recent REvil ransomware attack has revealed that our computer systems are vulnerable to unknown and surprising pathogens, similar to our vulnerability to Covid-19. The hackers claim that the attack penetrated more than a million workstations, and demanded about $70 million to unlock them. However, the most important question is how the damage could have been reduced or prevented. Let’s take a step back. Antivirus software comprises the first defense line (the IT immune system, if you will). The antivirus operating principle is simple: if malicious code is detected, it is signed by the various antivirus manufacturers and its hash is distributed as an update to the local antivirus installation. Thus, antivirus software can identify most malware and prevent them from damaging the computer.

Nevertheless, similarly to biological systems, some viruses and vulnerabilities are unrecognizable by antivirus software. About 30-50 IT companies, including many Israeli ones, work to discover the meager number of yet undiscovered malware and yet unabused vulnerabilities. This activity is expensive and carries large premiums, but numerous organizations around the world would pay for such protective measures. Think about it – if a security operation is attacked by 1,000 different malware a month, the damage of even a single penetration would be catastrophic. Therefore, an antivirus that prevents 99.9% of attacks will not suffice.

However, systems identifying unrecognized threats are prone to false alarms. No wonder – anyone trying to find a new type of threat is likely to be sensitive to any anomaly or change. Yet the high number of false alarms that these systems provide causes many to ignore them or to disable the systems, quite similar to muting the sound of a cardiac monitor, thus remaining unprotected yet again. One of the methods of containing the damage might sound familiar in the post-COVID world – isolation. For example, in the latest REvil attack, Kaseya software, serving as part of the supply chain, was damaged. The company warned customers over the weekend to disconnect their devices from the internet to prevent encryption of their information, as the malware was raging outside and a cure for it was yet to be found. A network control system, like an internal epidemiological investigation array, can sometimes be useful in stopping the malware spread and preventing some of its damage.

Isolate, test, and decide

NAC (Network Access Control) systems test every device and every user individually – who is the user attempting to connect? What is his role? What hardware does he use? Does he have an antivirus? Are there security updates installed? All these parameters are calculated to a security ranking, according to which network access is granted or denied. In some cases, it is possible to prevent or restrict the use of plug-in USB devices, and in extreme cases, it is even possible to deny usage completely and isolate the “sick” computer from the outside world.

An internal epidemiological investigation array mitigates the risks instead of trying to eliminate them completely. The truth about the Covid-19 pandemic, as well as for computer systems, is that complete isolation of our homes or computer stations will prevent us from catching the virus, but it will also prevent us from functioning. Therefore, IT systems and humans need to establish risk-mitigating measures which will balance the existing threat of infection and the need to connect, meet and interact with the outside world.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

About CDM InfoSec Awards
This is Cyber Defense Magazine’s ninth year of honoring global InfoSec innovators. Our submission requirements are for any startup, early stage, later stage or public companies in the INFORMATION SECURITY (INFOSEC) space who believe they have a unique and compelling value proposition for their product or service. Learn more at http://www.cyberdefenseawards.com

About the Judging
The judges are CISSP, FMDHS, CEH, certified security professionals who voted based on their independent review of the company submitted materials on the website of each submission including but not limited to data sheets, white papers, product literature and other market variables. CDM has a flexible philosophy to find more innovative players with new and unique technologies, than the one with the most customers or money in the bank. CDM is always asking “What’s Next?” so we are looking for Next Generation InfoSec Solutions.

About Cyber Defense Magazine
With over 5 Million monthly readers and growing, and thousands of pages of searchable online infosec content, Cyber Defense Magazine is the premier source of IT Security information for B2B and B2G with our sister magazine Cyber Security Magazine for B2C. We are managed and published by and for ethical, honest, passionate information security professionals. Our mission is to share cutting-edge knowledge, real-world stories and awards on the best ideas, products and services in the information technology industry. We deliver electronic magazines every month online for free, and special editions exclusively for the RSA Conferences. CDM is a proud member of the Cyber Defense Media Group. Learn more about us at https://www.cyberdefensemagazine.com and visit https://www.cyberdefensetv.com and https://www.cyberdefenseradio.com to see and hear some of the most informative interviews of many of these winning company executives. Join a webinar at https://www.cyberdefensewebinars.com and realize that infosec knowledge is power.

什麼是新的 Pandora FMS 755

What’s new in the latest release of Pandora FMS, Pandora FMS 755

Let’s review together the features and improvements related to the new Pandora FMS release: Pandora FMS 755.

HOW TO UPDATE PANDORA FMS

There are several ways to update Pandora FMS console:
  • Through Update Manager, in Pandora FMS console itself, automatically (it requires console internet connection).
  • Through Update Manager, in Pandora FMS console itself, manually, through OUM update files.
  • By manually installing RPM packages and later updating the console through the web interface.
The server will have to be manually updated through RPM or tarball packages. You may find more information about Pandora FMS downloads on our website: For detailed information and the steps to follow to update each item, classified by operating systems, go to our Wiki.

NEW FEATURES AND IMPROVEMENTS

New agent installer for MacOS

release-755-1 In this version we released a graphical installer for MacOS agents.

New interface view

A new specific view has been added to be able to see the network interfaces that are being monitored. On the one hand, there is the general view where you can filter the different agents that carry out said monitoring and on the other hand, a special view within each agent. release-755

New online documentation

We have migrated our online documentation system to a new site: https://pandorafms.com/manual which allows better searches, better navigation and better mobile usability. It also allows exporting on demand in PDF and very soon also in eBook (ePub) format. release-755

New Metaconsole interface

The visual interface of the Metaconsole has been modified to improve its navigability and display, adding the left side menu similar to that of the node. We have also unified some styles that will make working with the Metaconsole more familiar to how you work with the node. release-755

New Update Manager (WARP update)

WARP is the new version of the old Pandora FMS update system (Update manager). This new version allows you to apply server and console updates without having to execute any command in the terminal. In the Metaconsole, updates are applied in a distributed manner from the Metaconsole to the nodes, with a simple click. From now on, updates incorporate a digital signature so that the source of said update can be manually validated (both online and offline). release-755 release-755

Agent inventory

We have created a new type of report that is used to list the installed agents. Among other metrics, you can see the IP, main group, secondary groups, description and other data. These reports can also be exported to CSV and XML.

Full console translation into Russian

We have translated and revised 100% of the console into Russian. We are also working on the Russian translation of the online documentation.

release-755

SPECIAL UPDATE NOTES

Due to the new version 755 update system, WARP Update, it is necessary to perform a couple of extra steps in the console after updating the server. From version 755, the server will be automatically updated from the console using the pandora_ha component that already existed in the Enterprise version and that is now open for the Community. This component allows you to control server performance (stopping and starting it, controlling the status of HA and updates, if any). Before updating the server it will be necessary to stop the server: service pandora_ha stop /etc/inid.d/pandora_server top And start it again after updating it: service pandora_ha start Or through the init.d script that has been modified to start pandora_ha /etc/init.d/pandora_server start

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.