你可以通過你使用的工具來判斷你的監控
Whether you are a DIY ace or a master at roast beef, a decorated luthier or the best seamstress in the neighborhood, we all love to work with good tools, right? This includes, of course, good IT professionals. Because IT monitoring tools are fundamental when it comes to supervising a network infrastructure and applying the corresponding policies and security measures. Even so, not every monitoring tool is perfect, in fact some could even get to the point of harming us. Let’s take a look!
Better monitoring tools, better monitoring
It’s instinctively basic: you have to find the right monitoring tool for each job. Indeed, although it may seem unheard of, it is quite difficult for IT teams to find comprehensive and outstanding monitoring tools. Some of them are too specialized or do not support all applications because they might lack certain features. This dilemma can lead IT teams to use hundreds of disparate monitoring tools, due to the need to attend to all monitoring tasks. I know what you are thinking: “That must be expensive”. Yes, it is, plus it slows down the working pace due to the huge amount of reports, each with their own features, to be inspected and checked.
That is why we must avoid tool proliferation, as we avoid the proliferation of gremlins or herniated discs. Preventing it through individual monitoring solutions, even if this requires significant changes, such as the implementation of integrated tools, conceived to support multiple applications, or special network configurations.
The most efficient thing would be to go for IT monitoring tools that include updates to support today’s most respected applications and provide IT administrators with a single management board.
Simplifying is the key
If you have to choose a monitoring platform, you should be aware beforehand that different IT sectors require different types of solutions. Try, with a single solution, to address as many sections as possible, thus adding further depth to monitoring activities. Such a single solution will give you a greater ability to automate responses and locate irregular events in any system you are monitoring.
For this reason, IT departments often look for a suite of fully integrated IT tools offered by centralized system management and monitoring companies. These companies often promise to reduce the license and maintenance costs of their software, as well as the use of their monitoring tool integrated in the corresponding environment to help manage the company.
The IT department will reduce costs thanks to these integrated tools, among other things because they already have a strong response to any problem that may arise. In fact, one of the direct benefits is the reduction of incidents that require the action of the support teams. Also general performance visibility and system availability, thus increasing the total productivity of the company.
But hold on there, before you go running to look for a monitoring tool that suits your company’s requirements and even your zodiac sign, it is TOTALLY NECESSARY to define what justifies monitoring in your company. Remember that each piece of your IT department will have something to say and contribute, there are different features regarding each function, information flow and security clauses. Once you have a full and clear idea of what you and your company need, you may start with a good monitoring strategy.
Application monitoring tools
Application monitoring is, broadly speaking, monitoring activity logs to see how applications are being used. You know, looking at the access roles of the users, the data that is accessed, how this data is used… If your monitoring tool is good, it even shows a window to the log data and an exhaustive view of all the data elements that make up a healthy application: response times, data traces…
Any self-respecting application monitoring tool has to offer these kinds of features, as well as being integrated with database and network monitoring. Thus, together, they will be able to improve application response times through active and immediate solutions to performance problems that arise.
Network monitoring tools
DNS host monitoring, IP address management, packet tracking… This is more or less what all network monitoring tools usually offer. They usually fall short, however, when it comes to supervising everything related to network traffic, whether internally or externally. What they should always provide, under oath, is full surveillance of all devices connected to the network.
Compliance control monitoring
Don’t worry, if you haven’t yet managed to justify implementing a full monitoring tool, compliance monitoring will make up your mind.
Compliance monitoring solutions will provide you with templates based on types of regulations, allowing you to conveniently design and implement a comprehensive compliance monitoring strategy, including the ability to monitor log data, in real time, from any type of device connected to your network, including routers and switches.
Thanks to compliance control monitoring tools you will be able to collect, correlate and export any necessary registration information for the IT team. Report templates will be able to align with formats common to regulatory agencies. In addition to providing exhaustive analysis in the case of internal audits.
Conclusions
If we have made something clear today, it is that the system management and monitoring solution you choose must meet a small series of requirements: be integrated into several systems, be accessible to the IT team through an intuitive interface based on a control panel, be scalable, and stay constantly evolving so that its ability to help you maintain your services can go forward and transcend when you need it.
If doubt and anxiety overcome you, do not worry, what you are looking for is not far away. Pandora FMS is capable of monitoring all these IT areas that we talked about and much more. Thanks to its more than 16 features and more than 500 Enterprise plugins available. Also, if you are not very knowledgeable in this matter, do not worry, we manage it for you with our MaaS solution.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.
面對設備擴散，贏得與黑客的戰爭
Expanding Network Edges & Device Proliferation
With the advent of COVID-19, an enormous push to hybrid work changed the threat landscape. Many more activities have become remote, and therefore more reliant on and demanding of secure remote network connections. As more organizations expand their hybrid workforce models, the network edge continues to push out and the number of potential entry points for attackers increases. Device proliferation – specifically BYOD – is exacerbating this trend. As of 2021, 67% of employees use personal devices at work, and 59% of organizations have adopted BYOD.
IoT device proliferation is also broadening the threat surface, adding to the list of endpoints not only in the office, but also in the operating room, the factory floor and the shipping warehouse. There may be some 21.5 billion IoT devices by 2025 – a number that keeps IT security professionals up at night. From security cameras to connected multifunction copiers, IoT devices open the real potential for breaches.
The Role of Network Access Control
With so many diverse, dispersed devices requesting network access, security teams must be more diligent about setting and enforcing access control policies. To maintain vigilance, security teams need to focus their efforts on network access control (NAC). In a perfect world, this means deploying a NAC that offers cloud RADIUS services, a variety of authentication methods, as well as 24/7 endpoint risk assessment and remediation across all prominent access layers – wired, wireless and VPN. Simple, yet powerful – a NAC that’s easy to use while providing the extensive security coverage needed to confront these challenges head-on is required.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。
在即將到來的一年裡，什麼會威脅到SaaS的安全？
· Difficulties in controlling app security risks
Many companies use SaaS apps in their work more and more often, especially when their employees must work remotely. This is when they hit a problem: it is necessary to adjust security settings correctly for each app considering their configurations. As there are many such apps, security departments are forced to do major volumes of work and are not always maximally efficient.
· Low level of knowledge in cybersecurity rules by privileged users
Employees who do not follow cybersecurity rules and have expanded access put confidential information at the threat of being hacked and increase the risk of it being revealed. And because SaaS use continues to grow, there appears the necessity for control of employees’ access to apps.
· Phishing via SaaS
Criminals attack companies’ email via SaaS using the following scheme:
– Criminals send an email with OAuth app.
– An employee follows the link and logs in to their account.
– The app requests access to emails.
– The employee accepts the request.
– OAuth token is created, which is subsequently used by the cybercriminal to gain access to and control email or the whole disc.
– The criminal encodes the disc and the user can get access to it back only after they have paid ransom.
This is how ransomware works. Other types of cyberattacks can be organized using OAuth app as well.
Having installed special apps for protection against cyberattacks or using cloud services companies can protect themselves from such cyberattacks and identify changes in cybersecurity settings and SaaS apps in timely manner.
About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
[特別消息] 伺服器將於 2022-02-10 (15:00-17:00) 進行定期維護
為了提供更穩定的服務，產品註冊伺服器 (https://version-2.com.tw/register/)
將於 2022-02-10 (15:00-17:00) 進行定期維護。
不便之處，敬請原諒。
技術支援熱線: 電話 (02) 7722-6899
或電郵至: support@version-2.com.tw
關於 Version 2 Digital
資安解決方案 專業代理商與領導者
台灣二版 ( Version 2 ) 是亞洲其中一間最有活力的 IT 公司，多年來深耕資訊科技領域，致力於提供與時俱進的資安解決方案 ( 如EDR、NDR、漏洞管理 )，工具型產品 ( 如遠端控制、網頁過濾 ) 及資安威脅偵測應 變服務服務 ( MDR ) 等，透過龐大銷售點、經銷商及合作伙伴，提供廣被市場讚賞的產品及客製化、在地化的專業服務。
台灣二版 ( Version 2 ) 的銷售範圍包括台灣、香港、中國內地、新加坡、澳門等地區，客戶涵 蓋各產業，包括全球 1000 大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企業及來自亞 洲各城市的消費市場客戶。
網絡威脅：流行率上升，成本上升
Threat Surfaces Are Expanding
The proliferation of devices requesting access to the network, driven largely by the adoption of BYOD policies and utilization of IoT devices, has forced network security teams to be more diligent about setting and enforcing effective access control policies. Despite best efforts, attempts to address this evolving problem are akin to putting a finger in the dike – rogue devices inevitably slip through the cracks, leaving corporate networks vulnerable to ransomware and countless other cyber threats.
What’s more, network complexity complicates the issue. Today, networks consist of an ever-increasing number of WANs, LANs, VLANS, SD-WANs, MPLS, VPNs, employees’ homes, coffee shops, hotels, airports – wherever authorized devices can connect to gain access to company resources. As if the industry needed another acronym – some are calling it Bring Your Own Network (BYON). Regardless of how we define the trend, access to everything (from everywhere) has changed the security dynamic.
The impact on corporate bottom lines is tangible. The risks and costs associated with network breaches are growing larger by the year. It seems as if every day a new Fortune 500 company is reporting a costly cyberattack. Data breaches from January through September 30, 2021 (9 months), exceeded the total number of events in the entire year of 2020 by 17% (1,291 breaches in 2021 compared to 1,108 breaches in 2020). Adding to the challenge, threat actors are becoming more sophisticated and prevalent, leaving organizations on their heels fighting to catch-up.
A New Age of Cyber Threats
Cyber threats have become alarmingly prevalent, with malware increasing 358% overall and ransomware increasing 435% in 2021 compared with 2019. All threats, from phishing to attacks on Internet of Things (IoT) devices and supply-chains, have grown exponentially. Attacks on IoT devices tripled in the first half of 2019 and supply chain attacks were up 78%.
Costs have escalated in tandem. The average ransomware payment rose 33% in 2020 over 2019, to $111,605. The total cost of cybercrime for each company increased 12% from $11.7 million in 2017 to $13.0 million in 2018. Data breaches cost enterprises an average of $3.92 million annually.
In an attempt to mitigate these costly risks, many companies have opted to deploy niche solutions and tools such as network and host intrusion detection, various threat intelligence feeds, and mobile device management. While useful in isolation, these disparate tools (e.g., Network Performance Management, SIEM, XDR, SOAR, etc.) create many different panes of glass, leaving gaps in network security and complicating IT infrastructures. All this means extra work for already thinly-stretched IT teams. In this sense, less really is more.
Essential Areas of Cybersecurity
The cybersecurity software market is oversaturated with tools that have been designed for very siloed tasks. Many of these have been developed in direct response to new threats, and require a certain focus and sophistication that doesn’t lend itself to the average IT professional’s chaotic daily life. Instead, companies need to develop a simple, yet solid security foundation that consists of three essentials:
- Firewalls to monitor incoming and outgoing network traffic
- Network access control to enforce access policies, assess connected device risk and remediate non-compliant devices
- Endpoint protection like antivirus to prevent, scan, detect and eliminate malware and other viruses from devices
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。
關於 WSL2 Ubuntu 中的攝像頭和麥克風的建議
At the time of writing these lines, almost everything we connect to our devices is through the so-called Universal Serial Bus (USB): cameras, microphones, external storage… It’s the fastest and safest way to synchronize and backup information between our mobile phone and computer! But what does all this have to do with the Windows Subsystem for Linux (WSL2 Ubuntu)? Let’s have a look.
Study in WSL2 with Ubuntu: proprietary and free software
To begin with, I will leave you a link to an article published in this blog, in order to facilitate knowledge of the technology I will be discussing. I will add more of them throughout the text. We have quite a bit to go through, so I recommend a nice, steaming cup of black coffee in your hands before we start.
*The Last tests I have carried out have been on virtual machines (VirtualBox®: they may be created, erased, modified, etc. on Solid State Drive).
Brief retrospective
I always say that “in order to know where we are going, we need to know where we come from.” Since 1989, I have worked with the products sold by the Microsoft Corporation: first the MS-DOS operating system and its only form of command-line interaction, and then Microsoft Windows, which also uses the graphical environment. Yes, I am well aware, MS-DOS® as such was eliminated, but its commands remain. It was replaced with Powershell®, which we have already talked about, and it is important for today’s topic.
At the end of 2016, Microsoft surprised us with the news that its SQL Server® could be run on GNU/Linux. For me, who for many years worked installing and maintaining data servers for my clients, this was shocking news. But wait, there’s more, on my journey, I discovered that BASHware can affect a Windows system via WSL. Which brings us to today’s article, where we’ll go into handling USB devices, with particular attention to microphones and webcams, under WSL2 with Ubuntu 20.04.
WSL and WSL2
I recommend, again, the excellent article on WSL2. Although time has passed and there are some significant changes. At that time, WSL2 was installed by means of commands. Now, and I want to emphasize it, I notice that by MS Windows Control Panel, “Programs and Features”, we can add the two key components that are Virtual Machine Platform and obviously Windows Subsystem for Linux in the section of “Turn Windows features on or off”:
After this, the operating system must be restarted, this is already an idiosyncrasy of the house of Redmond! (There will be many more resets later that I will leave out. They will be implied.)
Another aspect that was added in July 2021 is the possibility of adding the Linux distributions that one wishes, directly, through the command line in Powershell (depending on the version and type of MS Windows that you have installed).
To see the available distributions:
wsl --list --online
To install Ubuntu 20.04:
wsl --install -d Ubuntu-20.04
After some time, depending on your Internet download speed, it will ask for username and password. It will immediately display the status of updates for Ubuntu.
To set WSL2 as default:
wsl --set-default-version 2
The option to download and use from the Microsoft Store is still valid and available, for Ubuntu 20.04 it takes almost half a gigabyte of space.
The fundamental difference between WSL and WSL2 is that the latest download is a complete Linux kernel, but not just any kernel, it is one specially designed to be coupled with the Windows kernel. This means that applications running on WSL2 will always have to be “passed through” -but not interpreted, as it was in WSL- before interacting with any hardware, USB included.
The only thing WSL does better than WSL2 is file sharing between the two operating systems. Apart from that, WSL2 offers many more advantages and improvements in WSL2.
Podman in WSL2
To give you an idea of how useful it is to include a full Linux kernel in MS Windows, the Podman software (Docker’s successor) can be run on WSL2. If you still don’t know what Podman is, make more coffee and read another of our articles.
Developer mode
A feature that Powershell offers that you may use to your advantage, once you have installed and configured WSL2, is the developer mode. It is accessed by pressing the Windows start key, typing “Powershell” and choosing the developer settings. The first thing is to activate the developer mode and wait for the necessary software to finish installing.
This consists of two main components:
- Device Portal.
- Device Discovery.
The Device Portal will open port 50080 (remember to properly configure the Windows Defender Firewall), and from any web browser you may enter the configured credentials and access a variety of aspects that you can see in the following image.
*There is a tutorial for establishing safe connections with HTTPS but it is irrelevant for this article:
Differences aside, this is similar to what eHorus offers for both basic and advanced monitoring, if used together with Pandora FMS. I have included this feature because the configured credentials are required for the next point.
The second component is Device discovery which, among other aspects, will open an SSH server to make a connection.
This allows us to open a terminal with the Windows command line and, once there, you may directly use WSL2 for any task that you need to develop remotely from another computer. In this case, as an example I used the PuTTY software to connect from the real machine to the Windows 10 virtual machine with WSL2 installed and configured:
As you can see, once the default configuration has been established, just by typing the command wsl you will be ready in a Linux environment, not GNU/Linux but MSW/Linux.
USB in WSL2
We come to the purpose of this blog post: USB handling in WSL2. At the time of writing these lines, there are two pieces of news, one bad and one good.
- The bad news is that no, WSL2 is currently unable to support USB, so for example your USB connected cameras and microphones will not be available to be used from WSL2.
- The good news is that you may compile your own Linux kernel for WSL2 and have access to the occasional microphone or webcam from your chosen Linux distribution. But what applications could you use for it?
Compiling Linux kernel for WSL2
Before doing anything, first update Ubuntu WSL2 with the usual commands:
$ sudo apt update
$ sudo apt upgrade
And if you thought that this was enough software download… well not, now what I call the programming environment (dependencies) must be installed:
$ sudo apt install build-essential flex bison libssl-dev libelf-dev
And now you may download the base kernel source code for Ubuntu on WSL2:
$ sudo git clone https://github.com/microsoft/WSL2-Linux-Kernel.git
There are three gigabytes to download. The source code. Awesome. Although you may always use the parameter git clone -depth=1<repository>, I did not use that option. I recommend at least 100 gigabytes free in storage before going into the downloaded folder (cloned repository) and running:
$ make -d KCONFIG_CONFIG=Microsoft/config-wsl
At this point I must clarify that I found many configuration options to compile. For example, to install the software for handling Snap packages on Debian. However, all this is excluded from Microsoft support, nothing you will be able to complain to this company if something goes wrong in the compilation process.
To finish off, turn off WSL2 with the command wsl –shutdown and copy the newly compiled kernel in the following way, not without first backing up the original kernel:
C:\Windows\System32\lxss\tools\kernel
At this point you should be able to connect any microphone or webcam and have access from WSL2… But it’s going to be no. It turns out that you must first get the hardware drivers for MS Windows, obviously, and then the Linux ones, enter in the source code the latter and recompile again. In addition to that, install in Ubuntu WSL2:
sudo apt install linux-tools-5.4.0-77-generic hwdata
sudo update-alternatives --install /usr/local/bin/usbip usbip /usr/lib/linux-tools/5.4.0-77-generic/usbip 20
And by the way, it must also be installed on Windows, with an MSI installer package, the USBIPD-WIN project…
As we can see, since we have gotten used to the graphical simplicity of Windows, if you disable the USB through the Device Manager, no hardware will be able to connect with or without your consent, since it will be blocked at operating system level.
Installing graphical applications in WSL2
Finally, although in the case of the snap package installer it is explicitly unsupported in Ubuntu over WSL2, other applications that interact with hardware (such as sound, for example) will be able to be installed, but when they try to access files of hardware (remember that in Linux everything is a file) because they simply will not find such resources. This is the case of the espeak software:
In theory, the Ubuntu blog indicates that by means of X Window System Architecture it is possible to “pass” the graphical interface of the applications installed in WLS2. Microsoft officially announced just before the end of 2021 that the following graphics applications can be run:
- Gedit (my favorite graphical GNU text editor).
- GIMP (powerful for graphic design).
- Nautilus (file explorer).
- VLC (audio and video player).
- Applications based on X11 (calculator, clock, etc.).
- Google Chrome (at your own risk due to its high RAM and resource consumption).
- Microsoft Teams (by the way, Pandora FMS has a special connector).
- Even Microsoft Edge web browser for Linux!
But this has some drawbacks. First, you must have Windows 11 Build 22000. Second, have the video hardware drivers for WSL2 installed. Third, be enrolled in the Windows Insider Program. I hope you liked the information!
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.
密碼：必要，但不足以保證網絡安全
The First Form of Security
In the beginning – or at least near the beginning – there was the password. This rudimentary method of security pre-dated computers by at least two millennia, and was commonly utilized by militaries like the Roman Legion to maintain secure access to bases, resources and other high-ranking officers across a wide swath of newly conquered territory.
As we fast forward to the 20th Century and the advent of the computer, passwords became the primary method of personal identification and access to systems, applications, networks…you name it. As computers became increasingly integrated into the daily lives of people both at work and at home, passwords became even more prevalent and served as the de facto method of security.
Password Management Today
Today, much to our chagrin, we all juggle passwords across our laptops, tablets and phones in work and personal lives. Remembering the multitude of passwords needed to access different areas of our digital existence has become an onerous, often screen-punching task. It has also become a task rife with security vulnerabilities – particularly at the corporate level. Everyone is now required to remember so many passwords that they resort to insecure practices like writing them down, using easy-to-guess passwords, or using the same password over and over again.
Most security experts see passwords as one of the weakest links in the security system, but many of the procedures that IT teams undertake with the intent of improving security – like requiring frequent password changes – makes the problem worse. If a hacker guesses a password or gains access to a password from one breach, they can try it again across other applications. Such tactics became household names in IT. For example, inputting a bunch of common passwords is known as “password spraying,” and reusing previously breached passwords is known as “credential stuffing.”
Password-focused attacks are extremely common. For instance, in the well-publicized campaign of attacks on SolarWinds and many other vendors in 2019, the US Cybersecurity and Infrastructure Security Agency (CISA) noted that “incident response investigations have identified that initial access in some cases was obtained by password guessing, password spraying…”
The Move to Single Sign-On (SSO)
As corporate employees found themselves needing to log into more and more different devices, applications and network types, IT teams began leveraging SSO technology to help simplify the process and eliminate the need for people to remember every single password use. At its core, SSO intended to allow employees to have one password that provided them access to all necessary corporate resources.
For several few years, while most applications still resided inside of a local IT datacenter, many organizations turned to tools like Microsoft’s Active Directory (AD) to manage user identity and access policies. The rise of AD adoption pushed other application vendors to support AD, further supplanting SSO as the then go-to method for password management and access security.
Then along came Software as a Service (SaaS), and the game changed. SaaS apps went from novel to common incredibly quickly thanks to the simplicity, efficiency and cost effectiveness they promised. As cloud services like Amazon Web Services (AWS) and Microsoft Azure made it easier to build SaaS apps, these tools went from common to ubiquitous. Today, most companies have so many SaaS applications in use that their IT teams need to subscribe to other SaaS apps to help them discover and manage their active SaaS app portfolio.
Every one of these new SaaS apps now in use utilized passwords. While early on some of these apps supported MS AD or its successor, Microsoft Azure AD (Azure AD), most did not at first. A such, it quickly became clear that successfully rolling out SSO universally was a daunting undertaking for most mid-sized businesses with complex IT environments and limited internal IT resources. After all, a company-wide password manager doesn’t eliminate the proliferation of passwords, and compromised SaaS apps can serve as gateways into the larger corporate network.
The Rise of Multi-Factor Authentication (MFA)
The explosion of passwords and password-based attacks has created a market for password management software. There are a plethora of vendors who deal solely with simple passwords (e.g., LastPass, Keeper Security, Dashlane), SSO (e.g., Okta, SailPoint, One Identity), or the third and most recent phase in the evolution of the password: MFA (e.g., Cisco Duo).
Out of SSO emerged MFA, which compliments and strengthens password management and network security efforts by introducing another means of identity verification on top of a person’s username and password. Most MFA vendors today provide mobile-based authentication, which can include methods such as push-based, QR code-based, and one-time password authentication (event-based or time-based), as well as SMS-based verification.
MFA, like SSO, has its own shortcomings. Mobile-based authentication is particularly vulnerable as mobile devices can be cloned, and apps often run simultaneously across several mobile devices. Advanced hackers can, in theory, intercept an MFA code sent via SMS or email. While this added layer of security raises the necessary skill level to execute a successful attack against a company’s network, critical vulnerabilities still exist.
The Gold Standard: Network Access Control (NAC)
With enterprise SaaS adoption and corporate networking eco-systems expanding and becoming more complex, MFA alone simply isn’t equipped to provide the secure access and authentication functionality needed to maintain an effective network security posture.
As we enter a period of unprecedented device proliferation, network expansion, and increased threat sophistication, NAC has emerged as the gold standard for establishing secure access and authentication to corporate networks, applications and other internal resources. NAC, for lack of a better word, has raised the bar and left hackers with their work cut out for them.
NAC systems evaluate whether a user and their device should be allowed onto a network, based on a series of security checks, MFA included. NAC combines MFA with other unique data points, such as the location of the device or the MAC address of the device to either grant or block their access to the network. Once connected, a NAC goes a step further by continuously measuring the security posture of each device, taking steps to either quarantine or boot the device off the network should it surpass the organization’s desired risk threshold. Additionally, a NAC can control which segment of the network a device can access, further limiting any impact of an intrusion.
As such, a NAC is a strong addition to tighter password management and MFA because its security controls are complimentary rather than overlapping. NACs were once thought to be powerful, yet complex and hard to manage. With the advent of cloud-native NAC such as Portnox CLEAR NAC-as-a-Service, however, companies can access that power without the hassle.
The Future of Password Management
While there are efforts to eliminate the need for passwords altogether, most business software will continue to require a username and password to gain access. Therefore, businesses must do more to secure their environments in the face of so many passwords.
No combination of security controls can guarantee protection, but if an organization operates with a limited IT budget and staff, a combination of password management, MFA, and cloud-native NAC will substantially reduce its risk of cyberattacks.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。
提高你的網絡安全的5個好習慣
1. Don’t forget to change your passwords regularly.
Don’t use the same password for a long time – change it. A very popular mistake users make is having the same password for all accounts. In the event of a cyberattack they all become available to cybercriminals.
When creating a password, make it stronger by using special characters, introduce a short code phrase. This will help you protect all your data from being hacked.
2. Don’t click on suspicious links.
Before you click on a link, take a careful look at it in order to understand where it leads to. By clicking on suspicious ones, you jeopardize your gadget, because malware can infiltrate your phone or computer.
3. Delete suspicious emails.
Make sure the email you got is not phishing. Google the address it was sent from.
4. Ignore attachments with unknown file formats.
Don’t open messages or emails containing attachments with non-standard file formats, such as .reg, .scr, .exe, .hta, vbs. They may contain a code cybercriminals use to hack your gadgets and steal confidential information.
5. Use two-factor authentication.
It will be much more difficult to hack into your account if you install an app that enables two-factor authentication. 2-step authentication with the use of text messages has also proved efficient.
About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.