With just a month left before the United States midterm elections, CISA and the FBI have joined forces to assure Americans that hackers are not a threat to election integrity. They call it a public service announcement, but, as all of us Americans know, election integrity will be questioned leading up to November 4th and after, likely until the heat-death of the universe. So, this seems to be an attempt to minimize the effect of conspiracy theory factories (cough Fox News cough) on a large portion of the populace or shore up an official narrative – you got refs for those claims?
Seeing as we’re all at least slightly more informed than the average grandparent when it comes to cybersecurity matters, it’s safe to say we aren’t the intended audience. Nonetheless, we’re in a key position to say something next time Uncle Joe Bob starts spouting off about dumpsters full of ballots behind the local Arby’s.
I bring this up, because I’m likely one of the few people that follows CISA alerts. I’m likely also one of a few people who have read this specific alert – the rest being the writer of the PSA and the manager that signed off on it – so it’s up to those who are in the know and have more appeal than a government agency to spread the CISA gospel: “Malicious Cyber Activity Against Election Infrastructure Unlikely to Disrupt or Prevent Voting.”
Many of us – ‘us’ being those perusing this site – have already helped out a less than savvy friend or family member with hardening their security posture. I know I installed an adblocker on my grandfather’s computer after an alarmingly loud pop-up and an attempt to get his bank info over the phone.
The point being that while we understand why it’s incredibly unlikely for any massive voter fraud to be caused by cybersecurity issues, others aren’t immune to exaggerated claims of compromised elections. Cybersecurity paranoia is real, but it’s caused by a lack of understanding. Of course, people tend to glaze over or become narcoleptic if anyone other than a talking head on the TV talks about cybersecurity. Good luck.
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About vRx vRx is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
Open-source software dependencies are used very often when developing web applications. I found some stats on the internet that around 90% of web applications consist of third-party components.
Based on my experience, this info is quite accurate. Mainly because of the deadlines, you would use already created components, and because of the cost, you would use open-source ones.
The problem when using open-source dependencies while developing the application is that developers would most likely choose the most used one by checking the downloads on Github, and many of them would not even bother to search about open-source vulnerabilities on the internet. Search on the internet can be tricky because that information can be found in many different sources, so they are not in one place.
There is also a possibility to look in the CVE database on this link or in the NIST database. Unfortunately, OSVDB is no longer active. Though you should remain aware that there is very little info on open-source vulnerabilities in these databases. Thus it is not enough to check these databases for vulnerabilities before you choose which dependency to use.
Why using open-source dependencies is dangerous if they are not checked frequently for vulnerabilities?
It is great that you would check for vulnerabilities to choose the right open-source dependency, which is fine when you want to start using them. But, when you start using the dependencies, you need to be sure that your web application is secure, so you would need to start checking vulnerabilities frequently!
Attackers are very aware of the third-party component used in web applications, the lack of security checks for dependency vulnerabilities, etc. Because of that awareness dependencies are often the largest attack surface!
For example, in November 2018, cyber attackers inserted malicious code into the EventStream component, which was used 6 million times. You can read more about it in this article.
What to do to secure the web application which is using open-source dependencies?
In short, you can check out vulnerabilities manually or automatically.
Besides the checking, always keep in mind that you should use new versions of libraries because some known bugs developers/testers found are fixed by each new version. And you know if there is a bug, there is a way for the attacker to “get in”! So, most simply put, always update your libraries!
By manually, I don’t mean you will go through the code itself and test packages for vulnerabilities. Although if you want, you can do that as well, it is very time-consuming, i.e., inefficient! I meant that you could use already existing tools that you would run and let them check all vulnerabilities of your application’s dependencies.
There are many open-source tools/services that can be used to check for dependency vulnerabilities.
I will list some of them:
Dependency-check is a command line tool which is designed by OWASP. It checks Java, .NET, JavaScript, and Ruby. It gets information from NIST NVD.
Node Security Project which targets Node.js modules and NPM dependencies. It uses two databases: NIST and his own.
RetireJS targets JavaScript dependencies. It has a specific dependency check but also provides a site-checking service for JS library vulnerabilities. It gets information from NIST NVD as well as from other JS sources.
OSSIndex targets JavaScript, C#(.NET), and Java library dependencies. It retrieves information from NIST NVD. It also gives a free vulnerability API.
Bundler-audit targets Ruby Bundler. It gets information from the NIST NVD and RubySec.
And by automatically, I mean you would set up your deployment to automatically check on push, merge code, etc. I will cover it in the next chapter!
What is the purpose of setting up a vulnerability checker while deploying?
Before your web application is live secure the application by implementing code workflow in your pipeline! Ensure your code and application is safe before it becomes public!
In this stage, your DevOps people are crucial!
What can you do to set up the code flow check correctly?
So, you can integrate the tool for checking the vulnerabilities throughout the entire development process.
I will give an example of flow if you are using Azure services:
Scanning Azure Repos and Github
Scanning Azure Pipelines
Scanning Azure Container Registry
Scanning Azure functions
This stage would be divided into four parts: Scan, Prevent, Fix, and Monitor. Scan to detect vulnerabilities in the project by scanning Azure repos or Github. Scan pull requests and prevent them from being merged if they contain vulnerabilities. The implemented tool would scan for new updates and patches and automatically populate a fix. This stage is done daily. Also, you can configure the security level with a policy that will prevent code from being merged.
This stage would be divided into three parts: Test, Prevent, and Monitor. When the Build is in process, the tool scans application dependency for vulnerabilities, makes a report, and monitors them constantly.
This stage would be divided into three parts: Scan and monitor, Prevent and Fix. The tool would scan all container images for possible vulnerabilities. In this stage, policies can also be set up to stop the build if images contain new vulnerabilities. The tool would try to fix them.
This stage would be divided into three parts: Scan, Monitor, and Fix. The tool would scan applications running on Azure services, monitor them, and protect deployment to ensure that no new vulnerabilities could be found in the new environment.
*Note: There are plenty of tools available which can be integrated with Azure DevOps, such as Snyk, SonarCloud, AWS Toolkit, Ado Security Scanner, Beagle Security, and many more.
On the internet, you can find many guides on how to set up an environment, depending on which tool you are going to use.
Conclusion
Open-source vulnerabilities are a very hot topic nowadays. The more you investigate, the more you will be aware that using third-party libraries puts your security in someone else’s hands.
Of course, you are not going to stop using open-source dependencies, nor should you. But, if you follow the best practices I mentioned in the article, you will be aware of the vulnerabilities and have the time to react!
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About vRx vRx is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
eLabFTW is a free and open source electronic laboratory notebook for researchers.1 Once installed on a server, it allows researchers to track their experiments, but also to manage their assets in the lab (antibodies, mouse, siRNAs, proteins, etc.).
Affected version:
This vulnerability affects users of the eLabFTW before 4.1.0, it allows attackers to bypass a bruteforce protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header.
CVSS v3:
CvSS Score 6.5
Confidentiality Impact Partial
Integrity Impact Partial
Access Complexity Low
Vulnerability type Gain Access
Authentication Required
Availability Impact Partial
Mitigation:
Create a readFailedLoginByIp function on app/models/Logs.php to execute a query where the user field is REMOTE_ADDR and the body is Failed login attempt.
Invoke readFailedLoginByIp function on login.php to validate if the count has reached the failed attempt limit and is banned.
Or can be se the method recommended by OWASP with Device Cookies.
This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. How it works quickly
Successful login will create a cookie on the device
Trying too many passwords from an untrusted device (no device cookies) will lock the account
A locked account can only log in from a trusted device
Even a good password guess on a locked account will be unsuccessful
Technical Analysis:
This section will explain how the lockout process works by testing the login page while also reviewing the source code and then making an attack process.
Lockout Process:
Assuming the administrator email is already known as “administrator@elabw.local” with a wrong password submitted in the login form will produce a failed login message. See Appendix A to enumerate valid email accounts.
From the flash messages above, failing 3 times will result in being banned for 1 hour. Let’s find out where in the source code these messages are triggered.
From the grep result above there are two files triggering the error messages: LoginController.php and login.html. Upon further inspection in LoginController.php file at line 74 there is an if-else validation for login failed attempt.
The code above will set failed_attempt key with value 1 in $Session variable if it’s not exist or, increment the value if it does. Because PHP handles and tracks $Session variables using PHPSESSID in a Cookie request header, which is controlled by the user, the bypass is very obvious. Simply using random value in PHPSESSID or, completely removing the Cookie header on each request to login.php will force the application to create a new session and the failed_attempt key will always be set to 1.
When inspecting the login page a hidden input called formkey was found and it’s required along with email and password as a data submitted to LoginController.php.
Attack Process:
This section will assemble what was found when identifying how the lockout process works.
1. Make a GET request to login.php
Extract PHPSESSID from the response header
Extract formkey from the response body
2. Make a POST request to LoginController.php with PHPSESSID and formkey from step 1 included and, use valid email address and wordlists for password on data field
3. Follow url redirections from step 2 response location header
If url redirect location is login.php, automatically remove the Cookie header
If url redirect location is not login.php, the attack is succeed.
Exploitation:
The exploit will use Burp Suite’s Intruder3 tool to automate the attack process. First step is to extract PHPSESSID and formkey from the login.php assuming the request was already made from the browser through Burp Suite Proxy. Navigating to Proxy > HTTP History, right-clicking on the GET request /login.php and select Send to Intruder:
Now navigate to Intruder window and choose Positions tab and remove a Cookie header if it exists:
Next, choose the Options tab and scroll down to Grep Extract. Tick Extract the following items from responses and set Maximum capture length to 150:
Click Add button then Refetch response and notice Set-Cookie header is being set. SelectPHPSESSID value and click OK:
Click Add button again and do the same for formkey value:
Select Always option on Redirections:
Navigate toHTTP History tab onProxy window then select POST /app/controllers/LoginController.php and copy the raw request:
Go back to Positions tab on Intruder window and paste copied raw request in the editor and then click Add § button to set a mark on these fields: PHPSESSID,password,formkey and set Attack type to Pitchfork:
Next, clicking the Payloads tab to set 3 payloads. Payload set 1 for PHPSESSID cookie value using “Recursive Grep”
Payload set 2 for password and set Payload type to “Simple list” then click Load to choose a small wordlist file from /usr/share/wordlists/wfuzz/others/common_pass.txt:
Payload set 3 for formkey using “Recursive Grep”:
Using Mitmproxy command-line mitmdump as upstream proxy to automatically remove Cookie header when following a redirect location request to /app/controllers/../../login.php.
Navigate to Project options > Connections > Upstream Proxy Servers, toggle Override user options and click Add button. Specify the Destination host to target domain elabw.local, Proxy host to 127.0.0.1 and Proxy port: 8081 and click OK:
Go back to Intruder window and start the attack by clicking on Start attack button:
See image above the Payload1 values are always changing and these values are taken from PHPSESSID columns for the next request. Forcing the application to create a new session so the failed_attempt key will always be set to 1. The lockout process successfully bypassed.
Notice in the highlighted request, the Length size is bigger than others and in the Response 1 tab, the Location header is pointed at “../../experiments.php” meaning the attack is successful.
Workarounds:
The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading.
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About vRx vRx is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source.
ECC relies on different parameters. These parameters are standardized for many curves. However, system didn’t check all these parameters. The parameter G (the generator) was not checked, and the attacker can therefore supply their own generator, such that when system tries to validate the certificate against a trusted CA, it’ll only look for matching public keys, and then use the generator of the certificate.
In order to yield the same public key to spoof the certificate, private key is set to 1
public Key = Private Key * Generator
Public Key = Generator
Trusted public key is used as the generator of spoofing certificate; Generator is not validated by system
MicrosoftECCProductRootCertificateAuthority.cer is by default a trusted root certificate authority (CA) using ECConWindows10. Anything signed with this certificate will therefore automatically be trusted.
CVSS v3:
Base Code 5.8
Confidentiality Impact Partial
Integrity Impact Partial
Access Complexity Medium
Authentication not required
Availability Impact non
Mitigation:
Microsoft Windows 2020 updates had been released to patch CVE-2020-0601 vulnerability.
In windows VM, navigate to C:WindowsSystem32driversetchosts
Add IP address of Ubuntu VM and URL - https://www.google.com
Files cert.crt, cert.key, and spoofed_ca.crt are used to serve content. Add the spoofed_ca.crt as a certificate chain in your server’s HTTPS configuration. Configure “index.js” server file.
Spoofed CA is validated by web browser as Trusted Root CA and original https://www.google.comcontent is replaced with the incorrect information as mentioned in “index.js” file.
CVE-2020-0601 – Windows incorrect ECC certificate validation vulnerability is implemented
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About vRx vRx is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
Security-minded system administrators prioritize taking all the necessary measures to safeguard confidential and protected data. The compromise of a device can prove costly if it contains sensitive company information, especially when organizations have compliance requirements. Disk encryption is one of the best ways to mitigate this risk.
Encryption is the process of encoding data. Data is converted from plain text to ciphertext using a special mathematical algorithm that renders the data unreadable unless the encryption key is provided. This key should always remain a secret to the person authorized to access the data.
There are two major types of encryption in a computer: Full Disk Encryption (FDE) and File Level Encryption (FLE).
Full Disk Encryption
In full disk encryption, also known as hard drive encryption, the entire hard drive or volume — including all the files — is protected. During booting, a passphrase or secret key is required to unlock the drive before logging in with your user account credentials.
Implementing FDE guarantees data privacy and security for all the files from unauthorized users or anyone with malicious intent. Learn more about the benefits of FDE, and five reasons you should consider requiring it in your organization.
File Level Encryption
As the name infers, file level encryption happens at the file system level. This type of encryption targets individual files and directories, but not the entire hard disk.
Both full disk encryption and file level encryption can be used simultaneously to achieve a higher level of data protection.
In this tutorial, we will focus on how to enable full disk encryption on Ubuntu 22.04 using LUKS.
What Is Linux Unified Key Setup (LUKS)?
LUKS is a standard hard drive encryption technology for major Linux systems including Ubuntu. It is a platform-independent disk encryption specification and the de facto disk encryption standard for Linux systems.
LUKS was originally developed for Linux systems and is used in nearly all Linux distributions. It is also a popular encryption format for network-attached storage (NAS) devices. It encrypts entire block devices, making it an ideal choice for encrypting SSD, hard disk drives, and even removable drives.
In addition to offering FDE, LUKS allows users to create and run encrypted containers with the same level of protection as LUKS full disk encryption.
With LUKS, disk encryption can be enabled during the installation of an operating system. In fact, full disk encryption is only achieved during the installation of the Ubuntu Desktop operating system. It encrypts all the partitions including swap space, system partitions, and every bit of data stored on the block volume with the exception of the Master Boot Record (MBR).
How to Fully Encrypt Data on Ubuntu 22.04
If you already have a running instance of Ubuntu 22.04 and you want to enable full disk encryption, you’re required to reinstall it. You cannot fully encrypt it once it is installed. You can only encrypt directories or partitions post-installation.
If you forget your encryption passphrase, all your data will be inaccessible. As such, it is recommended to pick one that you can easily remember or store on a password vault or manager. Better yet, if you have used a complex password, you can note it down somewhere and keep it under lock and key.
Additionally, before starting this process, be sure to backup any critical data that could potentially be lost during the reinstallation process.
Getting Started
We will skip the few installation steps on Ubuntu 22.04 and head straight to the “Installation Type” step that requires you to select your preferred disk partition mode.
Two options will be presented. The first one (the default option) is “Erase disk and install Ubuntu” which wipes out all the existing data and automatically partitions the drive. The second option is “Something else” which is used to manually configure the disk partitions yourself. Please note that you will not be able to enable full disk encryption by selecting the second option.
Select the first option: “Erase disk and install Ubuntu” and click the “Advanced features” button as indicated.
Once you click the “Advanced features” button, a pop-up appears. Be sure to select “Use LVM with new Ubuntu installation” and the “Encrypt the new Ubuntu installation for security” options.
Then click “OK.”
Next, assuming you have already backed up any important data, click “Install Now.”
Disk encryption requires a security key in order to access your files each time your device boots. In this step, provide a strong security key or passphrase.
You can also enable a recovery key which enables a user to access the encrypted disk if they forget their password, or if the disk needs to be installed on a new device.
Then click “Install Now.”
On the pop-up dialogue that appears, click “Continue” to write changes to the disk.
From here, continue with the installation process until the end, and finally, reboot the system. Provide the security key that you generated and hit ENTER prior to logging in.
The secret key unlocks your drive thereby granting you access to your system.
From here, you can log in to your new Ubuntu installation by providing your user account’s password and pressing ENTER.
Conclusion
In this guide, we walked you through the implementation of full disk encryption using LUKS on Ubuntu 22.04. FDE provides a robust way to safeguard your data in case of theft or accidental loss of your device.
Encryption is just one approach to ensuring the privacy and safety of your data. Therefore, you should not relax enforcing other data protection measures such as firewalls, identity and access management (IAM), and Zero Trust controls such as multi-factor authentication (MFA).
JumpCloud’s open directory platform is available to easily implement full disk encryption throughout your entire fleet. Pre-built policies make it possible to achieve full disk encryption for Windows and macOS devices, with granular control and visibility for BitLocker.
Linux devices can also be managed and monitored for encryption status. To see how this works, along with a number of other device security and management features, sign up today to get started. JumpCloud is free to use for up to 10 users and 10 devices; we also provide 24×7 in-app support for the first 10 days of use.
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
October is Cybersecurity Awareness Month, and this year’s theme is See Yourself in Cyber, which focuses on the individual’s role in cybersecurity. While cybersecurity can feel complex and inaccessible to the average person, the reality is that everyone has a role to play in security, from executives to the IT team to end users. This month, the JumpCloud blog will focus on helping you empower everyone in your organization to do their part regarding cybersecurity. Tune in throughout the month for more cybersecurity content written specifically for IT professionals and MSPs.
Many organizations spend quite a bit of time onboarding new employees and making sure they have access to everything they need; however, the same care is often lacking when it comes to offboarding. Whether a long-time employee suddenly leaves on bad terms, a contractor is no longer being utilized for some period of time, or an employee goes on leave, improper offboarding or suspension of that user’s permissions and access poses significant risk for your organization.
Offboarding and deactivating a user’s identity can be a manual and time-consuming process, yet it is also very time-sensitive and sometimes requires IT admins to be available at a moment’s notice. Not every employee gives notice prior to leaving, and unforeseeable events can happen that force admins to scramble at the last minute to deprovision that user’s access to company resources.
This process becomes even more difficult if your organization needs to provide access to IT resources for temporary workers like contractors and interns, or has full-time employees that may need to be temporarily offboarded or have their IT resource access suspended rather than be permanently offboarded due to personal events like marriages, births, family care, overcoming an illness or injury, and more.
Most Companies Struggle With Offboarding
Improperly offboarding employees is a dangerous game to play, yet, according to TechRepublic, 48% of organizations said they are aware that former employees still have access to corporate networks. Further, 20% of organizations say they’ve experienced a data breach that’s linked to former employees.
These stats tell us that improperly offboarded employees are a predominant threat to organizations; however, the tools and resources needed to fix this issue aren’t there. The missing link here could be a lack of time, no simple way to quickly offboard or suspend user access to all IT resources, and/or lack of insight into the security risks posed by inadequate processes. It puts a spotlight on the notion that offboarding is as much a security issue as it is an operational one for IT.
Another important finding from TechRepublic is:
Half of IT leaders said that ex-employees’ accounts remain active for longer than a day after their departure, 32% said it takes a week to deactivate an account, and 20% said it takes a month or more. Another 25% said they don’t know how long accounts remain active once the employee has left the company.
These percentages pose a significant problem for the organizations that fit into these stats. It only takes one angry ex-employee, one ex-employee that’s simply being careless with the handling of their credentials, or one employee on leave that still has active access to make damaging changes in some shared resource, even though they weren’t there for the last best practices discussion.
Case Study: Improper Offboarding and Compliance Violations
Here’s a real world example of how improper offboarding of employees and contractors can lead to considerable compliance violations, substantial fines, and the subsequent loss of public trust.
Pagosa Springs Medical Center (PSMC)
In 2018, Pagosa Springs Medical Center found itself at the epicenter of a major HIPAA violation which ended up costing them $111,400 — all because they did not properly offboard a terminated employee.
After their termination, the former PSMC employee retained remote access to PSMC’s web-based scheduling calendar, which contained patients’ electronic protected health information (ePHI). The investigation revealed that PSMC impermissibly disclosed the ePHI of 557 individuals to this former employee.
HIPAA calls out the need for a formal offboarding process under the security rule section – § 164.308(a)(3)(ii)(C): “Implement procedures for terminating access to electronic protected health information when the employment of a workforce member ends.“
HIPAA is just one standard that can easily be violated due to improper offboarding — there are many others out there with similarly severe consequences for non-compliance.
A Quick Offboarding Checklist
Even at organizations where offboarding is seen as a fairly quick process, i.e. less than a couple of hours, the risk of that ex-employee or another bad actor taking advantage of existing access is still prevalent.
TechRepublic also found that 70% of IT decision makers surveyed said it can take up to an hour to deprovision all of a single former employee’s corporate application accounts. Keep in mind, this does not include revoking an employee’s access to their devices and networks.
To combat this and improve your organization’s security posture, it’s helpful to put steps in place that improve offboarding efficiency. One of these steps should include an offboarding checklist to ensure that no loose ends are left after an employee’s de
parture.
Your offboarding checklist should include deactivation of access to:
All applications
Productivity tools:
Ex. Google Workspace and Slack
CRM tools:
Ex. Salesforce and Zoho
Cloud Infrastructure
File shares
Devices
Corporate Networks
VPN
RADIUS
Or, if WiFi access is not centrally managed, periodically refresh the Corporate WPA2 passphrase
And ensure return of equipment
Questions to Consider When Improving Offboarding Workflows:
Does HR inform you in a timely manner when an employee leaves your organization?
If an employee is terminated or leaves abruptly, are you able to deactivate their identity immediately?
Are you able to suspend the identity for contractors who leave the company and may return?
What about employees on medical leave who may return?
Improving Employee Offboarding
Sticking to an offboarding checklist to ensure all access is revoked is extremely important, but what’s just as important is the process in which everything is deactivated. Not only are manual offboarding processes time-consuming, but they also leave a lot of room for human error.
While working to improve and standardize your entire offboarding workflow, we also recommend that you establish routine communication with HR around onboarding and offboarding, as well as find an identity provider (IdP) to streamline the process.
Establish Routine Communication With HR
If you’re not already in continuous communication with HR regarding employees coming and going, you need to establish a better process between departments. HR should let you know when an employee is scheduled to leave or immediately notify IT when someone leaves abruptly. HR should also inform you in advance when an employee is scheduled to return from leave or their contract is renewed.
Though many project management tools exist to help alert internal stakeholders about new tasks, and some HRIS systems can even directly integrate into your core directory service to fully automate this process, this communication can be quickly achieved by creating an email alias or group with select individuals from HR and IT. Whenever someone across the organization alerts HR of a change in employment, they can CC this email alias to give IT the necessary “heads up” they need to act quickly.
Find the Right Identity Provider
When choosing an identity provider, find one that has the following capabilities:
Allows you to automate deactivation of a user’s identity
Once you set the date/time of deactivation, your IdP should take care of the rest
Lets you easily and quickly revoke access to ALL resources
Deactivating a user’s identity should revoke access to applications, devices, networks, and any other resources that user had access to
Simplifies user activation and reactivation
If an employee returns from leave or a contractor’s contract is renewed, you should be able to quickly and easily reactivate their identity in a just few steps
Includes integration capabilities with common HRIS software
Fixing the communication disconnect between HR and IT and implementing the right identity provider will allow you to securely and efficiently revoke access and re-provision access as needed, through just a few clicks.
JumpCloud’s Offboarding and User Suspension Features
Using JumpCloud® as your primary IdP allows you to quickly deprovision user access to virtually all of their IT resources. Our scheduled suspension features allows you to schedule a date and time for user deactivation which revokes access to applications, devices, networks, and any other IT resource their account has permissions for.
If the user in question will be returning, you can use this capability as a temporary suspension, and the user can later be reactivated; what’s more, they’ll receive updated permissions and access to new or changed resources as determined by their associated user, device, and policy groups automatically once reactivated. If the user in question will not be returning, use this feature to schedule their deactivation and then fully remove their account when appropriate (as dictated by compliance regulations or internal policy).
The JumpCloud scheduled user suspension feature simplifies and automates the deactivation workflow for scheduled permanent offboarding, as well as temporary suspension of contractors, freelancers, and employees on leave. This feature lets you revoke access to all resources, not just corporate applications. All of this works together to improve your overall security posture and ensure that your organization remains compliant with relevant standards.
All of this coupled with the fact that JumpCloud integrates with HR software like Workday and Bamboo, as well as provides API-based integration with other tools, provides a seamless onboarding and offboarding experience for IT admins.
Protect your organization from data breaches and compliance violations
This feature can be found within the JumpCloud Admin Console — find it under User Management > Users. Try it for free for up to 10 users and 10 devices by creating a JumpCloud Free account. Enjoy all of the functionality of the JumpCloud Directory Platform, including scheduled user suspension, and see if JumpCloud is the right IdP for your organization!
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
Unmanaged assets are connected to the network, but lack an identified owner and may exist outside the visibility of those responsible for the network. These devices can pose real security risks to a company or organization for numerous reasons, such as running older vulnerable operating systems or software, using insecure protocols, or having nefarious intent. Plus, they can be difficult to discover or locate, sometimes using unmanaged subnets within a network.
Arising from both intentional and inadvertent situations, unmanaged assets can be classified into several categories, including:
Orphaned – Assets that lost their original owner but are still present on the network
Shadow IT – Devices/systems that are connected to the network without permission
Transient devices, such as portable, mobile, or IoT devices that “come and go” on the internal network, including bring your own device (BYOD), might be better categorized as “unmanageable” rather than “unmanaged” and can also be easily discovered via runZero scanning.
Let’s take a look at how runZero is able to locate unmanaged devices on your networks.
Peek under the hood of our scan engine
At runZero, we intentionally built our offering around unauthenticated, active scanning, while complementing our technology through integrations with cloud, virtualization, and security infrastructure to provide full visibility into IT, OT, cloud, and remote devices. To start, let’s dig into our scanning capabilities. Our built-from-the-ground-up scanning logic in runZero Explorers and scanners will reach out to elicit a response from devices connected to the network. Replies received from our scan traffic are then captured for processing.
Benefits to our approach
No prior knowledge required: Our active, unauthenticated scanning approach doesn’t assume any “prior knowledge” of network-connected devices (e.g., credentials to authenticate into devices, deployed agents on managed devices, etc.), rather our network discovery capabilities are research-driven to find-and-surface every network-connected asset, whether managed or unmanaged. Highly configurable: Our scans allow you to go beyond basic subnet and speed settings. You can tune scans for specific ports or protocols that you want to know about, which can help quickly locate unmanaged devices that are running unsafe or company-prohibited protocols. Standard packets: All of our scanning packets, including probes and port/service querying, is done using standard packets to keep things safe. We never send malformed or otherwise unusual packets. Research driven: We use applied research to maximize scan result discoveries while still utilizing a “safe approach” for interacting with devices. This helps avoid any unexpected or unwanted side effects that are sometimes seen with other active scanning solutions, particularly when scanning ICS/OT and other traditionally sensitive devices/endpoints.
Comprehensive inventory of internal assets
A comprehensive asset inventory is not complete unless you know about the assets that aren’t managed by your organization. Here are some ways that runZero can help you zero in on assets you may not know about.
See your RFC 1918 coverage
runZero’s scans can help surface unmanaged subnets in your internal network, which may harbor a bunch of unmanaged devices. Our RFC 1918 scan capability can cover the entire IPv4 internal network address space (more than 21 million addresses), checking all potential places unmanaged devices could be hiding in your network. We’ve also developed a “subnet sampling” option as an informed approach to focus on statistically-likely-to-have-devices subnets so that the RFC 1918 scan runs in shorter time while still providing good coverage.
The interactive RFC 1918 coverage report presents discovered data in an easy-to-consume layout to show which subnets have been scanned, and includes additional data for unscanned subnets which might be active based on devices leaking secondary network interface information. This report allows you to “drill down” into subnets by clicking them to view discovered asset details within an address block.
Find unmapped assets
Unmanaged devices on your network can also surface in runZero as an unmapped asset. An unmapped asset is a MAC address connected to a switch, but not found in an ARP cache or through any of the other techniques runZero uses for remote MAC address discovery. Unmapped assets could be unmanaged assets, but could also be managed assets that were not included in the scope of a particular scan. You can get a visual overview of where unmapped assets appear on your network via the switch topology report, with each switch showing the number of assets (including unmapped assets) attached to it. A single click on a switch with unmapped assets will bring up a “View unmapped assets” link to the associated unmapped MACs report, which provides MAC details and the switch port the asset is connected to. This is potentially helpful for further investigation.
Search for devices missing agents in runZero
runZero uses applied research to identify other agent technologies that may be required on assets managed by your company or organization. You can find unmanaged assets that are missing these agents via runZero inventory queries. The following query example will surface any Windows assets on the network that are not running an Avast agent:
os:Windows and not edr.name:Avast
You can also search for unauthorized operating systems or applications on your network, which can be indicative of an unmanaged asset. For example, if all or your Windows systems are only allowed to be running Windows 11 or Windows Server 2022, you can create a query to surface any potentially unmanaged Windows assets not running these recent versions:
os:Windows and not (os:"Windows 11" or os:"Windows Server 2022")
Track unmanaged assets with tags
Tags are another runZero mechanism that can be used to surface unmanaged assets and also help “keep on top of” current asset ownership. This requires a bit of work up front to tag all managed assets, but requires little maintenance once in place.
Stay on top of unmanaged assets with alerts
Alerts are a powerful way to leverage queries into timely notifications in-app or via email or webhook. For example, we can build alerts for any of the queries used in this article. Rules are checked when a scan completes, and for any rule that evaluates as “true”, an alert can be generated. Check out our “Tracking asset ownership with tags” article to learn how to set up an alert rule.
Comprehensive inventory of external assets
Internal networks aren’t the only places unmanaged devices may exist. A public-facing web server could become orphaned, or a bad actor could DNS spoof/hijack a lesser-used company domain to redirect traffic to a phishing site they control. With just a domain name or ASN number set in the scan configuration, runZero can resolve the associated external-facing URLs and IP addresses to scan. And our hosted zone scanners can seamlessly run the scan, removing the step of installing an external-facing Explorer.
Uncovering unmanaged assets through integrations
At runZero, we understand the power of “better together”, and our development teams have been busy adding support for many product and service integrations. Some of these integrations can be leveraged to surface unmanaged assets in your network.
For example, let’s say your organization uses SentinelOne on all managed macOS assets. One day an employee connects their personal MacBook to the corporate network without authorization: a macOS device without SentinelOne installed. You can create a runZero inventory query to surface this asset (and any others like it):
os:macOS and not source:SentinelOne
As another example, let’s say your company uses Microsoft Intune on all managed Windows 10 and Windows 11 assets. You can create a runZero inventory query to surface any Windows 10 or Windows 11 assets connected to your network that are not known by your Intune integration:
((os:"Windows 10" or os:"Windows 11") and not source:Intune
Prefer to surface your runZero-discovered assets, managed and unmanaged, via another tool? We offer integrations for several popular services, including ServiceNow and Splunk, allowing you to leverage the power of runZero’s best-in-class discovery and asset fingerprinting with other applications.
Zero unmanaged assets
Getting a handle on unmanaged assets is important, but it can feel like “one more thing” to do in an already-lengthy list of responsibilities. At runZero, we’ve done our homework through research and development to make finding your unmanaged network assets quick and easy.
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About runZero runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.
You can say that Tor is an open-source, anonymizing, encrypted, volunteer-operated proxy network. It distributes your traffic over several layers (or relays) so that no single point can link you with your destination. Basically, you go through these relays before reaching that destination.
This helps you reduce the risk from both simple and more complex network analysis.
For example, installing the Tor browser on your client (Windows) machine will place a Socks5 proxy on it. You can configure it to push all the Internet traffic you want through that proxy – taking the same path.
Packets sent are encrypted and enter the Tor network encrypted; after that, they get bounced from node to node until they reach the exit node, where the packets get decrypted, and you arrive at your final destination – like Facebook. We call this a Tor circuit.
The example above takes the clear web into consideration. To access Tor’s hidden services, you need a .onion URL, a special URL required to access the Tor Darknet. Note that the exit node is not really required in this case, as you’re not leaving the Tor network; you’re going to a server that’s within the network.
This also means that your traffic will stay encrypted (end-to-end). The main idea about Tor here is that no individual relay (node) will know the complete path you’ve taken. In fact, the client negotiates a different set of keys for each hop within the Tor circuit. Thus, no hop can trace these connections as they are passing through.
There’s 10 minutes or so window for circuits (Tor uses the same circuit) where it will use the same circuit, but the later requests will be given a new circuit, keeping people from linking your previous actions to your later ones.
It’s important to note that Tor is not solving all the privacy and anonymity problems! Tor does not cover everything and is not a silver bullet, but it can be an extremely useful tool to help you protect your privacy and anonymity when configured correctly and when used in conjunction with other tools/layers that will keep your privacy and anonymity unscathed.
Tor utilizes the Diffie-Hellman handshake, which is used to establish the session keys (I mentioned above that the client negotiates different keys for each node); Diffie-Hellman basically lets your client negotiate the session keys in such a way that even if the negotiation was listened to by a MiTM (Man in The Middle), they wouldn’t be able to establish what the mutually agreed session key was.
Another thing that Tor uses is something called Perfect Forward Secrecy, which means the session keys are used briefly and later replaced. This means that if one of the nodes were to get compromised, data that already passed through it can’t be decrypted with the private keys because the keys have changed since then.
Tor is both a piece of software and an anonymizing network. A live representation of the Tor network can be seen here. The Tor browser (software) is what lets you access the Tor network.
Most of the Tor relays are to be found in Central Europe. From the link above, you can see the network’s historical development. You might experience more (or less) latency depending on your proximity to the nodes. The Tor network is generally known to not be blazing fast.
The Tor browser itself is a hardened Mozilla Firefox ESR (it has NoScript, HTTPS Everywhere, and Tor proxy browser addons). It can be also run from a removable media (standalone) and is cross-platform – available on Windows, Mac, GNU/Linux.
Once installed, and started, you will see a Firefox-like UI, and will be greeted with a welcome message for the first time. I will not cover how you can configure these, for the most part, its almost the same as for your Firefox broswer, so if you’re a Firefox user, you’ll feel at home. I will just share some thoughts below (check the third screenshot); This is more to give you an idea on what approach we need to have here, but the more technical aspects is something I will gradually build up to as we go through the series.
Note the two options from the second screenshot. The New Circuit option will make you go through a different exit node, and will basically present a new IP address but you can still have trackable items in your browser (even though the browser tries to fight that anyway, its still possible), but the New Identity option will restart the browser itself. This is the big difference between the two options, the New Identity will attempt to wipe everything that is contained within the browser and could be linked/used for tracking, which is why it restarts.
For an attempt at anonimity, you want the security settings set at the Safest option, even though it might break some websites. But, if that’s not chosen, deanonymizing is much easier, and it kinda defeats the purpose of using Tor in the first place. You obviously want to restrict 3pp cookies, disable browser plugins (Flash), never record browsing history or website data, and change details that distinguish you from other Tor Browser users.
I hope you liked this article, and that I’ve managed to shed some light on Tor! There’s way more to unpack here, and I hope to gradually help you familiarize yourself with this enormous topic, by building upon what was written in previous articles, so, stay tuned for the next one!
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About vRx vRx is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
There is no doubt about it — remote work is here to stay.
Managing, securing, and updating Apple device fleets has never been more pivotal to thwart potential security breaches. Mobile device management (MDM) solutions simplify remote management while providing peace of mind that essential data is kept safe.
Right now, organizations in industries across the board are cutting costs in response to the current economic climate. Are you a budget-conscious admin looking for “free Apple MDM” guidance? If so, keep reading to learn more about what to look for when evaluating platforms.
The Apple MDM Landscape
Choosing the right MDM vendor has become a crucial task since 2020. That’s when Apple released macOS Big Sur, which introduced several changes for end users and IT admins overseeing enterprise environments.
Proceeding this change, it wasn’t uncommon for small-to-medium-sized enterprises (SMEs) to leave Apple device maintenance in the hands of end users. Though several industries have embraced the vendor in recent years, Apple products still make up a small (but growing) percentage of the average organization’s device portfolio.
Of course, this left organizations vulnerable as most enterprise end users are not IT experts! Furthermore, they’re unlikely to prioritize organizational security over their daily tasks.
Today, Apple continues to add security patches that require coordination with official Apple MDM vendors. Of course, Apple’s commitment to privacy doesn’t stop there — Apple wants enterprise end users to know what their employers do and don’t have access to from their devices too!
Translation: Organizations must practice transparency, even with corporate-controlled devices. Admins can no longer rely on manual management of their Macs or third-party vendors that don’t use Apple’s native MDM protocols or APIs.
Free Apple MDMs: Are They Really Free?
Free MDM and open source MDM platforms do exist.
Review site Capterra lists 42 mobile device management software entries, in fact. But will these options cover the functionality you need? In most cases, the answer is no.
Open source MDMs and free MDM plans can often get the job done for extremely small businesses. But most SMEs require varying paid plans to meet more sophisticated security compliance requirements.
Most of the “free” Apple MDM plans you will find have device limits and/or time limits. In addition, they often require admins to manually install updates, troubleshoot connectivity issues, and/or manage on-prem infrastructure. Furthermore, each provider puts its unique spin on MDM APIs.
For these reasons, it’s crucial to clarify your requirements before investing time and energy into setting up a free Apple MDM solution. Let’s take a look at some key elements worth considering when weighing your options.
5 Essential Apple MDM Assessment Factors
It’s unlikely that most free or open source MDM solutions will check all of your boxes. You’ll need to decide which features are absolutely essential for your organization and which ones you can live without. Below are four core factors to consider before choosing a free Apple MDM:
1. Cross-Platform Support
Select a free vendor that only works with Apple products, and you’ll need to configure a different solution for Windows and Linux devices. Multiple solutions will require engaging in duplicate work, implementing multiple deployment processes, and staying up to date on different technologies. Translation: it can be a real pain in the tuchus!
If you manage a heterogeneous environment, prioritize device management technology that is cross-platform, multi-protocol, provider-agnostic, and location-independent. Ultimately, your MDM tool shouldn’t limit your choice of compatible vendor technology down the road either.
2. Security Compliance Functionality
Do you have remote workers using your servers? Following MDM best practices will require using platform features such as remote wipe, lock, restart, shutdown, mandatory password strength, multi-factor authentication (MFA), and more.
Consider if the free Apple MDM or open source solution will streamline the most common types of IT compliance regulations and standards: PCI, CCPA, HIPAA, SOX, SOC 2, and ISO 27001. While smaller businesses may not have many requirements, companies dealing with credit card transactions must cooperate with ISO 27001 standards. Furthermore, though SOC 2 isn’t a requirement it’s quickly becoming an industry standard for proving robust security practices.
Quick deployment and activation is essential for any admin expecting to meet evolving compliance instructions. In addition, look for streamlined reporting capabilities that make it easy to procure requested audit information at a moment’s notice.
3. Remote Configuration and Enrollment
Another factor to consider is how you currently deploy devices for new employees working from home. The best Apple MDM solutions allow admins to ship Apple devices straight to employees — ready to go out of the box. With zero-touch enrollment, the new employee simply follows the prompts on the screen for automatic enrollment and policy configuration. That means you can predetermine exactly what apps, resources, and data the employee will have access to ahead of time. If you’re looking for ways to take back your time, prioritize these features in your MDM search.
Young business people working in modern co-working space office using digital devices
4. Software Deployment and Patching
Software deployment on macOS comes in two flavors: App Store apps and non-App Store apps. Apps sold through the Mac App Store can be purchased through Apple Business Manager and then installed remotely via an MDM solution with no action required by the end user.
Alternatively, non-App Store apps must be packaged up and installed manually. Many paid MDMs will offer an “App catalog” with popular enterprise apps prepackaged and ready to install. If a free solution doesn’t offer this service, consider the time it will take to package up your apps manually.
And, as any experienced admin will tell you, never sleep on patch management! Failing to install security and performance updates is like turning away free food. So, when evaluating free Apple MDM solutions, take a close look at the patch management UX.
5. User Management
As previously mentioned, user management for Apple devices has become more complicated with the evolution of macOS. For example, the recent shift to SecureTokens as a way of ensuring trust caused plenty of challenges for IT admins.
Thus, it’s crucial to understand how your new MDM will work with your directory services. Here are some questions worth asking yourself how easy is it to:
Connect the MDM and directory service together to automate user management or will I need two separate solutions?
Control who can access which devices, networks, and applications?
Manage FileVault, which is intimately tied to the user and their profile?
Manage access to employee Macs remotely?
The integration of system and user management is extremely valuable for organizations planning to scale. In summary, choose the right solution from the start as it can be costly to switch after employee devices are already onboarded.
JumpCloud: The Best Free Apple MDM Solution
If you’re looking for greater integration between MDM and identity management, look no further than JumpCloud — the all-in-one MDM solution. Are we incredibly biased? Absolutely.
But the reality is there simply isn’t anything like it on the market. With JumpCloud you can manage Apple, Windows, and Linux devices from one frictionless location. The user portal allows admins to configure devices around user identities, wipe and lock devices, automate patch updates, and configure zero-touch enrollment quickly and easily.
In addition, users have the option of combining JumpCloud MDM with valuable security elements like SSO, MFA, full-disk encryption, cloud LDAP, and RADIUS.
MDM capabilities for 10 users and 10 devices forever.
10 days of premium 24×7 in-app chat support.
Full platform functionality (including software management, Zero Trust, etc.).
When you’re ready to scale, JumpCloud’s a la carte MDM plan starts at $5 per user/per device monthly. Below are some of the benefit from using JumpCloud:
Benefits of Using JumpCloud MDM
Seamless Cross-System Management
An IT admin’s credo is to secure their employee devices and, in doing so, protect company data and resources. Those devices could be Windows laptops, Linux servers, or Apple devices. JumpCloud, as an Apple-certified MDM vendor, offers seamless macOS MDM capabilities at no extra charge for companies on JumpCloud’s Free and Pro plans.
Convenient Security Controls
Security is something that can’t be sacrificed, even when it’s business as usual. Today, when teams are working from any corner of the globe, it’s even more critical that IT admins feel empowered to protect end users and enterprise devices regardless of location.
Once a JumpCloud-managed system is enrolled in Apple’s MDM, these commands equip admins with the ability to secure a user’s Mac in the event it’s lost or stolen. In addition, admins can remotely execute tasks like installing software, updating patches, and ensuring backups via JumpCloud’s command execution capabilities.
Easy Enrollment
Enroll macOS machines in bulk with a few clicks via JumpCloud’s macOS MDM enrollment policy. When applying the enrollment policy, admins have the option of checking a box that removes existing non-JumpCloud MDM enrollment profiles and automatically unenrolls devices from their previous MDM.
You can also use the policy to enroll new machines quickly. For DEP-enrolled machines, go through your Apple Business/School Manager platform and switch the association of their serial numbers to the new MDM server.
About Version 2 Limited Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
