人工智能 (AI) 已迅速從實驗性項目，轉變為 IT 策略的核心組成部分。大多數組織不是已經在使用 AI，就是正在積極規劃大規模部署。這場巨大的轉變，要求 IT 團隊必須緊急重新思考如何管理基礎設施、保護身份和確保敏感數據的安全。
快速採用帶來了顯著的風險。AI 系統會與關鍵基礎設施互動、處理機密資訊，甚至可能自主執行決策。如果缺乏健全的治理，這將導致安全漏洞和重大的合規性問題。您現在制定的政策，將決定 AI 成為組織的競爭優勢或昂貴的負債。
核心任務：治理 AI 以防範「影子 AI」
大多數 IT 領導者深切關注 AI 採用失控的風險，許多組織擔心未經審查的整合和合規性暴露。良好的治理是解決之道。清晰的政策確立了 AI 可用於何處、誰必須批准新工具，以及如何監控其使用情況。
影子 AI 的風險
政策對於防止 「影子 AI」（Shadow AI） 至關重要，即團隊在沒有 IT 監督的情況下部署未經批准的工具。這種缺乏可見性的情況，會瞬間打開數據洩漏和智慧財產權暴露的大門。主動治理可確保減少意外發生，並為關鍵系統提供更好的保護。
五項核心 AI 治理政策
為了安全地向前邁進，IT 領導者必須在以下五個領域定義規則：
1. 正式的整合審查與批准： 每個新的 AI 整合都必須遵循由 IT 安全或架構團隊主導的正式審查流程。這項政策確保在工具上線 之前，必須完成強制性的安全掃描、數據流審查和合規性驗證。
2. 機器身份與存取管理 (IAM)： AI 工具依賴服務帳號和機器人，但這些通常管理不善。政策必須要求實施強大的 IAM 實踐，包括將服務帳號的權限限制在最低需求，並要求定期輪換 API 金鑰和憑證。
3. 嚴格的數據治理與分類： AI 模型的可靠性取決於其輸入數據的品質。政策必須強制執行數據分類（例如：公開、機密），並要求敏感數據在用於 AI 訓練或推理之前，必須經過加密、清洗和驗證。這能確保系統可靠並隨時準備好進行稽核。
4. 監控與事件回應框架： 可見性是關鍵。政策必須定義哪些 AI 相關事件（身份活動、整合、數據存取）將被記錄，哪些安全閾值會觸發警報，以及 AI 相關事件應如何被升級和調查。
5. 變更管理與文件紀錄： 每個已部署的 AI 工具或整合都需要詳細的書面紀錄。政策必須強制要求對工具的目的、風險評估和數據來源進行徹底的文件紀錄，並記錄所有後續的變更和更新。這有助於簡化稽核並防止未經授權的部署。
引領 AI 採用的下一步
AI 是現代 IT 中不可逆轉的一部分。目標不再是阻止其使用，而是以一種安全、可擴展且符合業務目標的方式進行治理。透過現在就制定明確的政策——正式批准整合、仔細管理機器身份、保護數據、監控活動和記錄每次變更——您的團隊就能獲得安全使用 AI 所需的控制權。
儘早採取行動：實施這些治理步驟，以避免後續產生高昂的安全和合規性問題。
要深入了解像您這樣的組織如何採用和保護 AI，請下載 JumpCloud 最新的 IT 趨勢特別報告。
關於 JumpCloud
在 JumpCloud，我們的使命是建立一個世界級的雲端目錄。我們不僅是將 Active Directory 演進至雲端，更是重新定義現代 IT 團隊的工作方式。JumpCloud 目錄平台是一個統一的目錄，旨在管理您的用戶、其 IT 資源、您的裝置群組，以及它們之間的安全連線，並提供全面的控制、安全性和可視性。
關於 Version 2 Digital 資安解決方案 專業代理商與領導者 台灣二版 ( Version 2 ) 是亞洲其中一間最有活力的 IT 公司，多年來深耕資訊科技領域，致力於提供與時俱進的資安解決方案 ( 如EDR、NDR、漏洞管理 )，工具型產品 ( 如遠端控制、網頁過濾 ) 及資安威脅偵測應 變服務服務 ( MDR ) 等，透過龐大銷售點、經銷商及合作伙伴，提供廣被市場讚賞的產品及客製化、在地化的專業服務。
台灣二版 ( Version 2 ) 的銷售範圍包括台灣、香港、中國內地、新加坡、澳門等地區，客戶涵 蓋各產業，包括全球 1000 大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企業及來自亞 洲各城市的消費市場客戶。
預測性分析：利用 AI 和機器學習來預測硬件故障，或識別可能預示新興安全威脅的模式，讓您在問題導致停機前就加以解決。
—
通往可持續成長之路
成長應該是機遇，而不是營運的負擔。從自動化基礎任務到建立一個完全智慧協作的環境，這趟旅程為您提供了一條清晰的路徑，打造一個能與您的業務輕鬆同步擴展的 IT 計劃。這不僅僅是為了解決眼前的問題——而是為了奠定一個為未來做好準備的基礎。
準備好將這些原則付諸行動了嗎？探索 JumpCloud 如何幫助您自動化工作流程、串聯您的 IT 技術堆疊，並為各個成長階段建立穩固的基礎。
關於 JumpCloud
在 JumpCloud，我們的使命是建立一個世界級的雲端目錄。我們不僅是將 Active Directory 演進至雲端，更是重新定義現代 IT 團隊的工作方式。JumpCloud 目錄平台是一個統一的目錄，旨在管理您的用戶、其 IT 資源、您的裝置群組，以及它們之間的安全連線，並提供全面的控制、安全性和可視性。
關於 Version 2 Digital 資安解決方案 專業代理商與領導者 台灣二版 ( Version 2 ) 是亞洲其中一間最有活力的 IT 公司，多年來深耕資訊科技領域，致力於提供與時俱進的資安解決方案 ( 如EDR、NDR、漏洞管理 )，工具型產品 ( 如遠端控制、網頁過濾 ) 及資安威脅偵測應 變服務服務 ( MDR ) 等，透過龐大銷售點、經銷商及合作伙伴，提供廣被市場讚賞的產品及客製化、在地化的專業服務。
台灣二版 ( Version 2 ) 的銷售範圍包括台灣、香港、中國內地、新加坡、澳門等地區，客戶涵 蓋各產業，包括全球 1000 大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企業及來自亞 洲各城市的消費市場客戶。
在 JumpCloud，我們的使命是建立一個世界級的雲端目錄。我們不僅是將 Active Directory 演進至雲端，更是重新定義現代 IT 團隊的工作方式。JumpCloud 目錄平台是一個統一的目錄，旨在管理您的用戶、其 IT 資源、您的裝置群組，以及它們之間的安全連線，並提供全面的控制、安全性和可視性。
關於 Version 2 Digital 資安解決方案 專業代理商與領導者 台灣二版 ( Version 2 ) 是亞洲其中一間最有活力的 IT 公司，多年來深耕資訊科技領域，致力於提供與時俱進的資安解決方案 ( 如EDR、NDR、漏洞管理 )，工具型產品 ( 如遠端控制、網頁過濾 ) 及資安威脅偵測應 變服務服務 ( MDR ) 等，透過龐大銷售點、經銷商及合作伙伴，提供廣被市場讚賞的產品及客製化、在地化的專業服務。
台灣二版 ( Version 2 ) 的銷售範圍包括台灣、香港、中國內地、新加坡、澳門等地區，客戶涵 蓋各產業，包括全球 1000 大跨國企業、上市公司、公用機構、政府部門、無數成功的中小企業及來自亞 洲各城市的消費市場客戶。
Passwords are the bane of user and admin existence.
Keeping track of hundreds of passwords is tough, and employees inevitably forget them. When that happens, they’re frustrated that they can’t access the tools they need to do their job, and IT teams waste their precious time on lock-out tickets.
To circumvent this aggravating process, many employees create simple passwords or reuse them, which threatens their employer’s security and puts customer data at risk.
Many IT teams try to mitigate these issues by implementing single sign-on (SSO) or a password manager. But using just one or the other can still put a burden on IT and leave the company vulnerable to breaches.
What organizations really need is a unified approach to access that will enforce password health while allowing IT to control all target systems and support multiple authentication types. But is that even possible?
Below we’ll review why unmanaged passwords are so risky, describe the pitfalls of standalone SSO, and explain what a new world could look like when SSO and a password manager are implemented together.
The Dangers of Unmanaged Passwords
Unmanaged passwords are often a key component of cyberattacks, which are only getting more prevalent as employees have to remember more and more passwords to complete their day-to-day work. For example, Verizon’s 2022 Data Breach Investigations Report found that stolen login credentials were associated with half of all data breaches — a 30% increase from 2017.
But password management is expensive even without a breach. The average password reset can cost companies $70. When extrapolated to an entire organization, that adds up quickly.
While IT can send regular reminders to update passwords and educate employees on what makes a strong password, that’s not enough to mitigate risks. And those practices don’t reduce strain on IT either.
A password manager can reduce the chances of a breach and decrease pressure on IT by:
Rotating passwords – to ensure people are updating their passwords frequently
Syncing across operating systems and devices – to prevent as many lockouts as possible
While password managers certainly help, they still force employees to login into every application individually and, ideally, require additional layers of authentication to protect a user’s master password.
Resource Access With and Without SSO
Single sign-on, or SSO, is related to password management because it grants access to multiple applications after users provide one set of login credentials.
Without SSO, users still must remember and type in a username and password for every application they want to connect to. In that situation, you run the risk of employees sharing passwords, keeping sticky notes with their passwords on them, reusing passwords for several different applications, or creating passwords that are extremely easy to guess.
As discussed above, these habits can cause devastating financial and reputational damage. SSO and other Identity-as-a-Service platforms lessen the chances of a breach and decrease IT load by:
But SSO doesn’t solve everything — it doesn’t generate passwords, enforce password policies, or rotate passwords like a password manager can.
Benefits of a Password Manager + SSO
Combining the benefits of a password manager and SSO gives you the best of both worlds.
Users no longer have to create hundreds of complex passwords and worry about forgetting them. With a password manager and SSO, you can meet password-based access needs while imposing new authentication practices, including federation and multi-factor authentication (MFA). Adding more security best practices increases the protection of valuable IP and sensitive customer data.
The best joint password manager and SSO solutions store passwords locally on endpoints, making it tougher for hackers to get the data they want. In addition, some come with a relay infrastructure, allowing users to share passwords via end-to-end encrypted communication.
Ultimately, users get access to sites and services quickly, while IT admins can monitor and enforce password health on the back end without slogging through a slew of password reset tickets.
Secure Single Sign-On and Password Management With JumpCloud
The fact of the matter is that no one SSO or password management solution is going to safeguard your company from attacks and dramatically reduce IT’s workload. To truly accomplish those two objectives, you need to unify your tech stack and consolidate your IT tooling. Luckily, that’s what you get with the JumpCloud Directory Platform, which combines SSO and password management into a cloud-based directory.
With JumpCloud’s robust yet easy-to-use platform, IT can lay the foundation for unified access across all users, systems, and authentication types, including MFA. JumpCloud also has a newly released password manager, and its open directory infrastructure streamlines the login process for your employees. IT staff also benefit from having more time and budget to focus on strategic initiatives.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
As businesses continue returning to the office, more and more MSPs are being pressed to ensure that employees are able to return with minimal pain. Wi-Fi connectivity is often the very first issue that users will run into in a new office setting, so MSPs are finding that they must revisit how they handle the security of the wireless networks that they manage.
Common Wi-Fi Security Vulnerabilities
It’s very likely that your customers have their Wi-Fi set up with a guest network for visitors to use and a pre-shared key that employees are given on the first day of their employment. However, this authentication method is only marginally better than having no password at all and is very dangerous if the Wi-Fi provides access to domain-associated resources.
Addressing Connection Concerns
Being that your customers’ Wi-Fi keys are likely older than COVID-19, there has never been a better time to switch to a tried and tested solution: RADIUS. With RADIUS configured, network authentication takes place against a directory that has been configured to allow a user’s existing login credentials (username and password) to grant and revoke access to network resources.
RADIUS adds a much needed layer of security between users and a Wi-Fi network, while also bringing added convenience to your customers’ wireless networks. While RADIUS comes with a plethora of benefits, implementation can feel intimidating — but, it doesn’t have to be!
Using JumpCloud’s Cloud RADIUS Feature
In order to set up RADIUS for a client, you will need a directory to use as the source of truth for user authentication, and JumpCloud has the perfect solution for you. Here at JumpCloud, we leverage our powerful open directory platform to offer a high-quality, easy-to-use Cloud RADIUS solution that our customers love, giving them cloud-directory-fueled authentication and MFA to keep their networks secure and efficient.
Utilizing the Full Functionality of JumpCloud Alone
In addition to its Cloud RADIUS feature, implementing JumpCloud’sopen directory platform opens the door to a variety of other important features such as SSO, MDM, software deployment, and policies to help manage your users and endpoints.
In effect, with JumpCloud, you will not only be able to address your clients’ immediate network security and user experience needs, but you’ll also be able to position your services in a new way. You’ll be able to offer current and potential customers a more forward-facing and expansive service using all of JumpCloud’s capabilities — including helping clients consolidate their technology stack or adding much needed features into their IT infrastructure.
Now, I know what you’re thinking: “That’s great, but I am not in a position to migrate directory services. I simply want to deploy RADIUS to improve Wi-Fi and VPN authentication, and I already have customers using Azure Active Directory (AAD).”
Well, I have some good news for you: you can leverage your existing Azure AD environments in harmony with JumpCloud thanks to our new feature: RADIUS Authentication with Azure AD Credentials.
Using JumpCloud’s RADIUS Feature With Azure AD
Surprisingly (or maybe ironically?) enough, the implementation of RADIUS with Azure AD is reliant upon on-prem resources, with physical servers needing to be allocated to perform the required tasks. JumpCloud is a strong proponent of equipping MSPs and IT professionals with world-class tools to get their jobs done effectively, which means we focus on creating solutions for problems like this.
This means that we’ve made it so you can leverage JumpCloud’s Cloud RADIUS feature while maintaining Azure AD as the source of truth for your directory needs, effectively giving you the best of both worlds, with no on-prem setup necessary. This means that your customers can enjoy secure networks while improving ease of access to networks among their credentialed employees. On that same note, what this means for you, is that you now have a cloud-based RADIUS solution that can be implemented for any of your customers without gutting their existing directories.
Getting Started With Cloud RADIUS
Here are some guides to help you begin launching Cloud RADIUS across your MSP business and your clients’ orgs.
Check out some of the benefits that JumpCloud’s RADIUS solution will give to your clients:
Improved user experience that only requires a single, unique password to connect to networks and resources to get work done both in the office and remotely via a VPN.
Streamlined user onboarding and offboarding due to the activation or deactivation of a single set of secure credentials compared to many different usernames and passwords.
Fewer help desk tickets related to the pain associated with changing a PSK (pre-shared key) for a Wi-Fi network.
Simplified compliance that’s easier to prove by getting rid of a shared network password that anyone can get ahold of.
Easier network access for your techs. They’ll no longer be scrambling to figure out Wi-Fi passwords when performing site visits (this will also drastically lower the chance of a tech needing to huddle to one corner of a closet to get the single bar of LTE signal available for their hotspot to connect to your documentation service to find the Wi-Fi password. Definitely not speaking from personal experience. Sidenote: Why did they stop putting a network port on laptops?).
Ultimately, the largest benefit of having Cloud RADIUS from JumpCloud implemented is that you now have a solution that can be easily replicated across your entire customer base. Whether you’re working with a company that has never touched a directory service before (which JumpCloud can easily help with), or a customer that has been holding onto that 12 year-old server for dear life, JumpCloud is here to help you modernize your customers’ infrastructure.
With Cloud RADIUS, your service offerings around network management can fully revolve around a single authentication standard, your hardware vendor of choice, and a unified support approach that will delight your customers.
JumpCloud for MSPs
At JumpCloud, we are serious about setting MSPs up for success when working with in-office, hybrid, and fully remote clients. To do this, we have developed a dedicated platform for MSPs, called JumpCloud for MSPs.
JumpCloud for MSPs is an open directory platform that enables our partners to centralize identity, authentication, access, and device management capabilities under one umbrella without having to tear and replace any existing infrastructure.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
This morning, like many before it, I woke up and thought, “Today is the day I come up with some magical blog post idea that changes someone’s world!” I showered, threw on my Global Panini attire and a pair of Uggs slippers, cooked up an omelet, and made a pourover (my new obsession).
I plodded downstairs to the office and fired up the computer. I opened a new document, raised my hands to the keyboard and — nothing. Complete brain freeze.
It’s hard to be amazing week after week. I know you feel this too. You have IT projects that are stacked up. Your boss is on you week after week to make their world more secure without adding friction for the users. Or your MSP is feeling stagnant and you need to come up with some new services to offer — or figure out how to offer your current services in a different way.
The week over week of having to be “on” all the time…it diminishes your ability to be creative after a while. Problem-solving becomes what keeps you from getting out of bed each morning instead of driving you to be 1% better every day. I get that. I hear you loud and clear.
The Block is Real
This creativity block thing is real. Very real. And if you were just doing IT for the fun of it — creating a playspace for yourself — you wouldn’t have to worry. But, folks, this IT thing is what you get paid to do. You can’t just say, “too bad, so sad” and head off to the zoo, y’know?
Over here in the MacAdmins community, we have a great Slack instance where people are doing amazing things and being really creative. You go there, looking for something – a solution, some inspiration, a new job – but you’re still left uninspired. And you wonder why. Could be burnout. Could be general tiredness. Could be something else – let’s explore.
Brainstorming
At a recent standup (yes I now speak the language Agiletongue) I asked for a lift from my brilliant and creative teammates. Ideas, people, I needed ideas! It didn’t matter how outrageous they were. In fact, the more outrageous, the better. Anything is a springboard. As we’ve talked about previously, brainstorming requires a plethora of input and little to no judgment.
And as a response to my request I got….nuthin. No ideas. Not a one. I wonder if it’s just the heat of this unbelievably hot summer cooking our brains or if people are just plumb wore out from current events. No clue, but nobody had any ideas for me.
The next day, though, someone pinged me with an idea. “What about recipes?” they said. “It’ll be fun,” they said.
I work for a tech company. Our product does (amongst other incredible things) device and identity management. IT stack centralization. MDM and security management. Automation. With my IT background, I hear the word “recipe” my brain goes to GitHub and shell scripts and munki and other IT management types of things. But, alas, that is not what they meant.
They meant real recipes. Food recipes. Don’t get me wrong, I like food. It’s an important part of my day to day life. But, hmmm…was this a weird ploy to turn this into a happy homemaker column? I was both confused and a little offended but I stuck with the discussion knowing that I’d find out if I just let them talk.
How Does That Fit Into Tech?
Little by little the discussion started to make sense.
Us admins are under a lot of pressure to be perfect all the time. For many (if not all) of us, one mistake can cost our companies their reputation (not to mention financial and productivity loss). In some cases, if a mistake is big enough, it could cost our jobs or our client. So if you weren’t feeling stressed before you started reading this, you probably are now. Sorry!
One way to get past the stress is to get up from your chair, step away from your desk, and get active doing something that is not related to tech (if stepping away won’t get you in trouble, that is).
Thinking about other things is a great way to open channels that allow you to come up with solutions. We’ve all experienced this — our best ideas come in the middle of the night; or the middle of a shower.
Points to anyone who, by now, has accurately predicted where this is going.
A Story and a Treat
Mom baked every item on this table.
Growing up in my house meant that there was a plethora of home-baked goods. I don’t mean, a few store-bought cookies. I mean my mother baked. Daily. And there were always people over who didn’t live in this house.
The counter always had a few different kinds of cookies, a cake, maybe brownies, and on special occasions there were eclairs in the fridge. There were always bowls and beaters waiting to be licked clean and getting to the frosting bowl first meant you had to hide behind a locked door, lest someone steal it right out of your hands.
But one particular tradition we had was that on our birthday we got to choose our favorite dinner and our favorite cake. Mom wasn’t the best cook (I won’t say food was overcooked and dry and we’re probably lucky we didn’t all get food poisoning regularly, but…oh, I guess I will say it), but she could definitely bake.
So my choice was always spaghetti with meatballs (safe and really hard to mess up) and mom’s chocolate banana layer cake. I used to call it my migraine cake because every time I’d eat it I would end up with a migraine. Also, it was worth it every single time. I don’t do that anymore because now I know that my post-cake morbidity was due to celiac — but I can still taste it in my memory.
Here It Is
And, so, it is with a full heart and a now-hungry tummy that I gift you this recipe. Posting it here serves two purposes:
Getting up and doing something completely different from your work frees up your brain and refreshes your spirit.
Eating something delicious can reduce your stress level. Even if it’s not a healthy option, a treat is good for the soul.
The recipe card (mom retyped every one of her recipes onto an index card with our Selectric typewriter that only had an all-caps ball) is well-worn. It has food stains all over it. It may have even gotten a bit too close to the heat. But it’s still here and someday it will be passed down to someone in the family.
Chocolate Banana Cake
Serves: 16
Baking time: 30-35 minutes
Notes: This cake is best when frosted between layers and on the outside with a buttercream frosting.
Ingredients:
2 ¼ cups sifted flour
1 tsp baking powder
¾ tsp baking soda
1 tsp salt
1 tsp vanilla extract
½ cup sour milk
⅔ cup shortening (may substitute butter or margarine)
1 ½ cup sugar
2 eggs
2 ounce Bakers chocolate
1 cup mashed ripe bananas
Directions:
Preheat oven to 350º Fahrenheit.
Sift together flour, baking powder, baking soda, and salt.
Cream shortening together with the sugar until fluffy.
Add eggs, one at a time, beating after each addition to shortening mixture.
Mix chocolate in with egg and shortening. Stir in vanilla extract.
Add the dry ingredients, alternating with the banana and milk in small amounts.
Turn into two 9-inch greased pans.
Bake for 30–35 minutes or until a toothpick inserted into cakes comes out clean.
Let the cake cool completely before removing from pans and frosting.
Nutrition Information*: 1 slice (1/16th of the cake) contains 241 Calories, 11.1g Total Fat, 4g Saturated Fat, 21mg Cholesterol, 220mg Sodium, 355.5g Total Carbohydrates, 1.4g Dietary Fiber, 20.3g Total Sugars, 3.2g Protein
*Note that this does not include the nutrition facts of the buttercream frosting
Let us know if this helped reduce your stress by baking it or by eating it. Or both! Join us in the community and tell us your favorite recipe for freeing up your IT brain.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
October is Cybersecurity Awareness Month, and this year’s theme is See Yourself in Cyber, which focuses on the individual’s role in cybersecurity. This month, the JumpCloud blog will focus on helping you empower everyone in your organization to do their part regarding cybersecurity. Tune in throughout the month for more cybersecurity content written specifically for IT professionals and MSPs.
When we think of cyberattacks, we tend to envision the biggest and most disastrous ones — ones that involve well-known companies, expose tons of important data, and cause some serious fallout and public mistrust. While these attacks are real and dangerous, they’re not the only ones out there.
The reality is that cyber attacks affect businesses of all sizes and in all industries. Sometimes, our focus on the big ones can eclipse the less flashy ones that are just as dangerous to small and medium-sized enterprises (SMEs). In fact, a 2021 survey found that over 42% of small business respondents had experienced a cyber attack within the last year.
Mounting a viable defense starts with understanding what you’re up against — and even understanding the basics of common threats and defense measures can go a long way. The following are six of the most common attack vectors that can hit SMEs.
1. Ransomware
Because the largest ransomware attacks tend to dominate news cycles, many people don’t realize that ransomware attacks on SMEs are common as well. In fact, 50-70% of ransomware attacks are aimed at small businesses.
What Ransomware Looks Like for SMEs
Ransomware generally follows the same basic principles in attacks of all sizes: adversaries seize and lock a company’s data or assets and promise to return them upon payment of a ransom. For large enterprises, these ransoms can reach into the millions. For SMEs, they are often smaller — ransoms as low as $10,000 are common. While this may sound like a silver lining for SMEs, there’s a darker motive at play: adversaries know SMEs will pay them.
For established enterprises with decades of built-up resources, six-figure ransoms and the downtime associated with an attack are painful, but not often a death sentence. For SMEs with tighter resources, this isn’t always the case — the downtime and loss of data access alone can be crippling for a tightly-run SME. To adversaries, this means SMEs will fight to get their data back — so they demand a “reasonable” ransom and can expect with near-certainty that the SME will pay it. According to research, more than half of them do.
The Ramifications
The ramifications of a data breach to your employees, customers, partners, and reputation are grave: a Ponemon study found that 65% of consumers whose data was breached lost trust in the company that experienced the breach.
What’s more, paying the ransom doesn’t guarantee that your data hasn’t been compromised or shared when under the adversary’s control. Of the 59% of SMEs who said they had paid a ransom in a survey, only 23% got all their data back.
In fact, paying up can endanger your organization further: it tells hackers that you are willing and able to pay ransoms to reclaim your data. And now that they’re familiar with your defenses and architecture, they’ll have an easier time attacking you again. Unfortunately, repeat attacks are highly likely — either from the same criminal organization, or from another organization that the attackers sold your information to.
2. Supply-Chain Attacks
Most of us are familiar with supply chain attacks, where an infection starts with a large corporation and spreads as it comes into contact with other businesses through the supply chain. And while we’re likely to hear about supply-chain attacks on large businesses, news sources don’t always report on their trickle-down effects on smaller businesses in the supply chain.
How Supply-Chain Attacks Affect SMEs
In supply-chain attacks, SMEs aren’t usually direct targets, but rather casualties resulting from a larger breach. Thus, large supply-chain attacks have ramifications on many of the target organization’s partners, customers, or vendors. In REvil’s attack on Kaseya’s VSA software, for example, many of those impacted were SMEs that used the product. In another example, the famous SolarWinds breach was originally believed to have affected a few dozen organizations. It actually impacted over 250.
3. Phishing and Its Variants
Some of the most basic and low-effort tactics remain common — and effective — infiltration methods. Phishing remains one of the top three threats SMEs face, even despite increasing organizational awareness around it.
The reason phishing is still so common is two-fold:
It is effective for adversaries. From the cybercriminal’s point of view, phishing is relatively easy to deploy, and it often yields lucrative results. It takes few resources and minimal skill to launch phishing attacks, and yet they continue to dupe employees into sharing credentials, network access, and other sensitive (and, for cybercriminals, profitable) information and assets.
It preys on human error. Unlike many other attack vectors that leverage vulnerabilities in systems, phishing uses social engineering to take advantage of human nature (and human error) to gain initial entry. It only takes one mistake to allow an attack to take hold — and the average organization has a 37.9% phishing test fail rate.
Targeted Phishing in SMEs
Cybercriminals have refined tactics to mount more targeted and precise attacks with different types of phishing. Spear-phishing, for example, involves background research to convincingly target individuals rather than bulk-sending a list to a group of recipients. This personalization and specific targeting makes spear-phishing attempts harder to spot — like the popular scam that involves posing as the target’s boss in a text or email. These messages often use conversational language and use the names of the target and the boss, which can make them quite convincing.
Some adversaries take this type of attack a step further with whaling, which uses spear-phishing tactics to target company executives. Because executives have extensive access to systems and data, whaling is particularly popular — especially with SMEs, where scarce resources could hamper their ability to adequately train leaders on security and phishing awareness and best practices.
4. Software Vulnerability Exploits
Leveraging software vulnerabilities is a common way to gain access into an organization’s systems. Often, exploited vulnerabilities are known and even have patches available. In fact, many of the top exploited vulnerabilities were found years ago — for example, a Microsoft Office vulnerability found in 2017 continues to plague businesses that haven’t kept up with their patches. In a Ponemon survey, 60% of respondents who had experienced a breach said it could have occurred through a known vulnerability that had a patch available, but the organization hadn’t applied it.
Why SMEs Are Vulnerable
Routine patching is a critical basic cyber hygiene activity, and it is highly effective at blocking this type of attack. However, large-scale organizations are more likely to have formal patch management solutions in place than SMEs, which can make SMEs an easier target. In a 2022 JumpCloud survey, only about half of SME respondents said they were confident that their organization’s patch management strategy was sufficient to protect against known vulnerabilities.
5. Account Takeover
As businesses move to the cloud and dispersed infrastructure becomes the norm, identity has increasingly come to define the new perimeter. Because identity permeates every element of the infrastructure, it has become a common infiltration point. In fact, the number of password-stealing attacks on SMEs around the world increased by almost 25% from 2021 to 2022, and nearly 80% of attacks leverage identity to compromise credentials.
How ATO Attacks Work
In account takeover (ATO) attacks, adversaries gain access to the network by taking over a user’s account. Account access can be gained through various means, including password-stealing ware, social engineering, and using (often, by purchasing) the credentials of already-breached accounts. Once the adversary has taken over the account, they can access resources and move around the network under the guise of a legitimate user. This makes account takeovers difficult to detect.
6. Advanced Persistent Threats
SMEs that work with large enterprises may be more susceptible to advanced persistent threats (APTs), which are sophisticated attacks carried out stealthily over an extended period of time. APTs typically consist of infiltration, lateral movement toward targeted data or assets, and exfiltration. APTs can start from any ingress point, and can enter through methods as simple as a phishing attack or stolen password.
For example, an adversary could gain the credentials of an employee with base-level permissions through a phishing scam, then take over the account to analyze the network and gather permissions, access and store the target data, and finally exfiltrate it to sell for profit.
APTs are harder to detect in sprawled IT environments, which are common in SMEs that have grown quickly. IT sprawl limits the ability to fully carry telemetry data from one element to another, which makes infiltration and lateral movement hard to detect.
Shoring Up SME Security
Because cybersecurity attacks on SME attacks don’t always make headlines, SMEs often underestimate their vulnerability and underinvest in security. However, adversaries have something to gain from just about any business; SMEs face many of the same threats that enterprises do.
The attacks above are some of the most common, but SMEs face a multitude of threats via many different vectors. And while it’s impossible for anyone to achieve 100% immunity from threats, it’s possible for SMEs to develop a strong, reliable security program that deflects most attacks.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
October is Cybersecurity Awareness Month, and this year’s theme is See Yourself in Cyber, which focuses on the individual’s role in cybersecurity. While cybersecurity can feel complex and inaccessible to the average person, the reality is that everyone has a role to play in security, from executives to the IT team to end users. This month, the JumpCloud blog will focus on helping you empower everyone in your organization to do their part regarding cybersecurity. Tune in throughout the month for more cybersecurity content written specifically for IT professionals and MSPs.
Many organizations spend quite a bit of time onboarding new employees and making sure they have access to everything they need; however, the same care is often lacking when it comes to offboarding. Whether a long-time employee suddenly leaves on bad terms, a contractor is no longer being utilized for some period of time, or an employee goes on leave, improper offboarding or suspension of that user’s permissions and access poses significant risk for your organization.
Offboarding and deactivating a user’s identity can be a manual and time-consuming process, yet it is also very time-sensitive and sometimes requires IT admins to be available at a moment’s notice. Not every employee gives notice prior to leaving, and unforeseeable events can happen that force admins to scramble at the last minute to deprovision that user’s access to company resources.
This process becomes even more difficult if your organization needs to provide access to IT resources for temporary workers like contractors and interns, or has full-time employees that may need to be temporarily offboarded or have their IT resource access suspended rather than be permanently offboarded due to personal events like marriages, births, family care, overcoming an illness or injury, and more.
Most Companies Struggle With Offboarding
Improperly offboarding employees is a dangerous game to play, yet, according to TechRepublic, 48% of organizations said they are aware that former employees still have access to corporate networks. Further, 20% of organizations say they’ve experienced a data breach that’s linked to former employees.
These stats tell us that improperly offboarded employees are a predominant threat to organizations; however, the tools and resources needed to fix this issue aren’t there. The missing link here could be a lack of time, no simple way to quickly offboard or suspend user access to all IT resources, and/or lack of insight into the security risks posed by inadequate processes. It puts a spotlight on the notion that offboarding is as much a security issue as it is an operational one for IT.
Another important finding from TechRepublic is:
Half of IT leaders said that ex-employees’ accounts remain active for longer than a day after their departure, 32% said it takes a week to deactivate an account, and 20% said it takes a month or more. Another 25% said they don’t know how long accounts remain active once the employee has left the company.
These percentages pose a significant problem for the organizations that fit into these stats. It only takes one angry ex-employee, one ex-employee that’s simply being careless with the handling of their credentials, or one employee on leave that still has active access to make damaging changes in some shared resource, even though they weren’t there for the last best practices discussion.
Case Study: Improper Offboarding and Compliance Violations
Here’s a real world example of how improper offboarding of employees and contractors can lead to considerable compliance violations, substantial fines, and the subsequent loss of public trust.
Pagosa Springs Medical Center (PSMC)
In 2018, Pagosa Springs Medical Center found itself at the epicenter of a major HIPAA violation which ended up costing them $111,400 — all because they did not properly offboard a terminated employee.
After their termination, the former PSMC employee retained remote access to PSMC’s web-based scheduling calendar, which contained patients’ electronic protected health information (ePHI). The investigation revealed that PSMC impermissibly disclosed the ePHI of 557 individuals to this former employee.
HIPAA calls out the need for a formal offboarding process under the security rule section – § 164.308(a)(3)(ii)(C): “Implement procedures for terminating access to electronic protected health information when the employment of a workforce member ends.“
HIPAA is just one standard that can easily be violated due to improper offboarding — there are many others out there with similarly severe consequences for non-compliance.
A Quick Offboarding Checklist
Even at organizations where offboarding is seen as a fairly quick process, i.e. less than a couple of hours, the risk of that ex-employee or another bad actor taking advantage of existing access is still prevalent.
TechRepublic also found that 70% of IT decision makers surveyed said it can take up to an hour to deprovision all of a single former employee’s corporate application accounts. Keep in mind, this does not include revoking an employee’s access to their devices and networks.
To combat this and improve your organization’s security posture, it’s helpful to put steps in place that improve offboarding efficiency. One of these steps should include an offboarding checklist to ensure that no loose ends are left after an employee’s de
parture.
Your offboarding checklist should include deactivation of access to:
All applications
Productivity tools:
Ex. Google Workspace and Slack
CRM tools:
Ex. Salesforce and Zoho
Cloud Infrastructure
File shares
Devices
Corporate Networks
VPN
RADIUS
Or, if WiFi access is not centrally managed, periodically refresh the Corporate WPA2 passphrase
And ensure return of equipment
Questions to Consider When Improving Offboarding Workflows:
Does HR inform you in a timely manner when an employee leaves your organization?
If an employee is terminated or leaves abruptly, are you able to deactivate their identity immediately?
Are you able to suspend the identity for contractors who leave the company and may return?
What about employees on medical leave who may return?
Improving Employee Offboarding
Sticking to an offboarding checklist to ensure all access is revoked is extremely important, but what’s just as important is the process in which everything is deactivated. Not only are manual offboarding processes time-consuming, but they also leave a lot of room for human error.
While working to improve and standardize your entire offboarding workflow, we also recommend that you establish routine communication with HR around onboarding and offboarding, as well as find an identity provider (IdP) to streamline the process.
Establish Routine Communication With HR
If you’re not already in continuous communication with HR regarding employees coming and going, you need to establish a better process between departments. HR should let you know when an employee is scheduled to leave or immediately notify IT when someone leaves abruptly. HR should also inform you in advance when an employee is scheduled to return from leave or their contract is renewed.
Though many project management tools exist to help alert internal stakeholders about new tasks, and some HRIS systems can even directly integrate into your core directory service to fully automate this process, this communication can be quickly achieved by creating an email alias or group with select individuals from HR and IT. Whenever someone across the organization alerts HR of a change in employment, they can CC this email alias to give IT the necessary “heads up” they need to act quickly.
Find the Right Identity Provider
When choosing an identity provider, find one that has the following capabilities:
Allows you to automate deactivation of a user’s identity
Once you set the date/time of deactivation, your IdP should take care of the rest
Lets you easily and quickly revoke access to ALL resources
Deactivating a user’s identity should revoke access to applications, devices, networks, and any other resources that user had access to
Simplifies user activation and reactivation
If an employee returns from leave or a contractor’s contract is renewed, you should be able to quickly and easily reactivate their identity in a just few steps
Includes integration capabilities with common HRIS software
Fixing the communication disconnect between HR and IT and implementing the right identity provider will allow you to securely and efficiently revoke access and re-provision access as needed, through just a few clicks.
JumpCloud’s Offboarding and User Suspension Features
Using JumpCloud® as your primary IdP allows you to quickly deprovision user access to virtually all of their IT resources. Our scheduled suspension features allows you to schedule a date and time for user deactivation which revokes access to applications, devices, networks, and any other IT resource their account has permissions for.
If the user in question will be returning, you can use this capability as a temporary suspension, and the user can later be reactivated; what’s more, they’ll receive updated permissions and access to new or changed resources as determined by their associated user, device, and policy groups automatically once reactivated. If the user in question will not be returning, use this feature to schedule their deactivation and then fully remove their account when appropriate (as dictated by compliance regulations or internal policy).
The JumpCloud scheduled user suspension feature simplifies and automates the deactivation workflow for scheduled permanent offboarding, as well as temporary suspension of contractors, freelancers, and employees on leave. This feature lets you revoke access to all resources, not just corporate applications. All of this works together to improve your overall security posture and ensure that your organization remains compliant with relevant standards.
All of this coupled with the fact that JumpCloud integrates with HR software like Workday and Bamboo, as well as provides API-based integration with other tools, provides a seamless onboarding and offboarding experience for IT admins.
Protect your organization from data breaches and compliance violations
This feature can be found within the JumpCloud Admin Console — find it under User Management > Users. Try it for free for up to 10 users and 10 devices by creating a JumpCloud Free account. Enjoy all of the functionality of the JumpCloud Directory Platform, including scheduled user suspension, and see if JumpCloud is the right IdP for your organization!
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
Security-minded system administrators prioritize taking all the necessary measures to safeguard confidential and protected data. The compromise of a device can prove costly if it contains sensitive company information, especially when organizations have compliance requirements. Disk encryption is one of the best ways to mitigate this risk.
Encryption is the process of encoding data. Data is converted from plain text to ciphertext using a special mathematical algorithm that renders the data unreadable unless the encryption key is provided. This key should always remain a secret to the person authorized to access the data.
There are two major types of encryption in a computer: Full Disk Encryption (FDE) and File Level Encryption (FLE).
Full Disk Encryption
In full disk encryption, also known as hard drive encryption, the entire hard drive or volume — including all the files — is protected. During booting, a passphrase or secret key is required to unlock the drive before logging in with your user account credentials.
Implementing FDE guarantees data privacy and security for all the files from unauthorized users or anyone with malicious intent. Learn more about the benefits of FDE, and five reasons you should consider requiring it in your organization.
File Level Encryption
As the name infers, file level encryption happens at the file system level. This type of encryption targets individual files and directories, but not the entire hard disk.
Both full disk encryption and file level encryption can be used simultaneously to achieve a higher level of data protection.
In this tutorial, we will focus on how to enable full disk encryption on Ubuntu 22.04 using LUKS.
What Is Linux Unified Key Setup (LUKS)?
LUKS is a standard hard drive encryption technology for major Linux systems including Ubuntu. It is a platform-independent disk encryption specification and the de facto disk encryption standard for Linux systems.
LUKS was originally developed for Linux systems and is used in nearly all Linux distributions. It is also a popular encryption format for network-attached storage (NAS) devices. It encrypts entire block devices, making it an ideal choice for encrypting SSD, hard disk drives, and even removable drives.
In addition to offering FDE, LUKS allows users to create and run encrypted containers with the same level of protection as LUKS full disk encryption.
With LUKS, disk encryption can be enabled during the installation of an operating system. In fact, full disk encryption is only achieved during the installation of the Ubuntu Desktop operating system. It encrypts all the partitions including swap space, system partitions, and every bit of data stored on the block volume with the exception of the Master Boot Record (MBR).
How to Fully Encrypt Data on Ubuntu 22.04
If you already have a running instance of Ubuntu 22.04 and you want to enable full disk encryption, you’re required to reinstall it. You cannot fully encrypt it once it is installed. You can only encrypt directories or partitions post-installation.
If you forget your encryption passphrase, all your data will be inaccessible. As such, it is recommended to pick one that you can easily remember or store on a password vault or manager. Better yet, if you have used a complex password, you can note it down somewhere and keep it under lock and key.
Additionally, before starting this process, be sure to backup any critical data that could potentially be lost during the reinstallation process.
Getting Started
We will skip the few installation steps on Ubuntu 22.04 and head straight to the “Installation Type” step that requires you to select your preferred disk partition mode.
Two options will be presented. The first one (the default option) is “Erase disk and install Ubuntu” which wipes out all the existing data and automatically partitions the drive. The second option is “Something else” which is used to manually configure the disk partitions yourself. Please note that you will not be able to enable full disk encryption by selecting the second option.
Select the first option: “Erase disk and install Ubuntu” and click the “Advanced features” button as indicated.
Once you click the “Advanced features” button, a pop-up appears. Be sure to select “Use LVM with new Ubuntu installation” and the “Encrypt the new Ubuntu installation for security” options.
Then click “OK.”
Next, assuming you have already backed up any important data, click “Install Now.”
Disk encryption requires a security key in order to access your files each time your device boots. In this step, provide a strong security key or passphrase.
You can also enable a recovery key which enables a user to access the encrypted disk if they forget their password, or if the disk needs to be installed on a new device.
Then click “Install Now.”
On the pop-up dialogue that appears, click “Continue” to write changes to the disk.
From here, continue with the installation process until the end, and finally, reboot the system. Provide the security key that you generated and hit ENTER prior to logging in.
The secret key unlocks your drive thereby granting you access to your system.
From here, you can log in to your new Ubuntu installation by providing your user account’s password and pressing ENTER.
Conclusion
In this guide, we walked you through the implementation of full disk encryption using LUKS on Ubuntu 22.04. FDE provides a robust way to safeguard your data in case of theft or accidental loss of your device.
Encryption is just one approach to ensuring the privacy and safety of your data. Therefore, you should not relax enforcing other data protection measures such as firewalls, identity and access management (IAM), and Zero Trust controls such as multi-factor authentication (MFA).
JumpCloud’s open directory platform is available to easily implement full disk encryption throughout your entire fleet. Pre-built policies make it possible to achieve full disk encryption for Windows and macOS devices, with granular control and visibility for BitLocker.
Linux devices can also be managed and monitored for encryption status. To see how this works, along with a number of other device security and management features, sign up today to get started. JumpCloud is free to use for up to 10 users and 10 devices; we also provide 24×7 in-app support for the first 10 days of use.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
