Imagine if malware got into your computer. In fact, how do you know it isn’t there already? With some help from third-party researchers, we uncovered and analyzed a database of stolen data. It’s big — and the victims likely never knew their files had been stolen.
The discovery of a stolen database
We want to make it clear: we did not purchase this database nor would we condone other parties doing it. A hacker group revealed the database location accidentally. The analysis of the database was conducted in partnership with a third-party company specializing in data breach research. The cloud provider hosting the data was notified so it can be taken down.
1.2 TB database of stolen data
The stolen database contained 1.2 TB of files, cookies, and credentials that came from 3.2 million Windows-based computers. The data was stolen between 2018 and 2020. The database included 2 billion cookies. The analysis revealed that over 400 million, or 22%, of those cookies were still valid at the time when the database was discovered.
We now know that the virus escaped with 6 million files it grabbed from Desktop and Downloads folders. 3 million text files, 900,00 image files, and 600,000+ Word files made up the bulk of the stolen database, but it also contained over 1,000 types of different files.
Screenshots made by the malware reveal that it spread via illegal software (Adobe Photoshop), Windows cracking tools, and pirated games. Moreover, the malware also photographed the user if the device had a webcam.
The dangers of custom malware
Just like with hurricanes, experts love naming dangerous malware. But computer viruses don’t have to have names to be capable of stealing lots of data. The truth is, anyone can get their hands on custom malware. It’s cheap, customizable, and can be found all over the web.
Dark web ads for these viruses uncover even more truth about this market. For instance, anyone can get their own custom malware and even lessons on how to use the stolen data for as little as $100. And custom does mean custom – advertisers promise that they can build a virus to attack virtually any app the buyer needs.
How to stay safe
Based on the feedback from the researchers, it may be impossible to tell whether a file is infected. If the malware is new, no antivirus can recognize it. The only way to stay safe is to follow good cyber hygiene rules:
Web browsers are not good at protecting sensitive data. Use password managers to protect your credentials and auto-fill information.
Malware can’t access encrypted files. Services like NordLocker protect your files both on your computer and the cloud, so malware can’t just grab them.
Some cookies are valid for 90 days, and some don’t expire for an entire year. Make deleting cookies a monthly habit.
Peer-to-peer networks are often used for spreading malware. Only download software from the developer’s website and other well-known sources.
All malware gets recognized eventually. Make sure that your antivirus is always updated to prevent old viruses from slipping through the cracks.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
ScottMaden is a management consulting group that supports Fortune 500 companies. The service provider focuses on two primary business areas: the energy sector and corporate & shared services. With 40-year experience in the industry, ScottMadden provides its clients with strategic planning through implementation across different business fields and functions.
Addressing numerous global clientele challenges represents ScottMadden’s expertise in sophisticated planning. Therefore, how does a company with up to 250 full-time employees throughout the United States and three local East Coast offices face internal security issues? Clinton Miller, IT Director of ScottMadden, shares their story on filling in the missing links in the organization’s cybersecurity strategy.
The Challenge
Securing employees on the go the right way
The company consults domestic and international clients — employees travel quite a bit to client sites and work hands-on on their projects. Hence, a hybrid work model wasn’t the new normal for the organization once the pandemic hit.
ScottMadden consultants spend a lot of time in airports and other public spaces where they would connect to the airport or mobile hotspots and hotel wifi. Yet, the company’s solution wasn’t as good for protecting and running smoothly while traveling.
“The concern was to improve the existing security model and ensure our employees had an encrypted connection regardless of which network they were on.”
Having better performance, following industry best practices, and fulfilling client requirements to protect data outside the office were the driving factors in looking for a change. But is there a solution that can solve the problem effectively and efficiently onboard?
The Solution
Streamlined client drive-out to different environments
The traveling ScottMadden consultants and employees working from home used to rely on browser-based encryption. Using built-in data encoding in Office365 applications allowed them to perform job tasks and communicate with teams with some security levels.
However, the issue was the poor connection flow while video conferencing — latency is a deal breaker for online business meetings in a remote setup.
“Everyone during the pandemic did a lot of video conferencing via Google Meet, Microsoft Teams, or Zoom. We aimed to ensure there was a minimal impact on video calls.”
One thing is handling latency to elevate employees’ and clients’ experience. But can the transition process administratively have a minimal impact on existing company infrastructure and cybersecurity strategy?
“One of the things we wanted to do was to push out the client fairly easily, operating on an SSO solution already in use.”
ScottMadden uses solution Azure AD single sign-on solution for user identification within the organization. The company operates in macOS and Windows environments, so the chosen solution had to fit into the criteria for integration and simplicity.
Why choose NordLayer?
NordLayer solution is compatible with major service providers on the market. Thus, the company could integrate with AzureAD IAM solution and roll out organization-wide onboarding to a new solution using existing SSO.
The endpoint management solution allowed remote access in macOS and Windows environments.
“The implementation of NordLayer went a lot easier when we connected clients to Azure AD. It relieved us from setting up new individual accounts for every 250+ people in the organization.”
The IT Director handled the process — it didn’t require a lot of resources and time to deploy the solution in the organization.
Organization onboarding using Azure AD by ScottMadden
According to Clinton Miller, the IT Director of the company, the longest step was to create an Azure group and add NordLayer. Once it was solved, the complete rollout to NordLayer solution took only a few hours.
The Outcome
Onboarding to a chosen solution enabled the company to secure team connections and extensive access to functionalities that comply with ScottMadden set benchmarks. Achieving data security didn’t have to compromise connection speed and video conferencing quality.
“Anytime employees are outside the office – at home or coffee shop – wherever they might be, we validated that they can reach all the services they needed, and speed wasn’t an issue.”
The t
ransition to the new tool was heavily based on the company’s SSO. The documentation, knowledge base, and support team are highly responsive with communication to walk IT leaders through the process.
“For other potential decision-makers: onboarding NordLayer isn’t a heavy lift — you have the support and knowledge base ready, so it’s pretty straightforward.”
Moreover, NordLayer’s Control Panel provides a good cross-reference point for those using the tool while working outside the office by filtering ongoing active connections.
It also delivers another step in the reporting process for the IT admin and the whole organization. For instance, it verifies that the organization follows internal policies by exporting connection data to verify and justify to a third-party audit.
Pro cybersecurity tips
Different sectors, industries, and services, but the same goal unites every organization’s IT leaders — securing their company assets. Following best practices and professional knowledge helps achieve security targets easier. Clinton Miller, the IT Director at ScottMadden, shares his top-on-the-list tips:
Do you need to upgrade existing tools used in your organization to align with best practices in the industry, improve processes and performance for the team, or expand your capabilities of tracking and reviewing the implemented security strategy?
Using NordLayer, you can integrate more features and functionalities with the organization’s preferred tools, service providers, and IAM solutions. It is possible without committing to massive changes and re-organizing current policies and infrastructure. Reach out to find out about your options on how to secure connections for the off-office employees and improve their experience while working online.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
The consequences of non-compliance can be devastating.
In 2023, businesses have more to fear than just the formal penalties issued by regulatory or legislative entities. With cybercrime rates at a seemingly all-time high, and even once-trusted cybersecurity companies proving susceptible to breaches, organizations are on high alert.
Failing to comply is more than just a compliance issue or an unchecked box. It can represent an unchecked vulnerability that may give way to a data breach that will have your brand name on consumers’ lips for all the wrong reasons.
That’s why we invited two compliance and security experts to speak on the future and state of compliance. Here’s a short recap of the conversation moderated by Gerald Kasulis, VP of business operations at Nord Security, with:
Deena Swatzie, SVP, Cyber Security Strategy and Digital Innovation at Truist,
Joy Bryan, GRC/Privacy Technology Analyst, RNSC Technologies, LLC.
Kasulis asked the panelists astute questions about the implications of adopting tech powered by AI, the current corporate climate, and how businesses can prioritize compliance on a shoestring budget.
Watch the webinar recording in full right now or keep reading to find out three takeaways that will help kickstart or support your compliance agenda this year.
Increasingly savvy consumers will hold businesses accountable
When data breaches happen, usually it’s the consumers who suffer. The consequences range in severity and kind, but whether major or minor, reputational or financial, a violation of one’s privacy through personal data exposure is never a welcome outcome.
As businesses become hyperaware of the likelihood of a data breach, consumers are equally tuned in.
Consumers are getting smarter in that [data privacy] space. They’re going to expect more, they’re going to hold companies accountable. And so that’s why your compliance needs to be in place.
– Joy Bryan
GRC/Privacy Technology Analyst at RNSC Technologies, LLC
Consumers are more likely than ever to want assurances that their personal data will be kept safe as concerns surrounding data privacy become more mainstream. They want to know how their information will be stored and what measures businesses are taking to protect it.
In today’s climate, trust is a linchpin of customer satisfaction. A recent survey revealed that 71% of consumers are unlikely to buy from a company that loses their trust — which is bad news for businesses that have suffered major breaches.
Meeting compliance standards and earning certifications can be a shorthand for establishing (or re-establishing) customers’ confidence: this ensures that businesses are following the agreed-upon best practices in a verifiable way.
At the end of the day, the buck stops with corporations who collect and store personal data. They will be held accountable for their (in)ability to protect the data they keep.
“Consider yourself as the consumer,” says Swatzie. She suggests that businesses should use the golden rule as a framework — treat consumer data as you would hope and expect yours to be treated.
Additional resources may not be the answer
Even when we talk about talent and the workforce, everyone’s immediate response is ‘we need more resources.’ You don’t always necessarily need more resources.
– Deena Swatzie
SVP, Cyber Security Strategy and Digital Innovation at Truist
Swatzie explained that it’s important to understand what exactly is required to meet compliance standards so that you can balance what you have with what you need. Here, collaboration between teams is key. Security and compliance initiatives will overlap.
Both experts agree that it’s best to start by looking at in-house tech and talent before making an investment. And on the occasion when you do require an additional resource, like software, be sure that you’re adopting tools that serve multiple functions.
I think that whatever platforms and technologies are implemented should have a collaborative feel — where you’re tackling multiple things at once.
– Joy Bryan
GRC/Privacy Technology Analyst at RNSC Technologies, LLC
NordPass Business, for instance, delivers so much more than password management. Get a powerful data breach scanner, password health metrics, a detailed activity log, company-wide advanced security settings, and multi-factor authentication.
On the topic of breaches, take solace in NordPass’ zero-knowledge architecture which ensures that only you hold the key to your business credentials and vault items. In the unlikely event of a breach at NordPass, your private information will remain encrypted and out of reach to cybercriminals.
New investments in tech solutions should add value to what many teams are likely to prioritize the most: workflow efficiency. Consider how and whether security and compliance tools speak to that need.
Get into the nitty gritty. Take the time to consider your existing and prospective tools’ full scope to avoid overinvesting in overlapping functions.
According to Swatzie, “Privacy is everybody’s responsibility. Security is everybody’s responsibility. Compliance is everyone’s responsibility.” For that reason, it’s important not to take buy-in for granted with a top-down approach.
Ask yourself: will my team be open to adopting this policy or software? Does it promote or detract from their respective top priorities?
The word of the day is “proactive”
If we had to summarize the experts’ advice in just two words: be proactive. Specifically, on the topic of lessons learned from a turbulent 2022:
I would hope that in terms of lessons learned, it allows businesses to be a little bit more proactive in their approach and in their strategies.
– Joy Bryan
GRC/Privacy Technology Analyst at RNSC Technologies, LLC
If your compliance and security strategy is only reactive, then it shows a lack of forward-thinking, meaning you’re likely to be continuously caught off guard and lagging behind. Swatzie suggests that compliance professionals and business leaders “put on their auditor hat.”
I’m used to being heavily regulated and audited so I’ve learned enough from the auditors to know exactly what they’re going to ask me before they ask me. So going back to what Joy said earlier, be as proactive as possible.
– Deena Swatzie
SVP, Cyber Security Strategy and Digital Innovation at Truist
Where possible, brace your business for what’s likely to come down the compliance pipeline by studying the standards themselves. With an intimate understanding of the “spirit of the law” you should be able to intuit what’s next and prepare accordingly.
That being said, it’s not a lack of motivation that leaves security and compliance professionals in a reactive position. When it comes to cyber incidents, board and senior leadership members sometimes struggle to see prevention as the cure — waiting until after an event has occurred to implement more stringent security measures.
To learn more about how to get buy-in from colleagues and management before the fact, read our guide on how to campaign internally for cybersecurity.
Summary
Facing increasingly savvy and appropriately demanding consumers, businesses should understand that they will be held accountable for breaches of personal data and plan accordingly.
But, that doesn’t necessarily mean rushing to acquire additional talent and technological resources. Invest wisely and make it count. In particular, security software should be multi-functional.
Finally, the key to success is in forward-thinking. Adopt a proactive strategy to avoid a constant scramble to respond after-the-fact.
About NordPass NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Nord Security The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
The lines are blurred in the modern business lifestyle. There’re no boundaries between employees working from the office or anywhere in the world. And technological privilege enables linking personal devices to work applications for user and organization convenience.
This flexibility and ability to be mobile also mean that business matters simultaneously mix with personal activities online. And mobility is not alone to blame — the internet is often a necessary tool to perform job tasks and operate in different organization layers. Uncontrolled access to the internet provides vast resources incompatible with the work environment. How to manage what employees can do online without imposing risks on the company?
Deep Packet Inspection (DPI) is one of the most straightforward tools that limit free roaming online while connected to the company network. Establishing a set of restrictions helps create a secure perimeter for online activities within the company network.
It’s an important feature that supports performance and security efforts. Non-work-related activities can distract and reduce productivity. Moreover, entering various websites and apps can lure employees into malicious activities, so DPI is a choice for IT administrators to get a grip on the company’s traffic flow.
DPI solution using NordLayer
NordLayer solution offers a DPI Lite feature that allows IT administrators to control what user-requested data goes through or gets blocked from entering the company’s network.
The DPI Lite technology at NordLayer works on nDPI open-source protocol classification engine. It offers the most popular and acknowledged services (ports and protocols) that are used by websites and network apps to operate on the internet.
With NordLayer, admins choose specific ports and protocols they want to include in the custom-defined block list. The policy applies only when a user is connected to the organization’s virtual private gateway. Thus, employees who work on job-related projects can’t simultaneously use blocklisted online resources and network applications with restricted access.
How does NordLayer’s DPI Lite feature work?
The cloud-based feature is available only with a virtual private gateway configuration. It’s set to active within 24 hours upon request. IT admins can add or remove specific ports and protocols open to access through the company’s network. They can do it by submitting an inquiry via NordLayer’s Control Panel.
The IT administrators can navigate and choose from a wide range of alphabetically arranged services (no slot restriction) that cover dual-use online resources, potentially harmful to business operations:
Apple services
Domain Name System
E-commerce
Email client protocol/Email services
File sharing
Gaming
Google services
Hypertext Transfer Protocol
Identity
Infrastructure/Networking
IP tunneling protocol
Messaging protocol/services
Microsoft services
Monitoring/SCIM
Music streaming services
News services
Peer-to-peer file sharing
Remote Access
Social media
Software Development
Streaming services
VoIP protocol
VPN services
Other (miscellaneous)
Our internal data shows the tendency to stop services primarily related to unapproved Peer-to-peer file sharing, Social media, and Gaming categories. It comes as no surprise that customers are particularly interested in limiting access to non-work-related services that impose the biggest risks to company assets and staff performance.
However, if an employee needs access to company-level blocked sources, for example, a Social Media Manager working on Facebook and LinkedIn, IT administrators can purchase a separate dedicated Virtual Private Gateway for such employees and configure it with fewer restrictions.
The categories expand to a complete list of 250 available ports and protocols. You can choose only certain types of services, like blocking all messaging services except Slack, used for organizational communication.
NordLayer’s DPI Lite feature is managed only by the IT administrator and doesn’t have an ON/OFF function on the user side. The feature operates on the Application layer (OSI model Level 7) and Browser layer (OSI model Level 3). It means DPI inspects incoming data on the web and within network apps.
Enabled DPI Lite runs when the user, connected to the company’s virtual private network (or VPN), sends a request to access online resources or uses network-dependent applications. Once disconnected from the organizational network, the DPI policy isn’t active. Thus, it’s crucial to permit access to internal resources and applications only when they are connected to the network.
The incoming data is screened and filtered using the nDPI engine against the DPI Policy defined by the company’s IT administrator. The user is connected to a requested website if traveling data packets don’t include blocked services.
However, the connection to the requested online resource is restricted if there is a match between the data packet and the DPI block list policy.
How NordLayer’s DPI Lite is different?
Some solutions allow DPI to incorporate extensive categories and be customizable for every client’s preferences to restrict content online. However, a more complex approach may lead to excessive expenses. It may also require challenging configuration and become limiting to the company’s disadvantage.
Extensive data processing defined with all types of possible keywords can disrupt the connection flow and block access to online resources that initially weren’t intended to be restricted. On the other hand, if the company is set for hardware infrastructure and decides to continue with the same type of DPI technology, it will need to know how to configure and perform in-house maintenance. All these additional steps create an unnecessary workload for IT administrators.
To streamline the DPI implementation to the company infrastructure, NordLayer incorporates an easy-to-launch and control DPI Lite feature. It is cloud-native and easy to add or remove without investing in excessive resources. Its activation takes short notice and can be managed centrally, enabling flexibility and focus to the teams and operations:
Keep productivity on point. NordLayer’s DPI Lite feature encloses the company network with work-only online resources within employees’ reach. Leave no space for distractions, so teams are less likely to spend time on their personal activities and decrease the chances of human error.
Establish security levels. Entering unsecured websites or downloading data to work-linked endpoints can become a freeway for malicious actors accessing internal data and resources. DPI Lite can help filter out hidden remote computer access and control software planted by cybercriminals.
Quick implementation and adoption. DPI Lite, like all the other NordLayer features, is entirely cloud-based and thus simple to integrate into existing infrastructure. Besides short enablement time, it is compatible with other data processing features like DNS filtering by category, constructing a more robust organization security posture.
Easy to adhere to business needs. The categories or services of DPI Lite are simple to manage. A complete list or a few exceptions can be added or removed from the DPI Policy as required to suit the company’s service scope.
NordLayer offers a packet inspection solution that doesn’t overwhelm network security strategy and focuses on the most common business pain points. A well-sifted service list doesn’t leave space to overthink data to block or spend time researching what online resources to consider, so no openings are left. Overall, DPI Lite helps organizations handle their teams’ efficiency and activity while at work.
Benefits of DPI Lite
Establishing limits for online activity while working is like a reminder to focus on your tasks. But it’s not just about preventing employees from distractions using company gateways.
Adding DPI Lite as an additional security measure fortifies network security and advances business performance in different ways.
Prevent data leaking
Whether intentional or accidental, data leaks are damaging to businesses. DPI Lite adds to security measures by restricting the download of data-leaking apps or the usage of data-sharing and emailing services. Suppose employees try to send files from the company network via Dropbox or Google Drive. In that case, DPI Lite will recognize data packets containing related ports, protocols, and headers and will stop the action from completing the request.
Eliminate traffic overload
Online activities create traffic on network gateways: the more requests, the more overloaded infrastructure, ultimately resulting in performance issues. DPI Lite implementation to the virtual private gateways helps limit created traffic as users cannot access online resources. Online streaming and seeding services or visual-heavy social media increase network usage a few folds. Hence, with DPI blocking, fewer data packets must be inspected and unclog the network. Out of user sight, out of admin mind.
Protect static IP addresses
Unrestricted internet usage could create convenient conditions for employees to hide behind company IP addresses to perform illegal activities. For exampl
e, using torrents on a work network can result in copyright holders initiating blocked IP addresses or even legal prosecution for piracy on the organizational level.
With open internet access, scam attempts have a free pass. If law enforcement authorities identify IP during their investigation of a crime done by your employee from the company’s IP address, it might lead to the company’s liability and even hardware confiscation. Hence, whether the network is managed internally or via a vendor like Internet Service Provider (ISP), deep packet inspection as an additional security measure can help establish internal online activity limits to prevent any illicit acts from happening under the company name.
Entering NordLayer’s DPI Lite
Organization-first mindset while at work or dealing with company-related content can be seen as restricting user activity. Although it’s a strong push toward cybersecurity strategy implementation, preventing possible gaps and openings.
Deep packet inspection is part of the bigger picture when combined with other NordLayer security features like DNS filtering by category, ThreatBlock, and Jailbroken/rooted device detection. Enforcing our remote network access solution into your company infrastructure and activating the DPI Lite feature is a matter of a couple of days or less. Organization administrators need to access NordLayer Control Panel, navigate to Servers or Gateways under the Network tab, and configure it by selecting Deep Packet Inspection (Lite) categories as required.
Utilizing simple and affordable tools like NordLayer’s DPI Lite doesn’t overcomplicate the existing cybersecurity strategy and upgrades team productivity, network performance, and company security for better business performance.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
Microsoft Azure is a dominant cloud hosting platform, serving around 70 percent of organizations worldwide. A popular hosting environment for SQL databases, Azure also provides a flexible way to run up to 200 cloud applications.
This flexibility is a game-changer for many businesses. But there’s a catch. To function properly, it’s essential to create a secure Azure environment. Otherwise, cloud apps and databases can leak sensitive data. Credentials may be at risk, and companies can suffer huge compliance penalties.
Fortunately, solutions exist. This blog will explain how to secure your cloud environment with Azure security best practices. And we will look at how to create a layered security strategy that goes beyond Microsoft’s controls.
Why is securing access to Azure so important?
Azure security matters because Microsoft’s cloud platform hosts a range of critical assets. Companies use Azure to host .Net apps for web applications or gaming DevOps. Azure storage accounts host SQL databases containing client data, while Kubernetes clusters support private cloud infrastructure.
Whatever Azure services companies rely on, security is a priority. Insecure Azure apps can leak data and provide an entry point for cyber attackers. And you cannot rely on Microsoft to cover every security challenge.
Azure clients have wide areas of responsibility to secure their cloud configuration. Clients need to restrict access to sensitive data. Users must manage access and exclude malicious actors. They also have to manage how data flows between cloud apps. The need for an Azure security policy is obvious when you put these tasks together.
Microsoft Azure security best practices
Any companies that rely on Microsoft’s cloud services should get to know Azure security best practices.
The best approach is adopting a layered strategy. Users should exploit security tools provided by Microsoft. But they should add additional security controls where necessary. These Azure security best practices will explain how the layered security approach works.
1. Map Azure assets and create a compliance strategy
The first step in layering Azure security is understanding the cloud environment. Before applying any of the best practices below, you must understand what assets need to be protected.
Map the cloud assets on your Azure platform. Include all apps and data stores, and classify data according to importance. You should know exactly where client data is stored and who has access to that data.
It is also advisable to create a clear compliance strategy for Azure environments. Define your core goals, including HIPAA, DCI-PSS, or GDPR compliance. Use these data security frameworks as a baseline to improve Azure security and meet regulatory requirements.
Track your compliance progress with the scoring tools in the Azure Security Center. The compliance dashboard provides detailed information about security levels and required actions.
2. Encrypt critical data
Data security on Azure apps is the responsibility of clients, not Microsoft. So take action to encrypt data and hide it from malicious actors.
Encrypt sensitive data at rest using Microsoft’s server-side symmetric key encryption tools. You can use these tools to segment data by importance. This ensures that operational data is available to employees. But financial or personal information is only accessible to users with specific encryption keys.
Azure Disk Encryption works alongside Microsoft’s SSE. It creates another layer of data security for virtual machines and data containers. This reduces the risk of attackers exploiting Virtual Hard Disk (VHD) files. Attackers will find it much harder to create virtual machines within Azure environments.
When you apply Azure encryption, key storage is your responsibility. Secure encryption keys in IAM controls in place to prevent unauthorized access. The Azure Key Vault is a good key management solution and integrates well with Azure app environments.
Users should also encrypt sensitive data in transit. Data constantly flows between Azure apps, remote devices, and on-premises workstations. VPN encryption provides a solution, adding another layer of protection above Azure security controls.
3. Create a backup and disaster recovery plan
A strong Azure security posture features a fall-back plan when systems fail, or attackers succeed. Microsoft offers an end-to-end DR service via Azure Site Recovery (ASR). Combine this with Azure Backup to create tailored data backup plans.
With an ASR failover plan, you can recover application states with minimal information loss. You might also add Azure Storage Replication, which regularly generates multiple copies of important files.
4. Secure sensitive data with robust controls
Encryption is not the only data security control for Azure users. Consider a range of additional tools and find a mix that secures sensitive data without compromising user experience. Options to think about include:
Activate auditing tools. Users can instruct Azure to audit databases. This creates a data stream that tracks database changes. Data visibility makes it easier for security teams to detect anomalies and unsafe user activity.
Add Azure SQL threat detection. Many Azure apps rely on SQL, but SQL presents critical security threats. Using SQL databases, turn on SQL threat detection to isolate security weaknesses and secure the threat surface.
Use Azure Firewall. Azure Firewall adds another layer of data security protection for Azure-hosted apps. You can manage firewall settings centrally, and coverage can increase as new apps come online. Cloud-native TLS inspection provides valuable protection against malware attacks.
Enable Azure Monitor alerts. Gain additional awareness by engaging Azure Monitor alerts. Users can target alerts at single resources and use many metrics to identify vulnerabilities. Azure Monitor Action Groups make it easy to automate alerts and deliver precise information when threats arise.
Implement Azure Defender. Defender is a subscription-based security service that leverages extended threat detection and response (XDR) and contextual security. It covers hybrid and multi-cloud environments, delivering threat protection and remediation advice. Azure Defender may well be a sensible addition when securing complex cloud environments,
Use Shared Access Signatures. Created via Active Directory, Shared Access Signatures let you manage access to Azure resources to third parties and employees for limited periods. Best practices include creating a SAS for all short-term network users, as it allows admins to set granular controls.
5. Manage access with IAM
Preventing illegitimate access to cloud infrastructure is one of the most important Azure security best practices. The best way to manage user access is by adding Identity and Access Management (IAM) to your security arsenal.
Microsoft provides a cloud-native IAM system called Azure Active Directory (AAD). AAD authenticates logins and compares user credentials to a secure Active Directory database.
IAM best practices for Azure include using AAD to set role-based access controls (RBAC). With RBAC, admins can put the Zero Trust ‘principle of least privilege’ into action. Every user has very limited privileges. Privileges only apply after users supply multiple credentials.
Role-based privileges have big practical benefits. Developers will not retain access to resources when their project involvement ends. Attackers obtaining their credentials will be relatively powerless. They will struggle to achieve Virtual Machine access. Breaching Azure SQL databases will be much harder.
Add another layer to your security posture by combining AAD with Single-Sign-On (SSO). SSO combines all cloud and on-premises assets. Remote workers can log in to the apps they need via a single sign-on portal.
Users can apply Multi-Factor Authentication (MFA) at this stage. This requests an extra authentication factor for each login, such as biometric data or one-time codes delivered to smartphones.
IP allowlisting also features in recommended Azure security best practices. Allowlisting lets you specify trusted IP addresses. You can add remote work devices or employee smartphones and exclude every other device until it passes MFA and IAM controls.
6. Add workload and VM protection
Azure security best practices include securing virtual machines via specialist controls. For instance, Azure includes the option of applying just-in-time controls for VMs. These Azure security controls allow users to access VMs for limited periods, removing the possibility of accessing assets after sessions expire.
VM controls also allow administrators to lock vulnerable ports and limit access to authorized users. Restrict access to RDP, WinRM, and SSH ports commonly used by VMs. Access should only be available when absolutely required.
You can apply controls easily by assigning workloads and VMs to Network Security Groups (NSGs). These groups define security procedures for each asset and add another protective layer via the Azure Firewall.
Additionally, remember to keep workload patches up to date. Unpatched Azure apps can be vulnerable to exploits. Automate software updates where possible and audit unpatched tools to minimize your exploit vulnerability.
7. Control the cloud perimeter with network security
Internal Azure cloud security works alongside general network security. Attackers can steal credentials from devices outside the cloud or launch attacks via internet-facing endpoints. This is why Azure’s best practices include measures to harden on-premises security. These measures can protect the whole network perimeter:
Track internet-facing cloud endpoints and minimize the contact between the wider web and company resources.
Use a Security Information and Event Management solution. SIEM tracks network traffic and identifies potential threats. Integrate it with Azure Defender to cover external and cloud-based vulnerabilities.
Apply network segmentation. Separate cloud endpoints from data centers and workstations with internet access.
Install a VPN or similar security tool to encrypt data and conceal user identities.
8. Audit user identities and access policies
Your Azure cloud security posture can weaken over time. What works now may degrade and create new vulnerabilities.
Azure security teams must audit every cloud security control and ensure continuing app and data protection. Audit app ownership regularly to ensure only active users have administrative privileges. Clean up Azure platforms by removing obsolete services, groups, and users.
Use the Azure Security Center to improve auditing procedures. The ASC includes machine learning analysis tools that provide feedback and suggest security posture improvements. Real-time monitoring and audit logs provide evidence to fine-tune your security setup.
How can NordLayer secure your access to Microsoft Azure?
Microsoft Azure cloud security requires a layered mix of internal cloud-based controls and solid external security. Users must protect data at the app level, followed by workgroups, platforms, and the entire company network.
The best practices listed above provide a roadmap to achieve security at the cloud level. Encrypt data and manage Active Directory identities. Leverage the Security Center to track user activity and run regular audits. And target virtual machines and apps with specific protection.
But that’s not enough. Add an extra security layer for rock-solid SaaS access control by safeguarding the network edge and protecting credentials outside the cloud.
NordLayer will help you achieve this. Encrypt in-transit data, apply for SSO, and screen access with IP allowlisting. Limit access to trusted IP addresses and exclude everything else – an important step towards a Zero Trust security posture.
Prevent data leaks by blending NordLayer’s network security tools with Microsoft Azure’s internal controls. To find out more, get in touch with our team today.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
You lightly place your thumb at the bottom of your phone screen and, lo and behold, it’s unlocked instantly. So why can’t we do the same at the bank or when logging in to Twitter or YouTube? Well, soon we’ll be able to do it all. The passwordless future is inevitable and it’s almost here.
At NordPass, we’re thrilled to be creating a passwordless future. But what is passwordless authentication? How does it work? Let’s answer these questions.
Why should we consider going passwordless?
Year after year, we see either “123456” or “password” top our Most Common Passwords List. Millions of people reuse absurdly simple passwords across multiple platforms, even though they are very easy to crack by using a dictionary or brute force attacks. It makes passwords (and the people using them) one of the weakest links security-wise in any company or service.
Weak passwords are just part of the problem. The way we treat passwords is an issue as well. One of the worst password sins that all of us can attest to is reusing passwords. Having a single password to secure multiple accounts is a huge security risk, to put it mildly. In such instances, a single compromised account indicates that all of user’s accounts are essentially compromised as well.
The solution lies in biometric authentication and passkeys, which combined become one of the safest and smoothest passwordless authentication options available.
Passkeys: The key to passwordless authentication
In an age where technology usage continues to rise, the need for secure and efficient authentication methods becomes all the more pressing. Passwords, which have long reigned supreme as a solution for securing online accounts, have over time proven to be unreliable and susceptible to hacking. In turn, many organizations and companies have been looking for new, more efficient, and robust ways to authenticate users.
One organization at the forefront of the effort to go passwordless is the FIDO Alliance. The alliance works with various companies, including NordPass, to develop and promote open standards for passwordless authentication.
According to the FIDO Alliance, the technology set to replace passwords is passkeys. Passkeys are digital credentials that are generated by the user’s device. Usually used in combination with biometric data, such as a fingerprint or facial recognition, to offer an extra layer of security, passkeys provide access to websites and other online services.
What passkeys bring to the table
One of the major advantages of passkeys is that the private key, which is used to generate the passkey, never leaves the user’s device. This makes it almost impossible for attackers to gain access to the key through phishing or other forms of cyberattack. Furthermore, passkeys are almost impossible to hack, making them more secure overall.
Unlike traditional passwords, passkeys are invisible to the user and are never revealed or entered manually.
Going passwordless will also improve user experience. A fingerprint scanner, for example, is a fast and reliable authentication method. It would also mean that there would be no more password reset procedures — IT departments throughout the world will be very grateful. Also, when it comes to biometric authentication, you don’t need to remember anything. You won’t have any Post-its on the computer screen or notes in your planner. You can’t lose, steal, or forget your fingerprint.
Room for improvement for current passkey-based authentication
Right now, passwordless authentication is gaining major traction among such tech giants as Microsoft, Apple, and Google. All of these companies have been introducing passwordless authentication solutions, and in most instances the solutions include the use of passkeys.
However, current passkey-based solutions have a long way to go. At the moment, these solutions limit users to a single ecosystem, which makes it difficult to share them between, say, an Android user and an iOS user. In addition, the current solutions do not offer any kind of sync with password managers.
But this is where NordPass comes into play. We are currently working on integrating passkeys into your favorite password manager.
Introducing passwordless authentication to NordPass
At NordPass, we’re excited to be at the forefront of the passwordless revolution. And by early 2023, NordPass is set to introduce passwordless authentication both for individuals and businesses.
Passwordless access to NordPass
We are currently working on enabling a passwordless sign-in to NordPass. It will be a faster and simpler process than the one now, since it will require a single biometric confirmation. In simple language, this means that you will be able to access your Nord Account and NordPass with a single tap of a finger. You read it right. No more manually entering your Nord Account and Master Password each time you need to log in. Passwordless access to NordPass is set to significantly improve user experience and overall security.
NordPass passkey storage
All NordPass users will have the ability to save passkeys for any website or app in the encrypted vault and use them to access those online services later. With NordPass, you’ll be able to use, share, and sync passkeys between multiple devices and platforms, whereas many passwordless authentication solutions tend to lack such functionalities. This will make NordPass a single place for all of your digital valuables, including passwords, passkeys, credit cards, and other sensitive information.
Passwordless multi-factor authentication (MFA) for businesses
Password-based authentication is still the industry standard. However, due to the inherent vulnerabilities that come with password-based authentication, most businesses face a variety of cybersecurity risks. To significantly reduce the risk of suffering a phishing or an account takeover attack, businesses need to rethink their security approach with regard to access to endpoint devices such as laptops, desktops, workstations, and mobile devices as well as applications that leverage regular passwords or even single sign-on solutions.
With the introduction of passwordless MFA, we’re looking to help businesses improve their overall security stance by eliminating the need for passwords and introducing an authentication method based solely on biometrics.
Passkey integration for online service providers
The world is already moving rapidly towards a passwordless future. Unfortunately, not everyone can adapt smoothly and efficiently. Many small to medium-sized businesses (SMBs) lack the resources and know-how to implement passkey authentication for their users. However, at NordPass we’re ready to leverage our security expertise to make the transition from passwords to passkeys as smooth as possible. We believe that the frictionless user experience offered by passkeys across multiple platforms and devices, combined with superior security, will help your business increase conversion rates, user engagement, and user satisfaction.
You can expect big things as early as 2023. So stay tuned, and be prepared for the inevitable passwordless future – it’s just around the corner.
About NordPass NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Nord Security The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
You’re dozing off to one of your favorite shows on Netflix, and suddenly a notification flashes on your phone. You look down and see a weird message: “Someone signed into your Netflix account at 03:23 in Nigeria.” Odd, because you were asleep at that time – and certainly haven’t been to Nigeria before. Looks like it’s time to change your Netflix password.
Whether you have forgotten your password, want to wrangle Netflix away from your ex-spouse, or just want to update your passwords, this guide will tell you how to easily change your Netflix password.
How to change your Netflix password on desktop
Fortunately, Netflix foresaw the need for expediency when it comes to changing your password – the process is quick and straightforward.
Open up your browser and go to the Netflix login page. Once you’ve logged in, bring your mouse to hover over your profile picture in the top right corner. Click on “Account.”
The first thing you’ll see is a section marked “Membership and billing.” On the right-hand side of this section are a few hyperlinked options. Click on the “Change password” link.
You’re now on the page where you can reset your password. Before you do, check out our password generator to craft the perfect password that will be extremely difficult to crack.
There you have it — your Netflix password is now changed. Remember that you’ll need to re-enter this new password on whatever devices your Netflix account is connected to.
How to change your Netflix password on mobile devices
Open the Netflix app on your mobile device and log in to your account.
Tap the profile icon located in the upper-left corner of the screen and select “Account.” If you are using a tablet, tap “More” at the bottom of the screen and select “Account” there.
Now tap “Change password.”
Now enter your current and new passwords.
Tap “Save” to confirm. The changes should take effect immediately.
How can you reset your Netflix password?
If you have forgotten your Netflix password, the only way to regain access to your account is by resetting your passwords. Here’s a quick guide on how to reset your Netflix password:
Visit the “Sign in” page and select “Need help?” which is located below the “Sign in” button.
Choose “Email” and enter your email address. Click “Email me.”
You will receive an email from Netflix with instructions on how to reset your password and create a new one.
You can also choose the “Text message” (SMS) option. Simply enter your phone number and select “Text me.”
You will receive a text message from Netflix with instructions on how to reset your password and create a new one.
If it’s been years since you last had to reset your password, don’t worry: all hope is not lost yet! In the above image, you can see the option at the bottom that says “I don’t remember my email or phone.” Click on it.
Now, you can enter your personal and payment details to reset your password. Netflix’s UI is intuitive enough to make resetting the details of your account effortless. Just follow the on-screen instructions, and you’ll have a new password in no time.
Invest in a password manager
This is the most guaranteed way to never have to worry about your passwords again. NordPass can automatically generate top-tier strength passwords, store them in an encrypted vault, and then autofill them to whichever account it’s associated with. The unnecessary hassle of memorizing and creating passwords will be a thing of the past. With NordPass, online life is smoother and safer.
About NordPass NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Nord Security The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
So what’s the deal with password sharing? Would you give your partner the password to your banking account but not your phone? Is laying all your codes on the table a sign of trust or a massive security risk? Should couples share passwords at all? While it can help to build trust with a partner, sharing your passwords isn’t always the best idea.
We are asking some basic questions on a very touchy subject just to help keep your security tip top. Don’t worry — we’re not judging your loving relationship. We just believe in safety precautions no matter what, and you will too once you get a dose of reality from these not-so-lovely situations.
It’s all about how you share them
Sometimes the risk isn’t who you share your password with, but how you do it. Sharing your passwords over the internet, whether over unencrypted email or messaging apps, is like sharing them in plain view of the world. The next time you think about doing this, remember that any of the following situations can take hold (without you even knowing).
Your messaging app may not be as honest as you think. A messaging app without end-to-end encryption has full access to everything you send. End-to-end encryption means that the only person who can read your message is the person you send it to. Sounds like a given, right? Not when you consider the genuine possibility that your messaging app could be giving employees access to your private conversations.
Man-in-the-middle attacks. It’s true, attackers lurk in the middle of an exchange waiting to steal vital information, like passwords, credit card numbers, addresses… you name it. Without end-to-end encryption and zero-knowledge architecture, your credentials could be exposed, and a cybercriminal could be in and out of your bank account within seconds.
The easy way to share passwords securely
Looking at the potential risks that one might face when trying to share passwords online, it is quite natural to question whether couples should share passwords at all and is it worth the risk? The good news is that there’s a way to share passwords securely.
Obviously, the best defense is encryption. A messaging service or website using end-to-end encryption makes sure your data is kept safe from attackers. Password managers like NordPass help you store and share your passwords in a completely secure way.
With NordPass, encryption happens on your device, scrambling your data into gibberish before it even reaches the servers. This way everything you send remains locked, even from us – until it reaches your verified recipient.
NordPass Family is a great way for couples, families, or even groups of friends to further improve their online security. The Family plan comes with six Premium accounts and includes all the advanced security features. Best of all — you’ll be able to share passwords with other NordPass users instantly and effortlessly without sacrificing security.
The takeaway
Matters of the heart aside, always think twice before you send a password by text or messaging apps. Even if the service offers encryption, subpar ciphers and weak protocols can be broken by even a mediocre cyberattacker.
Sending a password securely with NordPass is easy. It locks your sensitive credentials in an encrypted vault. You can select them from a simple drop-down list and send in complete confidence.
The internet’s primary concern and priority is functionality. Your security and privacy probably aren’t. Don’t risk all of your accounts over something as small as sending a password.
About NordPass NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Nord Security The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
We’ve waved bye-bye to some pesky bugs and have also spruced up the place a touch – enjoy!
NordPass 4.36
We’re starting off 2023 on the right foot with a release that’s faster and more reliable. Stay tuned for some bigger announcements!
NordPass 4.35
No major updates this time, just a new and improved app release with some under-the-hood performance upgrades – enjoy!
NordPass 4.34
We’re happy to present you with a new release. Here’s what we’ve got this time:
DESIGN CHANGES TO ITEMS. We updated how your item details are displayed. Hope you’ll like it.
NordPass 4.33
Building good things takes time. So since the last release, we have mainly focused on catching and eliminating pesky bugs.
NordPass 4.32
This time we’ve waved bye-bye to some pesky bugs and have also spruced up the place a touch – enjoy.
NordPass 4.31
We’re happy to present you with a new release. Here’s what we’ve got this time:
AUTOFILL DISABLEMENT ON WEBSITES. You can now disable autofill on any page that you don’t want to fill your details. It won’t reset when you refresh the page but you can turn it back on at any time.
BUG FIXES.
NordPass 4.30
Here’s what you’ll see in the new NordPass release:
ONBOARDING UPDATE. New users will be greeted by a refreshed onboarding experience that will help them familiarize themselves with NordPass.
NordPass 4.29
No major updates this time, just a new and improved app release with some under-the-hood performance upgrades – enjoy!
NordPass 4.28
Building good things takes time. So since the last release, we have mainly focused on catching and eliminating pesky bugs.
NordPass 4.27
This time we’ve waved bye-bye to some pesky bugs and have also spruced up the place a touch – enjoy!
NordPass 4.26
No big announcements from us this time. However, we hope you’ll still enjoy an updated NordPass version with fewer bugs and better autofill.
NordPass 4.25
Our bug busters have been working hard since the last time you heard from us. That’s why today we can proudly present another NordPass release with even fewer bugs. We hope you’ll like it.
NordPass 4.24
Building good things takes time. So since the last release, we have mainly focused on catching and eliminating pesky bugs.
NordPass 4.23
We’re happy to present you with a new NordPass release. Here’s what we’ve got this time:
UPDATED PASSWORD INFO. Now you’ll get more guidance on making your passwords more secure. Open any of your passwords, and you’ll see whether it’s been reused on other accounts or it’s too old and needs changing.
BUG FIXES. Rome wasn’t built in a day. Therefore, we continuously aim to catch pesky bugs and provide you with the best password management experience.
NordPass 4.22
Here’s what you’ll see in the new NordPass release:
SWITCH ACCOUNT. A long-awaited feature is here! If you have a few NordPass accounts, like personal and business, switching between them will now be a breeze. Just click on your profile account and look for a “Switch Account” button.
LITHUANIAN LANGUAGE. For our Lithuanian friends out there, you can now use NordPass in your mother tongue. Simply head to Settings to change the language.
BUG FIXES.
NordPass 4.21
Our bug busters have been working hard since the last time you heard from us. That’s why today we can proudly present another NordPass release with even fewer bugs. We hope you’ll like it.
NordPass 4.20
We’re happy to present you with a new NordPass release. Here’s what we’ve got this week:
CARD PIN. From now on, you can also add your PIN when saving card details. Don’t worry; it won’t be autofilled. It’s for your reference only.
DELETE CLIPBOARD SETTING. When you copy your password or other item data, it’s normally saved in the clipboard. To avoid pasting it somewhere you didn’t intend; you can now choose the clipboard to clear after a set time.
BUG FIXES.
NordPass 4.19
It’s international women’s day! So we want to take this opportunity and say thank you to all the beautiful women who tirelessly work at NordPass. It wouldn’t be the same without you.
P.S. We mainly focused on fixing bugs this time, so we hope you like a better running app.
NordPass 4.18
Here’s what you’ll see in the new NordPass release:
SUBDOMAIN SORTING IMPROVEMENTS. From now on, if you have multiple items saved for one domain, the account with the matching subdomain will be shown first.
BUG FIXES.
NordPass 4.17
Did you know that January has a Blue Monday – the most depressing day of the year? The good news is it’s over. But if you’re still feeling a little bit blue, here’s a few things we’ve updated to hopefully cheer you up.
Safari import. You can now import passwords saved in Safari straight to NordPass.
Data Breach Report update. If your password appears in a Data Breach report and you update it on the website, select “Resolve” and the same details won’t appear next time you run the report.
Bug fixes. Caught many annoying bugs that hinder your experience.
Some write songs, some dedicate sonnets, some built monuments. We create release notes to honor each update of NordPass app for Windows, macOS and Linux. A single click of that magical “Update” button unlocks the newer, faster, better-performing world of stress-free password management.
NordPass 4.16
As Christmas is over, it’s time to make some New Year’s resolutions. But why wait? We want to become a better, smoother-running, and more user-friendly app now. We have strived for perfection since NordPass was launched, and this week is no exception. So we present you a new NordPass version with fewer bugs and more Autofill fixes.
NordPass 4.15
A good beginning makes a good ending, so why not start a week with a new NordPass release? Here’s what we’ve got this week:
BREACH SCANNER UPDATE. If your password was leaked in a data breach and you’ve reused it on other accounts, a new ‘Accounts at risk` tab will appear. There you’ll see a list of accounts that may be vulnerable. Don’t wait for a second and change their passwords to prevent cyber attacks.
AUTOFILL UPDATE. We’ve fixed a ton of autofill bugs so you’d have a smoother autofill experience on even more websites.
NordPass 4.14
We know that sometimes life throws challenges right at you. At those times, the last thing you want to think about is how and where to access your passwords.
That’s why from now on, you can give emergency access to your passwords and other items. Choose a person you really trust and invite them to be your emergency contact. Once they accept it, you can give them access immediately or wait for 7 days to be given automatically. Note: You can only give emergency access to another NordPass user with a Personal or Family plan.
NordPass 4.13
Trick or treat? Who are we kidding? It’s always just treated here at NordPass. So here’s our Halloween treat to you – a brand new NordPass release. Don’t worry, nothing to be scared of—just a smoother running version of your password manager.
NordPass 4.12
Tired of too many emails and banners? We get you, and we want to improve our communication with you. That’s why from now on, a lot of important information will appear as in-app notifications. So if you open the app and see a red dot next to a bell icon, just know that it’s something important from us to you.
P.S. We also solved a number of bugs.
NordPass 4.11
Getting your data stolen isn’t nice. But if that happens to you, it’s important to identify the stolen information and act quickly. That’s why with this release, Data Breach Scanner has gone even better. How?
If your data has ever appeared in any breach, you can now use the Breach Scanner to identify not just what type of data was leaked, but also see it in plain text. This includes passwords, your address, social security number, birth date, and other data types.
In addition to all this, we are continually working to improve one of our core features – Autofill. So expect to see more websites working flawlessly with NordPass.
NordPass 4.10
Can’t find tools to improve your password security? We got you. You’ll find security tools such as Password Generator, Data Breach Scanner, and Password Health in the sidebar from this release. More accessible to access and easier to use.
We also solved some pesky bugs to make your NordPass experience more enjoyable.
NordPass 4.9
What do you have in the box this time NordPass? Well, let me see…
Title and website address suggestion. That’s right, now when creating a new item, you only need to enter a few letters in the Title or Website address fields, and NordPass will suggest filling it with one of the thousand popular websites.
Spanish and Italian languages are now available on the NordPass extension.
Bug fixes, bug fixes, and more bug fixes.
NordPass 4.8
It’s August my friend. And you know what August is good for? Learning new languages.
Hablas español? Parli italiano? If you do, lucky you. Because you can now use NordPass in Spanish and Italian. Enjoy!
NordPass 4.7
Did you know that no one else has the same fingerprint as you? That’s why it’s the most unique password you can have. Dedicated Mac users, this release is for you. Yes, you can now sign in to your NordPass app with a fingerprint. Feeling like James Bond yet? We are!
P.S. We also solved a ton of pesky bugs to make your experience smoother than ever.
NordPass 4.6
Dear bugs, it’s time. Time to say goodbye. It won’t be the same without you. It will be better. The password managing experience will be much greater now.
NordPass 4.5
It’s officially summer, NordPass people! (Or winter, if you live in the southern hemisphere.) Wherever you are, we hope it’s sunny so that you can enjoy the brand new release. Here’s what we’ve got:
MULTIPLE ITEM SHARING. Sharing is caring, right? Well, now you can select multiple items and share them all at once. Easy peasy. Just always make sure you trust the people you share your credentials with.
PASSWORD GENERATOR HISTORY. You know that moment when you create a super-strong password with the NordPass Generator and forget to save it? Yeah, we’ve been there too. That’s why you’ll now see a little clock icon in your Generator where you can check your previously generated passwords.
BUG FIXES. And, of course, we won’t release a new NordPass version without getting rid of as many bugs as possible.
NordPass 4.4
“Speed” was the main keyword at NordPass this week. So what to expect in this release?
Updated designs so you could find your passwords or any other items at the speed of light.
Tons of bug fixes and maintenance work so that your app would work faster than ever and would be as pretty on the inside as it is on the outside.
NordPass 4.3
Don’t worry if you missed the chance to get NordPass Premium for less. The Summer Kick-Off Sale is here! Use this offer to get access to all the amazing Premium features.
Also, we have a little something for our Business users. From now on, all members who are added or removed from groups will be notified by email.
NordPass 4.2.18
Hello, world! We’ve prepared a nice little juicy pack of updates – just for you. Please give a warm welcome to:
Double EXTENSION-upgrade: from now on, not only it speaks German fluently but also is available in Dark Mode. Ready to give some rest for those sore eyes?
A new ge-ne-ra-tion for stronger passwords! Check out the PASSWORD GENERATOR to enjoy shiny new looks and (finally!) PASS-PHRASES for nice-and-strong-memorable-passwords.
NordPass 4.1
We are working hard on bringing Dark Mode to the NordPass extension. In the meantime, we are also doing some good old maintenance work. So expect to see some design changes in the browser extension and forget the existence of annoying bugs.
NordPass 4.0
Today is the day! You know what we are talking about. You asked for it; we delivered it. And oh boy, how good it looks! You’ll believe it once you see it.
OK, we recommend sitting down for this one. Then open your NordPass app, update it to the newest version and enjoy the shiny new DARK MODE.
And if that doesn’t impress you, well, then we have more news. You can now use NordPass in German. Whether it’s your mother tongue or just want to polish your German skills, you can now change your language preference in Settings.
NordPass 3.31
This time we’ve got many design changes to make your life easier. So let’s get to it. Here’s what you’ll see in this release.
TOAST MESSAGES UPDATE. Some of the success messages, such as when you import items or update your app, were outdated, so we made them easier to understand.
MULTISELECT REWORK. We noticed that the sorting option was missing when multiple items were selected. We introduced this option and changed long-winded buttons to visually pleasing icons.
BROWSER EXTENSION UPDATE. You can now access Tools from the NordPass extension, including the Password Health and the Data Breach Scanner.
NordPass 3.30
Are you ready to switch off the lights? Because Dark Mode is coming very very soon. We are working hard to make sure everything looks perfect for the release. A few more things, and we are done. Keep your eyes peeled.
In other news, we fixed some annoying bugs we found in Groups and took care of other bugs.
NordPass 3.29
Sometimes what we do is either too difficult to explain or too difficult to see. Yes, you guessed it. This week we put all our effort into finding and getting rid of bugs. We hope we’ll have something more exciting for you next week.
NordPass 2.34
NordPass has gone through some serious spring cleaning with this release. Why do we say so? Here’s what we did:
B2B GROUPS BUG FIXES. It’s new, fresh, and now with fewer bugs.
APP BUG FIXES. We’ll never give up on perfecting NordPass.
EXTENSION DESIGN REWORK. So much better looking now! You have to see it to believe it.
And something exciting is coming up very soon. So stay tuned. 😉
NordPass 2.33
This time, we’ve got good news for Business users. Let us introduce GROUPS. Admins and Owners can now assign members to groups and share passwords with a number of people instantly. Think, your finance department sharing login details every accountant needs to access.
Anything else? Of course, we got rid of more nasty bugs.
NordPass 2.32
Happy April Fool’s! Stay vigilant, and don’t get tricked by any hackers. Keep your passwords safe with an updated NordPass app. Here’s what we’ve got this time:
CHANGES TO MASTER PASSWORD CREATION. Now it’s easier to understand what that mysterious Master Password is and how it is different from your Nord Account password. BUG FIXES as usual.
NordPass 2.31
It’s spring! Flowers are blooming, birds are chirping, and NordPass is releasing another update. In this release, you’ll find: KEYBOARD SHORTCUTS. You can now use CTRL + F to search your items and CTRL + L to lock your app instantly. BUG FIXES. No bugs allowed here.
NordPass 2.30
NordPass bug hunters strike again. Yes, you guessed it. We got rid of more pesky bugs so you could enjoy an even smoother experience with NordPass. That’s it for now!
NordPass 2.29
“Could NordPass be any better?” asks our team every single week. And the answer never changes. YES, it can!
But it’s not always about new features and crazy advancements. Sometimes it’s all about perfecting those nitty-gritty details. So this week, we say another goodbye to a bunch of bugs. Bye, we won’t miss you.
NordPass 2.28
Another week, another release of a better, faster, and more secure NordPass app. And for this we say a BIG thank you to our bug hunters (aka developers). You guys rock.
NordPass 2.27
If NordPass was a dog, what would he say to a flea?
Stop bugging me.
The good news NordPass doesn’t need to endure nasty bugs. Bye-bye, bugs. We don’t wanna see you no more.
NordPass 2.26
Ready, set, new release! What can you expect to see in the new and shiny NordPass 2.26?
EXTENSION REWORK. Updated, upgraded, and overall better-looking browser extension. But what did we actually do? Well, we just made it even more similar to your desktop app, meaning more functional and easier to use. Voila!
BUG FIXES. Can you tell we don’t like insects? No bugs are allowed in our app. Yuck.
NordPass 2.25
It’s a very special day today. We thought about it over and over again. We were constantly considering, overthinking, and having sleepless nights about it. We even visited a fortune teller to ask if you’ll like it, or not. Yet still, our developers were nervously (but carefully!) coding that code.
And here it comes. A sincere love letter. In PDF format. Containing your Recovery Code. Save it, delete it, save it again, print it – do whatever you want, but please, keep it safe. And don’t show to anyone else! It was created from the bottom of our hearts to express how much we LOVE YOU.
Take care!
And don’t forget to update the app to get those extra bug fixes.
NordPass 2.24
Once upon a time, in a faraway land, a password manager named NordPass lived. His goal was to become the best password manager that there ever was. And he did it one release at a time.
He proudly presents his latest achievements:
AUTOSAVE AND PASSWORD EDIT UPDATES. Now it will be easier to understand when NordPass is prompting to update an old password or when it is offering to save a new one automatically.
HELP SECTION ADDED TO SETTINGS. If you need help using NordPass, head to Settings to be directed to the Help Center.
COPY CHANGES. Salvador Dali might have said not to fear perfection as we’ll never reach it, but we’ll still give it a good go.
BUG FIXES. No need to call the pest control officer; we got it fixed.
NordPass 2.23
AbraCadabra boom! No, it’s not magic. It’s just your passwords and personal information filling in quicker and smoother than ever before. Bye-bye, annoying bugs who tried to stop you. What else can you expect in this release?
ONLINE/OFFLINE INDICATOR appears in the NordPass extension.
COPY CHANGES to make the app easier to navigate.
MORE BUG FIXES.
NordPass 2.22
New Year, new NordPass release. Here’s what you’ll see in the latest version:
EASIER LOG IN WITH NORD ACCOUNT. We tweaked the steps you take logging in to NordPass for a smoother experience.
BUG FIXES, because no one likes bugs.
RECOVERY CODE PDF. You will now be able to download your Recovery Code in PDF. Keep it somewhere safe. 😉
NordPass 2.21
Yeah, Christmas will be different this year. But we’ve still got something to spread a little cheer.
In this release, you will see:
ICONLESS ITEMS STYLING. Your passwords that don’t have dedicated icons will light up in a variety of colors.
BUG FIXES. Well, it cannot be called a release without bug fixes, right?
NordPass 2.20
“You guys give up? Or are you thirsty for more?” – Kevin, Home Alone, 1990
That’s the NordPass spirit, Kevin! We’ve got more:
Design changes. Yes, the sky’s the limit for our designers, sorry.
Password Generator update. Did we mention that it’s important to have long and unique passwords?
Browser extension update. Easier to understand, prettier to look at.
NordPass 2.19
I don’t want a lot for Christmas
There is just one thing I need
I don’t care about the presents
Underneath the Christmas tree
Don’t want NordPass for my own
More than you could ever know
Making this wish come true
Giving a bug-free NordPass for you
P.S. Thanks Mariah Carey for inspiration.
NordPass 2.18
NordPass has turned 1 year old this week. Just on time for Thanksgiving, can you believe it? And we can honestly say this year we are the most grateful for YOU, our dear NordPass user. You, who believed in us and drove us to release one update after another.
So here’s one more. Full of even more design edits, bug fixes, and love:
LOGINS TURN TO PASSWORDS. Now all across the app, you’ll see the term “Password” instead of “Login” because it’s just easier to understand.
CHOOSE FOLDER WHEN AUTOSAVING to organize your passwords there and then.
RENEWED IMPORT. Importing passwords in bulk is now easier than ever.
MINOR DESIGN CHANGES because, let’s be honest, who doesn’t like a good-looking app.
NORD ACCOUNT DEEPLINK FIXES. No more accidental logouts when you use NordVPN and change your IP.
NordPass 2.17
Xmas is in less than 35 days. You’re welcome.
In other news, our designers, developers, and copywriters are presenting you with another brand new update. This time we fixed the annoying-forever-loading spinner, made minor changes to the way you see your items’ details, and updated the copy to make your app even more easier to navigate. Until next time 😉
NordPass 2.16
We know you have better things to do (like keep up with the news on the current presidential election. Yikes, so intense!). So we thought, ‘who are we to bombard you with more messages?’. Poof! Your login and logout messages are gone.
To make your day a little bit brighter, we also made some improvements to your items layout. And we can describe it with just one word – SLEEK. You’ll believe it when you see it 😉
And NordPass update wouldn’t be an update without bug fixes. We did the dirty work and crushed them once again.
NordPass 2.15
Trick or treat? Treat, always. We might be a few days late to any online Halloween party, but, to make up for it, we are bringing new treats to your desktop app:
ADD ITEM IN FOLDER. You can now add items straight from your folders. Easy, breazy, and all your items are organized.
ITEM DETAILS FIXES. “There is no limit to perfection!” screams the NordPass design team. Your items will now look more beautiful than ever.
OTHER LITTLE BUG FIXES. Little bugs and spiders might fit the Halloween theme, but they don’t look good in your NordPass app. We got rid of them to make your experience smoother and safer.
NordPass 2.14
Providing high-quality password-managing experience, routine maintenance and working under-the-hood is just as essential as releasing a new shiny feature. So nothing grand this time — just the usual bug-fixing and design-improving business. We’re packing and sending best wishes along with app improvements your way!
NordPass 2.13
BUG FIXES. Sometimes you couldn’t scroll down to the end of your passwords list. You simply couldn’t. The good news is that we did some magic tricks, so now you can.
BUG FIXES. We’ve also changed the font style, the button style, and the spacing style in the context menu of your passwords list (not exactly a bug, but we wanted to keep the release notes in style).
BUG FIXES for everyone.
BUG FIXES. Sometimes you couldn’t scroll down to the end of your passwords list. You simply couldn’t. The good news is that we did some magic tricks, so now you can.
NordPass 2.12
When life gives you Monday, we release the app update. Let’s see what we’ve got:
IN-APP NOTIFICATIONS sometimes were over-competitive and tried to overlap each other. Someone smart once said that the best way to kill competition is to partner it. So after some inspiring conversations about team spirit, the attitude was fixed – all notifications now act super friendly.
DESIGN BUG FIXES. Yes, sometimes bugs may look stylish. Even pretty. They are still bugs – and they are out now.
PASSWORD HEALTH IMPROVEMENTS. The development department was very excited about changing something with the algorithm. All I know is that the health of your passwords will be calculated even more accurately. I only write release notes – please don’t judge me. And have a nice day!
NordPass 2.11
Hey there! How are you? Ready for the update? Let’s go:
BREACH REPORT. This one feels like a lottery. By clicking a ‘Scan’ button, you can find out if any of your accounts were ever caught in data breaches. However, it probably is the first lottery where it’s better not to ‘win’ anything.
DESIGN IMPROVEMENTS. They see you scrollin’, they hatin’, – because scrolling with that new scroll bar has never felt so good. Just give it a go.
NordPass 2.1
Another week – another update. Let’s roll!
DESIGN IMPROVEMENTS. Yes, we did it again. We’ve played with UI, got lost in perfecting the details. Oh, baby baby. Yes, the item lists now look neat, the font is sent from above. It all looks perfect now!
PERFORMANCE IMPROVEMENTS. Let’s be honest – after entering your Master Password to unlock the vault, the app window was getting overexcited and moved all over the place. Not that it was a bad thing – but those moves really weren’t good. So, we’ve sent the app to some dancing classes. The result – the app learned some solid, stylish but still moves – more like JLo style.
NordPass 2.9
Faster than light.
Supersonic.
Fleet-footed.
Pronto.
Winged.
We’ve spent hours trying to find the right word to describe the improved speed of opening your passwords (and other items) in the vault, but none of them was good enough. They say that action speaks a thousand words, so enjoy viewing your items at full speed.
NordPass 2.8
Passwords are more human-natured than you could possibly think. They need a safe and cozy place to stay. Most of them eat well (cheat days included 😉 ) and constantly work out to become faster and stronger. However, sometimes they also may feel weak and unwell, so regular health check-ups are crucial. Luckily, we’ve found an easy way to maintain their well-being – set up a password health checker in the app. Take a chance to make your precious passwords happier (and accounts safer) without leaving the house.
Stay safe, everyone!
NordPass 2.7
The idea of throwing this party came out of thin air. Why not, we thought – work hard, party harder, right?
So we’ve ordered lots of food and drinks (everyone was curious seeing what new employees look like when they’re drunk), brought in a magical photo booth (making selfies was too mainstream), and prized trivia (to avoid awkward silences), and live music by our beloved DJ “Vibe Manager”.
Time flew, the party’s got in full swing (no one seemed to be running out of things to talk about – phew). Even NordVPN and NordLocker stopped by. After a not-work-related heated discussion about data privacy and online security, they promised to join our “Tools” department. Like, forever.
Autofill department surprised everyone with funky moves – those icons felt like dancin’ till the break of dawn. It was fun until the ‘fun’ went out of control – and out of login fields. Luckily, after taking a chill pill, everything’s got back in order.
By the way, some unwanted URL spaces were trying to crash both the party and the app. That’s kind of rude, so we’ve asked them to leave.
We’ve finished with a small team-building session with cleaning the office – it’s now nice and clean – and so is the app (we hope so).
That’s it – peace out!
NordPass 2.6
Our engineers are all about perfection. They literally were calculating coordinates for pixel-perfect autofill icons placement. However, some “wind of change” has happened, and those icons ended up finding their home OUTSIDE the login fields. Sorry for that – this unforgivable mistake was fixed.
Also, some sneaky, crawly, totally gross bugs were caught and removed. The app is much better without them – enjoy!
NordPass 2.5
This release contains some behind-the-scenes magic, usual tinkering-under-the-hood and minor design tweaks. By hitting the “Update” button, you will get one step closer to top-notch password-managing experience. Stay well!
NordPass 2.4
They say – small changes make a big difference. Behold – the update with a bunch of app upgrades is here. Let’s see what we’ve got here:
VISUAL IMPROVEMENTS. Mirror mirror on the wall, who is prettiest of them all? Well, our designer’s brush made some magic tweaks, so the answer is clear now – it’s those tiny cute little app icons. Lookin’ good!
APP LOADING FASTER. Need for speed? You’re welcome! Fasten your seatbelt and put the pedal to the metal – the project “Make the app faster” was completed successfully.
BUG FIXES. Dear sneaky bugs, thanks for visiting, farewell, let’s never meet again.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
Salesforce is a dominant player in the Customer Relationship Management sector. Around 150,000 companies use Salesforce to manage customer data and launch marketing campaigns, and the company enjoys a 33% market share.
It’s easy to see why. Salesforce’s cloud-based tools save costs and time, simplify customer analysis, and integrate smoothly with other SaaS services. But is Salesforce a secure environment to run your business?
While Salesforce is generally safe to use, data security in Salesforce is still something users need to consider. Data breaches have exposed potential vulnerabilities. And users need to know how to use the Salesforce data security model when making their implementation more secure.
Data security in Salesforce
Data security is the protection of sensitive data handled by an organization. In the context of Salesforce, this refers to customer records, including financial information and private personal details such as names and contact details.
The consequences can be severe if an organization loses control of data privacy protection. According to IBM, the average cost of a data breach is approximately $4.35 million. Companies that lose large volumes of sensitive customer data can expect to pay hefty compensation.
Salesforce is no exception. In 2019, Salesforce client Hanna Andersson suffered a major data breach. A malware infection on the clothing retailer’s Salesforce platform exposed over 200,000 customer accounts. Neither Hanna Andersson nor Salesforce knew anything about it.
Three months after the Salesforce breach began, law enforcement officers discovered confidential data for sale on the Dark Web. Customers immediately sued under the California Consumer Privacy Act (CCPA).
Salesforce and Hanna Andersson eventually settled the claim in 2021. Both companies accepted shortcomings in protecting user data, detecting malware, and informing customers. And they had to pay as much as $5,000 to affected customers.
Related articles
In Depth
6 Network Access Control best practices
29 Dec 2022•13 min read
In Depth
SaaS Security 101: The Definitive Guide
10 May 2022•9 min read
The Hanna Andersson settlement shows that data security is a critical vulnerability and could happen to any Salesforce user. So let’s dig deeper into the Salesforce data security model to explain how secure the platform is and what companies can do to protect their data.
The Salesforce data security model
Since the 2019 Salesforce data breach, the platform has tightened up its native security features.
Data at rest on Salesforce is encrypted, concealing it from outsiders. Logging systems allow users to track weaknesses and handle alerts. MFA adds strength to authentication processes. And users can even create bespoke protection for data analysis with the Data Mask feature.
However, one set of controls in the data security field is all-important. Permission sets enable Salesforce users to manage data access. Users can use permission sets to ensure that only authorized users can access data. Everyone else is blocked by default – until they are granted necessary privileges.
There are four Salesforce permission sets. Each one plays a role in locking down confidential customer information:
Organization level – At the organization level, users can manage access for all users in their enterprise. Multi-factor authentication factors make Salesforce portals more secure. Connection limits, location tracking, and IP range screening exclude malicious actors.
Object level – Organizations can limit access to Salesforce databases and apps. Object level controls allow administrators to set aside portions of the Salesforce environment and create restricted zones with limited access.
Record level – Security teams can create permission sets for specific records. Marketing teams may need access to information about customer purchases. But financial data can be locked away. Admins can set objects to read-only or allocate editing privileges for certain users.
Field level – At the field level, users can restrict how users interact with database fields. This provides tight control over how data is used. Many employees may have object access to CRM data. Only a tiny number will have field level access to edit and export the most sensitive data.
Salesforce security issues
Applying access controls is critical, but users must also be aware of Salesforce security vulnerabilities. Be sure to factor in these issues when planning your security strategy.
1. Inadequate data classification
Before you can protect confidential data, you need to understand the data you hold. Companies need to classify every record according to its value and vulnerability. When you have that information, you can start creating field level controls and setting permissions.
Review your databases and assign risk levels to the information they contain. Use regulations as a framework. For instance, the CCPA mandates robust protection of customer financial records. HIPAA requires tight control of any patient data.
Classification matters because it isn’t always practical to secure all customer data. Unclassified data generates noise and confusion. Security teams are presented with false positives and waste time on securing low-value data.
2. Confusing data ownership
Who is responsible for securing your Salesforce CRM system? Many companies cannot answer this question and rely on multiple stakeholders to secure customer data.
Data ownership should be clear and communicated to all Salesforce users. Assign an individual or team to manage data security. They should ensure compliance with relevant regulations, apply native Salesforce controls, and integrate enterprise-wide security systems with the CRM system.
Take advantage of Salesforce’s training materials. The platform offers courses in identity and access management (IAM). With this information, your security manager can master Salesforce permission sets and protect critical databases.
3. Poor Salesforce security awareness
Knowledge about Salesforce security should extend beyond the data security lead. Every CRM user must know security policies and the importance of protecting against phishing attacks.
Remember the Hanna Andersson case. A single Salesforce cyber attack can compromise huge data sets. Poor training and a shallow security culture can have huge implications.
Extended awareness matters because Salesforce is highly customizable. Employees can easily misconfigure communities in the Experience Cloud. And teams can add Salesforce services without IT teams knowing.
Both actions expand the threat surface, potentially compromising a Salesforce environment. Avoid them by educating Salesforce users and creating policies that explain how to use the platform safely.
4. Not understanding how shared responsibility works
As with all cloud-based products, security responsibility is shared between Salesforce and service users. Unfortunately, this is something that users easily forget.
Users may assume that Salesforce protects data, but this is partially correct. Salesforce does encrypt data and guards against malware infection. Clients are responsible for ensuring secure access and object configurations.
Companies using Salesforce can over-provision employees, giving them too much access to sensitive data. They might allow wide third-party access to databases, even down to field level. Marketing teams could create vulnerabilities as they customize their Salesforce solution.
Be aware of your responsibilities under the shared responsibility model. If not, data breaches will probably be due to your own negligence.
Why do you need additional security in SalesForce?
Native security features provided by Salesforce are powerful but insufficient to achieve data security. Companies need to combine internal controls like Salesforce data encryption with external security solutions.
The 2019 data breach demonstrates why external security is so important. Salesforce and Hanna Andersson did not know about the malware infection. Security teams had no idea that gigabytes of user data had been stolen.
While the single data breach cost both companies plenty of money, the cost could have been higher without the actions of law enforcement professionals.
The initial malware infection involved a ‘magecart’ attack that skimmed customer data from the retailer’s payment portal. This agent probably arrived via a phishing attack on a Hanna Andersson employee. None of Salesforce’s internal controls could prevent it, but external security solutions could help.
SIEM tools to scan attachments and quarantine suspicious links can stop phishers in their tracks. IP allowlisting screens devices and permits access for approved IP addresses. VPNs encrypt company networks and conceal credentials from external observers.
Salesforce allows in-depth access management and security logging. But when fine-tuning their CRM security, companies should supplement native features with additional measures.
How can NordLayer help with Salesforce security?
Salesforce makes CRM simple, allowing eCommerce businesses to thrive. But recent data breaches have shown that the cloud-based platform has some critical cybersecurity vulnerabilities.
NordLayer’s tools supplement native Salesforce security and make it easier to achieve regulatory compliance.
Our cloud security solutions include access management tools and Single Sign On that bridge company networks and cloud portals.
IP allowlisting is another core NordLayer feature. Allowlisting lets you set approved IP addresses and block everything else. This makes it safer to admit remote workers to your Salesforce environment. It also means that credential theft does not automatically provide access to your data. Attackers without approved IP addresses will still remain outside the perimeter, unable to steal customer information.
Discover how to create a rock-solid Salesforce security posture. Get in touch with our team and discuss your options today.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
However, if an employee needs access to company-level blocked sources, for example, a Social Media Manager working on Facebook and LinkedIn, IT administrators can purchase a separate dedicated Virtual Private Gateway for such employees and configure it with fewer restrictions.
