Skip to content

Libdrop: File sharing through NordVPN

What is Libdrop?

Libdrop is a cross-platform library developed in the Rust programming language. It is compatible with Windows, MacOS, Linux, iOS, and Android. File sharing within the NordVPN environment is facilitated by the Libdrop library, which is available as an open-source resource on GitHub.

The goal of Libdrop implementation is to allow smooth and secure file sharing between users over Meshnet. The library should be easily integrated into the NordVPN application so API users can issue transfer requests, with the rest of the processes being carried out in the library.

Libdrop protocol

The Libdrop protocol enables peer-to-peer file sharing via both IPv4 and IPv6. In this process, the sender presents files to the receiver, who then selects specific files for download. Downloads are then initiated.

The transfer is live until one of the peers goes down or the transfer is explicitly canceled by either of the peers, after which the files are no longer available for download. This provides the user with a time window where they can decide which files they want to download now and in the future while the transfer is still up.

High-level overview of communication between two peers.

Communication and low-level details

Let’s take a closer look at the technical details of the communication process, and how we developed our current setup.

gRPC

At first glance, it seemed evident that our easiest course of action would be to focus on the HTTP server and client because this is very easy to use and understand, as well as being a time-proven technology. We could make a REST endpoint and just proceed with a regular HTTP download.

To enhance speed and control, we opted for gRPC. Because gRPC is a binary protocol it has less overhead. It is also strongly typed, making errors harder to introduce. gRPC technology automatically generates the code needed for both the client and the server, making it an excellent fit. In fact, Libdrop was originally built on gRPC.

Initially, it was very comfortable to use — both the client and the server code just worked. We could issue a certain call via the wire and expect the appropriate function to be called on the peer.

However, as time went on, we found that debugging gRPC presented some challenges, and the “black box” nature of it began to concern us. The generated code also had little control over the socket itself because it was abstracted too far away to gain direct access. Consequently, we transitioned from gRPC to WebSockets in pursuit of a more adaptable solution.

WebSockets

Unlike gRPC, WebSockets is not strongly typed, which offers a degree of flexibility. This flexibility comes at the cost of making it easier for bugs to appear. However, there’s no automatic code generation, which is a plus.

The ability to easily introduce versioning was another advantage. We just need to have the URL in the form of “ws://{addr}/drop/{version}/query.” It also helped that WebSockets is a fairly easy-to-understand technology that works in tandem with HTTP so the traffic can be inspected easily as well as debugged.

Choosing WebSockets turned out to be a wise decision. It led to a reduction in code complexity and greatly enhanced our understanding of the data flow. Plus, having written the code ourselves, we felt fully in control of the system.

Simplified representation of backward compatibility between Libdrop versions.

Rust and Tokio

Due to the nature of the Libdrop library’s heavy IO and event-driven architecture, the codebase contains a lot of asynchronous flows which could have been a tough problem. However, Rust’s great implementation of async alongside the Tokio library proved to be a great combination in dealing with this and avoiding potential crashes.

Rust shines because the borrow checker is really persistent about lifetimes and safety while developing because it prevents you from compiling incorrect code that breaks ownership rules.

We are also fairly safe from panics as we spend most of the time in Tokio tasks and those are executed in catch_unwind. This means that if the Tokio task panics it will simply yield an error instead of tearing the whole thread down.

Still, not every place in the codebase runs in a Tokio task, and so for those cases where a Tokio task is not involved, we tune Rust linter to detect unwrap() calls in the codebase that could potentially invoke a panic handler.

NordVPN uses Rust in numerous libraries and panics are handled in custom panic handlers. These handlers wrap the error and emit it via callback so the API user receives it and can properly log it.

API and the dilemma: To block or not to block?

We’ll now explore the choices we made around our API.

SWIG

For the API we used SWIG, which was already battle-tested and proven by libraries such as Libtelio. SWIG automatically generates FFI binding code for all target platforms, but it’s not without limitations. While it’s very easy to pass primitives such as integers and strings, higher-order structures are not that comfortable. In a compromise, we accept certain parameters as JSON strings.

JSON strings, while slightly less optimal, are a great solution to the problem. All mainstream languages know how to parse it or have a popular library ready to do so. The downsides to JSON strings are less type safety and a need for greater control to avoid breaking the conformity.

Event-driven architecture and reporting

One question that arose around the API was whether or not we should block it. Based on the API users we opted to not make the API block and communicate via events. This provides more complexity on the API design side but it provides an event-driven API and means that API users don’t need to care about threads. App developers are usually experienced in working with callbacks so this architecture suits them well.

Callbacks are used for event notification and reporting so the API user can receive reports and log them where appropriate. Events are for reporting. Both events and reports are passed on as JSON-encoded strings.

Errors are reported when the parameters to the API are incorrect or when a runtime error is encountered.

Types of events

Events are emitted for various milestones:

A transfer was requested.

The transfer was successfully queued (the API returned no error) and contains all the paths collected.

A file upload/download was started, finished, or failed.

A file upload or download progressed.

User experience and history tracking with SQLite

When considering how to track transfer records and states, our team opted for a local SQLite database that users can easily inspect.

We chose SQLite for its flexibility and cross-platform availability, and because it offers a strong query system that makes it user-friendly.

The widespread use of SQLite in various applications gave us added confidence in its reliability and performance, making it an easier choice over alternatives like JSON files or custom binary formats.

Database limitations: A read-only resource

The SQLite database does not control Libdrop’s operations in any way. Its role is purely read-only. The SQLite database serves to offer our users a convenient API for accessing transfer histories and logs, without impacting the underlying functionality of Libdrop.

In cases where we fail to open or migrate the SQLite database successfully we can remove it entirely and try again. If it fails again we can then use an in-memory database that provides proper functionality while the app is alive.

Security and validation

Security in Libdrop has several key focuses:

  • Ensuring that the right sent file reaches the receiver.

  • Ensuring that a transferred file is immediately picked up and scanned by NordVPN’s Threat Protection feature.

  • Ensuring that foreign apps cannot make calls directly to the peer.

  • File validation: Ensuring integrity from start to finish

As part of our commitment to ensuring a reliable file transfer process, we take several precautions. The moment a file is selected for upload, we immediately fetch its metadata, specifically capturing its size and checksum. This information is then shared with the receiver to ensure both parties have synchronized data right from the start.

During the actual upload, we keep a close eye on the data transfer. We compare the size of the transferred data with that of the received data, allowing us to detect any inconsistencies. If a discrepancy is found, the transfer is terminated, ensuring that only accurate and complete files proceed.

At the receiving end, a fresh checksum is calculated once the correct amount of data is received. If this calculated checksum doesn’t align with the initially shared checksum, the transfer is terminated. In such cases, the transfer is reported and stored as a failed transfer on both ends.

Threat Protection

In both Windows and MacOS, files often carry metadata indicating their origin. Without this information, antivirus software would need to scan each and every file for threats, which isn’t efficient.

Applications regularly produce many files, the majority of which are legitimate and harmless so it’s common practice to embed specific markers within these files. This allows antivirus tools to identify and scan files faster.

On Windows and MacOS, we immediately attach these markers once files are downloaded. This ensures that the Threat Protection scanner can promptly identify and assess them, leaving no gap during which they might be accessed without a prior security check.

MacOS uses kMDItemWhereFroms while Windows uses Zone.Identifier.

Socket security

Finding the protocol and communication method used by Libdrop is straightforward. The port we use is 49111, and the address is in the format ws://{addr}/drop/ (this can all be seen in the source code provided on GitHub).

While it’s true that you can bypass Libdrop by directly connecting to this URL with cURL or similar tools, this is a situation we’d like to avoid. Our aim is to maximize usability and minimize the risks for users.

Since we considered user experience, we also explored the idea of automatically accepting files from trusted peers. However, we recognized the potential risk of someone abusing this feature to spam others, and so decided against it.

To enhance security, we implemented an authorization system based on Meshnet keys. These keys are retrievable via API after successful user authentication. Since NordVPN is consistently aware of peer public keys, we’re able to use this information to validate connections at the Libdrop communication level. If a user fails the authorization process, the transfer is terminated — no questions asked from the receiver side.

To accomplish this, we employ HMAC with SHA-256 and generate a shared key using the Diffie-Hellman algorithm. When initiating a connection, the NordVPN app provides the public key of the peer. Combined with the private key we already possess from the time of initializing Libdrop, we’re able to calculate this shared key. Both sides of the transaction do the same, and the process is only deemed successful if the keys match.

We’re aware that this system isn’t bulletproof. For instance, users might find a way to exploit a Linux CLI app. However, we believe these improvements represent a significant step towards creating a safer and more reliable experience for our users.

Permissions and user access

Integrated into the NordVPN application, Libdrop operates under the constraints of user permissions as enforced by the operating system. This ensures that users can only share files to which they have ownership rights. To initiate a file transfer, a connection between peers must first be established. Enabling file sharing for a specific Meshnet peer allows one to start receiving files from that device. Disabling file-sharing permissions for a Meshnet peer will halt incoming transfers from that particular device. You can read more about file-sharing permissions here.

On the Linux platform, we faced an additional challenge because the app needed to run as root due to Libtelio’s requirements. Running Libdrop as root was out of the question, as it would have unrestricted access to the entire file system. To navigate this, we set Libdrop up to run as a user process that communicates with the NordVPN daemon.

Fortunately, mobile devices didn’t present the same issue, thanks to their robust sandboxing. Likewise, applications on Windows and MacOS operate with user permissions, so there were no concerns on those platforms either.

It’s worth noting that Libdrop isn’t designed for multi-user scenarios, as it uses a hardcoded port number, 49111. However, it can technically bind to different network interfaces without any problems.

File aggregation

To simplify the user experience and streamline integration, we designed Libdrop to automatically enumerate files in the paths provided. These paths can point to either individual files or directories, allowing for greater flexibility. This setup posed several challenges, however:

  • How can we recreate the directory hierarchy?

  • What do we do when we encounter a symlink?

  • What happens if there are too many files?

  • What are the issues with Android permissions?

Let’s take a closer look at how we overcame these challenges.

Recreating the directory hierarchy

For hierarchies, we used the same rename logic as we did with the files, but only for the root level directory. We only communicate the path with the peer starting at the root level of the provided path, meaning that if there’s a directory structure of C:\Files\Photos\Cats\Cute and the user adds C:\File\Photos then we only send Photos\*, the receiver is unaware of the C:\Files portion. This was important because, if the receiver was aware of that portion, personal details could be leaked.

Interestingly, directory separators are not cross-platform. Windows supports both \ and / while Unix-based OSs (Android, iOS, MacOS, Linux) support only /. Initially, we just communicated with the path as-is, which then produced some fun results. Sending a path, “Photos\Cats\1.jpg,” from Windows to a Linux machine would produce a file with that name instead of two directories and one file when transferring a directory.

As an easy solution, we chose the following approach: when the user sends a directory and we aggregate a path, we split it with the native path separator and then glue it back together using the universal one — /. We can then use that path going forward.

Dealing with symlinks

We decided that, when a symlink is encountered, we would return an error. This reduces the chances of possible security issues arising around certain files.

Symlinks reduce the visibility of operations, creating situations in which a user might think they are sending one set of files while in reality a different group of files are picked up.

What happens if there are too many files?

In Libdrop we allow for certain configuration values when initializing the library, ensuring that it can be flexible across multiple platforms. To help with interoperability, we decided to add two values: file limit and file depth limit.

Including these two values means that deep directories result in an error. An error is also generated when the file limit is reached. We think it’s better to be explicit than implicit, and so we’d rather generate an error than send an incomplete file transfer.

Android permission issue

Using the transfer system on Android presented us with some challenges. In order to use the POSIX file system, the API needs appropriate permissions in the application manifest. Direct file system access requires that the application is placed within a single specific category, but this was a problem because NordVPN is not just a file or backup manager.

A solution was found when we did an experiment and found that upon selecting the file in Android, it was possible to detach the file descriptor. This enabled us to use POSIX with the provided descriptor:

Testing and dogfooding

We used Python and Docker to load the compiled library and imitate conversation between two peers. This allowed us to reproduce the bugs by writing test cases, easing our concerns about bigger changes in the codebase.

The testing framework allowed us to generate scenarios quickly using a Python API where we can imitate all the actions a user might take alongside the events we would expect as a result.

Tests can’t perfectly replicate what happens in real life so we still constantly seek QA feedback alongside the relevant aggregated logs. Still, having an easy-to-use test framework proved to be very beneficial and boosted our confidence during development.

Meshnet protocol and wire safety

NordVPN’s file-sharing feature is built on Meshnet, a peer-to-peer protocol. This design allows for the shortest possible data path between computers, eliminating the need for third-party cloud storage or service providers.

One caveat is that both Meshnet nodes must be online simultaneously for the transfer to take place. All traffic between Meshnet nodes, including file sharing, is authenticated and encrypted via WireGuard’s cryptography, ensuring that even Nord Security cannot access the contents of the files or the traffic being transmitted. You can read more about the Wireguard protocol here.

Thanks to Libtelio and Meshnet, Libdrop doesn’t need to use any encryption of its own because double-encryption would be unnecessary. If you’re considering implementing Libdrop into your own product, you should integrate transport layer security (TLS), which should be fairly trivial to implement.

In summary, NordVPN’s File Sharing feature offers a secure, efficient, user and API-user-friendly method for peer-to-peer file transfers through the Meshnet.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Don’t let your desire for love turn into lust for data

 

Asking for money or intimate photos is out of date. Romance scams are getting more sophisticated.

Valentine’s Day is coming up, but this holiday is not always a simple celebration of love with bouquets, chocolate, and romantic dinners. For those who are still on a quest to find the right partner, it may be a day highlighting how sad and lonely they feel. This feeling of loneliness, combined with a desire for a partner, is what many scammers prey upon.

With cybersecurity finally getting well-deserved attention in recent years, chances are that you’ve already noticed warnings about romance scams long before now. Using social networks and chat applications, scammers can pretend to be potential lovers, and after they open their victim’s heart, they also try to open their wallet.

However, with increasing levels of general digital security awareness, scammers’ tactics have evolved. Some no longer directly ask for money because, for example, their imaginary relative needs surgery. Instead, they send you just one risky sentence: “Let’s go chat somewhere else.”

Often, the victim is led down a path to a new unknown app, one that is offered on third-party app stores or websites that prompt you to download spy tools that are capable of reading your private data stored in your smartphone like it’s an open book. In these cases, your only defense is to have a reliable cybersecurity solution that can detect the app’s suspicious activities running in the background while you two lovebirds are chatting.

From connecting people to spying

Since ICQ, “I Seek You,” one of the most popular online messaging apps to hit the internet in the mid-1990s, introduced its service globally, the popularity of messaging apps has seen constant growth.

Let’s take one of today’s most popular messaging apps, WhatsApp, as an example. Since its launch on February 24, 2009, WhatsApp has been constantly growing, reaching 2.49 billion quarterly users in Q3 2023.

Overall, the number of people using messaging apps surpassed 3.3 billion in 2023, with the vast majority using three services: WhatsApp, Facebook Messenger, and WeChat.

However, scammers have also been looking at those numbers amorously, and messaging apps have quickly become a platform for both phishing and online romance scams, amongst other threats.

In just three years – from 2019 to 2022 – the amount of losses attributed to romance scams reported to the U.S. Federal Trade Commission (FTC) rose from $493M to $1.3B. Social networks and messaging applications were the first contact platform for 59% of those who said they lost money to a romance scam in 2022.

These numbers get even more serious when considering that the vast majority of fraud isn’t even reported to the government. A study conducted in 2021 found that only 4.8% of people who experienced mass-market consumer fraud bothered to complain to the non-profit Better Business Bureau or a government entity.

Love in a military uniform

Some recent cases show that romance scammers are not only going after your money but also lusting for data. Spyware inserted in apps has become a serious issue, and the latest ESET Threat Report calls attention to a surge in Android spyware detections, which have risen by 88.9%.

In the past, spying chat apps were often nonfunctional, and a targeted person could quickly figure out that something was not right and delete it immediately. Nowadays, these malicious apps are actually doing what victims expect them to do. For example, threat actors make a copy of a legitimate open-source functional chat app and just change its visuals. This means that the targeted person may not get suspicious and can be monitored for a long period of time.

In June 2023, ESET researchers published a blog about Android GravityRAT spyware being distributed within malicious but functional messaging apps BingeChat and Chatico, which were both based on the OMEMO Instant Messenger app. The spyware can exfiltrate call logs, contact lists, SMS messages, device location, basic device information, and files with specific extensions such as jpg, PNG, txt, pdf, etc.

The apps mentioned above were only available on phishing websites, not via official or third-part app stores, but how potential victims were tricked to go there and download them remains a mystery. However, when researchers at Qihoo 360, a Chinese cybersecurity company, analyzed different fake but functional chat apps bundled with spyware, they found that the motivation behind victims downloading these apps was due to “matters of the heart.”

In this case, attackers created multiple accounts on Facebook pretending to be love-seeking female users and added relevant Pakistani military personnel as friends to further obtain their contact information. Then, with the fake profiles and their hidden agenda, they wrote to victims that they were interested in pursuing a relationship, and had “found” a great new app where they could chat further.

While the individuals targeted probably thought they were falling head over heels in love, they were in fact unwillingly feeding threat actors sensitive personal information, along with military intelligence.

Don’t give your heart and data away so readily

To avoid being scammed, let’s begin with the basics and go through common romance scam red flags.

  • Making excuses to avoid meeting: The scammer will avoid a meeting in person despite repeatedly stating that they are willing to do so.
  • Things are moving too fast: Your new “partner” will express deep interest/affection and perhaps a desire for intimacy despite your having been chatting for only a few days.
  • Asking for money: Romance scammers often come with a heartbreaking story concerning why they need money as soon as possible. They can also pose as rich people who can pay their debts with interest but “right now, cannot access their funds.”
  • Leaving secure communication: The scammer may ask to leave a dating service or social media site to communicate directly.

Your chances of being scammed will also rapidly decrease when you use only trustworthy app stores with strict app review policies.

Your mobile’s chaperone

In case you’ve downloaded a malicious app, it’s good to have a powerful antivirus operating on your phone. This may be especially useful in cases where the app is fully functional and does not raise any obvious red flags.

Try ESET Mobile Security today!

 

ESET Mobile Security (EMS) can detect and block threats during the download process, even before installation occurs. This means that the threat never reaches the user. EMS can also be used to scan already existing apps to double-check that you haven’t bought the devil in disguise.

Moreover, EMS provides the user with real-time file system protection that scans all files in download folders for malicious code when opened, created, or run.

In the case of a malicious app or download, EMS alerts users that malicious code has been detected – as seen in the picture below.

Caption

You can also perform an on-demand scan anytime you want with two possible options:

1. Smart Scan goes through installed applications, executable files, SO files (SO stands for shared libraries), archives with a maximum scanning depth of three nested archives, and SD card content.

2. In-depthScan will check all file types, regardless of file-extensions, both in internal memory and on SD cards.

When ‘follow your mind’ advice won’t help you

When it comes to discussion of how to avoid disappointments in love, you often hear tips like “follow your mind, not your heart.” But if you are targeted by a sophisticated romance scam, chances are that such advice won’t help. This is true even for those who aren’t in a sad mood on Valentine’s Day.

In cases where your perception fails, you need reliable software equipped with advanced scanning capabilities to show you what your new chat app and new wannabe partner truly are.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

How Databook Labs met stakeholders’ expectations by doubling down its global team’s security

Databook Labs, a pioneering company in AI, has revolutionized the enterprise sales landscape. Their exceptional ability to interpret vast financial and market data arrays has notably enhanced global strategic relationships for sales teams.

Profile of Databook Labs

With users across 104 countries, the platform ingests and interprets billions of financial and market data signals to generate actionable sales strategies that connect the seller’s solutions to a buyer’s financial pain and urgency.

A successful product led to rapid expansion and a distributed workforce across 8 countries. Anne Simpson, Head of Privacy, Security, and Compliance at Databook Labs, walked us through how the company faced the pressing challenge of ensuring robust cybersecurity in a hybrid work environment.

The challenge

Scaling up securely in a global landscape

Databook Labs experienced accelerated growth, scaling from 12 to 100 employees and expanding to three global offices.

First, starting at the founder’s house basement, the company grew and got its first office before the pandemic. Changing team location and scale required an established security mindset.

Besides, this rapid development and a primarily remote workforce presented significant cybersecurity challenges.

“With a mostly remote workforce, Databook needed a way to secure data while working away from our known networks.”

Click to tweet

Their primary concern was safeguarding data across numerous unknown networks, a critical issue given their large enterprise customer base with stringent security expectations.

The solution

Choosing NordLayer for comprehensive security

When Anne Simpson, Head of Privacy and Security, joined Databook Labs, she recognized the need for a robust VPN solution to protect their global, remote workforce.

“The majority of our customers are large enterprises that want to see high-security standards in place.”

Click to tweet

Besides securing a remote workforce, Anne was also responsible for developing, maintaining, and enforcing Databook’s information security policies to meet client expectations.

“We encourage people to get out there and explore the world while working. When they appear on an unknown network, I can’t guarantee the data transmission’s security, so we had to get a VPN.”

Click to tweet

The integration of NordLayer allowed the company to maintain a high level of security without the need for extensive in-house resources.

“We are a very small team, so we don’t have the resources to build a VPN and maintain one in the house. And that’s what we love about NordLayer.”

Click to tweet

Compatibility, security, and simplicity are the key characteristics NordLayer solution proved to be the top pick.

Why choose NordLayer

After thorough research and peer consultations, NordLayer emerged as the ideal choice. Its ease of implementation, excellent customer support, and compatibility with non-technical users made it a perfect fit for Databook Labs.

The company already had SOC 2 certification, so adding NordLayer to our policies and procedures made it all about privacy and security at Databook Labs.

“After the demo, we felt that NordLayer was the easiest to implement. It gave us everything we needed, and the team was really helpful. We’ve never had a problem with any customer service support issues.”

Click to tweet

As Anne Simpson claims, the tool doesn’t require manual handling, and the security manager doesn’t need to worry about it.

How NordLayer helps manage the expectations of different parties

Overall, NordLayer simplifies the experience of enabling and using a remote network access security tool. It’s designed to be user-friendly for non-tech-savvy employees while meeting the high standards expected by clients and stakeholders.

The outcome

Enhanced security and operational efficiency

Implementing NordLayer had a profound impact on Databook Labs. Anne Simpson and her team found peace of mind in knowing that their data was secure and that they were in compliance with global regulations.

“NordLayer is very user-friendly. During onboarding, our team members receive training on using the VPN, and the Okta integration plays a crucial role. They are well-versed in when it is most beneficial to be connected to the VPN.”

Click to tweet

NordLayer’s solution, with its simplicity, allowed the team to dedicate more time to strategic objectives. It also made it easy for non-technical employees, eliminating the need to manage VPN complexities.

“I would recommend NordLayer VPN as it is simple to use and does not incur any upfront costs, such as setting up our own VPN and needing on-premises hardware.”

Click to tweet

Additionally, NordLayer’s performance causes any issues with the company’s operations, easing initial concerns about potential slowdowns.

Pro cybersecurity tips

Everyday cybersecurity rules should become a mantra of every tech user in the modern world. But sometimes, it’s not that obvious where to start. Thus, here are the main recommendations from the Head of Privacy, Security & Compliance at Databook Labs, where it’s worth concentrating your focus to begin with.

Quotes of Databook Labs

Databook Labs’ experience using NordLayer proves that being accountable for data security is challenging with remote teams yet achievable using the right solutions. Discover how compatible your cybersecurity strategy is with the NordLayer tool and enjoy the peace of mind it brings to every IT manager who uses it.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

[IMPORTANT] Registration Server will be regularly maintenance on 2024-02-17 (04:00 pm) to 2024-02-18 (04:00 am)

IMPORTANT !

ESET planned Network Core Infrastructure maintenance in ESET HQ which will take place on
Saturday, February 17th, 2024, from 4:00 PM to Sunday, February 18th, 2024, 4:00 AM, Hong Kong Time lasting 12 hours.

The impact of this outage covers ALMOST ALL ESET services, regardless internal or external.
It means in certain time within the maintenance window, customers might not place orders, activate license or generate license, etc.

That means Order System, Check Key, Key activation and eStore all affected.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Finding TeamCity On-Premises installations with runZero

On February 6th, 2024, JetBrains disclosed a serious vulnerability in the TeamCity On-Premises product. 

The issue, CVE-2024-23917, allows attackers who can access the TeamCity installation via HTTPS to bypass authentication mechanisms and gain administrative privileges on the affected systems.

What is the impact? #

Upon successful exploitation of these vulnerabilities, attackers can execute arbitrary commands on the vulnerable system. This includes the creation of new users, installation of additional modules or code, and, in general, system compromise.

Are updates or workarounds available? #

JetBrains has released an update to mitigate this issue. Users are urged to update as quickly as possible.

How do I find potentially vulnerable TeamCity installations with runZero? #

From the Services Inventory, use the following query to locate assets running the vulnerable products in your network:

product:TeamCity

Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Zero Day Bug Evolution and the Power of NAC

Zero-day bugs have proven to be a constant source of concern due to their potential to exploit vulnerabilities before they can be patched or even known. But worry not; solutions like Network Access Control (NAC) can effectively mitigate their impact on corporate networks. Today, we dive into the evolution of zero-day bugs, their impact on corporate networks, and the power of NAC in dealing with them.

Understanding the Zero-Day Bug Evolution

Zero-day bugs stand out in the realm of cybersecurity due to their unique nature. These elusive threats are essentially software vulnerabilities that cybercriminals leverage before they are detected or fixed by the software developers. As a result, there are literally ‘zero days’ left to address these vulnerabilities, hence the name. The evolution of zero-day bugs from simple nuisances to significant threats has been a multi-faceted process resulting in a rapid progression that is increasingly detrimental. The advancement and proliferation of internet usage have amplified the potential risks associated with these bugs.The advent of cloud computing has also played a significant role in their evolution. Cloud environments, with their vast, interconnected networks, have increased the number of potential entry points for hackers to exploit these bugs. Perhaps, the most significant contributor to the development of zero-day bugs has been the rise of the Internet of Things (IoT). IoT devices, ranging from smart thermostats to connected security systems, have exploded in popularity over recent years. However, these devices often lack robust security features and, therefore, present a fertile ground for zero-day exploits. The journey of zero-day bugs reflects the broader trend in the cybersecurity landscape: an increasing attack surface due to technological advancements even in the most secure environments. Recently, a ransomware gang used a new zero-day flaw to steal data on 1 million hospital patients. As such, it’s crucial for network administrators and engineers to comprehend this evolution and its implications. Understanding the trajectory of zero-day bugs is a significant first step towards developing robust strategies to combat them.

The Impact on Corporate Networks

When zero-day bugs successfully infiltrate corporate networks, the repercussions can be severe and far-reaching. Given that these vulnerabilities can be exploited before they are detected, organizations could suffer significant setbacks before even realizing there is a problem. These impacts often extend beyond the IT department, reverberating across an entire enterprise. The cybercriminals who exploit zero-day vulnerabilities have the potential to access, steal, or manipulate sensitive data, which could include proprietary business information or confidential customer data. This data breach could result in severe financial penalties, particularly if regulatory requirements are violated, and the fallout could damage customer trust, leading to loss of business. A single attak could be financially crippling for most companies as the global average cost per data breach was 4.45 million U.S. dollars in 2023.

Operational Headaches

In addition to data breaches, zero-day bugs can disrupt critical services. Operations may be halted or slowed as IT teams scramble to identify and address the vulnerability. This disruption can result in costly downtime, with businesses losing valuable time and money. Furthermore, zero-day exploits can enable cybercriminals to gain control of systems, which can lead to further compromise. With this level of access, attackers can potentially alter system configurations, install additional malicious software, or even lock out legitimate users. Such a situation could result in prolonged system outages or require extensive effort to remediate.

Covert Attacks

Perhaps the most alarming aspect of these bugs is their ability to bypass traditional security defenses. This is due to their unknown nature, which allows them to go undetected by typical antivirus software and firewalls. Consequently, network administrators may find themselves battling an invisible enemy, making the task of protecting corporate networks significantly more challenging. In the face of these potentially devastating impacts, it becomes evident that proactive measures are necessary to guard against the stealthy and unpredictable threat of zero-day bugs. As technology continues to evolve and create new vulnerabilities, organizations must continue to enhance their defense strategies to keep pace.

The Power of Network Access Control (NAC)

In the dynamic landscape of cybersecurity, Network Access Control (NAC) emerges as an efficient and proactive defense mechanism against zero-day bugs. This security solution is essentially a gatekeeper, governing access to a corporate network based on specific policies set by network administrators. By exerting control over who and what is accessing the network, NAC provides an additional layer of defense against cyber threats.

Network Visibility

The main strength of NAC lies in its ability to provide a comprehensive view of the network. It affords administrators a holistic perspective of network access, shedding light on every device, user, and connection. This visibility is crucial in detecting potential threats and irregularities that could indicate an exploited zero-day vulnerability. Moreover, NAC is not just about monitoring; it’s about action. It can enforce policies on devices and users, blocking or limiting access if they fail to meet certain criteria. This proactive approach can help prevent unauthorized access and reduce the risk of zero-day exploits. NAC also offers a degree of adaptability. It can be tailored to fit the specific needs and security posture of an organization, from defining policies to customizing alerts and responses. This flexibility allows it to evolve in tandem with an organization’s growth and changing security needs, thereby enhancing its value as a long-term investment.

Safe and Secure with NAC

With the right NAC solution, an organization can not only protect its network but also align with compliance requirements. By enforcing access policies, documenting all network connections, and providing comprehensive reports, NAC helps businesses demonstrate their commitment to secure practices and meet regulatory standards. In the battle against zero-day bugs, Network Access Control (NAC) serves as a potent ally. Its ability to offer visibility, enforce policies, and adapt to changing needs, positions it as a key player in the realm of network security. However, its true power lies in its capability to turn the tide in an organization’s favor, transforming potential vulnerabilities into fortified defenses. Looking for a NAC solution for your organization? Portnox’s cloud-native NAC solution delivers passwordless authentication, endpoint risk monitoring, and 24/7 compliance enforcement.

Implementing NAC for Enhanced Security

The first step in deploying NAC within your organization is to establish comprehensive network access policies that clearly define who or what can have access, when and where this access can occur, and under what conditions. These policies will serve as the foundation upon which your NAC solution operates. It is essential to involve all key stakeholders in this policy development process, ensuring that it reflects the unique needs and challenges of your organization. Once your policies are in place, it’s time to select and implement a NAC solution that aligns with these guidelines. Effective network controls are the foundational core of your enterprise security strategy. NAC solutions come in a variety of forms, including hardware and software solutions. They can be implemented as standalone products or integrated with existing network infrastructure. The choice between these options will largely depend on your organization’s specific needs and the complexity of your network environment.

NAC is the New Black

Cloud-based NAC solutions, in particular, have become increasingly popular, largely due to their inherent scalability and relative ease of deployment. These solutions are ideal for organizations with rapidly growing networks or those with a significant number of remote or mobile users. A cloud-based approach allows for the management of network access control from any location, providing a significant advantage in today’s increasingly mobile and decentralized work environments. Regardless of the form your NAC solution takes, its implementation should be carried out with a focus on ensuring seamless integration with existing systems and minimal disruption to network operations. During this phase, it’s critical to test the solution thoroughly, ensuring that it operates as expected and aligns with your defined policies. This process may involve several rounds of testing and adjustments as necessary. Additionally, consider the ongoing management and maintenance of your NAC solution. This includes regular updates and patches to keep it effective against new and emerging threats. Preventing attacks should always be tops of mind as bad actors are constantly finding innovative ways to target vulnerabilities. In fact, 2022 is the second-highest recorded year for zero-day vulnerabilities since 2014. Remember, a robust NAC implementation is not a one-time project but an ongoing commitment to network security.

Navigating Future Challenges with NAC

The cybersecurity landscape is not static; it continues to evolve at a rapid pace. The introduction of new technologies and the increasing complexity of cyber threats require equally advanced security measures. As we peer into the future, Network Access Control (NAC) undoubtedly retains its key role, but it must also evolve to meet the changing dynamics of network security. Emerging technologies like 5G expand the potential attack surface for zero-day bugs. However, an adaptable NAC solution can rise to this challenge, leveraging these new technologies to enhance its capabilities and provide more robust defenses.

IoT

Moreover, the Internet of Things (IoT) continues to grow and diversify, with each new device potentially a new entry point for an attack. But with its comprehensive visibility, NAC can keep track of every connected device, regardless of its nature or number, thereby strengthening its defense against the exploitation of IoT devices. The sophistication of zero-day threats also continues to increase, as cybercriminals employ increasingly innovative techniques to exploit unknown vulnerabilities. But the power of NAC is in its proactive approach and its ability to adapt. It can evolve in line with these threats, enforcing stricter policies and enhancing detection capabilities to identify and neutralize potential exploits.

Future Success with NAC

However, to navigate these future challenges, a continued commitment to NAC is required. The deployment of a NAC solution is not the end of the journey but rather the beginning. Constant updates, regular testing, and continual adaptation to new network realities are essential to maintaining an effective NAC solution. As the future unfolds with new technologies and advanced threats, NAC remains a vital tool in the cybersecurity arsenal. Its power lies not just in its current capabilities, but also in its capacity to adapt, evolve, and rise to the challenges of tomorrow. Invest in the secure future of your organization with the help of Portnox’s cloud-native NAC solution. With the Portnox Cloud, powerful and easy-to-use network access control functionality is available at your fingertips.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

23.12.6 Voyager released

Changes compared to 23.12.5

Enhancements

  • Improved the performance of S3-compatible Storage Vaults when Object Lock is enabled
  • Improved the performance of simulated restores for most Protected Item types
  • Added a Job History tab to the User details page which shows jobs for the selected user in the Comet Server web interface

Bug Fixes

  • Fixed an issue preventing one or more files from being selected for restore when a partition of a virtual disk is selected in the granular restore workflow
  • Fixed a crash caused by an out-of-bounds access when using granular restore from a Hyper-V Protected Item
  • Fixed an issue with the Comet Server web interface where schedule options would overlap in certain languages
  • Fixed an issue with extra fields appearing when editing a Storage Template created prior to 23.12.5 in the Comet Server web interface
  • Fixed an issue with missing validation for Storage Template settings using the Custom Remote Bucket type
  • Fixed a cosmetic issue with not resetting the Test Connections button state when switching Storage Template types in the Comet Server web interface
  • Fixed a cosmetic issue with showing an unusable Test Connections button for Storage Template settings using the Custom Remote Bucket type
  • Fixed an issue with unexpected “incomplete data” log messages when restoring large files to certain locations

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

Finding AnyDesk Installations with runZero

On February 2, 2024, AnyDesk disclosed that they have been the victim of a cyber attack that has compromised production systems. 

This compromise led AnyDesk to revoke its current code signing certificate, as well as reset all passwords for various cloud services.

The company indicates in their statement that they do not have any evidence that end-user systems have been compromised. They do, however, recommend users change passwords if they are used for both AnyDesk and other services. The company also recommends that users update to the latest version of AnyDesk with the new code signing certificate.

What is the impact?

According to the company they do not have any evidence that end-user systems have been compromised. However, they state that their production systems have been impacted and have revoked their existing code signing certificate.

Are updates or workarounds available?

As part of its statement, AnyDesk urged users to change their passwords if the same password is used for AnyDesk and other services. Additionally, they recommend that users update to the latest version of AnyDesk, which uses the new code signing certificate.

How do I find AnyDesk installations with runZero?

From the Services Inventory, use the following query to locate AnyDesk clients:

product:AnyDesk

Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Virtual vs. physical firewalls: why going virtual wins

Introduction: understanding virtual firewalls 

As businesses adapt to hybrid work models, traditional hardware firewalls are reaching their limits. Designed for on-premises security, they excel within office perimeters but may struggle in remote work culture.

Gartner® highlighted this gap, predicting a significant shift toward Firewall-as-a-Service (FWaaS) by 2025. This transition reflects a growing need for security that goes beyond physical boundaries.

Cloud firewalls, such as NordLayer Cloud Firewall, step in to fill this gap. It extends protection to every endpoint, anywhere, bridging the gap left by traditional firewalls. Moreover, it simplifies security management and adapts to various environments, from the office to the cloud.

Key takeaways

  • Cloud firewalls deploy faster and cheaper than physical ones, needing no physical setup and integrating online quickly.

  • They’re cost-effective, with automatic updates, free patches, and lower operational costs due to no physical maintenance.

  • Cloud firewalls allow easy, fast updates and policy changes via the web, perfect for changing businesses.

  • They scale easily, adjusting resources as needed without hardware delays and offering flexible payment options.

  • Ideal for hybrid work, cloud firewalls provide consistent access and security for both remote and office workers, unlike office-restricted physical firewalls.

Easier, faster and cheaper deployment

In the past, we purchased a physical firewall akin to a router and placed it in the office server room. This box was then connected to the modem.

Setting up a physical firewall meant engaging in physical setup, network configuration, and rigorous testing—a process demanding both time and technical know-how.

A Cloud Firewall offers a modern and straightforward approach to network security. Its setup includes a few steps: choosing a provider, setting up a gateway, and adding rules. This method fits smoothly into your existing network, eliminating the need for extra hardware and saving time and resources. Plus, testing is faster than with traditional methods.

The ease and speed of installing a Cloud Firewall benefit IT teams greatly. For example, setting it up with NordLayer can take just 10 minutes.

Starting from zero with no cybersecurity means both cloud and physical firewalls need initial setup time. Time-wise, the difference isn’t very large.

A physical firewall could be more cost-effective if you have the right staff. But that’s only true if your business doesn’t plan to grow or change work formats.

Easier, faster and cheaper maintenance

Firewall maintenance includes regularly updating and applying patches to ensure optimal security. It also involves monitoring for any potential vulnerabilities and making necessary adjustments.

A Cloud Firewall is more efficient, cost-effective, and reliable even for businesses where everyone works in the office. Its lower maintenance, easy management, and strong security make it great for those seeking easy and effective network protection.

Here are things to consider about a physical firewall

  • Yearly maintenance costs 10–20% of the initial price.

  • Redundancy needs double the investment.

  • Power outages disable it without UPS investment.

  • May need special training or staff.

  • Manual updates need constant attention.

  • Support could mean extra costs.

  • Hardware upgrades are pricey.

  • Might use more bandwidth.

Cloud Firewall benefits

  • Support services are part of the subscription.

  • Removes the need for multiple firewalls.

  • Works without direct power, avoiding outage issues.

  • Updates and maintenance happen automatically.

  • Upgrades are free, keeping security current.

  • Manage and monitor easily from a browser.

  • Updates without interrupting network protection.

  • Little technical knowledge needed, but support is available.

  • Uniform security throughout your network.

  • It uses no office space.

Easier and more flexible rules update

NordLayer’s Cloud Firewall allows easy creation of rules. The control panel is user-friendly for everyone, regardless of IT expertise.

With NordLayer Cloud Firewall, you can edit or disable any rule anytime. You can manage and update destination address and network services centrally in the NordLayer Control Panel. Any changes to IP addresses or network services automatically update all firewalls where they are in use. Rules for each employee turn off automatically when their NordLayer account is terminated. Plus, every action is documented for tracking.

Easier, faster, and cheaper scalability

Cloud firewalls offer easy scalability without physical hardware. They adjust resources on demand, avoiding the extra costs and delays of buying and installing equipment. Their automated setup and simple web interface configuration allow quick changes, making transitions smooth.

These firewalls are cost-effective, too. They cut down on operational costs, as there’s no need for physical upkeep or upgrades. This approach, along with less strain on IT staff, makes cloud firewalls economical for growing businesses’ network security.

With a physical firewall, more planning means slower progress.

Enables and protects hybrid infrastructure & hybrid workforce

A traditional physical firewall is strong and reliable for teams that only work in the office. Its benefits are clear in a fixed setting. But its advantages lessen when your team mixes office with remote or travel work.

While you can access on-premises firewalls from any location through IPSec tunnels or similar technology, this approach may reduce convenience, slow down processes, and complicate matters, especially with multiple sites.

The Cloud Firewall adapts to this evolving work scene. It enables and secures team members working from anywhere, be it at home, a cafe abroad, or an airport.

It removes location limits, giving remote workers the same access and security as office staff. For businesses with global teams and flexible work, the Cloud Firewall leads in providing secure and effortless connectivity.

Conclusion

Cloud Firewall brings a major upgrade in network security. It meets the needs of modern hybrid businesses with its ease of use and cost efficiency. It removes the reliance on physical hardware and delivers strong security from the cloud to every endpoint. This change not only boosts safety but also improves IT operations.

Setting up a Cloud Firewall is easy: for that, you need to be a NordLayer Premium plan user. It’s manageable through the NordLayer Control Panel.

In short, choosing NordLayer’s Cloud Firewall is a strategic step towards a more secure, efficient, and forward-looking network.

For more details about our Cloud Firewall, contact our sales for assistance.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

NIS2 directive: A key to compliance is business continuity

As the timeline to implementation of the NIS2 directive shortens, businesses find themselves contemplating the necessary steps for implementing robust cyber security and IT compliance. The impending deadline of October 17, 2024, necessitates a strategic approach to meet the regulatory requirements outlined in NIS2. 

This article provides actionable insights into how organizations can proactively prepare for NIS2 compliance, with a particular focus on backup management and disaster recovery as integral components for ensuring business continuity — a key focus of the new directive, specifically article 21.

Let’s jump into the essential steps businesses can take now to fortify their defenses against cyber threats by following a best practice framework.

If you’re looking for a general overview of all things NIS2, such as who does NIS2 apply to, read our blog, “What is the NIS2 Directive?”

What to do now: Get your business ready with best practices

Article 21 of the NIS2 directive sets out clear cybersecurity risk-management measures “to protect network and information systems” that focus on ensuring business continuity through “backup management and disaster recovery.”

 

At the minimum, the best practice would be to back up vital data, create a strong disaster recovery plan, and then test these processes to know that they work as expected (meaning you have protected your business-critical data and it can be recovered). Luckily, to help elaborate on this practice, there’s a framework to follow to help guide you through the process: Map, prioritize, test.

Map-prioritize-test framework for NIS2 directive compliance backup and disaster recovery

Map-Prioritize-Test framework to ensure compliance

This framework is helpful for businesses to prepare for compliance with the expected NIS2 requirements by boosting cyber resiliency, most notably by maintaining business-critical functions through protecting key business infrastructure. Here’s more detail about what each leg of the framework entails:

1. Map critical systems

Assess and analyze critical infrastructure across on-premises, native cloud, and public cloud environments. Identify and prioritize crucial data, ensuring business continuity. Don’t overlook SaaS applications like Entra ID; safeguarding identity and credential data is vital.

 

Neglecting identity and access data can impact business continuity even if other data is fully restored. Microsoft recognizes identity systems as more critical than human life support systems due to how important this data is for businesses: Read what Microsoft has to say about the importance of backing up Entra ID (formerly Azure AD).

2. Prioritize: What is critical to maintain access to?

Understanding the nature of your data is key to strengthening your organization’s data resilience. As you consider the types of data you handle, such as SaaS data from Microsoft 365 (M365) or Entra ID, it becomes evident that not all data holds equal importance. This realization forms the basis for strategic prioritization, a critical step in preparing for NIS2 compliance.

 

Whether safeguarding CEO emails, logistics data, customer information, intelligence dashboards, or proprietary code, identifying the priority for recovery establishes a strategic foundation. This speeds up recovery time and minimizes downtime, ensuring that your business continuity efforts are precisely aligned with the specific datasets crucial for sustaining your operations.
By determining what needs to be recovered first, you ensure that your business continuity efforts are targeted and aligned with the specific data sets crucial for sustaining your operations. This strategic prioritization not only optimizes your backup plan but also enhances your preparedness for compliance with the NIS2 directive.

3. Test that your backup works

This critical phase of the framework involves validating the effectiveness of your backup and disaster recovery processes. Testing is a key element of continuity, because with regular testing, your business ensures that data recovery is possible in the event of a real crisis — this is best practice data security and compliance in line with the NIS2 framework.

 

Ensuring the effectiveness of your backup and disaster recovery processes is crucial for maintaining data integrity and business continuity. The following guidelines outline key steps in the testing phase, aimed at validating your organization’s readiness to swiftly recover critical data in diverse scenarios.

 

From prompt validation of restoration capability to involving relevant stakeholders, this comprehensive testing phase guideline ensures confidence in your disaster recovery plan and ongoing resilience against potential threats:

  • Validate restoration capability promptly:
    Promptly validate that your backup systems can efficiently restore critical data without compromising integrity.
  • Determine acceptable downtime:
    Establish the maximum allowable time for data recovery, aligning with recovery time objectives set during prioritization.
  • Regularly test backups for confidence:
    Frequently test your backups to instill confidence in your disaster recovery plan and promptly address any identified issues.
  • Consider different scenarios:
    Simulate diverse scenarios, testing the recovery of individual files, entire databases, and complete systems to identify weaknesses.
  • Document and analyze results:
    After each testing session, document and analyze the time, accuracy, and challenges encountered to gain insights for improvement.
  • Involve relevant stakeholders:
    Collaborate with IT teams, data custodians, and business continuity managers to ensure comprehensive testing aligns with broader goals.
  • Update and improve:
    Continuously update recovery plans based on testing insights, addressing weaknesses, refining procedures, and adapting to evolving threats.

As organizations diligently adhere to the rigorous testing guidelines outlined above, they pave the way for a robust IT compliance policy essential for NIS2 readiness. The elements of backup management and disaster recovery, as emphasized by Article 21 of NIS2, not only acknowledge its far-reaching impact but also serve as proactive measures against evolving cyber threats.

Keepit as an established expert in EU compliance

Keepit, being a European company based in Denmark, understands the intricacies of EU regulations and their profound impact as we’re also subject to them ourselves. We operate without any sub-processors and maintain our own independent cloud operations within the EU, utilizing data centers in Denmark, Germany, and the UK. With a commitment to excellence in compliance, Keepit holds end-to-end ISO 27001 certification and is audited in accordance with ISAE 3402 type 2.

 

To guide your company through the complexities of legislative directives such as NIS2, NIS, and GDPR, we invite you to explore a demonstration of how Keepit can assist in ensuring comprehensive compliance.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.