March 2024 - Page 5 of 7 - Version 2 Limited

Securing Your Organization Against the Harm of Identity-Based Attacks

Today, the specter of identity-based attacks looms larger than ever over the corporate world. These cyber-attacks, which exploit personal or organizational identifiers to gain unauthorized access to systems, have become a favored tool in the cybercriminal arsenal. Their rising prevalence underscores a critical vulnerability in the digital defenses of large organizations.

This discourse aims to dissect the anatomy of identity-based attacks, elucidate the tactics employed by adversaries, assess the potential harm to vast enterprises, and advocate for the strategic deployment of network access control (NAC) mechanisms as an essential countermeasure.

Understanding the Surge in Identity-Based Attacks

The escalation of identity-based attacks represents a sophisticated evolution in the cyber threat landscape, propelled by an intricate web of technological and behavioral factors. Sadly, 90% of organizations experienced at least one identity-related breach in the past year. This surge is primarily driven by the increasing digitalization of identities and the widespread adoption of cloud services, combined with the ubiquitous nature of remote work. These elements collectively expand the attack surface, offering cybercriminals a larger playground to exploit.

The complexity of these attacks is further magnified by the seamless integration of social engineering techniques with advanced technological exploits, making the detection and prevention of such intrusions increasingly challenging. Cybercriminals are leveraging the abundance of personal information available online to craft highly targeted attacks, exploiting the smallest vulnerability in human behavior or system security. In fact, more than 80% of confirmed breaches are related to stolen, weak, or reused passwords.

The shift towards more sophisticated and stealthy methodologies underscores a deliberate move away from brute force attacks to those that can silently bypass traditional security defenses, exploiting trust and the inherent weaknesses within organizational systems. This shift not only signifies a higher level of threat actor sophistication but also highlights the urgent need for organizations to adapt and evolve their cybersecurity strategies in response to this growing threat vector.

How Cybercriminals Execute Identity-Based Attacks

Cybercriminals, in their pursuit to breach corporate defenses, have fine-tuned the art of identity-based attacks through an array of sophisticated methods. Spear phishing represents one such tactic, wherein attackers, armed with detailed personal information, craft convincing communications to lure individuals into revealing their credentials. Additionally, attackers exploit the technique of password spraying, targeting numerous accounts with a few commonly used passwords, capitalizing on the prevalent issue of password reuse across multiple platforms. 74% of all breaches include the human element, with people being involved either via privilege misuse, use of stolen credentials, social engineering, or error

These adversaries are also adept at employing social engineering to manipulate users into granting access or performing actions that compromise security. Once the initial breach is achieved, these malefactors employ lateral movement strategies, exploiting legitimate but compromised credentials to navigate through the network undetected. This stealthy traversal is aimed at escalating privileges and gaining access to high-value targets, all while masquerading as legitimate users. These methods, rooted in deception and exploitation of trust, underscore the criticality of vigilant, adaptive security measures to counteract the ever-evolving tactics of cyber adversaries.

The Devastating Impact on Large Organizations

For substantial enterprises, the fallout from identity-based attacks extends far beyond immediate fiscal deficits; it strikes at the very heart of their long-term viability and brand integrity. Such intrusions inflict profound reputational harm, undermining public confidence and loyalty, which are not easily restored. The illicit acquisition of proprietary information, customer data, and sensitive strategic insights by adversaries can severely disrupt competitive positioning and operational continuity. This breach of confidential information often leads to non-compliance with stringent regulatory standards, attracting severe legal sanctions and further financial drain.

The aggregated impact of these repercussions can dramatically alter an organization’s market standing and its ability to secure future opportunities. In this challenging landscape, the paramount importance of robust cyber defenses becomes unequivocally clear, underscoring the necessity for organizations to anticipate, recognize, and neutralize these sophisticated threats with unwavering diligence and advanced protective strategies.

The Crucial Role of Network Access Control in Mitigating Risks

Network Access Control (NAC) stands as a paramount defensive strategy in safeguarding large organizations from the nefarious reach of identity-based attacks. This advanced guard operates by meticulously validating the credentials of both users and devices seeking entry into the network, ensuring that only those with legitimate authorization can penetrate its digital perimeter.

NAC’s efficacy is further enhanced through its dynamic policy enforcement capabilities, which tailor access rights based on a comprehensive assessment of user roles, device integrity, and the nature of the requested resources. Moreover, its sophisticated monitoring mechanisms are adept at swiftly identifying and isolating suspicious activities, thereby serving as an early warning system against potential breaches.

Through the diligent application of NAC, organizations erect a formidable barrier that not only curtails the operational playground of cyber adversaries but also fortifies the trust and confidence vested in them by their stakeholders. Implementing NAC is not merely a tactical defense measure but a strategic move towards creating a resilient and secure digital ecosystem, capable of withstanding the complex challenges posed by identity-based threats.

Best Practices for Leveraging NAC to Combat Identity-Based Attacks

To optimize NAC as a bulwark against identity-based attacks, a strategic approach rooted in vigilance and precision is imperative. Crafting a meticulous inventory that catalogues every user and device interfacing with the network underpins the creation of an impenetrable defense mechanism. This foundational step ensures no entity remains hidden or unmonitored within the digital expanse of an organization. Establishing policies that are not only robust but also nuanced, reflecting the unique position and access requirements of each user and device, is crucial. This granularity enables a more tailored security posture, minimizing unnecessary access that could potentially be exploited by cyber adversaries.

Engaging in relentless monitoring and conducting systematic audits are essential to unearth and swiftly mitigate any irregularities or signs of compromise. This proactive surveillance acts as the organization’s digital immune response, poised to neutralize threats at their inception. Further strengthening the NAC framework through seamless integration with complementary security technologies, such as Multi-Factor Authentication (MFA) and Security Information and Event Management (SIEM) systems, elevates the security matrix to new heights.

Additionally, fostering a culture of cybersecurity awareness among employees, emphasizing the criticality of vigilant digital hygiene practices, serves as the linchpin in safeguarding the organization’s digital domain against the scourge of identity-based attacks. This collective effort fortifies the digital bulwark, ensuring the integrity and resilience of the organization’s network against the evolving threat landscape.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Women’s Day: ESET’s Women in Cybersecurity Scholarship

Cybersecurity, traditionally a male-dominated industry, is gradually changing. According to a recent Women in Cybersecurity report, women accounted for 25% of the global cybersecurity workforce in 2022. The report suggests that the percentage could rise to 35% by 2031.

ESET recognizes that women remain underrepresented in the cybersecurity industry, and the company has been making significant efforts to help close the gender gap in science, technology, engineering, and mathematics (STEM). Since 2016, ESET has been awarding scholarships to women in the United States who are pursuing studies in cybersecurity or related fields. The program is currently running at ESET’s offices in the United States (offering two $10,000 USD scholarships), and Canada (offering two $5,000 CAD scholarships), and is launching this year in the United Kingdom and Australia.

Australia is launching their Women in Cybersecurity Scholarship on March 8,2024. The scholarship value is AUD 5,000, and is supported by the Australian Minister for Home Affairs and Cyber Security, Clare O’Neil.

Applicants are evaluated on their passion for cybersecurity, academic achievement, leadership, community involvement, and potential for future success. This scholarship offers a fantastic opportunity for women who are passionate about cybersecurity. It provides not only financial support but also a network of motivated women already working in STEM.

Remember, International Women’s Day is not only about celebrating the achievements of women but also about taking action to create a more equal future. Diversity, Equity and Inclusion (DEI) matters to us at ESET because we believe different experiences and views enable us to drive innovation, efficiency and creativity.

Watch this video to find out more about the global program and about the employee resource groups created at ESET to support women working at the company.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2024

Secure and Reliable Networks: Your Frontline Against Cyber Threats

In today’s digital landscape, a stable and secure network is crucial for businesses of all sizes. It forms the foundation of effective cyber threat protection. However, without this foundation, even the most sophisticated cybersecurity tools and systems can fall short. But how can you ensure both security and stability?

An efficient network must be resilient, highly available, robust, scalable, and secure. While there’s no one-size-fits-all solution, implementing best practices tailored to your network environment and your business needs can set you on the right path.

Let’s explore the key aspects of network security: data network architecture, network segmentation, and network access control.

Data Network Architecture:
Building a Strong Foundation

When defining your network architecture,it is important to consider topology, technology choices, and communication protocols, and ensure they are all tailored to fit your organization’s structure and needs. Whether you’re a small manufacturer, a global enterprise, a university, an ISP, or a data center, understanding the layers of the OSI model is crucial for building a secure network.

At the physical layer (L1), the quality of your infrastructure is paramount. Poor-quality fiber optics, inadequate cabling, or faulty network sockets can undermine network performance. We’ve all seen instances where a network faltered due to damaged cables or dirty connectors. These local problems can escalate to higher levels, potentially disrupting part or all of your network.

Moving up to the data link layer (L2), we encounter the Spanning Tree Protocol (STP). This crucial protocol prevents loops in the network, ensuring only one active path between any devices. However, STP recalculation can affect the entire L2 topology, leading to widespread network outages. To mitigate this risk, it’s essential that all devices within the STP domain support the same STP protocol and, ideally, can create STP trees across individual VLANs. Additionally, accurate configuration of the Root Bridge or the implementation of a Root Guard is highly recommended.

At the network layer (L3), issues from L2 can lead to disruptions. For instance, connecting VLANs between routers within a dynamic routing protocol can introduce problems. To minimize the impact of L2 issues, consider logical or geographical segmentation of your network at the L3 layer.

Maintaining a stable network requires continuous monitoring of all individual elements and performance metrics like Round Trip Time (RTT), Average Response Time (ART), and User Experience Time (UET). Tools like GREYCORTEX Mendel can assist you by tracking these metrics, identifying configuration issues, and reporting anomalies to ensure smooth operations.

Network Segmentation:
Protecting LAN Integrity

Network segmentation plays a crucial role in both the security and performance of your data networks.

From a performance standpoint, it’s advisable to separate individual broadcast domains into network segments using VLANs. This minimizes unnecessary broadcast and ARP queries, leading to a more stable network. Moreover, selecting the optimal STP protocol further reduces the impact on these domains.

From a security perspective, segmenting the network into smaller subnetworks simplifies access control management and eases the inspection of communication between segments. It’s important to monitor whether your current network traffic complies with your security policies.

GREYCORTEX Mendel excels in network security monitoring, providing you with clear insights into your network activities. It also verifies whether current traffic aligns with your security policies and offers a straightforward visualization of the results.

Network Access Control:
Knowing Who’s on Your Network

Effective network access control should be enforced both at the level of network devices and of end users. At the device level, several measures can prevent unauthorized devices from compromising your network:

BPDU Guard: This security function detects BPDU (Bridge Protocol Data Unit) packets used for communication and information propagation within the STP. If BPDU packets are detected, it blocks the switch port, preventing an unauthorized “smart” switch from connecting.
Port Security: Properly configuring port security involves defining the number of MAC addresses allowed on a single port, thereby limiting the potential use of a connected “rogue” switch. Alternatively, you can allow only a specific MAC address, preventing the connection of any devices other than those that are configuration-approved.
802.1x with EAP (Extensible Authentication Protocol): In dynamic environments where users frequently move and connect from different locations, 802.1x with EAP is recommended. This protocol facilitates user and device authentication, determining network access and dynamically assigning devices to specific VLANs based on organizational departments.
Advanced Access Control: For a more detailed approach, additional attributes such as the device’s “health status”, software configuration, or specific settings can be included. This often requires an endpoint agent, which may be standalone or part of an endpoint protection client suit. The agent collects data on the device, such as the OS version, endpoint protection status, installed applications, and registry settings, integrating this information into the access control policy.

GREYCORTEX Mendel offers a clear view of network assets and their interconnections, providing insights beyond what is recorded in asset management systems.

Remote access management

Remote access management is increasingly important as users often work beyond the secure boundaries of their organization. While traditional VPN access still remains popular, it has limitations and often falls short in providing adequate security. To address this, it’s important to monitor several aspects of VPN usage: who is accessing the VPN, which devices or systems they are communicating with, the protocols in use, the services accessed, and the volume of data transferred. GREYCORTEX Mendel can help with carrying out this comprehensive monitoring.

For enhanced security, consider Zero Trust Network Access (ZTNA) solutions, which offer enhanced security by granting access only to specific applications or services, thus improving transparency and control over remote access.

Building a Secure Network Foundation

A high-performing network is the cornerstone of organizational cybersecurity. By leveraging NDR tools like GREYCORTEX Mendel and following best practices, you can ensure superior management and protection of your network infrastructure, strengthening your overall security posture.

Remember, a secure network is not just about having a perimeter defense—it’s about creating a resilient, monitored, and well-managed internal infrastructure that can withstand and respond to various cyber threats. By focusing on these key aspects—architecture, segmentation, and access control—you’ll be well on your way to building a network that’s both secure and reliable.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2024

Spy Skills for Your Business: Threat Intelligence Explained

Ever wanted to be a spy? With such a great deal of espionage operations happening online, gathering threat intelligence might feel like being a modern-day James Bond.

Think about cyber threat intelligence as having a spy network working to protect your business online. It’s all about gathering information on potential cyber threats — understanding how bad actors operate, what areas of business they might target, and what tools they use. Companies cannot effectively defend themselves from cyberattacks without well-researched, reliable data. With threat intelligence, businesses can stay one step ahead of cybercriminals, know what to look out for, and have a clear understanding of how to protect their assets.

A brief history of threat intelligence and its role in cybersecurity

Without cyber threat intelligence, a company is “blind and deaf.” It would not be an exaggeration to say that it is an essential part of cybersecurity. However, its shape and role in cybersecurity have changed over the years as a result of the internet’s evolution and the growth of worldwide interconnectivity. New cyber threats arise daily, making security experts develop innovative defensive strategies and tactics.

Initially, companies focused solely on basic security measures such as IP and URL blacklists and antivirus solutions. However, with the spread of malware, worms, and viruses in the early 2000s, they found themselves in need of more sophisticated threat detection and response capabilities. As cyber criminals got smarter and more organized, it became evident that security experts needed to collaborate and share information. Consequently, the President of the United States established the Information Sharing and Analysis Center (ISAC), a non-profit organization dedicated to facilitating the sharing of threat intelligence within specific industries.

In the 2010s, the rise of data automation and the emergence of Threat Intelligence Platforms (TIPs) resulted in organizations having the right tools to manage and analyze large volumes of data. These platforms are technological solutions that can manage data collected from multiple sources and presented in various formats.

Later on, TIPs were integrated into Security Operations Centers (SOCs), providing security analysts with a unified interface for accessing and utilizing cyber threat intelligence seamlessly in a company’s day-to-day operations. Threat Intelligence Platforms also became an integral part of Incident Response (IR) processes, delivering actionable scenarios for managing and mitigating the impact of a security incident on an organization. This integration made the response to cybercrime faster and more efficient.

Nowadays, the role of machine learning and AI in cyber threat intelligence grows stronger every day, helping to analyze and predict cyber threats. We can also see a shift in the cybersecurity objectives — from threat detection to cyber resilience, focusing on the business’s ability to recover quickly from cyberattacks. Fortunately, throughout the years of the digital revolution, the cybersecurity community has recognized the importance of collaboration, data sharing, and the integration of threat intelligence into the overall cybersecurity strategy.

Threat Intelligence Lifecycle

Gathering threat intelligence is a complicated process that involves collecting, processing, and analyzing large volumes of data. The outcome of this process should focus on vulnerabilities specific to your organization. It should be detailed and contextual and, last but not least, be actionable.

Let’s examine the six phases of the threat intelligence lifecycle:

1. Direction

The direction phase is a crucial part of the process: you cannot perform a secret service operation without specifying its objectives. Therefore, you should follow in the footsteps of the character played by Jodie Foster in the 4th season of “True Detective” and ask questions such as:

Who are the attackers?
What motivates them?
Which data assets and business processes need to be protected?
Protection of which aspects of the organization is our priority?
What happens if we fail to protect them?
What types of threat intelligence do we need to protect the company’s assets and respond to emerging dangers?

2. Collection

After setting goals and objectives, we can move to the next phase: data collection. The security team gathers raw data from various sources, including open-source intelligence (OSINT), commercial feeds, internal logs, and information shared within the cybersecurity community. At this stage, it’s important to validate our sources of information and the accuracy of collected data. This will allow us to avoid missing severe cyber threats or being misled by false positives.

3. Processing

Remember that nowadays, threat analysis relies on processing huge volumes of data, which is automated and requires data to be standardized and formatted. When our collected data are compatible, we can identify relationships and connections between different pieces of information to better understand the cyber threat landscape.

4. Analysis

Threat intelligence analysis is a human process that turns processed information into actionable intelligence, enabling data-driven decision-making. The analysis should prioritize risks, resulting in the creation of a threat management roadmap. It should also provide a context for collected threat intelligence by understanding the motives, capabilities, and tactics of cybercriminals. What’s important here is to present threat analysis in a way that decision-makers will easily understand.

5. Dissemination

Dissemination is a crucial part of threat intelligence management. Analyzed data must be transformed into actionable intelligence reports, alerts, or indicators of compromise (IOCs) that the security team can use to strengthen the company’s defense system. Then, those should be shared with relevant teams and decision-makers within the organization and, in some cases, with trusted external partners.

6. Feedback

Threat intelligence management and effectiveness must be evaluated. Did the intelligence have the impact you expected? Did it improve the company’s safety? What went wrong in the entire process? Answering those questions helps your business move forward and improve its threat intelligence program.

Four types of threat intelligence

We need to understand the types of threat intelligence to fully grasp its impact on overall business cybersecurity. Usually, cyber threat intelligence is divided into four categories, ranging from high-level information to specific technical details about cyber threats.

Strategic

Strategic threat intelligence is non-technical information focused on understanding the broader context of cyber threats. It may come in the form of reports describing hackers’ motives and capabilities, geopolitical influences, or industry-specific risks. Usually, this type of threat intelligence is presented to high-level stakeholders, e.g. the board of directors.

Tactical

This type of threat intelligence includes information that can be used by security experts to make data-driven decisions and actively defend the organization. Tactic intelligence is more detailed than strategic. For example, it may describe cybercriminals’ tools, attack avoidance tactics, or weak points in the company’s security infrastructure.

Operational

It provides real-time information on specific threats, ongoing crime operations, and emerging attack patterns. This type of intelligence enables the company to respond to specific cyberattacks immediately; it can also help mitigate the damage made by hackers.

Technical

Technical threat intelligence may come in the form of evidence that an attack is happening or specific indicators of compromise (IOCs). Ideally, it’s provided in real-time before the hackers can cause any significant damage. Examples of tactical cyber threat intelligence include phishing emails detected by AI tools or real-time data breach notifications sent by an advanced enterprise password manager.

How NordPass can help protect organizations

A country needs all kinds of security measures to protect its citizens: the border guard, the police, an army, and special agents. It can be safe only if all parties work together. The same rule applies to keeping your business safe. It requires all types of threat intelligence — every single one of them is an important part of the cybersecurity landscape. They are interconnected, and only together can they provide comprehensive defense against cybercrime. Even the best strategic plans won’t stand a chance if the company fails to recognize data breaches in real-time.

Luckily, there are tools available that can make gathering technical threat intelligence easier and more efficient. The NordPass built-in Data Breach Scanner automatically scans leaked databases and compares them with information stored in your and your employees’ password manager vaults. It generates password breach reports with detailed information about data leaks that have affected your company. Most importantly, it notifies you or your security team in real time about every new breach so you can act and protect your company immediately. Give it a try, and don’t let cyber threats slip through your company’s defense anymore!

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Nord Security NordPass 2024

24.2.3 Mimas released

Changes compared to 24.2.2

Bug Fixes

Fixed an issue with being unable to load a user with an “@” in the username in the Comet Server web interface
Fixed an issue with “Test Connection” on VMware Protected Items not working when logged in as a normal user

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

Comet 2024

How to use dark web monitoring: a talk with Mary D’Angelo

Today is just like any other day at the office. You are going through emails and laying out plans for your company’s upcoming big project when suddenly, your screen freezes. None of the troubleshooting steps work. Quickly, your IT team becomes anxious; the company’s network has stopped working. The reason is a security breach tied to stolen credentials from RIPE, an organization that assigns IP addresses across numerous countries.

This situation is similar to what Orange Spain experienced, suffering an outage due to a hacker who improperly accessed their RIPE account. Researchers at Resecurity have noticed a troubling trend: the dark web now houses millions of stolen network operator credentials, which cybercriminals are poised to misuse.

The dark web serves as a hidden space where these stolen credentials remain unseen. It is also where attackers coordinate their plans and recruit accomplices for future breaches.

For businesses, keeping an eye on the dark web is vital. It helps uncover new threats and trends as they arise.

Equally important are cybersecurity practices. They shield businesses from an increasing array of cyber threats.

By combining dark web monitoring with solid cybersecurity, businesses can establish a protective strategy to remain secure.

That’s why we talked with Mary D’Angelo, a leading Cyber Threat Intelligence and Dark Web Advisor. We discussed how the dark web works and explored why businesses might need dark web monitoring.

The interview’s highlights

The deep web makes up 80% of the internet, while the dark web and clear web each make up 10%.
The US Navy originally created the Tor network for good reasons, but now less than 1% is for whistleblowers and journalists.
Dark web monitoring lets businesses see planned attacks, indicating the immediate need for protection.
Ransomware groups are growing, and threat actors are switching to platforms like Telegram.
Companies should combine dark web monitoring and cybersecurity practices for early threat detection.

Key insight #1: the clear web makes up only 10% of the internet

NordLayer: To start, what is the dark web?

Mary D’Angelo: When I discuss the dark web, I refer broadly to its distinction from the deep web and the clear web. The dark web is a segment of the internet accessible only through specialized software, typically Tor, which I’ll mostly reference. It’s because Tor is the most commonly used. The deep web and clear web are other internet segments. The clear web includes anything findable via Google and other search engines. The deep web, while still accessible through search engines, comprises sites that are very hard to enter. Statistics indicate that the deep web constitutes 80% of the internet, with the dark web and the clear web each accounting for only 10%.

NordLayer: The dark web ensures anonymity and is technically limitless. How does the Onion Router contribute to this anonymity?

Mary D’Angelo: The Onion Router, a type of software made to connect to the dark web, encrypts messages in multiple layers, similar to an onion. These messages, when sent, pass through various relays or nodes, mixing up communications. Upon receiving a message, each relay cannot trace its origin, making it extremely difficult to track the messages and users’ activities.

Key insight #2: the original purpose of the dark web, initiated by the U.S. Navy, now makes up just 1% of its current content

NordLayer: Could you explain the legal and illegal aspects of the dark web?

Mary D’Angelo: It’s a common misconception that the dark web is entirely illegal. Initially, the Tor network was developed by the US Navy research team to enable secure communications.

The primary purpose of the dark web was to assist journalists and whistleblowers in remaining anonymous and using encrypted messaging on a privatized platform. Over time, it has evolved to host a significant amount of illegal activity.

It’s estimated that 40% of the dark web is comprised of child sexual exploitation material, with less than 1% now dedicated to whistleblower and journalism activities. The majority involves illegal marketplaces, threat actor forums, ransomware groups, and similar entities.

NordLayer: But the dark web also has positive uses for privacy and free speech. Can you discuss them?

Mary D’Angelo: The dark web is valuable for media organizations and individuals in censored countries, providing a secure communication channel. Organizations like ProPublica use the dark web for secure communications, offering a platform for whistleblowers and those reporting from repressive regimes.

NordLayer: Considering its origins, does the dark web offer more security than platforms like Amazon?

Mary D’Angelo: The comparison depends on what you mean by security. The dark web provides anonymity, encrypted messaging, and privacy, even for websites. Users on the dark web enjoy encrypted and anonymized communication unseen by others. Conversely, Amazon tracks all user information, making the dark web, in some respects, more secure. However, this anonymity also contributes to the prevalence of illegal activities.

NordLayer: Is regulation of the dark web a significant challenge?

Mary D’Angelo: Yes, law enforcement faces considerable difficulties in tracking down illegal activities due to the dark web’s structure. Although recent efforts have improved, the process is complex and time-consuming.

NordLayer: Can dark web marketplaces be shut down successfully?

Mary D’Angelo: Marketplaces like Silk Road and Alpha Bay have been taken down by law enforcement, involving extensive international investigations. Often, the downfall of these sites is due to the carelessness of threat actors. However, new marketplaces frequently emerge, creating a continuous cat-and-mouse game between law enforcement and dark web users.

NordLayer: How does law enforcement investigate the dark web?

Mary D’Angelo: Investigations involve collaboration with various agencies and platforms like ours that can index and search the dark web efficiently. Law enforcement builds cases on threat actors, tracking their movements and communications, often capitalizing on their mistakes to dismantle operations.

Key insight #3: dark web monitoring helps to detect the threat on its planning stage

NordLayer: How did your interest in the dark web begin?

Mary D’Angelo: My journey into the dark web began with my background in cybersecurity and network detection. Joining Searchlight Cyber, I deepened my understanding of threat intelligence and the significance of dark web monitoring to identify potential security threats to organizations.

NordLayer: Why is it important for businesses to monitor the dark web?

Mary D’Angelo: The dark web is a hub for threat actors to plan attacks. Dark web monitoring allows businesses to detect potential threats early in the planning stage, giving them more time to prevent attacks.

“You can also try NordLayer’s ThreatBlock to prevent threats. It automatically blocks access to harmful websites, making it easier to avoid entering a malicious site. You won’t see harmful ads and pop-ups, and you will be prevented from accessing websites linked to illegal activities or those marked as unsafe in trusted databases. This tool makes life easier.”
Martyna Gaidelė, Product Marketing Manager at NordLayer

Click to tweet

NordLayer: So how can organizations monitor the dark web effectively?

Mary D’Angelo: Companies like Searchlight Cyber provide services to monitor the dark web safely and efficiently, helping businesses to protect themselves without risking exposure to malicious content.

NordLayer: Can you share a success story related to dark web monitoring?

Mary D’Angelo: Our human intelligence team does a lot of the undercover work. Accessing some dark web sites is tough; it requires specific permissions. Our team managed to enter these sites and found someone selling domain access control credentials for a large US airline. They didn’t name the airline to avoid detection but shared details like the revenue size, location, and access type. High pricing often indicates legitimacy. Upon discovering this, I contacted the airline’s security team to alert them, despite them not being our client. We then discussed the intelligence, which was new to them, and together, we devised a plan to enhance their security.

NordLayer: That’s impressive. What security measures do you generally recommend to introduce?

Mary D’Angelo: We generally suggest enforcing multi-factor authentication (MFA) across all platforms. The approach depends on the attack type, but ensuring MFA is in place is crucial so that only authorized individuals have access.

“Multi-factor authentication (MFA) is an essential part of NordLayer. However, we advocate for a broader range of multi-layered authentication solutions and encourage our customers to implement more comprehensive Zero Trust Network Access (ZTNA) strategies.
Multi-layered network access control minimizes the risks of data breaches and aids in achieving compliance certificates, contributing to business credibility as well.
My favorite NordLayer features for network access control are the Cloud Firewall and Device Posture Security. They are easy to use and powerful solutions, ensuring advanced network access control.”
Martyna Gaidelė, Product Marketing Manager

Click to tweet

Key insight #4: Ransomware groups are hiring, which means even more attacks in 2024

NordLayer: Have you observed any trends in the dark web, such as an increase in ransomware groups?

Mary D’Angelo: Last year, we saw ransomware groups increase their recruitment. This means that they only plan to increase their attacks. They now have larger budgets because they were so successful last year in terms of the ransom payments. And so now they have more purchasing power, they can buy better exploits and better credentials. Bad actors also have their AI tool, called fraud GPT, which can just more easily and quickly make very sophisticated attacks.

Key insight #5: for businesses to stay safe, they need all employees to be aware of possible attacks

NordLayer: What general advice would you give businesses to enhance their security?

Mary D’Angelo: Businesses should prioritize early detection of threats by monitoring for reconnaissance activities. Leveraging threat intelligence to understand the landscape and adopting a proactive security posture can significantly reduce the risk of attacks.

NordLayer: How important is cybersecurity awareness?

Mary D’Angelo: Cultivating a culture of security throughout an organization is crucial. Integrating cyber threat intelligence across all levels can inform strategic decisions and prioritize security measures, ultimately making it more difficult for threat actors to succeed.

NordLayer: In conclusion, investing in cybersecurity is more cost-effective than facing the consequences of a ransomware attack.

Mary D’Angelo: Absolutely. The cost of proactive security measures is significantly lower than the potential losses from a successful cyber attack.

How NordLayer can help

NordLayer offers a comprehensive security approach, protecting your team with Threat Prevention from harmful sites, securing online activities with VPN, and ensuring appropriate access with Cloud Firewall. Beyond these tools, we advocate for adopting Zero Trust Network Access (ZTNA), Security Service Edge (SSE), and other cybersecurity frameworks to strengthen your defense. Our sales team is always here if you need any help along the way.

Beyond NordLayer’s offerings, it’s essential to create a culture of cybersecurity, maintain up-to-date software, and use secure communication tools. Additionally, assessing your vendors through a Third-Party Risk Management Plan and restricting their access can significantly mitigate risks.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

2024 Nord Security NordPass

What’s New? Quarterly Release 24.2 Mimas

This article covers what’s new our latest Quarterly release series from December 2023 to February 2024. Read the release notes here.

Comet 24.2.0 Mimas

We’re very pleased to announce our latest Quarterly release series – Comet 24.2 Mimas. This is the the latest entry in our quarterly rollup series, that branches off from our main rolling Voyager development into a fixed target for you to qualify and build your service offering upon.

Mimas is named after a moon of Saturn, which in turn takes its name from an ancient Greek mythological giant. Mimas is relatively small compared to Earth’s moon, with a diameter of about 396 kilometers (246 miles). Its composition is primarily made up of water ice with a small amount of rocky material. Its most distinguishing feature is a giant impact crater which stretches a third of the way across the face of the moon, making it look like the Death Star from “Star Wars.”

For users coming from the previous 23.11 Saturn quarterly release series, Mimas adds 3 features and 15 enhancements, including Dark Mode for the Comet Server web interface and a Debian installer for the Comet Backup desktop app as mentioned below.

The full set of changes can be found in the release notes.

Webinar announcement

If you’d prefer to watch rather than read, we’re hosting a webinar to discuss this new quarterly release and all the new changes. Please register before we go live on Tuesday 12 March (4pm ET / 1pm PT) to catch up on all the latest Comet news with Comet’s CTO, Mason – and as usual, there will be time for a live question-and-answer session at the end of the presentation.

As well as that, we have many more videos available on our YouTube channel, including guides on getting started with Comet, individual features, demonstrations with our technology partners, and webinars for previous quarterly software releases.

Dark Mode for the Comet Server

To continue our visual improvements to the Comet Server web interface we have added Dark Mode support. This completely overhauls the look and feel of the Comet Server and automatically applies based on the theme you have chosen for your system. Next time you have a chance check it out by logging into your Comet Server and clicking the new toggle button in the top right corner.

Light Mode:

Dark Mode:

Debian Installer for the Comet Backup desktop app

To make it easier to install Comet on your Debian Linux installs, we are pleased to announce our new Debian Installer. Our new installer will walk you through all of the required steps to install Comet. Comet is installed as a systemd service meaning it will now automatically start when your device boots.

Once installed you can still upgrade Comet remotely using the Comet Server web interface meaning you now have multiple options for managing, installing and upgrading Comet on your Linux devices.

Improved S3-compatible Object Lock Performance

Object Lock is a great way to add additional security to your data stored in an S3-compatible Storage Vault. This month we’ve been hard at work finding ways to optimize Comet’s performance when backing up to an S3-compatible Storage Vaults. We have found a way to significantly decrease the time taken to extend the object lock duration on objects stored in the vault. As a result, backup jobs to an S3-compatible Storage Vault now complete up to 16 times faster than before.

Custom Headers added for Custom Remote Buckets

Comet has a great list of S3-compatible storage providers that we have storage templates for. To add better support for other S3-compatible storage providers you can now add Customer Headers to a Custom Remote Bucket in the Comet Server web interface. This greatly expands your options for which provider you would like to use as you can now add additional data such as long lived authentication tokens as part of the request Comet makes when connecting to the storage provider.

Faster Logins between the Comet Account Portal and Comet Hosted

Once Comet Hosted is running our new 24.2.0 Mimas release, we will enable the overhauled login button for Comet Hosted servers from the Comet Account Portal.

The new login button shares credentials between the Comet Account Portal and Comet Hosted meaning you no longer need to remember two sets of passwords. Because of this we have been able to solve all of the failing cases and can provide you with a reliable login experience for your Comet Hosted servers.

Once you’ve logged in with the new system for the first time, when you log out of your Comet Hosted Server you will see a new Login with Comet Account Portal appear on the login page. This allows you to jump straight back into your Comet Hosted server faster than ever before. This button will only appear on web browser sessions that remember you’ve clicked the login button from the Comet Account Portal first to ensure we don’t show Comet branding to unexpected users of your Comet Hosted Servers.

VM Pricing Adjustments

At Comet, we are committed to continuously improving our products and services to meet your evolving data protection needs. In order to do this, occasionally we find it necessary to make adjustments to our product offerings. We are updating our pricing structure in order to further standardize our virtual machine protected item types – VMware and Hyper-V.

Effective February 28th 2024, we are introducing a new unlimited guest license option for VMware, priced at $39. If you have 8 or more VMware guests backing up, you will automatically get the unlimited pricing; no action needed on your part. This change supports your business growth as you scale and add VM deployments.

Also as of February 28th 2024, we are dropping the $2 base charge for Hyper-V. You will only pay the booster charge for all virtual environment backups (both VMware and Hyper-V) going forward.

To bring our virtual machine licensing into alignment, starting February 28th 2024, Hyper-V licensing will be charged at $3 per guest or $24 for unlimited guests per host.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

Comet 2024

Collectd Pandora FMS: Maximizing Monitoring Efficiency

Collectd is a daemon (i.e. running in the background on computers and devices) that periodically collects metrics from different sources such as operating systems, applications, log files, and external devices, providing mechanisms to store values in different ways (e.g. RRD files) or makes it available over the network. With this data and its statistics you may monitor systems, find performance bottlenecks (by performance analysis) and predict system load (capacity planning).

Content:

Introduction to Collectd
Plug-Ins of Collectd
Benefits of Collectd
Collectd Integration with Pandora FMS
Collectd vs StatsD: A Comparison
The Importance of Collectd Integration with Pandora FMS
Conclusion

Programming language and compatibility with operating systems

Collectd is written in C for *nix operating systems; that is, UNIX-based, such as BSD, macOS and Linux, for portability and performance, since its design allows it to run on systems without scripting language or cron daemon, as integrated systems. For Windows it can be connected using Cygwin (GNU and open source tools that provide similar features to a Linux distribution on Windows).
Collectd is optimized to take up the least amount of system resources, making it a great tool for monitoring with a low cost of performance.

Plug-ins of collectd

Collectd as a modular demon

The collectd system is modular. In its core it has limited features and to use it, you need to know how to compile a program in C. You also need to know how to start the executable in the right way so that the data is sent to where it is needed. However, through plug-ins, value is obtained from the data collected and sent, extending its functionality for multiple use cases. This makes the daemon modular and flexible and the statistics obtained (and their format) can be defined by plug-ins.

Plug-in types

Currently, there are 171 plug-ins available for collectd. Not all plug-ins define data collection themes, as some extend capabilities with interfaces for specific technologies (e.g. programming languages such as Python).

Read plug-ins fetch data and are generally classified into three categories:
- Operating system plug-ins, which collect information such as CPU usage, memory, or the number of users who logged into a system. Usually, these plug-ins need to be ported to each operating system.
- Application plug-ins, which collect performance data about an application running on the same computer or at a remote site. These plug-ins normally use software libraries, but are otherwise usually independent of the operating system.
- Generic plug-ins, which offer basic functions that users may make use for specific tasks. Some examples are the query for network monitoring (from SNMP) or the execution of custom programs or scripts.
Writing plug-ins offer the ability to store collected data on disk using RRD or CSV files; or send data over the network to a remote daemon instance.
Unixsock plugins allow you to open a socket to connect to the collectd daemon. Thanks to the collectd utility, you may directly obtain the monitors in your terminal with the getval or listval parameters, where you may indicate the specific parameter you wish to obtain or obtain a list with all the parameters that collectd has collected.
You also have the network plug-in, which is used to send and receive data to and from other daemon instances. In a common network configuration, the daemon would run on each monitored host (called “clients”) with the network plug-in configured to send the collected data to one or more network addresses. On one or more of the so-called “servers”, the same daemon would run, but with a different configuration, so that the network plug-in receives data instead of sending it. Often, the RRDtool plugin is used in servers to store performance data (e.g. bandwidth, temperature, CPU workload, etc.)

To activate and deactivate the plug-ins you have, you may do so from the configuration file “collectd.conf”, in addition to configuring them or adding custom plugins.

Benefits of Collectd

Open source nature
Collectd is open source software, just like its plug-ins, though some plug-ins don’t have the same open source license.

Extensibility and modularity
Collectd has 171 plug-ins, supports a variety of operating systems, and is very easy to set up. It also allows customization according to the needs of the company and its features can be easily extended by adding some reliable plug-ins, in addition to being able to be written in several languages such as Perl and Python.
Scalability
Collectd collects data from many sources and sends it to a multicast group or server. Whether they are one or a thousand hosts, collectd can collect statistics and performance metrics. Collectd also allows you to merge multiple updates into a single operation or large values into a single network packet.
SNMP support
Collectd supports Simple Network Management Protocol (SNMP), which allows users to collect metrics from a wide range of network resources and devices.
Flexibility
It provides flexibility and the opportunity to decide what statistics you want to collect and how often.

Collectd Integration with Pandora FMS

Monitoring IT environments

Collectd provides statistics to an interpretation package, so in a third-party tool, it must be configured to generate graphs and analysis from the data obtained, in order to see and optimize IT environment monitoring. Collectd has a large community that contributes improvements, new plugins, and bug fixes.

Effective execution in Pandora FMS

The pandora_collectd plugin (https://pandorafms.com/guides/public/books/collectd) allows to collect this information generated by collectd itself and send it to your Pandora FMS server for further processing and storage.
The plugin execution generates an agent with all the information of collectd transformed in Pandora FMS modules; with this, you may have any device monitored with collectd and obtain a data history, create reports, dashboards, visual consoles, trigger alerts and a long etcetera.

A very important feature of “pandora_collectd” is that it is a very versatile plugin, as it allows you to process data collected from collectd before sending it to your Pandora FMS server. By means of regular expressions, it allows you to decide according to the features you have, which metrics you want to collect and which ones you want to download, to send the desired metrics to your Pandora FMS server, in an optimal way. In addition, it allows you to modify parameters such as the port or the IP address of the tentacle server that you wish to use.
Also, it is possible to customize what we want your agent to be called, where the modules will be created, and modify their description.
Another important aspect of this plug-in is that it can run both as an agent plug-in and as a server plug-in. By being able to modify the agents resulting from the monitoring, you may easily differentiate one from the other and monitor a high amount of devices in your Pandora FMS environment.
In addition, your plugin is compatible with the vast majority of Linux and Unix devices so there will be no problems with its implementation with collectd.
To learn how to set up collectd in Pandora FMS, visit Pandora FMS Guides for details.

Collectd vs StatsD: A Comparison

Key differences

As we have seen, collectd is suitable for monitoring CPU, network, memory usage and different plugins for specific services such as NGinx. Due to its features, it collects ready-to-use metrics and must be installed on machines that need monitoring.

Whereas StatsD (written in Node.js) is generally used for applications that require accurate data aggregation and sends data to servers at regular intervals. Also, StatsD provides libraries in multiple programming languages for easy data tracking.

Once this is understood, collectd is a statistics gathering daemon, while StatsD is an aggregation service or event counter. The reason for explaining their differences is that collectd and StatsD can be used together (and it is common practice) depending on the monitoring needs in the organization.

Use cases and approaches

Cases of StatsD use:
- Monitoring Web Applications: Tracking the number of requests, errors, response times, etc.
- Performance Analysis: Identification of bottlenecks and optimization of application performance.
Cases of use of collectd:
- Monitoring hardware resources such as CPU usage, memory used, hard disk usage, etc.
- Monitoring specific metrics of available IT services.

The Importance of Collectd Integration with Pandora FMS

- Lightweight and efficient
  Collectd in Pandora FMS is lightweight and efficient, with the ability to write metrics across the network, by itself a modular architecture and because it runs mainly in memory.
- Versatility and flexibility
  This plugin allows you to decide which metrics you want to collect and which to discard in order to send only the metrics you want to your Pandora FMS server. It also allows you to adjust the data collected from time to time, according to the needs of the organization.
- Community support and continuous improvement
  In addition to the fact that collectd is a popular plugin, there is community support for those who constantly make improvements, including specialized documentation and installation guides.
  All this makes us understand why collectd has been widely adopted for monitoring IT resources and services.

Conclusion

Collectd is a very popular daemon for measuring metrics from different sources such as operating systems, applications, log files and external devices, being able to take advantage of the information for system monitoring. Among its key features we can mention that, being written in C, in open source, it can be executed on systems without the need for a scripting language. As it is modular, it is quite portable through plug-ins and the value of the collected and sent data is obtained, the collectd feature is extended to give a better use in monitoring IT resources. It is also scalable, whether one or a thousand hosts, to collect statistics and performance metrics. This is of great value in IT ecosystems that continue growing for any company in any industry.

The pandora_collectd plugin collects information generated by the collectd itself and sends it to Pandora FMS server from which you may enhance the monitoring of any monitored device and obtain data from which to generate reports or performance dashboards, schedule alerts and obtain history information for capacity planning, among other high-value functions in IT management.

For better use of collectd, with the ability to be so granular in data collection, it is also good to consolidate statistics to make them more understandable to the human eye and simplify things for the system administrator who analyzes the data. Also, it is recommended to rely on IT monitoring experts such as Pandora FMS, with best monitoring and observability practices. Contact our experts in Professional services | Pandora FMS

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Pandorafms 2024

How to reset or change a Spotify password

The music doesn’t have to stop just because you’ve forgotten your Spotify password. This streaming service offers everything from personalized playlists to pop culture podcasts. For many of us, it’s the first stop to hear the latest music from our favorite artists. Knowing how to perform a Spotify password reset is a must, just as remembering to change your Spotify password regularly to keep your account well-protected.

How to reset your Spotify password

If you’ve forgotten your Spotify password, resetting it is the quickest option to regain access to your account. To do so, you’ll need to use your browser because it won’t work on desktop or mobile apps. Head to the Password Reset page on your browser and follow these simple steps.

Type your Spotify username or email address into the text box and click “Send.”
Open a new tab, navigate to your inbox, and look for an email with the subject “Reset your password.” Check your spam folder if you don’t see it within a few minutes. For Gmail users, look in the “Social and Promotion” sections.
In the email, click “Reset password.”
You’ll be redirected to the “Reset” page. Enter and confirm your new password.
Click “Send.”
You can now return to the browser or the app and log in with your new password.

It’s imperative to keep passwords secure across all your devices and profiles, but too many people still use the same login details for multiple accounts.

That can be convenient and make credentials easy to remember, but it also increases the threat posed by cybercriminals and hackers. You could be in trouble if someone broke into one of your accounts and that password was reused across many different profiles.

For this reason, you must change your password regularly and differentiate it from others.

One of the easiest and quickest ways to equip all your favorite online accounts with strong and unique passwords is by using a password generator. The NordPass Password Generator can create custom, virtually uncrackable passwords instantly.

How to change a Spotify password

Still, remember your Spotify password but want to change it today? Here’s how:

Open Spotify on your browser (again, this won’t work on desktop or phone apps).
Log into your account.
Click on the profile icon in the upper-right corner of the screen.
Click “Account.”
Click “Change password.”
Input your current password and your new password.
Click “Set new password.”

Now you can open your app and input your new password if you’ve been automatically logged out.

Frequently asked questions

Does Spotify send emails to reset passwords?

Yes, sending emails is a part of the Spotify password reset procedure. However, stay vigilant. If you received an email titled “Reset your password” but didn’t initiate the process, it could be an attempt to take over your Spotify account.

Under any circumstances, do not click on the link provided in the email. Instead, change Spotify password immediately (you’ll find the instructions above!).

After changing your password, make sure to remove third-party apps’ access to your Spotify accounts and log out from all devices and web pages. Here’s how to do it:

Open and log in to Spotify via your browser.
Click on your profile icon in the upper-right corner of the screen and choose “Account.”
Go to “Manage apps.”
Review the app list and remove all the apps linked to your account by clicking on the “Remove Access” button next to each item. You can reconnect your favorite apps with Spotify later after securing your account.
Go back to the Account tab and choose “Sign out everywhere.”
Tap the “Sign out everywhere” button. It will log you out of Spotify on all devices and web pages where you’re currently logged in.
Now, log in to the streaming platform with the new secure password!

How often should I change my Spotify password?

We do not advise changing your Spotify password more often than once a year unless you have a reason to do so. Frequent password changes can lead to frustration and cutting corners by reusing old passwords or choosing a minor variation of the previous one.

Reasons for changing your Spotify password immediately:

Security breach

If a data breach affects Spotify or one of the third-party apps connected to your account, change Spotify password as soon as possible.

Note: You can use the NordPass password manager with the built-in Data Breach Scanner to find out if your email got compromised. This advanced security tool will send you real-time notification if any breach occurs.

Suspicious activity related to your account

Received an out-of-the-blue email suggesting you initiated a Spotify password reset? Got an unexpected two-factor authentication request? Noticed any mysterious activity on your profile, such as disappearing playlists or unknown artists popping up in the Music section? It may be a sign that someone has broken into your account or is attempting to do so.

Malware

If you detect malware that has been running rampant for a while, you should change the passwords for all your online accounts.

Public or shared devices

Public or shared computers may be infected by malware. That’s why it’s a good safety practice to change your Spotify password after logging in on any unknown device.

May I use special characters in my password?

Yes, you may and should! When creating the password, Spotify recommends using letters, capitals, numbers, and special characters. Your password should contain at least 8 characters; however, the longer, the better.

Check out Spotify’s tips on how to protect your account and consider using a Password Generator to create truly strong passwords.

What if I can no longer access the email linked to my Spotify account?

You can try to regain access to the email associated with your Spotify profile or create a new account.

However, if you’ve ever logged into Spotify via Google, Facebook, or Apple, you can still do it. Once you access your account, change the email address by following these steps:

Open and log in to Spotify using your browser.
Go to the profile icon in the upper-right corner of the screen.
Choose “Account.”
Click “Edit profile” at the very top of the action list.
Type in your new email address and confirm it by choosing “Save profile.”

Is there a limit to the number of password reset attempts?

Spotify doesn’t specify how many times you can carry out a password reset. However, for security purposes, you can request a password reset once every few hours.

You keep resetting your password because you haven’t received the “Reset your password” email? Check all your email folders, including Spam and Trash, and/or contact Spotify’s Customer Service.

Keep your passwords safe with NordPass

Changing your password with ease is always helpful, and it’s an integral part of best practices in digital security.

To avoid this problem of having to change or reset your passwords, you can and should use a password manager.

NordPass is a secure and intuitive password manager built to make your life easier. With NordPass, you can securely store your login details for your favorite online accounts, credit card details, personal information, and secure notes.

One of the best things about NordPass is the Autofill enhanced by machine learning, which automatically fills out online forms, credit cards, and passwords for you.

Additionally, NordPass comes equipped with advanced security features. One of those goes by the name of Password Health and helps you detect weak, old, or reused passwords. Another one, known as a Data Breach Scanner, allows you to find out if any of your personal information has been compromised in a data breach.

These days, with cybercrime on the rise, having a password manager should be a no-brainer.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Nord Security NordPass 2024

Keeping encryption secure from BitLocker sniffing

Recently, the YouTube channel stacksmashing uploaded a video on breaking the built-in encryption in Windows, essentially bypassing Windows Disk Encryption on most devices using Microsoft’s globally dominant operating system with a cheap $10 tool.

This all in just 43 seconds – record time. And while encryption has often been the poster child for efficient and secure data protection, now it seems like encryption, too, has its holes, despite relying on advanced features such as Trusted Platform Modules (TPM), which are now also required by the newest Windows OS.

But can this security hole be properly navigated? Thankfully, the solution is relatively easy and also does not cost as much as a full data breach would.

Exploring BitLocker sniffing

The method bypassing encryption has been dubbed “BitLocker sniffing,” named after the built-in Windows encryption tool BitLocker. Essentially, data from the TPM is exposed on the bus, and if anything is using the TPM, one can then “sniff” out the data that gets exposed on the bus at some point during the de-encryption process. This can happen on older machines, specifically those whose TPM is not integrated into the CPU.

The exploit on BitLocker relies on the fact that it is not using a password or any other secondary authentication method alongside the TPM. In the case presented in the video, the PC boots automatically with only the TPM providing access to the Disk Encryption Key (also known as Volume Master Key – VMK). While switching on the machine, the BitLocker automatically uses the TPM to decrypt the VMK and boots to Windows login almost immediately. So, the VMK is available in the plain on the bus as the system is booting up.

Simply put, the communication between the TPM and the computer’s processor is exposed during startup, meaning that the encryption key can be read by someone snooping on the signal between the TPM and the CPU, which can be done with a cheap tool and some firmware.

This might remind someone familiar with cybersecurity of how in some cases man-in-the-middle attacks can “eavesdrop” on a person’s internet connection/Bluetooth/RFID signal while trying to connect to somewhere or something. This occurs because the data stream can become exposed while traveling to a receiver, unless there’s some form of additional security involved, like using a VPN while connected to public Wi-Fi, ensuring a protected hidden connection. Basically, adding another security layer on top is required to mask the data transfer.

Is encryption not enough?

This new piece of research is very interesting, especially since using a TPM security module or chip is now a requirement of the Windows 11 OS, which is why many older processors that might not have satisfied the requirement were barred from having the eligibility to install the OS.

The issue is not whether encryption is enough of an incentive for someone to want the newest OS features, but the fact that, so far, it’s always been a signal of added security. However, with BitLocker sniffing, it seems like encryption might be just another redundant security function…or is it?

Truthfully, encryption is a necessary – no, a compulsory – security measure for any user that has to ensure their data remains safe and securely stored, limiting potential access opportunities even after a device gets stolen. What’s more, as an added security layer, it makes activities that much harder for crooks, as it delays their potential breach time, giving more time to security responders.

Every company security strategy has to include encryption, as this is also required for regulatory compliance and cyber insurance, where the trend sees compulsory standards raised every year.

To answer the headline then: No, encryption is not enough, as multiple security layers are needed for any strategy to work against malicious threats, but it is a necessary component; businesses must include it for better protection. However, encryption does not need to be as it is, a singular security layer, and there are ways to protect it even against BitLocker sniffing.

It’s all about the layers

Was it Shrek who described how ogres are layered like onions? Well, like ogres, successful cybersecurity apps and measures are layered too. At ESET, the PROTECT Platform is one example of that, since in and of itself, it contains multiple layers of technologies that protect against threats, be they zero-days that have never seen the light of day or known malware trying its best to avoid detection with newer evasion techniques.

As such, ESET can also guarantee better encryption thanks to a simple thing – a password. It might seem like a simple layer, but it is very powerful, as thanks to its inclusion within ESET Full Disk Encryption (EFDE) and ESET Endpoint Encryption (EEE), it protects against techniques such as BitLocker sniffing, as that technique relies on unprotected communication between a discrete TPM chip and a CPU. Thus, any secondary authentication that happens before the process starts prevents the encryption key from being out in the open.

In normal operation with EFDE and EEE, the user is required to enter their password upon booting up their computer. Essentially, the password is used in conjunction with other data and the TPM encryption to decrypt the VMK. So, without the user’s password, the correct VMK cannot be obtained. Yes, at some point the data decrypted by the TPM will be available in the plain; however, this cannot take place without knowing the user’s password first.

Powerful encryption, secure systems

In the end, cybersecurity will always need to keep evolving, just as threats do. However, sometimes simple security measures can demonstrate quite an impact.

Passwords have always been the first line of defense against external compromise (as gaining access to a single account can cause a chain reaction), and this will probably continue into the future.

However, a reminder needs to be said – never pick weak passwords, never reuse a single password across your accounts or encryption, and in general, be mindful of cybersecurity. And for businesses in general, consider what level of security you require – as just a single product, or a single additional measure like a strong password for your encryption, can make a difference.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2024

Understanding the Surge in Identity-Based Attacks

How Cybercriminals Execute Identity-Based Attacks

The Devastating Impact on Large Organizations

The Crucial Role of Network Access Control in Mitigating Risks

Best Practices for Leveraging NAC to Combat Identity-Based Attacks

Data Network Architecture:Building a Strong Foundation

Network Segmentation:Protecting LAN Integrity

Network Access Control:Knowing Who’s on Your Network

Remote access management

Building a Secure Network Foundation

A brief history of threat intelligence and its role in cybersecurity

Threat Intelligence Lifecycle

1. Direction

2. Collection

3. Processing

4. Analysis

5. Dissemination

6. Feedback

Four types of threat intelligence

Strategic

Tactical

Operational

Technical

How NordPass can help protect organizations

Bug Fixes​

The interview’s highlights

Key insight #1: the clear web makes up only 10% of the internet

Key insight #2: the original purpose of the dark web, initiated by the U.S. Navy, now makes up just 1% of its current content

Key insight #3: dark web monitoring helps to detect the threat on its planning stage

Key insight #4: Ransomware groups are hiring, which means even more attacks in 2024

Key insight #5: for businesses to stay safe, they need all employees to be aware of possible attacks

How NordLayer can help

Comet 24.2.0 Mimas​

Webinar announcement​

Dark Mode for the Comet Server​

Debian Installer for the Comet Backup desktop app​

Improved S3-compatible Object Lock Performance​

Custom Headers added for Custom Remote Buckets​

Faster Logins between the Comet Account Portal and Comet Hosted​

VM Pricing Adjustments​

Programming language and compatibility with operating systems

Plug-ins of collectd

Collectd as a modular demon

Plug-in types

Benefits of Collectd

Collectd Integration with Pandora FMS

Monitoring IT environments

Effective execution in Pandora FMS

Collectd vs StatsD: A Comparison

Key differences

Use cases and approaches

The Importance of Collectd Integration with Pandora FMS

Conclusion

How to reset your Spotify password

How to change a Spotify password

Frequently asked questions

Keep your passwords safe with NordPass

Data Network Architecture:
Building a Strong Foundation

Network Segmentation:
Protecting LAN Integrity

Network Access Control:
Knowing Who’s on Your Network

Bug Fixes

Comet 24.2.0 Mimas

Webinar announcement

Dark Mode for the Comet Server

Debian Installer for the Comet Backup desktop app

Improved S3-compatible Object Lock Performance

Custom Headers added for Custom Remote Buckets

Faster Logins between the Comet Account Portal and Comet Hosted

VM Pricing Adjustments