Skip to content

Future-proofing PC fleets with the powerful pairing of Intel® Threat Detection Technology and AI-Native endpoint protection

Everyone enjoys a PC refresh – Processor performance joined by security as an important factor 

The continued shift to hybrid work (and play) marked a significant departure from pandemic norms. While health protocols reverted, the digital realm saw enduring changes. Amidst this transformation, security has emerged as a crucial but often overlooked aspect of personal and business computing, joining (speed) processor power as a significant factor in users upgrading PCs.

And, despite the recent passing of co-founder Gordon Moore, Intel has continued to advance in its approach to innovation, including prioritization of attributes like security and efficiency, which speak to the needs of modern computing.

Hardware evolves for our new hybrid reality

Looking back, PC sales surged during the peak of COVID restrictions in 2020 and 2021.1 They saw a significant decline by 13.7% in 2022 and the first half of 2023 as restrictions eased, according to International Data Corporation data from August 2023.

This post-COVID normalization of PC sales may have served to mask a notable transformation underway in the form of hardware-based threat detection. For the past several years, business PCs have shipped with Intel Threat Detection Technology (Intel TDT), providing an added layer of security. This enhanced protection may already be integrated into your endpoint security software, which when paired with an Intel vPro powered machine can deliver an effective hardware plus software solution, helping to keep you safe from advanced threats.

 

<image1. Canalys estimates (sell-in), PC Analysis, January 2024>

Why boost security from the silicon layer?

Enabling security directly from the silicon layer adds a hardware ‘eye’ for malicious payloads like cryptomining and ransomware by applying AI to low-level silicon data for runtime threat execution monitoring. Intel is the world’s only chipmaker that has developed the capability to enable CPU-level telemetry to assist endpoint security software from leading vendors.

In order to avoid potential strain on computing resources from AI computations, Intel’s optimization of Intel TDT can shift compute-intensive workloads from the CPU to the integrated GPU, allowing threat detection to operate at high performance, while ensuring little to no impact on the end user’s other critical tasks. Integration with endpoint security software like ESET PROTECT also allows for shared detections, enhancing security for PC fleets.

When coupled with modern endpoint software like ESET PROTECT, recognized for its low impact on performance, low false positives rates, and multi-layered technology fed by industry-leading malware and threat research, security receives an immediate boost. While PC fleets with integrated security are becoming increasingly widespread in 2024, the ongoing demand for compute power highlights that security remains a journey, especially in the context of the demanding hybrid work model, which introduces new threats and demands for both processor power and efficiency.

Powering integrated security

Intel engineers aim to establish collective security through Intel TDT’s integration with leading security software vendors, delivering scalable protections primarily tailored for business fleets. ESET, with millions of business endpoints in the SMB segment alone, integrated Intel TDT with ESET PROTECT in March 2022 via ESET Endpoint Security. This integration allows the ESET detection engine to co-validate threats with Intel TDT, leveraging ESET’s telemetry and both protection and prevention capabilities, and simultaneously ensuring high efficacy security without compromising system performance.

The collaboration extends from select 9th Gen Intel® Core™ processors to the latest Intel® Core™ Ultra processors, leveraging improved hardware telemetry capabilities in Intel’s processors for enhanced threat monitoring. These enhanced detections leveraging TDT’s CPU telemetry + AI-based technology and ESET Endpoint Security provide an additional layer of security for SMBs, augmenting ESET’s multilayered security solution without requiring additional micromanagement by security admins.

Hybrid work demands performance, efficiency, and security

Hybrid work necessitates steady advances in performance, efficiency, and security, which means that Moore’s Law remains relevant in supporting these demands, particularly with hardware-based security. While updates to processors still prioritize performance, there’s a noticeable shift toward deploying multicore solutions with distinct cores built for performance and those built for power efficiency.

In March 2023, IDC recognized Intel’s success in advocating for a PC refresh to enhance the end-user experience, elevate remote management capabilities, and establish a layered defense between hardware and software2 via Intel TDT. Furthermore, this alignment with modern work methods, such as hybrid work arrangements and online collaboration, enhances productivity while keeping efficiency and security in mind, without a compromise.

Regarding security, IDC also highlights the effectiveness of Intel vPro’s hardware-based AI threat detection and silicon-based Windows 11 virtualization in improving detection efficacy while reducing a computer’s attack surface.

Conclusion: Securing hybrid work is influencing hardware and software providers

In conclusion, the integration of ESET PROTECT with Intel TDT reflects a collaborative shift in the cybersecurity landscape, offering opportunities for wider integration among hardware and software providers. IDC emphasizes that modern endpoint security extends beyond software products, encompassing collaboration among various stakeholders in the ecosystem. This collaborative approach is timely, given the evolving cybersecurity needs of hybrid work environments, collaboration tools, and cloud services.

While the holistic approach demonstrated by the ESET – Intel integration is delivering immediate value to ESET’s customers, it also underscores the importance of incorporating enhanced prevention and protection measures when refreshing PC fleets for hybrid work. ESET R&D teams are collaborating with Intel to leverage future generations of processors to ensure the best of hardware and software are working together to deliver robust security solutions.

1Forbes, July 10, 2020 – Gartner’s preliminary PC sales results for the second quarter of 2020 show huge gains for several of the leading PC makers, not least HP, which saw sales increase by 17.1% year-on-year to push the company within a whisker of reclaiming its spot as the world’s biggest maker. Lenovo clings to that title, shipping 16.197m units in the quarter to HP’s 16.165m.

2IDC, Quick Take, Can your PCs deliver the end-user experience, manageability, and security you need now and in the future?, #lcUS50531323; March 2023

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

How to analyze network traffic: a step-by-step guide

Network traffic is the data that passes through on-premises, cloud, and hybrid cloud networks. Traffic consists of larger files divided into data packets. Packet data flows between network nodes before being put back together at destination devices.

Network traffic is crucial because it enables users and applications to communicate. Traffic carries data files and queries, extracting data from cloud resources for employees to use. It connects users with devices like cameras and printers, facilitates video streaming, and links local workstations to internet resources.

Understanding and managing network traffic includes learning how to analyze network traffic effectively. This analysis helps monitor and interpret these data flows to optimize performance, ensure security, and manage resources effectively. One method to model and understand network traffic relates to network topography, which illustrates how data moves through the network.

  • North-south data passes from data centers to connected devices on a hub and spoke model. This data class includes web browser traffic originating outside the network.

  • East-west traffic travels inside a data center, such as communications between on-premises workstations.

Another method models network traffic based on priority.

  • Real-time network traffic includes high-priority packet data requiring instant transmission and high levels of accuracy. For instance, voice-over-IP can’t work well without high fidelity, instant transfers.

  • Non-real-time traffic includes routine email transfers and FTP downloads that are not operationally crucial.

Network traffic types also relate to how we inspect data.

  • Flow data aggregates simple information about network traffic. Examples include packet origins and data quantities.

  • Packet data involves granular analysis of individual packets through techniques like deep packet inspection. This level of analysis assists security investigations and micro-level performance optimization.

Engineers must consider how these network traffic types interact. Monitoring systems must take account of network topography and implement solutions to capture relevant, high-value data about network traffic.

What is network traffic analysis (NTA)?

Network traffic analysis applies continuous monitoring of network traffic. This has two main functions: ensuring network availability and securing network assets.

NTA determines the availability of network assets. Tools detect anomalies and performance issues, alerting IT teams to enable prompt responses. For instance, monitoring may identify and suppress high-volume data transfers or bursts of inbound traffic.

Network monitoring tools also have a critical security role. Tracking tools enforce security policies by detecting and blocking threats. They scan for suspicious activity and flag potential issues before data breaches or system outages result.

Monitoring systems check for vulnerable protocols or encryption ciphers, informing administrators if data becomes insecure. Tools also identify blind spots in network architecture. Technicians can plug gaps in the attack surface created by new devices or user activity.

Good reasons to adopt network traffic analysis

Analyzing network traffic is a wise move for all companies. Modern business depends on constant data flows and reliable network performance. Measuring how data travels empowers IT managers to make improvements and optimize network performance. 

Understanding and implementing strategies on how to improve network performance can significantly enhance the efficiency and reliability of data flow. It will also ensure that business operations remain smooth and uninterrupted.

6-reasons-to-adopt-network-traffic-analysis

Beyond that general benefit, network traffic analysis has the following advantages:

#1 Better network visibility

Network visibility tools create inventories of devices connected to the network. Companies can add new devices securely and secure network traffic to existing devices.

#2 Compliance

Businesses that monitor network traffic are well-placed to detect threats and safeguard customer data in line with GDPR and HIPAA regulations.

#3 Robust performance

Continuous monitoring identifies technical problems with the availability of applications and data centers. IT teams can troubleshoot issues before downtime occurs.

#4 Capacity planning

Engineers can model future network traffic loads and plan for smooth change management.

#5 Network analysis

Engineers can leverage monitoring logs to analyze performance and find fixes to improve speed or reliability. Monitoring provides network context to investigate security incidents.

#6 Cost reductions

Monitoring network traffic identifies redundant components and suggests efficient ways to route data, cutting networking costs.

Related articles

 

In Depth, Remote Work

Best practices for achieving cybersecurity visibility in hybrid work environments

18 Apr 20246 min read

Cybersecurity visibility

 

In Depth

Data speaks volumes: how analytics improves network visibility

21 Nov 20237 min read

Data speaks volumes web cover 1400x800

 

How to get started with network traffic analysis

The benefits of network traffic analysis are clear. However, analyzing network traffic is harder to grasp. Businesses need monitoring systems that cover relevant data sources. Monitoring must be accurate and deliver usable outputs, but analyzing network traffic must not affect speeds or general performance.

Follow the step-by-step guide below to analyze network traffic in a way that meets those core conditions.

1. Assess your data sources

Before analyzing network traffic, you must understand what data flows through your network. Traffic monitoring can only track visible data flows. A thorough data assessment is essential.

On the device side, data sources include routers, servers, and switches that facilitate data transfers. Firewall appliances and proxy gateways may also be relevant if you use them. User workstations lie inside the scope of network traffic monitoring, as do remote work devices and IoT accessories.

Data sources also include the applications that process or store network data. Include applications stored on-site alongside cloud services that users rely on.

Automation helps you discover connected devices and apps and model device dependencies. Application and network discovery tools scan endpoints, and data flows to assess network topography.

Manually assessing network maps is also possible but time-consuming. Maps also become outdated without regular updates, while automation tools adapt as network traffic changes.

The outcome of this exercise should be a clear map of critical data flows, including a list of device and application dependencies.

2. Decide how to collect network traffic

Now, we need to create systems to extract information from data sources. There are two basic approaches: agent-based collection and agentless collection.

Agent-based systems deploy agents on devices. Agents are tiny apps that continually collect data about performance, availability, traffic volume, and inbound or outbound communications.

Agents are essential to monitor network traffic at the level of network packets. However, they can interfere with network speeds or lead to storage problems.

Agentless collection does not rely on agents to gather information. These solutions generally use protocols like the Simple Network Management Protocol (SNMP) or APIs supplied by data source vendors.

Agentless systems send monitoring queries to apps or devices. Targets respond, supplying data about their availability and security status. Agentless collection is a slightly less detailed way of analyzing network traffic. However, network traffic data is still sufficient for most monitoring purposes.

3. Configure context-based network visibility

Now, set the rules for network traffic analysis. Robust network visibility is not just about collecting masses of network traffic. IT teams must also consider network context to understand the reason for data spikes or speed issues.

Contextual information includes user authentication requests, app usage, or threat intelligence. This information may explain why traffic is spiking on particular devices. The absence of contextual data could indicate an imminent threat.

Combining raw network traffic data with situational knowledge empowers security teams and technicians. The more you know about your network environment, the easier it is to identify problems and avoid security incidents.

Choose a traffic analysis solution that integrates with threat detection and response systems. Even better, opt for a network visibility solution that blends threat detection and performance monitoring.

4. Check network restrictions

Before turning on network traffic monitoring, engineers must check local network restrictions and verify that monitoring will function properly.

For example, encrypted traffic may not be visible to tracking systems without key sharing. Bandwidth restrictions may apply, and some ports may be inaccessible to monitoring protocols. Monitoring cloud data can also be challenging. Providers operate their own data restrictions, potentially compromising network visibility.

Legacy systems often co-exist with cloud implementations. Engineers should ensure traffic monitoring covers all data sources and replace applications or devices you cannot monitor. Firewall appliances and network traffic segmentation can also influence data collection.

Compliance is another consideration. Privacy regulations prohibit the unauthorized collection of private data. Network traffic collection should not extend to user or customer identities without consent.

Finally, network traffic analysis must consider malicious threats. Can monitoring tools identify suspicious traffic and work around obfuscation techniques? If not, alternative solutions may be preferable.

5. Decide how to collect tracking data

Collecting network traffic is useless without a secure and accessible storage solution. This storage facility guards your collection tools and is a reliable destination for harvested traffic.

Separating tracking systems from general network traffic is advisable. Separation protects data from external attacks or outages. The best solution is using a secure cloud-based provider to store tracking data or building separate on-premises hardware.

Virtualized storage solutions suit multi-cloud or single-cloud networks with low on-premises involvement. Hardware is ideal for traditional office networks with few cloud components.

6. Put in place traffic analysis tools

IT teams need the ability to view, analyze, and use network traffic data. Beware: not all monitoring systems include visualization panels and ways to aggregate tracking logs.

Without visualization features, engineers face libraries of text files, and it takes hard labor to extract data from tracking logs. Unless you are comfortable with those processes, choose a tracking partner that makes analysis easy.

Effective solutions allow users to generate reports for audits and investigations. They enable application and user-level traffic analysis. Automating routine security tasks and network traffic map generation are also helpful features.

Don’t forget: Systems for analyzing network traffic also need alert functions to trigger user responses. Choose network traffic analysis solutions with customized alerts and robust measures to detect false positives.

7. Test network traffic analysis before going live

Deploy network traffic analysis gradually. Measured deployment gives you time to check components are functional and deliver the data you need. Rushed implementations waste resources and may lead to inadequate long-term coverage – giving you a false sense of security.

Begin by tracking a small group of data sources. Start with a single data server or cloud-based application. Only expand network traffic analysis when you know that everything works as designed.

How NordLayer can help you achieve network visibility

Network traffic analysis identifies performance and security problems before they impact business operations. In a world of constant data breaches and evolving cybersecurity threats, visibility is everything. Companies that remain in the dark will eventually suffer.

Fortunately, effective network visibility solutions are available for all business contexts. NordLayer’s network visibility tools track relevant traffic and simplify analysis – putting you back in control of network data flows.

Our tools let you dive deep into network activity. Device posture monitoring, server usage analysis, and user activity tracking deliver invaluable insights to guide security teams. Detect suspicious connections, only admit compliant devices, and keep track of network availability.

Network traffic analysis is the key to understanding performance and improving network security

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

24.3.7 Voyager released

Changes compared to 24.3.6

New Features

  • Added support for selecting Windows drives by drive letter when configuring a Disk Image Protected Item

Enhancements

  • Added a label in the Comet Server web interface and the Comet Backup desktop app to distinguish if Protected Items are enforced via the policy
  • Added the ability to convert Windows System Backup Protected Items to Disk Image Protected Items via the Users tab and Bulk Actions dropdown in the Comet Server web interface
  • Improved Microsoft 365 Drive downloads by adding configurable account concurrency and adding concurrency to single file downloads

Bug Fixes

  • Fixed an issue with default Protected Items, allowing edit and delete options when the configured policy doesn’t strictly enforce it
  • Fixed an issue with the Comet Backup desktop app deleting DeviceIdentificationEntropy and DeviceIdentificationHardwareIDOverride registry keys when uninstalled
  • Fixed an issue causing a deadlock when too many requests to a Storage Vault fail during decompression in a single job
  • Fixed an issue causing restores to panic when Comet fails to load a directory included in the files being restored
  • Fixed an issue with some search results not appearing when multiple partial matches exist in the Comet Server web interface
  • Fixed an issue with search results not appearing for results with non-ASCII characters in the Comet Server web interface
  • Fixed an issue allowing search invocation underneath an active dialog in the Comet Server web interface
  • Fixed an issue causing Comet Server to segfault when starting on Linux
  • Fixed an issue causing clients running on Windows Server 2008R2 and Windows 7 to lose their live connection and become unable to be remotely upgraded after a Comet Server upgrade

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

DNS Threats: Vulnerabilities, Attacks, and Prevention Strategies

The Domain Name System (DNS) is crucial for internet functionality, acting as an address book that maps web addresses to their numerical IP addresses. However, DNS is also a vector for various cyber threats due to its foundational role in network communications. Malware, ransomware, phishing, and more sophisticated forms of cyberattacks like Domain Generation Algorithms (DGA) and DNS tunneling exploit DNS to infiltrate and damage systems.

142.250.189.206 – google.com

DNS security is an underrated risk. The technology is structured in a way that allows DNS packets to flow through the network without prior scrutiny. Moreover, DNS activity within networks is rarely monitored, creating a blind spot in cybersecurity. This oversight is significant, as 88% of companies suffer from DNS attacks every year, according to a 2023 report by EfficientIP. Despite the high risk, one-third of these attacks could be prevented at the DNS level, as highlighted by a 2023 study by Cisco.

What is inside DNS traffic

DNS traffic can carry a variety of parameters that play an important role in the exchange of information between clients and DNS servers. These parameters may include the type of request, the server’s response code, TTL (time to live of the record in the cache), transaction identifier, query options, etc. DNS queries are essential components of DNS traffic, involving requests made by clients to DNS servers to resolve domain names into IP addresses.

Moreover, DNS traffic can carry data about the IP addresses of DNS servers, information about network traffic, the location and configuration of domains, as well as much more that helps ensure the efficient operation of the Internet and its security. The DNS resolver plays a crucial role in processing these DNS queries, facilitating the exchange of information between clients and DNS servers. Here is a list of the main parameters:

Threats at the DNS level

Malware

Malicious software, or malware, includes various cyber threats such as viruses, trojans, spyware, adware, and techniques like DNS cache poisoning, where malware redirects users to malicious sites by exploiting DNS vulnerabilities. It can cause significant issues, from minor annoyances to major financial losses, by altering browser settings, using up computing resources, and collecting sensitive user data like passwords and credit card numbers.

DNS protection is crucial in combating malware by:

  • Blocking access to malicious domains to prevent malware communication and data breaches.
  • Monitoring for abnormal behavior to detect malware presence.
  • Providing network activity logs to enhance incident response and mitigate security breaches quickly.

Ransomware

Ransomware is malicious software that encrypts a computer’s files, rendering them inaccessible, and may lead to data breaches. The malware demands ransom for decryption, impacting both individuals and business operations.

DNS protection aids against ransomware by:

  • Blocking access to ransomware’s command and control servers to disrupt its communication.
  • Preventing devices from connecting to malicious websites and email attachments that could initiate an attack.
  • Enabling rapid, automated threat detection and alerts, facilitating a swift response to potential ransomware activity.

Phishing and Typosquatting

Phishing and Typosquatting are forms of cyber deception aimed at stealing sensitive information through fake websites and misspelled domain names. DNS spoofing is another method where attackers manipulate DNS records to redirect users to fraudulent sites, often for malicious purposes such as phishing, malware distribution, or denial-of-service attacks. These practices can compromise personal and corporate security, leading to financial losses and reputational damage.

DNS protection helps combat these threats by:

  • Preventing access to fake websites designed to mimic legitimate ones, safeguarding user credentials.
  • Utilizing algorithms to identify and block deceitful domains that resemble legitimate sites, protecting users from fraud.

Botnet, Cryptojacking, and C2C

Botnets, composed of internet-connected devices infected with malware, can perform various malicious activities, including DDoS attacks, data theft, and illegal cryptocurrency mining, leading to energy and productivity loss and potential financial and reputational damages. Botnets and C&C servers often utilize DNS requests to communicate and control compromised devices, highlighting the need for robust DNS protection strategies.

DNS protection helps by:

  • Blocking access to known command and control (C&C) servers to disrupt botnet communications.
  • Detecting and preventing connections to suspicious domains associated with botnets or C&C servers.
  • Identifying unusual patterns that may indicate botnet presence to prevent system infections.

Parked Domains

These are domain registrations on DNS servers offering parking services, not actively used but may host illegitimate content at a remote server at any time. SafeDNS implements a verification pipeline using real-time data from various sources to monitor new domains and their content, identifying and filtering out illegitimate resources at an early stage. The system establishes domain-IP-autonomous system (AS) relationships, which helps in the early detection of malicious domains.

DGA and DNS Tunneling Attacks

DGAs create numerous domain lists to maintain botnet communication and evade security measures. They don’t directly harm networks but enable the infiltration of malicious software and impede its removal, potentially resulting in corporate network damage.

DNS protection contributes by:

  • Detecting and blocking DGA-generated domains using machine learning and traffic analysis, ensuring queries are directed to the correct IP address by verifying information with the authoritative DNS server.
  • Monitoring and obstructing abnormal DNS activity that could signify DNS tunneling.
  • Maintaining a database of known DNS tunnels to block unauthorized connections and data transmission.

An authoritative DNS server plays a crucial role in this process by holding the official and up-to-date information about a domain name’s IP address, ensuring that DNS queries are resolved with the correct IP address, which is essential for preventing DNS tunneling and DGA threats.

Threats at the DNS level are a major concern because they can disrupt operations, compromise sensitive data, and damage reputations. However, with the right solutions in place, many of these threats are preventable. SafeDNS is at the forefront of this defense, leveraging the latest advances in AI and machine learning to effectively detect and mitigate threats.

By processing billions of queries every day, SafeDNS provides real-time monitoring and proactive measures to secure networks. The power of SafeDNS lies in its extensive categorization database of over 2 billion URL records, providing unparalleled protection. This comprehensive approach ensures that SafeDNS not only identifies existing threats, but also anticipates emerging ones, providing a robust shield against DNS-level threats. With SafeDNS, organizations can secure their online presence and ensure the continuity and integrity of their digital assets.

 

 

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

Preparing for UEFI bootkits. ESET discovery shows the importance of cyber intelligence

Roman Cuprik

Some threats bypass standard security tools. In such cases, security operators capable of deep analysis are needed. 

Last year, ESET Research confirmed rumors concerning BlackLotus, the first publicly known UEFI bootkit capable of bypassing a UEFI Secure Boot, being sold on underground forums. This means that malware preying upon fundamental weaknesses in the UEFI security model is in-the-wild and experts are expecting more bootkits like BlackLotus in the near future.

“Bootkits are no longer just a threat to legacy systems, but a real threat to the majority of modern UEFI firmware systems,” said ESET Researcher Martin Smolár, who discovered this previously undocumented real-world UEFI bootkit and presented his finding at the 2024 RSA conference.

This threat creates a challenge for businesses: How to take a prevention-first approach and secure their devices against attacks that cannot be fully prevented simply by following the standard recommendations and using default system settings because there are known vulnerabilities that still haven’t been fixed and might never be fixed?

Despite businesses holding the short end of the stick right now, they are not without hope. In fact, these are the situations where cyber intelligence platforms such as ESET Threat Intelligence shine.

Confirmed myth

In a nutshell, UEFI bootkits are serious threats targeting Windows that gain full control over the operating system (OS) boot process. With this level of capability, they can disable various OS security mechanisms and are able to operate very stealthily and with high privileges.

The initial attack vector is unknown, but UEFI bootkit starts with the execution of an installer deploying the bootkit’s files to the EFI  System Partition. This abbreviation stands for Extensible Firmware Interface System Partition, which stores files needed for booting operating systems.

Using this installer, attackers can disable the first two layers of defense: Hypervisor-protected Code Integrity (HVCI) and BitLocker encryption. Then they reboot the host.

After the first reboot, the malware abuses the known vulnerability CVE-2022-21894, allowing attackers to enroll their own Machine Owner Key (MOK). An MOK allows owners of devices running non-Windows OSes to generate keys that sign non-Microsoft components during the boot process, thus allowing only approved OS components and drivers to run. By abusing this boot security feature, attackers achieve persistence.

The computer now thinks that the system is booted using trusted software, which means that attackers have bypassed another layer of protection, UEFI Secure Boot, and the machine is then again rebooted.

In the next stages, the self-signed UEFI bootkit is executed and deploys the kernel driver, having access to the Kernel, a computer program at the core of a computer’s operating system, which generally has complete control over everything in the system. It also deploys a user-mode HTTP downloader responsible for communication with the C&C. The abused device can now receive and execute commands from C&C and download additional user-mode or kernel-mode payloads.

Businesses are not powerless

Looking at this cascade for the hijacking of a compromised computer, and knowing that there is no effective fix for older devices due to their outdated security mechanisms, one may feel as if their hands are tied.

But businesses can protect themselves and apply a prevention-first approach even in these cases.

  • First of all, businesses need to keep their system and security products up to date, decreasing options for attackers.
  • IT staff should learn possible risks and procedures concerning how to decrease them. Microsoft released a threat description and a guidance for investigating UEFI attacks.
  • If needed, set up a custom secure boot policy. This, however, requires an experienced admin and is manageable only with a handful of devices due to its complexity.
  • Deploy reliable monitoring solutions and configure their integrity-scanning tools to monitor the composition of the EFI boot partition.
  • Block any attempts of modifying all or specific files on EFI System partition by untrusted processes to prevent bootkits installation.
  • Track developments with UEFI malware across Threat Intelligence platforms and resources.

ESET solutions such as ESET Enterprise Inspector and ESET UEFI Scanner, which is part of the ESET Host-based Intrusion Prevention System (HIPS), can detect signs that something suspicious is happening with a device and alert IT admins. While ESET UEFI Scanner checks and enforces the security of the pre-boot environment, HIPS combines advanced behavioral analysis with the detection capabilities of network filtering to monitor running processes, files, and registry keys.

For more information, check the RSA presentation by ESET Researcher Martin Smolár, via the ESET research podcast, and the NSA BlackLotus Mitigation Guide.

Be one step ahead of threat actors

Since the discovery of the in-the-wild UEFI bootkit, Microsoft has released several patches, and experts across the world provided some guidance. But how to protect a business from the start, before all of this can happen?

To identify such new threats and customize their solutions to deal with them, global leaders in cybersecurity such as ESET invest a lot in research. ESET Threat Intelligence turns this effort into a service, providing businesses with curated global knowledge about threat actors’ activities, gathered by ESET analysts and experts.

Thanks to ESET Threat Intelligence, security engineers, analysts, or incident responders can learn about new threats ASAP, anticipating them and making better, faster decisions. This allows them to deploy a proactive defense, customize their security, and fight increasingly sophisticated cyberattacks.

Moreover, ESET APT Reports give businesses access to private, in-depth technical analysis together with threat mitigation tips. Every user with the APT Reports PREMIUM package will also have access to an ESET analyst for up to four hours each month. This provides the opportunity to discuss topics in greater detail and help resolve any outstanding issues.

Facing a challenge

UEFI Bootkits represent a challenge that is hard to tackle, however that is why it is so important for businesses and enterprises to have reliable cyber intelligence.

With a globally distributed network of security centers, ESET research labs never sleep and have immediate access to threat intelligence like no one else, thanks to the number and distribution of devices protected around the world. Combined with more than three decades of experience in cybersecurity research and product development, ESET can provide businesses with vital intel and use this knowledge to continuously innovate threat-defense techniques.    

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

How ROCKEN fortified its growing network against cyber-attacks for better data protection

ROCKEN, based in Zurich, Switzerland, operates in the recruiting sector, offering a unique blend of consulting and recruiting services. Their office boasts a dynamic team of recruiters, consultants, and business account managers dedicated to bridging the gap between companies and candidates.

The company’s edge is its extensive database, housing detailed candidate profiles enriched with personal interviews, experiences, and expectations. This database, coupled with their custom CRM crafted by their dedicated outstaff development team, stands as their cornerstone, offering a nuanced understanding of each candidate’s profile.

The extensive database, containing candidates and employer information, is the apple of the eye that needs to be protected sufficiently. Julia Zaliznytska, Product Manager and a bridge between business and development, shares why using security services like NordLayer in ROCKEN’s line of work was critical.

The challenge

On a lookout for stronger protection measures

Key pain points

With business expansion plans and team growth, safeguarding ROCKEN’s expanding database became paramount as the company faced a dual challenge.

“We are working for the Swiss market at the moment, and we are extending to Germany this year, and we will have even more data that needs to be protected.”

Click to tweet

First, they had to protect vast amounts of sensitive data, including candidates’ personal information and client companies’ corporate data, against increasingly sophisticated cyber threats such as DDoS attacks.

“With DDoS attacks as a threat and users leaving loads of personal data on the platform, we wanted to provide better protection than just relying on passwords.”

Click to tweet

The team also has gated content on their website, including market overviews and research that is not for free and, thus, must be secured from unverified access.

Second, ROCKEN had to accommodate its hybrid work model with employees and developers working remotely across Switzerland, Germany, Ukraine, and Estonia. For a company with all infrastructure in the cloud, it’s essential to have secure remote access to the internal systems from any location.

Some employees are fully remote, while locals must visit the office three time a week. For this reason, the company needed a unified approach connecting to the company network that is robust against cyber threats.

The solution

Sustainable scalability and protection against threats

Main criteria choosing the solution

After the launch, the company was small and didn’t have much data to protect—securing IP addresses on their own CRM was sufficient initially.

As ROCKEN grew rapidly from 30 to 91 employees, they sought a reliable solution that scales together without compromising security. The solution had to seamlessly integrate for remote and office-based employees alike, ensuring data protection across all touchpoints.

Besides exponential growth, the main triggering factor for enhanced security was a reminder of constant online threats. An identified DDoS attack didn’t do any tangible damage to the company but sent a message that the risk is always there.

“Once, we have experienced a DDoS attack. Whether it was an attacker or rivals testing our protection levels, the attack didn’t result in a data breach but reminded us that we are hunted.”

Click to tweet

A more complex and robust solution than passwords and authentication apps was needed to protect the company network. After a thorough market comparison, ROCKEN chose NordLayer for its comprehensive corporate VPN solutions.

Why choose NordLayer

Several factors influenced ROCKEN’s decision to partner with NordLayer. Primarily, it was necessary to ensure more complex and layered security solutions in place. Then, it had to be ensured that all connections are encrypted and authenticated.

“The access is secured only for those who already have access inside our organization once on-site and through the VPN once remote. Developers use VPN to connect to the production and staging systems.”

Click to tweet

Notably, team members’ personal positive experiences with NordVPN influenced the decision. Moreover, the responsive and accommodating nature of NordLayer’s customer support and the platform’s cost-effectiveness, especially with the provided growth-supportive discount, have been significant factors in choosing the tool.

“We compared many services, but the majority lacked corporate solutions that are centralized in management and payments. NordLayer offered an all-in-one platform with bulk organization control and setup.”

Click to tweet

NordLayer’s reputation for reliability and its ability to offer a scalable, secure solution for a growing company like ROCKEN were decisive.

How NordLayer prevents threats and secures company network

How NordLayer prevents threats and secures company network

The outcome

Easy implementation of a reliable tool

The benefits of implementing NordLayer

The implementation of NordLayer was smooth and swift, taking just a week to onboard the entire organization, thanks to the clear instructions and support provided.

Despite initial hiccups with corporate laptop setups, the transition to NordLayer was well-received across the organization.

“There were absolutely no issues with NordLayer. Because we have corporate laptops that a third-party organization manages, devices weren’t prepped in advance for all users; thus, whole organization onboarding took up to a week.”

Click to tweet

The VPN’s no-logs policy and the ability to manage teams and users through a simple portal were particularly appreciated, ensuring ROCKEN’s operations remained secure without sacrificing efficiency.

Pro cybersecurity tips

It’s a good idea to use post-it notes for everyday cybersecurity tips as a reminder, but not passwords. This and many other tips come from our case study heroes. This time, we asked Julia Zaliznytska, a Product Manager at ROCKEN, to share her favorite habits for practicing cybersecurity hygiene.

ROCKEN about NordLayer

Rocken’s partnership with NordLayer underscores the critical importance of robust cybersecurity measures in today’s digital landscape, especially for companies dealing with sensitive data.

Through strategic planning, careful vendor selection, and a focus on scalability and security, ROCKEN has successfully fortified its defenses, ensuring the confidentiality and integrity of its data as it continues to grow and expand into new markets.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Understanding the Relationship Between Unified Access and Zero Trust

In the complex and ever-evolving world of cybersecurity, protecting an organization’s digital assets against breaches requires more than just traditional perimeter defenses. With cyber threats becoming more sophisticated, a dynamic and holistic approach is needed. Enter the concept of Zero Trust Access Control, a strategic initiative that helps organizations prevent unauthorized access, contain breaches, and reduce the risk of data loss by assuming that threats could be both external and internal. This blog post delves into how Unified Access and Zero Trust work hand in hand to provide a robust security framework, particularly addressing the needs of Chief Information Security Officers who are at the forefront of minimizing cybersecurity risks and optimizing the cybersecurity budget, all while ensuring compliance and adapting to new threats. 

Decoding Zero Trust Access Control

Zero Trust Access Control represents a significant departure from conventional security paradigms, which traditionally placed implicit trust within the network perimeter. The Zero Trust model embodies a comprehensive and preemptive approach to security, predicated on the foundational principle of “never trust, always verify.” In this framework, each request for access is treated with skepticism, irrespective of its origin, and must undergo rigorous verification before access is granted. This necessitates a continuous evaluation process, wherein a user’s credentials and the context of their request are meticulously examined to ensure they align with the access level they are seeking. The implementation of Zero Trust hinges on this granular scrutiny and validation, aiming to significantly narrow the opportunities for unauthorized access and mitigate potential breaches.

Central to achieving Zero Trust’s objectives is the ability to authenticate and authorize every access request with precision. This model demands a dynamic and flexible security posture, capable of adjusting to the constantly evolving threat landscape and the changing contexts of access requests. By adopting a Zero Trust approach, organizations embark on a strategic transformation of their security architecture, moving away from the outdated assumption of implicit trust within their networks. Instead, they cultivate an environment where security decisions are made on a case-by-case basis, leveraging real-time data and comprehensive validation processes. This shift not only enhances the overall security framework but also propels organizations towards a more proactive and resilient cybersecurity stance.

The Role of Unified Access in Facilitating Zero Trust

Unified Access is integral to the deployment and efficacy of a Zero Trust security model, serving as the architectural backbone that supports and enhances its principles. By offering a unified and integrated platform for access control, it simplifies the orchestration of security policies across an organization’s entire digital ecosystem, from cloud services and on-premises applications to mobile and IoT devices. This holistic approach is essential for enforcing the granular access controls and real-time security assessments required by Zero Trust, ensuring that only authenticated and authorized entities can interact with sensitive resources under strict compliance with the policy of least privilege.

Furthermore, Unified Access facilitates the seamless application of dynamic security policies that can adapt to the contextual variables of each access request, such as user location, device health, and the sensitivity of the accessed data. This adaptability is crucial for maintaining a robust defense against the rapidly evolving threat landscape and the increasing sophistication of cyber attacks. By leveraging the centralized visibility and control provided by Unified Access, organizations can more effectively monitor and manage access events, detect anomalies, and respond to potential security threats in real-time.

In essence, Unified Access not only simplifies the practical implementation of the Zero Trust model but also amplifies its effectiveness. It enables a more agile and responsive security posture that aligns with the dynamic nature of modern digital environments and the pervasive challenges they face. Through its integral role, Unified Access ensures that the principles of Zero Trust can be consistently and effectively applied across the breadth of an organization’s operations, providing a foundation for a more secure and resilient digital infrastructure.

Enforcing Least Privilege Across Every Access Point

The foundational element shared by Unified Access and Zero Trust frameworks is the meticulous enforcement of the least privilege principle. This doctrine is pivotal, restricting access rights for users to the bare minimum necessary for the completion of their tasks. By adopting this approach, organizations effectively create a stringent barrier against unauthorized access, significantly diminishing the avenues through which attackers can infiltrate or escalate their privileges within a network.

Implementing least privilege across every access point necessitates a nuanced understanding of user roles, the data they require access to, and the conditions under which access is granted. It involves a dynamic assessment of access needs, continuously adjusting permissions in line with changing job responsibilities, ensuring that access rights remain tightly aligned with actual requirements.

This process is facilitated by sophisticated identity security solutions, which enable precise control over access permissions. Through mechanisms like contextual authentication, these solutions can determine the appropriate access levels based on real-time analysis of user identity, location, device security posture, and other relevant factors. This not only fortifies security measures but also streamlines the user experience, allowing legitimate users to access necessary resources without undue friction.

In practice, the enforcement of least privilege represents a proactive defense strategy, minimizing potential damage from breaches by limiting what attackers can access. This principle is integral to both preventing unauthorized access and containing the impact of any security incidents that do occur, thereby playing a crucial role in the overall effectiveness of the Zero Trust and Unified Access security models.

Leveraging Identity Security for Unified Access and Zero Trust Integration

In the intertwined realms of Unified Access and Zero Trust, identity security emerges as a critical connector, ensuring that access controls are not only stringent but also intelligently adaptive. This synergy is made possible through an array of sophisticated identity security technologies, which collectively empower organizations to verify and validate the legitimacy of each access request in a nuanced manner. The cornerstone technologies such as multi-factor authentication (MFA), single sign-on (SSO), and identity governance serve as the first line of defense, enhancing security without compromising on user convenience.

The utilization of these identity security measures enables a seamless integration of Zero Trust principles within a Unified Access framework. MFA, by requiring multiple proofs of identity, effectively thwarts unauthorized access attempts, aligning perfectly with the Zero Trust mandate of “never trust, always verify.” Meanwhile, SSO simplifies the user’s navigation across various applications and services, ensuring that security measures do not hinder productivity. Identity governance, on the other hand, provides a comprehensive overview of access patterns and permissions, enabling continuous refinement of access controls in alignment with the evolving organizational needs and threat landscapes.

What sets identity security as a pivotal element in this integration is its ability to dynamically adjust access controls based on real-time assessments of risk factors associated with each access request. Whether it’s evaluating the security posture of the device being used, the location from which a request originates, or the sensitivity of the data being accessed, identity security technologies provide the necessary granularity of control. This dynamic adaptability ensures that the principles of Zero Trust are not only upheld but are also effectively operationalized within the context of Unified Access, thereby fortifying an organization’s defenses against the increasingly sophisticated cyber threats of today’s digital landscape.

The Business Impacts of Integrating Unified Access with Zero Trust

Merging Unified Access with Zero Trust is not just a strategic move for enhancing security—it also carries significant implications for organizational efficiency and financial health. By implementing a framework that insists on rigorous authentication and authorization for every access attempt, companies place themselves in a formidable position against cyber threats. This bolstered defense mechanism does more than just protect critical data; it aligns with compliance mandates, thereby mitigating legal and financial repercussions associated with data breaches. The ripple effect of such an integrated approach extends to the operational budget as well. With a streamlined process for managing access, the redundancy seen with multiple, overlapping security tools is considerably reduced, leading to a more efficient allocation of resources.

The agility offered by this cohesive strategy enables businesses to swiftly respond to evolving technological landscapes and cyber threat tactics, ensuring they remain a step ahead in safeguarding their digital domains. Furthermore, this integration paves the way for an advanced level of automation in access management. By relying on the principles of Zero Trust to automate decision-making processes related to user access, organizations can reallocate human capital from mundane, administrative tasks to focus on broader, strategic objectives. This shift not only enhances the productivity of the IT department but also fosters a culture of innovation, driving the company forward in its operational and security endeavors. Thus, the confluence of Unified Access and Zero Trust extends beyond mere cybersecurity enhancements, touching upon vital aspects of business operations, financial management, and organizational agility.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Adding layers of security with password pepper

When it comes to password security, the more layers of protection your personal or business security system has, the better. There is no such thing as a bullet-proof online service; you never know which malicious tactic hackers may employ to access your accounts. Password pepper is yet another additional security layer protecting against brute force attacks, dictionary attacks, and rainbow tables. Read on to find out what a password pepper is, how it works, and how it can improve your cybersecurity. 

Contents:

What is a password pepper?

The password pepper or peppering—as it’s also called—is strictly connected to the password hashing process. Websites don’t store users’ passwords in plain text because it would allow anyone with access to see them. In most cases, users’ passwords are hashed: Encryption algorithms convert them into complicated strings of characters. This way, even if a site’s database gets breached, hackers must decrypt hashes to get hold of users’ credentials.

A pepper is a secret value—a random string of characters—added to a password before hashing. Unlike salt, another cryptographic way of adding an extra layer of security to your password, pepper doesn’t change. Like a chef’s secret ingredient, it stays the same across all dishes: user’s online accounts or — if part of the source code— across users’ databases.

How does password peppering work?

The password pepper changes the value that’s being hashed, resulting in a modified and more secure password hash. The pepper can be hard-coded into the website’s source code or added manually by the private or business user.

In the first scenario, the online platform’s owner chooses the pepper, taking responsibility for the code’s strength and security. The same pepper is used throughout the site’s database: There are no individual password peppers for users. Following a data breach, hard-coded pepper might be more trouble than it’s worth. If cybercriminals gain access to the source code, they could quickly discover the pepper, and it could compromise the hashed passwords. Also, in this setup, changing the breached pepper requires modifying the source code and redeploying the application, which is rather cumbersome.

For the above reasons, we’ll focus on the second scenario: Peppering passwords by hand. It requires setting up a strong, random code — you can use our password generator for it — and keeping it safe, separately from your login credentials. Adding a pepper to your login credentials means that even if you use a robust password manager like NordPass, you’ll still have to memorize your secret code or keep it in another safe place.

 

Using password peppering to improve your online security

Password peppering can protect your accounts in case your passwords get compromised. The rising numbers of cybercrime—the most lucrative criminal activity nowadays—show that you can never be too careful or introduce too many layers of protection. No online service provider may be completely bullet-proof breach-wise, which is what LastPass learned the hard way at the end of 2022.

Adding a pepper to your passwords has to be done manually, which extends the time needed to access your accounts. It can be annoying, especially if you are used to the seamless login experience, but it will definitely improve your online security.

People are creatures of habit and convenience and tend to ditch the security practices that are too demanding. Hence, we do not recommend peppering all your passwords — pepper the most important ones. Here’s how to do it:

  1. Create a strong and complex pepper you’ll be able to remember.

    You can think of a pepper as a password: the longer and more complex it is, the better. Make it random and use different kinds of symbols. However, don’t go overboard; the best way to keep your pepper safe is to memorize it!

  2. Create your “base password” and store it in your password manager.

    Use a password generator to create a complex string of characters: Let’s call it “your base password.” Now, save it in your password manager’s encrypted vault.

  3. Add password pepper and update passwords to your most important accounts.

    Once you’ve created your base password, add the pepper and that will be your actual new password. Update your most important accounts using it. Now, when logging in, you’ll have to add the pepper every time to access the account.

    Note: You can include the pepper anywhere in the string of characters constituting your base password. However, to avoid overcomplicating it, add it at the beginning or end of your base password.

  4. Don’t store your pepper in the password manager vault.

    The idea behind peppering your passwords is not to keep all your eggs in one basket. Hence, keeping your secret code in your password manager vault doesn’t make sense. If your passwords leak, the pepper leaks as well. To make password peppering work, keep your pepper safe somewhere else, preferably your head.

Password peppering from a business perspective

From a business perspective, password peppering can cause more trouble than it’s worth. It may interrupt the teams’ cooperation and information sharing, extend the time spent on tasks that could easily be automated, and mess up the results of compliance and password security audits.

Let’s look at other security measures more suited to the business environment. Unlike password peppering, they promote transparency and allow immediate response to cyber threats.

  • Password policy

The password policy is a set of rules and guidelines for creating and managing passwords in the organization. It informs employees how long their passwords should be, what kinds of characters they need to include, and how often they should change them. When enforced automatically by the company’s password manager, password policies give business network administrators control over every password used in their company.

  • Password health

Password health metrics track your company’s vulnerable passwords. The NordPass Password Health feature provides insight into the weak, older than 90 days, and reused passwords employees rely on. It allows omitting the risk of data breaches connected with weak passwords instead of mitigating the results of hacker attacks.

  • Data Breach Scanner

Data Breach Scanner notifies you in real time about all data leaks related to your company emails and domains. It can be a real game-changer since, according to IBM’s 2023 data security report, companies take 277 days on average to identify and contain a breach. If you respond to the security incident at once, chances are cybercriminals won’t have enough time to use the information against your company.

Trends in password security

These are pivotal years for password security. We’re witnessing a shift towards a more user-friendly and secure authentication method: passkeys. Passkeys allow access to your online accounts the same way you unlock your smartphone—via fingerprint or face ID. This new technology combines biometric verification with cryptographic keys, reducing the risks of phishing, brute-force attacks, and other cyber threats.

Some of the largest tech giants—including Amazon, Apple, Google, and Meta—have already joined the FIDO Alliance, an industry association created to “solve the world’s password problem.” NordPass is also a part of FIDO and, along with other members, actively promotes passkeys and makes them accessible to users. That’s why our password manager provides you a way to securely store, access, and share passkeys.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Understanding the Business Continuity Plan (BCP) and Its Importance

These days, cybercrime is rampant. It’s no longer a matter of “if” you’re going to suffer an attack but “when” it will happen. All companies want to be ready for any crisis – that’s where a business continuity plan comes into play.

Setting up a strategy helps understand the next steps during and following a potential cyber incident. So what is a business continuity plan, exactly? What does it encompass? And what makes it so important to organizations? Today, we’re exploring all these questions in-depth.

Contents:

What is a business continuity plan?

A business continuity plan (BCP) is a document that sets guidelines for how an organization should continue its operations in the event of a disruption, such as fires, floods, other natural disasters, or cybersecurity incidents. A BCP aims to help organizations resume operations without significant downtime.

Despite their utility for business security, BPCs are not as commonplace as expected. According to ZipDo, 43% of businesses across the globe don’t have a business continuity plan in place.

Business continuity vs disaster recovery plan: What’s the difference?

Sometimes, people use the terms disaster recovery plan (DRP) and business continuity plan (BCP) interchangeably. However, these are two separate types of plans. A business continuity plan helps organizations stay prepared to deal with a potential crisis and, hence, usually encompasses a disaster recovery plan. Although the two overlap and are often set into motion to optimize procedures during crisis events, their purposes differ.

The key difference between BCPs and DRPs is their goal. Business continuity plans aim to reduce downtime during the incident to a minimum. Disaster recovery plans focus on reducing any faults or abnormalities in the system caused by the event and returning things back to normal. They also tend to be more extensive, including additional steps like containing, examining, and restoring operations and covering employee safety measures.

In terms of functionality, a disaster recovery plan focuses on operational steps to restore data access to business as usual following an incident. On the other hand, a business recovery plan is set in place while the incident is still ongoing, ensuring that the operations proceed despite the circumstances.

Benefits of business continuity planning

The number of news headlines announcing data breaches has numbed us to the fact that cybercrime is very real and frequent and poses an existential risk to companies of all sizes and industries.

According to the 2023 Data Breach Investigations report, ransomware is present in 24% of all breaches and is among the top four most common types of cyberattacks. In fact, 24% of breaches involved ransomware, with damages costing businesses an average of $4.82 million.

Most cyberattacks are financially motivated, as the global cost of cybercrime exceeded $8 trillion in 2022 and is expected to exceed $13 trillion by 2028. The picture is quite clear — cybercrime is a lucrative venture for bad actors and potentially disastrous for those on the receiving end.

The importance of business continuity plans cannot be understated, as to thrive in these unpredictable times, organizations go beyond conventional security measures. Many companies develop a BCP parallel to secure infrastructure and consider it a critical part of the security ecosystem. The purpose of a business continuity plan is to significantly reduce the downtime in an emergency and, in turn, reduce the potential reputational damage and — of course — revenue losses.

Business continuity plan template

Business Continuity Plan Example

[Company Name]

[Date]

I. Introduction

  • Purpose of the Plan

  • Scope of the Plan

  • Budget

  • Timeline

The initial stage of developing a business continuity plan starts with a statement of the plan’s purpose. It explains the main objective of the plan, such as ensuring the organization’s ability to continue its operations during and after a disruptive event.

The Scope of the Plan outlines the areas or functions that the plan will cover, including business processes, personnel, equipment, and technology.

The Budget specifies the estimated financial resources required to implement and maintain the BCP. This includes costs related to technology, personnel, equipment, training, and other necessary expenses.

The Timeline provides a detailed schedule for developing, implementing, testing, and updating the BCP.

II. Risk Assessment

  • Identification of Risks

  • Prioritization of Risks

  • Mitigation Strategies

The Risk Assessment section is an essential part of the business continuity plan that identifies potential risks that can disrupt an organization’s critical functions.

The Identification of Risks involves identifying potential threats to the organization, such as cybersecurity breaches, supply chain disruptions, or power outages. This step is critical to understand the risks and their potential impact on the organization.

Once the risks have been identified, the Prioritization of Risks follows, which helps determine which risks require the most attention and resources.

The final step in the Risk Assessment section is developing Mitigation Strategies to minimize the impact of identified risks. Mitigation strategies may include preventative measures, such as system redundancies, data backups, and cybersecurity measures, as well as response and recovery measures, such as emergency protocols and employee training.

III. Emergency Response

  • Emergency Response Team

  • Communication Plan

  • Emergency Procedures

This section of the plan focuses on immediate actions that should be taken to ensure the safety and well-being of employees and minimize the event’s impact on the organization’s operations.

The Emergency Response Team manages the response to an emergency or disaster situation. This team should be composed of individuals trained in emergency response procedures who can act quickly and decisively during an emergency. The team should also include a designated leader coordinating the emergency response efforts.

The Communication Plan outlines how information will be disseminated during an emergency situation. It includes contact information for employees, stakeholders, and emergency response personnel, as well as protocols for communicating with these individuals.

The Emergency Procedures detail the steps during an emergency or disaster situation. They should be developed based on the potential risks identified in the Risk Assessment section. The procedures should be tested regularly to ensure their effectiveness.

IV. Business Impact Analysis

The Business Impact Analysis (BIA) section of a business continuity plan is a critical step in identifying the potential impact of a disruption to an organization’s critical operations.

The BIA is typically conducted by a team of individuals who understand the organization’s critical functions and can assess the potential impact of a disruption. The team may include representatives from various departments, including finance, operations, IT, and human resources.

V. Recovery and Restoration

  • Procedures for Recovery and Restoration of Critical Processes

  • Prioritization of Recovery Efforts

  • Establishment of Recovery Time Objectives

     

The Recovery and Restoration section of a Business Continuity Plan (BCP) outlines the procedures for recovering and restoring critical processes and functions following a disruption.

The Procedures for Recovery and Restoration of Critical Processes describe the steps required to restore critical processes and functions following a disruption. This may include steps such as relocating to alternate facilities, restoring data and systems, and re-establishing key business relationships.

The Prioritization of Recovery Efforts section identifies the order in which critical processes will be restored based on their importance to the organization’s operations and the overall mission.

Recovery time objectives (RTOs) define the maximum amount of time that critical processes and functions can be unavailable following a disruption. Establishing RTOs ensures that recovery efforts are focused on restoring critical functions within a specific timeframe.

VI. Plan Activation

  • Plan Activation Procedures

The Plan Activation section is critical in ensuring that an organization can quickly and effectively activate the plan and respond to a potential emergency.

The Plan Activation Procedures describe the steps required to activate the BCP in response to a disruption. The procedures should be clear and concise, with specific instructions for each step to ensure a prompt and effective response.

VII. Testing and Maintenance

  • Testing Procedures

  • Maintenance Procedures

  • Review and Update Procedures

This section of the plan is critical to ensure that an organization can effectively respond to disruptions and quickly resume its essential functions.

Testing Procedures may include scenarios such as natural disasters, cyber-attacks, and other potential risks. Clear objectives, testing scenarios, roles and responsibilities, and evaluation criteria to assess the plan’s effectiveness are also part of the procedural structure.

The Maintenance Procedures detail the steps necessary to keep the BCP up-to-date and relevant.

The Review and Update Procedures describe how the BCP will be reviewed and updated regularly to ensure its continued effectiveness. This may involve reviewing the plan regularly or after significant changes to the organization’s operations or threats.

What should a business continuity plan checklist include?

Organizations looking to develop a BCP have a lot to consider. Variables such as the organization’s size, its IT infrastructure, personnel, and resources all play a significant role in developing a continuity plan. Remember, each crisis is different, and each organization will have its own view on handling it according to all the variables in play. However, all business continuity plans include a few fundamental elements.

  • Clearly defined areas of responsibility

    A BCP should define specific roles and responsibilities for emergencies. You must detail who’s responsible for what tasks and clarify what course of action a person in a specific position should take. Clearly defined roles and responsibilities in an emergency event allow you to act quickly and decisively and minimize potential damage.

  • Crisis communication plan

    In an emergency, communication is vital. It is the determining factor in crisis handling. Establishing clear and effective communication pipelines is critical. Alternative communication channels should not be overlooked either. Make sure to outline them in your business continuity plan.

  • Recovery teams

    A recovery team is a collective of professionals who ensure that business operations are restored as soon as possible after the organization confronts a crisis.

  • Alternative site of operations

    Today, when we think of an incident in a business environment, we usually think of a cybersecurity-related event. However, as discussed earlier, a BCP covers many possible incidents. In a natural disaster, determine potential alternate sites where the company could continue to operate.

  • Backup power and data backups

    Whether a cyber event or a real-life physical incident, ensuring that you have access to a power source is crucial to continue operations. A BCP often contains lists of alternative power sources like generators, locations of such tools, and who should oversee them. The same applies to data – regularly scheduled backups can significantly reduce potential losses incurred by a crisis event.

  • Recovery guidelines

    If a crisis is significant, a comprehensive business continuity plan usually includes detailed guidelines on how the recovery process will be carried out.

Business continuity planning steps

business continuity plan steps

Here are some general guidelines that an organization looking to develop a BCP should consider:

Analysis

A business continuity plan should include an in-depth analysis of everything that could negatively affect organizational infrastructure and operations. The analysis phase should also include assessing different levels of risk.

Design and development

Once you have a clear overview of potential risks your company could face, start developing a plan. Create a draft and reassess it to see if it accounts for even the smallest of details.

Implementation

It’s critical to get everyone on the same page regarding crisis management. Implement the BCP within the organization by providing training sessions for the staff to familiarize themselves with the plan.

Testing

Make sure to test the plan rigorously. Run through a variety of scenarios in training sessions to assess its overall effectiveness. By doing so, everyone on the team will be closely familiar with the business continuity plan’s guidelines.

Maintenance and updating

The threat landscape constantly changes and evolves, which means you should regularly reassess your BCP and take steps to update it. By tuning your continuity plan to recent developments, you can stay one step ahead of a crisis.

Business continuity planning standards

Business continuity plans don’t just appear out of thin air. They must strictly adhere to industry standards, including ISO and regional standards, to ensure that business is sufficiently prepared for a crisis scenario.

Following a standard is advantageous to businesses as the relevant information and the requirements are continuously being updated. This ensures that the implemented strategies don’t fall behind the security requirements. The ISO 223XX standard series, in particular, aims to provide a clear and internationally recognized framework for continuity planning.

ISO 22301

ISO 22301, or the Security and Resilience Standard, provides organizations with a framework to plan, operate, improve, and otherwise maintain response and recovery strategies. The business continuity plan acts as the documented management system (known as a business continuity management system, or BCMS) that aims to prevent disruptive incidents and, if they occur, ensure a full recovery. It goes hand in hand with ISO 22313.

ISO 22313

This business continuity plan standard provides guidance on implementing the ISO 22301 requirements. It details the precise steps on how the business continuity management system should be implemented in an organization.

ISO 27001

ISO 27001 provides a framework for managing information security. This standard ensures that an organization implements the right risk assessment and controls to upkeep the development, improvement, and protection of information management systems (ISMS). The NordPass ISMS is certified according to ISO 27001.

ISO/IEC 27031

These guidelines cover the principles of how ready an organization’s information and communication technology (ICT) infrastructure should be for business continuity. It covers all potential events and incidents that may impact the infrastructure, leading to the implementation of a BCP.

ISO 31000

ISO 31000, or the Risk Management Standard, exists to help all organizations handle potential risks. Its main purpose is to allow organizations to compare their internal risk management practices to the global standards. However, ISO 31000 can’t be used for certification purposes.

Level up your company’s security with NordPass Business

A comprehensive business continuity plan is vital for the entire organization’s security posture. However, in a perfect world, you wouldn’t have to use it. That’s is where NordPass Business can help.

Weak, reused, or compromised passwords are often cited among the top contributing factors in data breaches – unsurprising, considering that an average user has around 170 passwords. Password fatigue is real and significantly affects how people treat their credentials. NordPass Business counters these issues.

With NordPass Business, your team will have a single secure place to store all work-related passwords, credit cards, and other sensitive information. Accessing all the data stored in NordPass is quick and easy, which allows your employees not to be distracted by the task of finding the correct passwords for the correct account.

NordPass Enterprise helps keep your corporate credentials secure at all times. Everything stored in the NordPass vault is secured with advanced xChaCha20 encryption, which would take hundreds of years to brute force.

If you’are interested in learning more about NordPass Business and how it can help fortify corporate security, do not hesitate to book a demo with our representative.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.