Skip to content

Your Company’s Cyber Insurance Coverage is Making It a Target

The sharp spike in ransomware attacks has increasingly turned cybersecurity insurance coverage from an optional add-on into an essential safeguard for businesses. Yet, a dark trend is emerging: the safety net of insurance may paradoxically mark you out as prey for cybercriminals.

Cyber attacks are becoming more frequent, sophisticated, and severe. According to one report, 70% of businesses fell victim to ransomware attacks in 2022. Moreover, phishing attacks rose by 48% in the first half of the same year, with reports of 11,395 incidents costing businesses $12.3 million.

And in an increasingly dangerous cyber threat landscape, it’s easy to see why cyber insurance is becoming an increasingly attractive prospect for businesses worldwide. But Is cybersecurity insurance really securing your business, or is it setting you up to become the next target in the fast-paced, relentless world of cyber warfare? Let’s get into it.

Cyber Insurance Adoption is Surging

The global market for cybersecurity insurance is surging. It stood at $7.60 billion in 2021 but is expected to grow to a whopping $20.43 billion by 2027.

As businesses become increasingly digital, they inevitably grow more vulnerable to cyber threats. This escalating risk has led to a boom in the demand for cyber insurance. A key reason for this surge is the financial protection it offers. When a cyber-attack strikes, a company faces a multitude of costs ranging from ransom payments to data recovery, crisis management, and even lawsuits from customers or partners.

The benefits of cyber insurance extend far beyond a simple payout. Companies benefit from the insurers’ wealth of knowledge about cyber risk management, which helps craft robust cyber risk mitigation strategies. Furthermore, in the aftermath of a breach, insurance providers often offer expert resources to mitigate the fallout. This includes PR consultants to manage potential reputational damage, forensic teams to identify security loopholes and legal counsel for possible regulatory penalties. For many companies, the ability to access these resources swiftly and efficiently is invaluable, making cyber insurance coverage an increasingly attractive investment

Companies with Cyber Insurance Become Targets

According to a survey by Barracuda Networks, 77% of organizations with cyber insurance were hit at least once, compared to 65% of organizations without insurance. And more worryingly, of the companies that had cyber insurance, 39% paid the ransom.

The report also highlighted other worrying trends – like the fact that insured companies were 70% more likely to be hit with ransomware attacks multiple times.

Why Do Cybercriminals Target Companies with Cyber Insurance Coverage?

  • Increased visibility: Companies with cyber insurance often advertise it as a selling point or include it in their public disclosures. This increased visibility can attract cybercriminals who specifically target companies with cyber insurance, knowing that they might have valuable assets.
  • Perceived financial resources: Cybercriminals may assume that companies with cyber insurance have sufficient financial resources to pay for potential losses or to cover ransom demands. This perception can make them more likely to target these companies in the hopes of securing a larger payout.
  • Inadequate security measures: Some companies may view cyber insurance as a substitute for implementing robust cybersecurity measures. They might become complacent, assuming that their insurance coverage will mitigate any potential damages. This attitude can lead to insufficient investments in security measures, making these companies easier targets for cybercriminals.
  • Potential for higher payouts: Cyber insurance policies typically cover financial losses resulting from cyberattacks. Cybercriminals are aware of this and may specifically target companies with insurance coverage, hoping to inflict significant damages that will result in larger insurance claims and potentially higher payouts.
  • Delayed detection and response: Some companies with cyber insurance may prioritize filing an insurance claim over immediate detection and response to a cyber incident. Cybercriminals can exploit this window of opportunity, knowing that it might take longer for the targeted company to identify the breach and take appropriate action, giving them more time to carry out their malicious activities undetected.

Is There More to the Story?

Barracuda’s report paints a worrying picture, and understandably, companies considering cyber insurance may now feel more reluctant to go ahead. However, the situation is more complex.

For example, cyber insurance coverage has proven to offer several benefits to companies, not just in terms of recovering financial losses and repairing reputations but also in bolstering security. For example, many cyber insurers now require that their clients meet minimum security requirements. These include enabling MFA, having antivirus and malware detection software, a robust firewall, and an endpoint detection and response (EDR) tool. Insurers also often mandate that clients have secure and resilient backups.

These security measures encouraged (or demanded) by cyber insurers help reduce the likelihood of an attack and reduce the probability of victims paying the ransom. For example, if you have regular secure, resilient backups, you can recover the data yourself.

What Can Companies Do?

Beyond choosing to get cyber insurance or not, there are several things companies can do to safeguard their networks from ransomware attacks.

  • Prioritize cybersecurity investments: Companies should allocate sufficient resources to implement robust cybersecurity measures, including regular security assessments, network monitoring, threat intelligence, and employee training.
  • Develop a comprehensive cybersecurity strategy: Companies should create a well-defined cybersecurity strategy that addresses potential vulnerabilities, establishes incident response protocols, and emphasizes continuous improvement and adaptation to evolving threats.
  • Implement multi-layered defense: Deploy a combination of preventive, detective, and responsive security measures, such as firewalls, intrusion detection systems, encryption, endpoint protection, and strong access controls, to create multiple layers of defense against cyber threats.
  • Conduct regular security assessments: Perform regular vulnerability assessments and penetration tests to identify and address weaknesses in the company’s infrastructure, applications, and security controls.
  • Implement strict access controls: Limit user privileges and implement robust authentication mechanisms, such as two-factor authentication, to prevent unauthorized access to sensitive systems and data.
  • Establish incident response plans: Develop and regularly test incident response plans to ensure that the company can effectively detect, respond to, and recover from cyber incidents, minimizing potential damages.

Final Thoughts

While possessing cyber insurance coverage can inadvertently attract cybercriminal attention, companies can mitigate this risk by adopting a proactive cybersecurity approach. By investing in robust security measures, promoting employee awareness, and maintaining a solid cyber defense strategy, companies can safeguard their digital assets and reduce the likelihood of becoming targets for cyberattacks, regardless of their insurance coverage.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Defend Your Business Against Ransomware Attacks

Ransomware attacks are becoming increasingly prevalent, posing severe threats to individuals and businesses. Safeguard your organization from these malicious attacks with the TLP:CLEAR guide, a comprehensive resource that offers practical information on how to prepare for, prevent, and mitigate the impact of ransomware.

The TLP:CLEAR guide presents a concise yet thorough approach to combatting ransomware attacks. It emphasizes the importance of proactive measures such as implementing Protective Domain Name System (DNS) services and sandboxed browsers to mitigate risks associated with web browsing and malicious internet activity. By leveraging these solutions, organizations can effectively protect themselves against the dangers of browsing the internet.

As cybersecurity experts, we wholeheartedly endorse the recommendations outlined in the TLP:CLEAR guide. Notably, the guide highlights the significance of web filtering as a crucial component of a company’s cybersecurity posture.

Web filtering is a fundamental element of a comprehensive cybersecurity strategy, providing organizations with a proactive defense mechanism against a wide range of threats. By implementing robust web filtering solutions, companies can exercise control over the content their employees can access, effectively blocking potentially malicious or harmful websites.

In our discussions on cybersecurity, we consistently emphasize the importance of web filtering. It is reassuring to see that the experts behind the TLP:CLEAR guide also recognize the value of this essential security measure. Their endorsement of web filtering further validates our stance and reinforces the critical role it plays in safeguarding organizations against cyber threats.

The TLP:CLEAR guide equips organizations with actionable steps to enhance their cybersecurity posture and mitigate the risks associated with ransomware attacks. We strongly recommend following the comprehensive checklist provided in the guide, which covers the implementation of Protective DNS, adherence to cybersecurity best practices, and continuous employee training. Proactively implementing these measures significantly reduces susceptibility to ransomware attacks and effectively safeguards digital assets.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

Savour ITSM’s perfect burger: People, processes and technology

“In this bleak world where technology has become a vital necessity, IT Service Management (ITSM) has become a key tool for many businesses.” It sounds like the introduction to a dystopian novel, doesn’t it? Easy, it’s not like that, today I didn’t get up very like Aldous Huxley.

We will rather answer the question: What is ITSM exactly? 

Don’t you worry, I will not get too involved with the technicalities, you already know what we’re like, I will explain it to you in an easy way and worth prizes such as the Nobel Prize for scientific dissemination.

Advantages of ITSM: Improve IT service management

What exactly is ITSM?

*Warning: Allegory for children.

Imagine that ITSM is the detective of a company. It’s the tough guy who helps the organization understand how technology works in the business and how it can become more efficient. But to be a good detective, ITSM needs three elements: people, processes, and technology.

People are important in ITSM because they are the ones who use the company’s IT services. End users, employees, customers, and external vendors are all people who need the company’s IT services to do their jobs. 

The implementation of ITSM helps define the roles and responsibilities of each user group, and ensures that everyone understands how they can contribute to improving the management of IT services.

Processes are also important in ITSM. And we’ll go crazy inserting an analogy into another analogy. Inception! 

If ITSM were a hamburger, the processes would be like hamburger mince. 

Processes are the different stages that the company’s IT services go through, such as incident management, IT asset management, and change management. A good ITSM implementation will help the company define these processes and ensure that they are followed correctly.

If we continue with the hamburger simile, technology is like ITSM’s hamburger cheese. It is the ingredient that holds everything together with its caloric value. 

Technology allows the company to automate its processes and improve access to service providers and end users. Automation reduces errors, brings consistency and service metrics based on critical success factors.

Although if you got lost in the middle of my great allegory of detectives and hamburgers I leave you here a more academic and cheeseless definition:

ITSM is the acronym for Information Technology Service Management, which refers to a set of practices, policies, procedures and tools used to plan, design, deliver, operate and control the information technology (IT) services that a company offers to its internal or external customers. 

ITSM is based on the service management approach and focuses on customer satisfaction, continuous improvement of services and efficient management of IT costs and resources. 

ITSM includes processes and areas such as incident management, problem management, change management, asset and configuration management, service level management, and capacity management. 

Implementing ITSM enables companies to improve the quality of their IT services, increase the efficiency and effectiveness of their processes, and reduce the risks and costs associated with information technology management.

Now that we know what ITSM is, what are the keys to its implementation?

Well, there are some key requirements that need to be met.

  • First, the roles and responsibilities of end-users must be defined.
  • Secondly, the processes to be followed must be defined, such as incident management, IT asset management and change management.
  • And finally, the right technology must be implemented to automate these processes and improve access to IT services.

When implementing new ITSM processes, the key is to adapt to the specific needs of your business. 

If your IT support team is always working on the same problems, finding the root cause and solving it is undoubtedly the best option. 

For example, if storage space is a recurring problem, deleting files every time the hard drive reaches its maximum capacity is not a long-term solution. 

Instead, installing a hard drive with greater capacity would be a more effective solution over time.

In ITSM, the incident management process becomes problem management. 

In this example, the lack of storage space is the incidence, while the storage capacity of the hard drive is the underlying problem.

But the implementation of ITSM processes depends not only on the tool used, but also on a culture change. 

It’s important for end users to see the IT team as a service provider, rather than just another department of the company.

Key points to consider when implementing ITSM processes are team maturity and size, identifying specific issues, and selecting the right framework. 

Each framework has its own structure and processes, so the choice will depend largely on the problems to be solved.

Once ITSM has been implemented, what are the advantages and why is it important?

There are many benefits to implementing ITSM. 

ITSM processes are key for companies looking to optimize the management of their IT services and improve customer satisfaction. 

Clearly defining service delivery goals, publishing an IT Service Catalog, and creating well-trained and enthusiastic support teams are just a few of the ways ITSM can benefit a company.

In addition, a good ITSM implementation can ensure quick troubleshooting, saving end users time and reducing help desk workload. 

This, in turn, can reduce IT service provision costs and increase service availability and trust.

Last but not least, ITSM ensures compatibility with different regulations or legal regulations, which is crucial for companies looking to comply with security and privacy standards. 

In short, implementing ITSM processes can provide a number of benefits to businesses, from better management of IT services to greater customer satisfaction and greater compliance with legal regulations.

But what about ITIL?

ITIL is a very popular ITSM framework, but it’s not the only option. 

There are other frameworks and standards, such as COBIT, ISO 20000, MOF and USMBOK, that can also be used to manage IT services. 

The main difference between ITIL and other frameworks is that ITIL is very prescriptive and specific about how IT services should be managed, while other frameworks are more flexible and allow companies to customize their processes according to their specific needs.

Despite the differences between ITSM and ITIL, both are important for IT service management. 

ITIL is a good choice for companies looking for a more detailed and structured solution, while other frameworks may be better suited for companies that need a more flexible and customized solution.

Conclusions

What else can we say, the implementation of ITSM is fundamental for the efficient management of IT services in companies. 

Like a seasoned detective, ITSM helps the organization understand how technology works in the business and how it can be more efficient. 

With the right definition of roles and responsibilities, well-defined processes, and implementation of the right technology, ITSM can improve the quality of IT services and increase end-user satisfaction. 

Whether using ITIL or any other framework, ITSM is a key tool for any company that wants to stay competitive in the increasingly technological world in which we live.

And remember, if you ever have problems with your company’s IT services, don’t worry, because ITSM is here to help you solve the mystery and make everything run smoothly!

As the famous detective Sherlock Holmes once said, “when the impossible has been removed, what remains, however improbable it may seem, is the truth”. And the truth is that ITSM is a powerful tool to improve the management of IT services in your company.

Dimas P.L., de la lejana y exótica Vega Baja, CasiMurcia, periodista, redactor, taumaturgo del contenido y campeón de espantar palomas en los parques. Actualmente resido en Madrid donde trabajo como paladín de la comunicación en Pandora FMS y periodista freelance cultural en cualquier medio que se ofrezca. También me vuelvo loco escribiendo y recitando por los círculos poéticos más profundos y oscuros de la ciudad.

Dimas P.L., from the distant and exotic Vega Baja, CasiMurcia, journalist, editor, thaumaturgist of content and champion of scaring pigeons in parks. I currently live in Madrid where I work as a communication champion in Pandora FMS and as a freelance cultural journalist in any media offered. I also go crazy writing and reciting in the deepest and darkest poetic circles of the city.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

No more mistakes! Learn how to create strong, flawless software deployments with the help of automation

Friends, welcome to the world of software development! There have been more changes here in recent years than in Lady Gaga’s wardrobe during her Super Bowl halftime performance! You know, Agile, DevOps, the Cloud… These innovations have enabled organizations to develop and deploy software faster and more efficiently than ever before. One of the key DevOps practices is automated deployments.

In this article, we will discuss the importance of creating and monitoring strong automated implementations.

Automated deployments: achieve error-free software

Why do you need strong automated deployments?

Traditionally, software deployment was a manual process that implied manifold steps and was prone to human error. 

Automated implantations, on the other hand, allow organizations to implement software automatically without human intervention, reducing the chances of errors.

Automated implementations also offer the following advantages:

  1. Faster deployment: Manual implementation is a slow process that implies manifold steps. Automated implementation reduces the implementation time and allows companies to implement software more frequently.
  2. Coherence: Automated deployments guarantee that the deployment process is documented and can be repeated, which reduces the chances of errors caused by human errors.
  3. Downgrade: Automated deployments allow organizations to return to the previous software version quickly and simply if some problem arises.
  4. Profitability: Automated implementations reduce the need for manual intervention, which can be expensive and time-consuming.
  5. Improved tests: Automated deployments can be tested in a test or pre-production environment before going into production, reducing the likelihood of problems arising.

Steps to create strong automated implementations

Creating strong automated deployments involves the following steps:

  • Defining the deployment process: Define the steps needed to deploy the software, including dependencies, configuration settings, and environment requirements.
  • Automating the deployment process: It uses tools like Terraform, Ansible, Jenkins, and YAML to write the deployment process as code, store it in source control, and test it.
  • Add doors and approvals: It adds doors and approvals to require external approvals, perform quality validations, and collect status signals from external services before the implementation can be completed.
  • Develop a rollback strategy: Develop a rollback strategy that includes feature indicators and bluish-green deployments to roll back to the previous version of the software easier should any issues arise.
  • Implement automated monitoring: Implement automated monitoring of system metrics such as memory usage, disk usage, logged errors, database performance, average database response time, long-duration queries, simultaneous database connections, and SQL query performance.
  • Test and refine: Test and refine the automated deployment process, making the necessary adjustments.

Monitoring of strong automated deployments

Automated implementations must be accompanied by automated monitoring.

Organizations must monitor system metrics such as memory usage, disk usage, logged errors, database performance, average database response time, long-duration queries, simultaneous database connections, and SQL query performance.

Mature monitoring systems make obtaining a baseline prior to implementation easier as well as spotting deviations after the implementation.

Holistic hybrid cloud monitoring tools that alert organizations to errors or abnormal patterns are an important part of feature flags and bluish-green deployments.

They are the indicators that allow organizations to find out whether they need to deactivate a feature or return to the previous production environment.

Tools and processes

Although implementation and monitoring tools alone do not guarantee the success of the implementation, they certainly help.

It is also important to create a DevOps culture of good communication, design reviews throughout development, and thorough testing.

Automated deployments are just part of the DevOps lifecycle, and organizations can decide at what point in the cycle automation it adds value and create it in small chunks over time.

Automated deployments reduce the risk and effort required. Their high return on investment often makes them a great place to start automating considering DevOps best practices.

Conclusion

Automated deployments are an essential part of the DevOps culture. They reduce the likelihood of human error, allowing faster deployment.

Closing the circle with a reference to Lady Gaga:

Automated deployments are like having Lady Gaga’s costume assistant as your personal assistant – there’s no room for error!

Dimas P.L., de la lejana y exótica Vega Baja, CasiMurcia, periodista, redactor, taumaturgo del contenido y campeón de espantar palomas en los parques. Actualmente resido en Madrid donde trabajo como paladín de la comunicación en Pandora FMS y periodista freelance cultural en cualquier medio que se ofrezca. También me vuelvo loco escribiendo y recitando por los círculos poéticos más profundos y oscuros de la ciudad.

Dimas P.L., from the distant and exotic Vega Baja, CasiMurcia, journalist, editor, thaumaturgist of content and champion of scaring pigeons in parks. I currently live in Madrid where I work as a communication champion in Pandora FMS and as a freelance cultural journalist in any media offered. I also go crazy writing and reciting in the deepest and darkest poetic circles of the city.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Binary memory protection measures on Windows OS

Binary memory protection is a core part of cybersecurity, but there are many different options for implementing it. In this article, we explore common mechanisms and protection measures for Windows OS.

Why is binary memory protection important?

You may remember when the Blaster worm struck the internet, or more recently when WannaCry caused global havoc using a leaked EternalBlue Windows OS exploit. Both are examples of malware that used buffer overflow memory corruption vulnerabilities, causing remote code execution and infecting millions of machines worldwide.

Most operating systems, written in C or C++, have limited memory protection, allowing these attacks to occur. Malware like Blaster and WannaCry manipulate the environment, instructions, and memory layout of a program or operating system to gain control over it.

Security professionals have implemented mechanisms to prevent software exploitation and minimize damage caused by memory corruption bugs. A “silver bullet” solution would be a mechanism that makes it challenging and unreliable for attackers to exploit vulnerabilities, allowing developers to leave buggy code in place while they work on fixing or rewriting it in memory-safe languages.

Common mechanisms and protection measures

Let’s review some of the most common mechanisms and protection measures provided inside Windows OS from Windows XP to Windows 11.

ASLR

Address space layout randomization (ASLR) is a computer security technique that prevents an attacker from reliably jumping to, for example, a particular exploited function in a program’s memory. ASLR randomly arranges the address space positions of a process’s key data areas, including the base of the executable and the positions of the stack, heap, and libraries. The effectiveness of ASLR depends on the entropy of the process’s address space (simply put, the probability of finding a random local variable).

Because of this protection, exploit payloads must be uniquely tailored to a specific process address space.

Vista and Windows Server 2008 were the first operating systems in the Windows family to provide ASLR natively, though this system was first developed back in 2001. Prior to these releases, there were several third-party solutions like WehnTrust available that provided ASLR functionality to varying degrees.

When Symantec conducted research on ASLR in Windows Vista, they found that ASLR had a significant effect when implemented in Windows 8 (or Windows 8.1). It provided higher entropy for address space layouts. The larger address space for 64-bit processes also increased the entropy of the ASLR for any given process.

  Exploit mitigation improvements in Windows 8

Windows 8 added randomization for all BottomUp and TopDown memory allocations, increasing the effectiveness of ASLR, which was not available in Windows 7.

Exploit mitigation improvements in Windows 8   Exploit mitigation improvements in Windows 8

In Windows 8, Microsoft introduced operating system support to force EXEs/DLLs to be rebased at runtime if they did not opt-in to ASLR. This mitigation can be enabled system-wide or on a per-process basis. You can modify the settings of mandatory ASLR through the Windows Security app.

ASLR, like any other security technique, has its weaknesses and attack vectors (heap spray, offset2libc, Jump Over ASLR, and others). Even one memory disclosure can completely defeat ASLR and provide an attacker with a significant opportunity. In addition to this, ASLR is only efficient when all executables and shared libraries loaded in the address space of a process are randomized. For example, research by Trend Micro researchers showed that Microsoft Edge browser exploit mitigations, including ASLR, could be bypassed. You can watch a video from the BlackHat conference to learn more.

DEP

Data Execution Prevention (DEP) is a protection mechanism that blocks the execution of code in memory pages marked non-executable. The NX (No-Execute) bit is a protection feature on CPUs used by DEP to prevent attackers from executing shellcode (instructions injected and executed by attackers) on the stack, heap, or in data sections. If DEP is enabled and a program attempts to execute code on a non-executable page, an access violation exception will be triggered.

Starting with Windows XP Service Pack 2 (2004) and Windows Server 2003 Service Pack 1 (2005), the DEP was implemented for the first time on x86 architecture.

An application can be compiled with the /NXCOMPAT flag to enable DEP for that application. You can also use editbin.exe /NXCOMPAT over a .exe file to enable it on a previously compiled file.

On 64-bit versions of Windows, DEP is always turned on for 64-bit processes and cannot be disabled. Windows also implemented software DEP (without the use of the NX bit) through Microsoft’s “Safe Structured Exception Handling” (SafeSEH), which I will talk about a bit later.

Despite being a useful protection measure, the NX bit can be bypassed. This leaves us unable to execute instructions placed on the stack, but still able to control the execution flow of the application. This is where the ROP (Return Oriented Programming) technique becomes relevant.

GS (Stack Canaries)

Stack canaries are a security feature that helps protect against binary exploits. They are random values that are generated every time a program is run. When placed in certain locations, they can be used to detect stack corruption. The /GS compiler option, when specified, causes the compiler to store a random value on the stack between the local variables and the return address of a function. According to Microsoft, these application elements will be protected:

  • Any array (regardless of length or element size)

  • Structs (regardless of their contents)

In a typical buffer overflow attack, the attacker’s data is used to try to overwrite the saved EIP (Extended Instruction Pointer) on the stack. However, before this can happen, the cookie is also overwritten, rendering the exploit ineffective (though it may still cause a denial of service). If the function epilogue detects the altered cookie and the application terminates.

Example of memory layout during the buffer overflow
 
Example of memory layout during the buffer overflow

The second important protection mechanism of /GS is variable reordering. To prevent attackers from overwriting local variables or arguments used by the function, the compiler will rearrange the layout of the stack frame and will put string buffers at a higher address than all other variables. So when a string buffer overflow occurs, it cannot overwrite any other local variables.

It was introduced with the release of Visual Studio 2003. Two years later, they enabled it by default with the release of Visual Studio 2005.

However, this protection measure is also not bullet-proof, since the attacker can either try to read the canary value from the memory or brute force the value. By using these two techniques, attackers can acquire the canary value, place it into the payload, and successfully redirect program flow or corrupt important program data.

CFG/XFG

Control Flow Guard (CFG) is a highly-optimized platform security feature that was created to combat memory corruption vulnerabilities. Placing tight restrictions on where an application can execute code makes it much harder for exploits to execute arbitrary code through vulnerabilities such as buffer overflows.

CFG creates a per-process bitmap, where a set bit indicates that the address is a valid destination. Before performing each indirect function call, the application checks if the destination address is in the bitmap. If the destination address is not in the bitmap, the program terminates.

How Windows CFG works
 
How Windows CFG works

Microsoft has enabled a new mechanism by default in Windows 10 and in Windows 8.1 Update 3. Developers can now add CFG to their programs by adding the /guard:cf linker flag before program linking in Visual Studio 2015 or newer. As of the Windows 10 Creators Update (Windows 10 version 1703), the Windows kernel is compiled with CFG.

To enhance CFG (Control Flow Guard), Microsoft introduced Xtended Control Flow Guard (XFG). By design, CFG only checks if functions are included in the CFG bitmap, which means that technically if a function pointer is overwritten with another function that exists in the bitmap, it would be considered a valid target.

XFG addresses this issue by creating a ~55-bit hash of the function prototype (consisting of the return value and function arguments) and placing it 8 bytes above the function itself when the dispatch function is called. This hash is used as an additional verification before transferring the control flow.

Getting back to the CFG, there are multiple techniques to bypass it. For example, you can set the destination to code located in a non-CFG module loaded in the same process, or find an indirect call that was not protected by CFG. A brief write-up about the CFG bypass by Zhang Yunhai can be found here.

SafeSEH

SafeSEH is an exception handler. An exception handler is a programming construct used to provide a structured way of handling both system and application-level error conditions. Commonly they will look something like the code sample below:

1
try {
2
}
3
catch (Exception e)
4
{
5
// Exception handling goes here
6
}










Windows supplies a default exception handler when an application has no exception handlers applicable to the associated error condition. When the Windows exception handler is called, the application will be terminated.


Exception handlers are stored in the format of a linked list with the final element being the Windows default exception handler. This is represented by a pointer with the value 0xFFFFFFFF. Elements in the SEH chain before the Windows default exception handler are the exception handlers defined by the application.





Exception handler layout on stack



 



Exception handler layout on stack




If an attacker can overwrite a pointer to a handler and then cause an exception, they might be able to get control of the program.


SafeSEH is a security mechanism introduced with Visual Studio 2003. It works by adding a static list of good exception handlers in the PE file at the timing of compiling. Before executing an exception handler, it is checked against the table. Execution is passed to the handler only if it matches an entry in the table. SafeSEH only exists in 32-bit applications because 64-bit exception handlers are not stored on the stack. By default, they build a list of valid exception handlers and store it in the file’s PE header.


Preventing SEH exploits in most applications can be achieved by specifying the /SAFESEH compiler switch. When /SAFESEH is specified, the linker will also produce a table of the image’s safe exception handlers. This table specifies for the operating system which exception handlers are valid for the image, removing the ability to overwrite them with arbitrary values. If you want to see how this mitigation technique can be bypassed in real-life, this blog post offers more useful information.



Conclusion


Memory corruption vulnerabilities have plagued software for decades. As mentioned in the beginning, there are multiple mitigation techniques to prevent software exploitation and minimize damage caused by memory corruption bugs. However, those protections are definitely not a “silver bullet” solution for all memory corruption vulnerabilities.


For the developer, this means that no one should not blindly rely on the OS-provided protections. Instead, try to propagate secure coding practices and integrate security toolings like fuzzers and static code analyzers.


Lastly, move to memory-safe languages like Rust, if possible. For the attackers, even if the target application has all available mitigation measures, there may still be ways to bypass those protections.







								

				

				

				

							
		

						

						

					

			

						

				

									
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
								

				

					

		

					

		

				

		

						

				

					

		

					

		

				

		
   
Optimizing your business IT processes
		

						

						

					

			

						

				

									
In today’s fast-paced business environment, information technology shapes the way companies operate, compete, and grow. The pace of technological advancements adoption can play a deciding role in a company’s success or failure. However, how this can be achieved within an organization may not always be clear.
For this reason, we’ve invited co-founder and CPO at Kubernetes automation, optimization, security, and cost management platform CAST AI, Laurent Gil. Additionally, our Head of Platform Engineering at NordLayer, Carlos Salas, for his take on improving the current organization’s IT infrastructure.
Let’s take a deep dive into your current IT infrastructure assessment, automation areas identification, the right automation tools selection, its implementation, and the best practices.
Assessing your current IT infrastructure
Laurent Gil shared his valuable insights on how businesses can optimize their IT infrastructure to drive efficiency and productivity. According to him, one crucial step in this process is conducting a comprehensive assessment of your current infrastructure.
“A successful IT optimization strategy always starts with a gaining clarity around the current state of the infrastructure. A thorough assessment helps to identify issues and bottlenecks that are good candidates for automation – and where automation will make the biggest impact. Quick wins are just as important as long-term strategy and keeping your eye on the bigger picture, considering your company’s specific needs and direction.”
Click to tweet
Here’s how your current IT infrastructure could be evaluated in 8 steps:
  1. Define assessment objectives. Assessment objectives can be diverse, and they should focus on particular areas that could use improvements. For some businesses, it may be ironing out security vulnerabilities, while for others, it may be performance improvements. 
  2. Gather information. Regardless of assessment objectives, the next step will always be data collection. This will form a solid foundation for the evaluation process providing useful insights in later steps.
  3. Evaluate your used hardware and software. All used servers, storage devices, routers, switches, as well as operating systems, databases, applications, and security software should be reviewed. Check for potential bottlenecks and clunky setups that are slowing down your operations. 
  4. Perform network checks. Analyze your network topology, bandwidth, and latency. Evaluate your network security measures, such as firewalls, intrusion detection, and prevention systems.
  5. Look into data backups and disaster recovery. Verify that your data backup and recovery plans are up-to-date, reliable, and effective. Test your disaster recovery procedures to ensure that they meet your recovery time objectives.
  6. Analyze your security setup. Assess your security policies and procedures, including access controls, authentication, and authorization. Test your security controls to identify weaknesses or gaps.
  7. Consider the IT budget. Evaluate your IT budget and spending to identify areas for improvement or cost savings. Identify potential areas where technology investments can drive business value and growth.
  8. Document your findings. Document your findings and recommendations in a detailed report. This will serve as a reference document providing actionable recommendations for improving your IT infrastructure.
Identifying areas for automation
Findings from the IT infrastructure assessment should help you identify areas that could benefit the most from automation. As different companies have different IT struggles, going through this process should be a highly individualized approach. That said, here are some common areas that could be easily automated.
Data entry and data processing. Routine maintenance tasks like data entry, migration, and validation can be easily automated using macros, scripts, and other robotic processes.
Network and system administration. Tasks like server monitoring, backup, and patch management can be time-consuming and repetitive. Automations enable the creation of templates to perform the tasks identically, leaving less room for human error. In addition, this frees the staff from manual processes allowing them to focus on strategic activities.
Software deployment. Every software deployment instance involves a lot of repetitive tasks to ensure that it’s deployed correctly and without errors. Automating them can help reduce the time and effort required for deployment and improve the reliability of the process.
Customer support. Simple customer support tasks like answering frequently asked questions, providing account information, and processing routine requests can be solved without human involvement. Leveraging chatbots and virtual assistants can combine convenience and efficiency for businesses and their customers.
Choosing automation tools
When it comes to selecting automation tools, Laurent Gil highlights the significance of putting business needs at the forefront.
“I’ve seen the benefits automation can bring to organizations of all sizes firsthand. However, not all automation tools are created equal, and choosing the right one for your business can be a daunting task.
What you need to consider are first and foremost your specific business requirements. Understanding business needs and matching them to the right automation offering ensures that what you invest in represents the best fit for your company.”
Click to tweet
Here’s a brief overview of the approach that businesses can take when selecting automation tools:
Research what’s available on the market 
Clear business objectives and defined areas for improvement will allow you to fill in the gaps with automation tools. This can involve various routes like reviewing industry publications or consulting with vendors directly.
Evaluate select tool features 
Once a list of potential features has been compiled, it’s important to evaluate its features. Depending on needed functionalities, this can involve scalability, customizability or other ease of use adjustments.
Consider integrations
Industry expert and Head of Platform Engineering Carlos Salas highlighted the importance of considering the bigger picture when selecting automation tools, highlighting their interoperability.
“Whatever automation tools you select won’t exist in a vacuum, so thinking about potential integrations with existing systems and processes isn’t a bad idea.”
“Data security is paramount. Before implementing any automation tool, it’s imperative to thoroughly evaluate its capabilities in protecting sensitive information and adhering to established security protocols.”
Click to tweet
This paves the way for seamless automation implementation without hiccups and ensures optimal performance down the line.
Test and trial 
Before making a final decision, businesses should take chosen automation tools for a test drive. Various methods like setting up a proof of concept or pilot project to evaluate the effectiveness of the tool in real-world scenarios will help to realistically evaluate its usefulness.
Implementing automation
Implementing business IT automation can be a complex task that requires careful planning and execution. Here are some general steps that you can follow to implement business IT automation.
  1. Design the automation process. Start by creating a plan for automation, including a timeline and a list of tasks to be automated. It also helps to break the process into smaller tasks and identify the rules and conditions that must be followed.
  2. Deploy the automation. The exact route of automation deployment will depend on whether it’s an in-house built tool or a third-party provider was chosen. Still, it’s best to test in a production environment initially and, after testing, move on to full-scale implementation.
  3. Train employees. Expect that your workforce will only know how to use it after a while. Expect that there will be a transitionary period during which various training will help staff to familiarize themselves with the tool better.
  4. Evaluate the results. After the automation has been implemented and employees get used to it, it’s worth checking its impact on productivity, efficiency, and accuracy. This information can be highly useful when identifying shortcomings in your current setup as well as planning and identifying new areas for automation.
Best practices for automating IT
To maximize your chances that your automation process goes smoothly, it can be good advice to follow the best industry practices. These include:
Focusing on standardization 
Standardization is critical when it comes to automating IT processes. It also makes it easier to automate routine tasks, reduces the chances of errors, and helps ensure consistency across your IT infrastructure.
Make use of automation platforms
Laurent Gil quote 
According to Laurent Gil, automation platforms have the power to enhance business efficiency and streamline operations.
“Automation platforms enable businesses to accelerate and streamline their workflows and processes. Gone are the days of tedious manual tasks and complex coding requirements. With intuitive dashboards and user-friendly interfaces, these platforms empower users to design, create, and implement automation workflows without the need for in-depth technical expertise. And that’s a very good thing.”
Click to tweet
Gil’s words highlight the significant shift brought about by automation platforms in the business landscape. With these powerful tools at their disposal, organizations of all sizes can leverage automation to optimize their workflows, freeing up valuable time and resources for more strategic endeavors.
Adopt a DevOps approach 
Adopting a DevOps approach to automation can help streamline the IT development and deployment processes. Integrating development and operations teams allows the entire software development lifecycle to be automated. This can help you deliver software faster and with fewer errors.
Involving stakeholders 
Stakeholders are the personnel that the automation process will directly impact. Therefore, their input can help to identify potential pain points in advance. This can lead to more effective automation that addresses real problems and is designed to meet the organization’s specific needs.
Bottom line
Optimizing your business IT requires a systematic approach based on evaluating your current setup. The thorough analysis of the current businesses’ IT environment allows them to identify potential automation areas.
The process is finalized by choosing appropriate automation tools and going through the implementation process. It’s important to consider specific needs, evaluate tool features, integration, and test and try the solutions before fully committing. Automation adoption has the potential to make businesses even better adjusted to the current digital landscape.
								

				

				

				

							
		

						

						

					

			

						

				

									
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
								

				

					

		

					

		

				

		

						

				

					

		

					

		

				

		
   
Elevating healthcare: a definitive guide to robust cloud security in the industry
		

						

						

					

			

						

				

									
When compared to other industries, healthcare has remained quite reluctant to digitalization. However, as technology evolves, cloud computing has become vital in streamlining operations and enhancing data accessibility. On the flip side, this also introduces various security concerns that demand attention.
This comprehensive guide delves into the importance of robust cloud security in healthcare. It provides valuable insights to safeguard sensitive patient information, maintain regulatory compliance, and fortify the industry against evolving threats. Join us as we explore all the essential information regarding cloud security in healthcare.
The growing importance of cloud security in healthcare
After the COVID-19 pandemic, the healthcare industry experienced a heightened demand for improved and more modern services. Distributed care and telemedicine pushed healthcare organizations to move to cloud computing, meaning data security had to be considered. The problem is that the same techniques that were valid for data security on-premises don’t translate well into externally kept data.
Some of the challenges facing the healthcare industry transitioning to cloud infrastructure included:
  • Resource and budget strains. Most healthcare providers work with limited IT budgets, so major infrastructure overhauls are long and tedious.
  • Continuity of operations. Data migrations to the cloud shouldn’t disrupt everyday operations, which isn’t something that all healthcare providers can allow.
  • Regulatory compliance. Patient data is highly confidential information so various local regulations sanction its security.
Generally, healthcare organizations want to move to cloud computing to make their services more effective while avoiding unnecessary or unmanaged risks. As patient data is one of the most sensitive data types, ensuring robust security measures is a top priority.
Types of healthcare cloud security solutions
Healthcare providers (and, by extension, most industries) rely on three main types of cloud computing services. This includes Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS).
Infrastructure-as-a-Service (IaaS)
Infrastructure-as-a-Service provides virtualized computing resources as services over the internet. In IaaS, the service provider manages and delivers all associated hardware and software components: servers, storage, networking, and virtualization resources. With IaaS, users can provision and control these resources on-demand, scaling them up or down as needed.
Benefits of IaaS in healthcare
Aside from the fact that cloud computing makes it easier to deploy workloads, IaaS has a range of benefits that could be useful for healthcare companies.
  • Scalability and flexibility. By leveraging IaaS, users can rapidly deploy and configure virtual machines, storage, and network components. This allows healthcare organizations to scale their infrastructure up or down based on their actual needs.
  • Disaster recovery. IaaS enables organizations to back up and recover their critical data and remote machines. As critical data and applications are kept in cloud storage, this ensures their availability and integrity.
  • Cost efficiency. IaaS service providers use a flexible pay-as-you-go pricing model allowing users to pay only for the resources they use. This enables cost optimization, eliminating the need for upfront hardware and infrastructure maintenance investments.
Security challenges and how to address them
IaaS security is shared between the service provider and the user. While the service provider is responsible for managing underlying networking, storage, servers, and virtualization, the user is responsible for managing the security of everything running on top of the infrastructure. This involves operating systems, middleware, data, and applications. This setup is not without cybersecurity challenges.
  • Data protection. Sensitive patient data must be protected using encryption and access controls. As the data is physically located in third-party data centers, unauthorized access or breaches are the primary concern.
  • Compliance. Patient data falls under government-protected information, so regulatory compliance applies to it. Organizations must ensure that their IaaS providers adhere to sensitive patient data from unauthorized access or breaches.
For these reasons, IaaS provider selection is crucial to avoid collateral damage. Implementing multi-factor authentication, regular vulnerability assessments, and proactive monitoring can enhance security.
Platform-as-a-Service (PaaS)
Platform-as-a-Service includes everything from IaaS with a dedicated environment for developing, deploying, and managing applications over the internet. It offers tools, frameworks, and services that enable developers to build, test, and run applications. Much like a physical data centre, PaaS providers handle hardware provisioning, operating system management, and network setup, allowing developers to focus solely on application development.
Benefits of PaaS in healthcare
With PaaS, healthcare providers get a platform for developing, testing and deploying applications in the cloud. Here are its main benefits:
  • Rapid application development. PaaS simplifies the application development process, allowing one to skip multiple setup steps and go directly to the deployment. This can accelerate innovation and provide new solutions quickly.
  • Scalability and performance. As with all cloud-based tools, they can automatically scale based on demand, ensuring high availability and optimal performance.
  • Collaboration and integration. PaaS is compatible with existing systems, meaning currently used tools can be integrated into a unified system.
Security challenges and how to address them
When adopting PaaS, organizations need to be wary of its security challenges. Here are some examples:
  • Application security. PaaS environments involve the deployment and running of custom applications. Therefore, businesses should conduct regular code reviews, implement secure coding practices, and perform vulnerability assessments.
  • Secure configuration. Businesses need to make sure that used PaaS platforms are properly configured. This includes firewalls, network access controls, and encryption protocols.
  • Incident response and monitoring. PaaS environments require ongoing monitoring and timely incident response capabilities. By establishing robust logging and monitoring systems and employing detection and prevention mechanisms, we can have a ready system in case of an intrusion.
Software-as-a-Service (SaaS)
Software-as-a-Service is a cloud computing model in which hosted software is delivered over the internet instead of installed on local premises. In this model, the software is centrally hosted by a provider who manages and maintains the underlying infrastructure, database, and updates. Users only pay a subscription fee to access and use the software on a pay-as-you-go basis.
Many healthcare-related applications are delivered via SaaS, including healthcare picture archiving and communication systems (PACs), electronic health records (EHR), telehealth services, and more.
Benefits of SaaS in healthcare
With SaaS, healthcare organizations are provided with the service directly without the need to handle setup and maintenance. Here are its main benefits:
  • Accessibility and mobility. SaaS applications can be accessed from everywhere, enabling healthcare professionals to securely access patient information on various devices, enhancing workflow efficiency.
  • Automatic updates. The responsibility to handle software updates and patches fall on the service provider, meaning that healthcare applications are always up to date and protected against emerging security threats.
  • Fast deployment. SaaS applications are provided instantly and with minimal setup compared to on-premises software. Software updates and maintenance are handled by the SaaS provider, ensuring smooth operation.
Security challenges and how to address them
The problem is that SaaS brings healthcare organizations not only benefits. It does have some security challenges that need to be addressed by IT personnel.
  • Access control. As SaaS applications are externally hosted, managing user access and authentication is critical. This is the only way to prevent unauthorized intrusions.
  • Third-party integrations. Some SaaS applications need to be integrated with third-party services or APIs. These integrations can introduce security risks if not properly managed or if they have exploitable vulnerabilities.
  • Multi-tenancy risks. The same SaaS application can serve multiple consumers, sharing the same underlying structure and resources. This is why logical separation and isolation between tenants are crucial to prevent data leakage or unauthorized access to customer data.
Compliance and regulatory landscape in cloud security
Regulatory landscape and compliance are critical considerations for organizations across various industries. Most countries have recently implemented various data protection and cybersecurity laws. The government regulates the privacy protection of medical data, and breaching the law ensues grave consequences.
Here are some prominent regulations, guidelines that could impact cloud security, and strategies for ensuring compliance.
HIPAA and HITECH
The Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act are crucial regulations in the healthcare industry. They both perform different functions:
HIPAA — sets standards for protecting sensitive patient health information
HITECH — promotes the adoption of electronic health records
Compliance with both is essential when leveraging cloud computing services in the healthcare sector. Organizations need to take care of security measures like data encryption, access controls, and regular audits to safeguard patient data and meet the requirements outlined in these regulations.
GDPR
The General Data Protection Regulation (GDPR) is a comprehensive data protection framework that affects organizations operating in European Union countries or handling EU citizen data. It emphasizes individual privacy rights, consent management, and data breach notification.
Cloud service providers and organizations utilizing cloud computing services must comply with GDPR by implementing appropriate security measures, conducting data protection impact assessments, and ensuring cross-border data transfers adhere to GDPR guidelines. Encryption, pseudonymization, and privacy-by-design principles are critical for achieving compliance with GDPR in cloud computing.
Other regional regulations and guidelines
In addition to HIPAA, HITECH, and GDPR, other regional regulations and guidelines impact cloud security in specific industries or geographic locations. Examples include the Payment Card Industry Data Security Standard (PCI DSS) for the payment card industry and the Federal Risk and Authorization Management Program (FedRAMP) for U.S. government agencies.
Compliance with these regulations requires organizations to align their cloud security practices with specific requirements. Depending on the regulation and area, this may include data encryption, access controls, vulnerability management, and incident response protocols. Staying informed about relevant regional regulations is crucial to ensure compliance and avoid potential penalties or reputational damage.
Navigating third-party challenges and shared responsibility
As it was mentioned previously, cloud services adoption would involve collaboration with third parties. Here are some key considerations of security responsibilities between the cloud service provider and the customer:
Vendor risk assessment
A thorough vendor risk assessment helps to make sure that a cloud provider will be a matching fit for a healthcare organization’s needs. The cloud service provider’s market is saturated, but not everyone has compliant security controls, certifications, incident response capabilities, and data protection practices. The same strict requirements for healthcare organizations also apply to their third-party partners.
By assessing vendor risks, organizations can make informed decisions and select providers aligning with their security requirements and compliance obligations. Provider’s failure to secure the underlying infrastructure can open the gap in the security set up by the healthcare provider.
Understanding the shared responsibility model
The shared responsibility model defines the division of security responsibilities between cloud service providers and customers. While providers are responsible for securing the underlying infrastructure, customers are accountable for securing their data and applications within the cloud.
Organizations must understand and fulfill their share of responsibilities, which may involve tasks such as configuring access controls, encrypting sensitive data, applying patches and updates, and regularly monitoring for security incidents.
Key cloud security strategies and solutions for healthcare
While cloud computing is appealing to make operations more modern and effective, the downside is the potential cybersecurity risks. Safeguarding sensitive patient data and navigating regulatory compliance requirements are the primary concerns for healthcare providers. There are three main cloud security strategies and solutions to consider.
Advanced threat prevention
Advanced threat prevention is one of the key cloud security strategies for healthcare. It involves deploying sophisticated security measures to identify and mitigate potential threats before they cause any damage. Relying on technologies like machine learning algorithms, behavior analysis, Deep Packet Inspection, and real-time monitoring, organizations aim to detect and respond to suspicious activities.
As a proactive approach to cybersecurity, advanced threat monitoring allows healthcare organizations to identify and effectively neutralize threats. This helps businesses to reduce the risk of data breaches and unauthorized access to patient information.
Cloud-based security operations and monitoring
Monitoring is critical in ensuring the integrity and confidentiality of healthcare data stored in the cloud. By providing continuous oversight and proactive detection of potential security breaches or unauthorized access attempts, monitoring enables organizations to secure against security incidents promptly.
In addition, by leveraging cloud-based security tools, healthcare organizations can centralize security operations, streamline incident response, and gain insights into potential vulnerabilities. The systems can be automated, helping organizations detect and mitigate security breaches on time and enhancing overall security posture without human involvement.
Secure remote work
During the COVID-19 pandemic, the adoption of remote work in the healthcare sector accelerated. Secure remote access became critical as healthcare professionals needed to access patient data and collaborate remotely.
Cloud security solutions enable secure sensitive data storage, ensuring healthcare providers can work efficiently while adhering to strict security protocols. Implementing secure virtual private networks (VPNs), multi-factor authentication, and encryption technologies safeguard data transmission and prevent unauthorized access, mitigating risks associated with remote work.
Cloud security in action: enabling new healthcare capabilities
Cloud security not only performs the function of safeguarding patient data, it also empowers healthcare organizations to embrace new capabilities and innovate. Here are some routes in which cloud security can facilitate advancements.
Redundancies to prevent ransomware attacks
Ransomware attacks use malware that encrypts data stored in the device’s hard drive rendering it inaccessible until a payment is made to the attacker. This is extremely disruptive to organizations relying on on-premises infrastructure as this can completely shut down all operations and compromise patient data.
The only solution to this issue is data replication in multiple dispersed locations. That way, there’s no centralized storage that could be tampered with. In an accident, data can be restored from unaffected backups, minimizing downtime and ensuring continuity of care. Cloud servers enable effective mirroring solutions allowing distributed backups.
Delegation of security responsibilities to third-party firms
Cloud security can catalyze operations outsourcing, allowing better work distribution in your organization. Managing and maintaining robust cloud security infrastructure requires specialized expertise. That’s one of the key reasons why many healthcare organizations delegate their security responsibilities to reputable third-party vendors.
Cloud computing partners already possess the knowledge and resources to implement industry best practices, conduct regular security assessments, and respond to emerging threats promptly. This allows organizations to enhance the cloud security posture and focus on quality patient care.
Automation to free up healthcare resources
Cloud security can be improved by adopting various innovations to improve the setup. By automating vulnerability scanning, log analysis, and security policy enforcement, healthcare providers can free up their workforce from manual and time-consuming tasks.
Automation improves efficiency, reduces the risk of human error, and ensures consistent application of security controls. As IT professionals aren’t burdened with recurring manual tasks. This leaves them more time to focus on advanced security measures and stay updated with evolving threats.
Expert insights and resources for healthcare cloud security
Several organizations provide expert insights and resources for healthcare cloud security. Cloud Security Alliance (CSA), the European Union Agency for Cybersecurity (ENISA), and the National Institute of Standards and Technology (NIST) are the main ones providing various recommendations for cloud security in healthcare companies.
CSA
CSA has established requirements for healthcare organizations to ensure secure cloud computing practices. These requirements mainly focus on several key areas:
  • Implement strong access controls and authentication mechanisms to protect sensitive data.
  • Regularly monitor and audit cloud services for security vulnerabilities and incidents.
  • Encrypt data both in transit and at rest to maintain confidentiality.
  • Conduct regular risk assessments and threat modelling to identify and mitigate potential risks.
  • Establish incident response and recovery plans to handle security breaches effectively.
  • Stay updated with the latest security best practices and standards.
By adhering to these CSA requirements, healthcare organizations can enhance the security of their cloud computing environments and protect patient information from unauthorized access or data breaches.
ENISA
ENISA lays out comprehensive requirements for healthcare organizations in the European Union to enhance their cybersecurity measures. These requirements encompass multiple aspects of cloud security:
  • Develop and enforce robust security policies and procedures for cloud adoption.
  • Perform thorough risk assessments to identify and address potential security threats.
  • Ensure the secure configuration and hardening of cloud computing environments.
  • Employ strong access controls and authentication mechanisms to protect sensitive data.
  • Regularly monitor and log cloud computing activities to detect any suspicious behaviour.
  • Establish incident response plans and conduct regular security audits.
Adherence to these ENISA requirements is vital to safeguarding patient data, protecting critical healthcare systems, and maintaining the resilience and trustworthiness of healthcare services within the EU.
NIST
NIST provides guidelines and requirements and guidelines for healthcare organizations to ensure the security and privacy of patient information. These requirements include:
  • Follow the NIST Cybersecurity Framework for risk management and cybersecurity best practices.
  • Employ strong identity and access management controls to protect data and resources.
  • Use encryption to safeguard data both in transit and at rest.
  • Regularly update and patch cloud infrastructure and applications to address security vulnerabilities.
  • Implement robust network security controls, such as firewalls and intrusion detection/prevention systems.
  • Conduct continuous monitoring and log analysis to promptly detect and respond to security incidents.
Healthcare companies must review and adapt these recommendations to their organizational needs and regulatory requirements.
How can NordLayer help?
Securing cloud infrastructure can be challenging for healthcare companies. Still, the benefits outweigh the risks, so it’s worth considering digitally transforming an organization and improving its services. It’s not a bad idea to turn to third-party partners that could help to take a leap.
NordLayer streamlines network access controls to ensure only authorized users can access confidential data. Access to cloud resources happens using encrypted tunnels using AES 256-bit and ChaCha20 cyphers. The service is also compatible with major cloud platforms like Azure and AWS, allowing seamless integration with other solutions and services.
With correct control mechanisms, NordLayer is a valuable ally to follow through with the best cloud environment security practices. With an extensive set of centrally implemented features and monitoring controls that are all managed via the Control Panel, NordLayer allows the implementation of security policies reducing various risks.
Contact NordLayer and discuss your security options today to ensure safe access to patient data and protect your cloud infrastructure.
FAQ
How can healthcare organizations ensure compliance in the cloud?
Healthcare organizations can ensure compliance in the cloud by understanding applicable regulations. Familiarizing with regulations like HIPAA and GDPR will allow organizations to identify specific compliance requirements. This will serve as a basis for cloud provider choice and guide what access controls and other cybersecurity functionalities must be implemented to align with requirements.
What are examples of cloud security?
Cloud security is an umbrella term encompassing various technologies to protect data and systems in the cloud. This includes encryption, access controls, firewalls, intrusion detection and prevention systems, security information and event management, and data loss prevention.
How does the shared responsibility model work in healthcare cloud security?
The shared responsibility model defines the division of security responsibilities between the cloud service provider (CSP) and the healthcare organization. While the specifics entirely depend on the cloud service model, the cloud service provider usually takes care of the underlying cloud infrastructure. At the same time, the healthcare organization is responsible for application data security and access control.
What steps can healthcare organizations take to mitigate third-party risks?
To mitigate third-party risks, healthcare organizations must establish clear contractual agreements outlining security expectations, data handling procedures, breach notification requirements, and liability provisions. Then, a good plan is to perform ongoing maintenance with regular risk assessments. This should help organizations minimize risks associated with third parties.
								

				

				

				

							
		

						

						

					

			

						

				

									
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
								

				

					

		

					

		

				

		

						

				

					

		

					

		

				

		
   
February 2023: What’s New?
		

						

						

					

			

						

				

									
“What’s New?” is a series of blog posts covering recent changes to Comet in more detail. This article covers the latest changes in Comet Voyager over February 2023.
There were just three Comet software releases during February – two in the 22.12.x Voyager release series, plus the launch of our latest quarterly series 23.3.0 “Leda”.
February is a short month, and it was also a quiet month for new feature development as we focused on quality assurance ahead of the new quarterly software release. Most new feature development this month has been held back as a result, so you will see many more exciting new features land in the 23.3.x “Voyager” series when it reopens shortly next month in March.
Better email reports
The latest 22.12.x versions of Comet included improvements to the email reporting features that launched at the start of the 22.12.x series.
The Recent Activity email report template now includes a table legend in the email footer, helping to distinguish the color series from each other. By way of comparison, when you view Comet Server’s Recent Activity page in a web browser, it’s possible to hover the mouse over each color segment to display more detailed information about the breakdown of different job types. However, email is a more limited technology medium and an equivalent hover feature is not available. The legend is a simple solution that makes the Recent Activity email report more accessible to Comet Server operators who are not yet familiar with the colors.
The email feature has received more attention to detail, leading to us developing additional fixes for email report previews; for filtering the subset of customers; and for partial configuration of time boundaries.
Better granular restore
Another one of our areas of focus this month has been the granular single-file restore system, that now shares some common core functionality across both the Disk Image and Hyper-V Protected Item types. Granular restore now supports more types of NTFS compressed file, including a fix for files that have been compressed with the LZNT1 algorithm. We also fixed an issue with reading single files from within NTFS partitions that have a highly fragmented MFT (Master File Table).
Additionally, we have fixed additional issues with the new Hyper-V single-file restore if a single Protected Item contains multiple virtual machines with multiple VHDX images, as well as fixing cosmetic issues when toggling between Protected Item types in the Comet Backup desktop app.
Better syncing with Gradient MSP
There have been improvements to the process of syncing Comet data with Gradient MSP. As a reminder, this is an external service that can correlate your Comet user accounts and storage usage with RMM invoices in systems such as Autotask, Syncro RMM, Connectwise, and many more.
The latest versions of Comet Server allow more fine-grained control of the connected feature set; the ability to toggle sending backup job failures to the RMM; optimizing the number of alerts that are sent; and providing clearer error messages if there is an error from Gradient’s service.
Comet 23.3.0 “Leda”
All of our focus on bugfixes this month has been building up to one thing – a smooth and seamless release of our latest quarterly milestone software version. This time, it’s named “Leda”, and this rolls up the whole quarter’s worth of 22.12.x enhancements into a new fixed point for you to build your business on.
Like Comet’s previous recent quarterly software releases, “Leda” is named after a moon of Jupiter. Jupiter has a great number of moons and more are continuing to be discovered. When Leda was discovered as recently as 1974, it was one of Jupiter’s 13 known moons. Today, Jupiter has 92 known moons, with the most recent discovered just this month in February 2023!
You can read the full release notes for Comet 23.2.0 “Leda” to see the full details – or if you’d prefer to watch rather than read, I’m hosting a webinar next week to discuss this new quarterly release and all its new features. Please register for a notification before we go live on March 7th (PST) to catch up on all the latest Comet news with me – there will be a free live Q&A session after the presentation.
As well as that, we have many more videos available on our YouTube channel, including guides on getting started with Comet, individual features, demonstrations with our technology partners, and webinars for previous quarterly software releases.
								

				

				

				

							
		

						

						

					

			

						

				

									
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.
								

				

					

		

					

		

				

		

						

				

					

		

					

		

				

		
  
Compliance Experts on What to Expect in 2023
		

						

						

					

			

						

				

									


The consequences of non-compliance can be devastating.


In 2023, businesses have more to fear than just the formal penalties issued by regulatory or legislative entities. With cybercrime rates at a seemingly all-time high, and even once-trusted cybersecurity companies proving susceptible to breaches, organizations are on high alert.


Failing to comply is more than just a compliance issue or an unchecked box. It can represent an unchecked vulnerability that may give way to a data breach that will have your brand name on consumers’ lips for all the wrong reasons.


That’s why we invited two compliance and security experts to speak on the future and state of compliance. Here’s a short recap of the conversation moderated by Gerald Kasulis, VP of business operations at Nord Security, with:



    
 	
  • 

    Deena Swatzie, SVP, Cyber Security Strategy and Digital Innovation at Truist,
    

    • 
 	
  • 

    Joy Bryan, GRC/Privacy Technology Analyst, RNSC Technologies, LLC.
    

    • 



Kasulis asked the panelists astute questions about the implications of adopting tech powered by AI, the current corporate climate, and how businesses can prioritize compliance on a shoestring budget.


Watch the webinar recording in full right now or keep reading to find out three takeaways that will help kickstart or support your compliance agenda this year.



Increasingly savvy consumers will hold businesses accountable


When data breaches happen, usually it’s the consumers who suffer. The consequences range in severity and kind, but whether major or minor, reputational or financial, a violation of one’s privacy through personal data exposure is never a welcome outcome.


As businesses become hyperaware of the likelihood of a data breach, consumers are equally tuned in.





quotes





Consumers are getting smarter in that [data privacy] space. They’re going to expect more, they’re going to hold companies accountable. And so that’s why your compliance needs to be in place.


– Joy Bryan


GRC/Privacy Technology Analyst at RNSC Technologies, LLC






Consumers are more likely than ever to want assurances that their personal data will be kept safe as concerns surrounding data privacy become more mainstream. They want to know how their information will be stored and what measures businesses are taking to protect it.


In today’s climate, trust is a linchpin of customer satisfaction. A recent survey revealed that 71% of consumers are unlikely to buy from a company that loses their trust — which is bad news for businesses that have suffered major breaches.


Meeting compliance standards and earning certifications can be a shorthand for establishing (or re-establishing) customers’ confidence: this ensures that businesses are following the agreed-upon best practices in a verifiable way.


At the end of the day, the buck stops with corporations who collect and store personal data. They will be held accountable for their (in)ability to protect the data they keep.


“Consider yourself as the consumer,” says Swatzie. She suggests that businesses should use the golden rule as a framework — treat consumer data as you would hope and expect yours to be treated.



Additional resources may not be the answer




quotes





Even when we talk about talent and the workforce, everyone’s immediate response is ‘we need more resources.’ You don’t always necessarily need more resources.


– Deena Swatzie


SVP, Cyber Security Strategy and Digital Innovation at Truist






Swatzie explained that it’s important to understand what exactly is required to meet compliance standards so that you can balance what you have with what you need. Here, collaboration between teams is key. Security and compliance initiatives will overlap.


Both experts agree that it’s best to start by looking at in-house tech and talent before making an investment. And on the occasion when you do require an additional resource, like software, be sure that you’re adopting tools that serve multiple functions.





quotes





I think that whatever platforms and technologies are implemented should have a collaborative feel — where you’re tackling multiple things at once.


– Joy Bryan


GRC/Privacy Technology Analyst at RNSC Technologies, LLC






NordPass Business, for instance, delivers so much more than password management. Get a powerful data breach scanner, password health metrics, a detailed activity log, company-wide advanced security settings, and multi-factor authentication.


On the topic of breaches, take solace in NordPass’ zero-knowledge architecture which ensures that only you hold the key to your business credentials and vault items. In the unlikely event of a breach at NordPass, your private information will remain encrypted and out of reach to cybercriminals.



New investments in tech solutions should add value to what many teams are likely to prioritize the most: workflow efficiency. Consider how and whether security and compliance tools speak to that need.


Get into the nitty gritty. Take the time to consider your existing and prospective tools’ full scope to avoid overinvesting in overlapping functions.


According to Swatzie, “Privacy is everybody’s responsibility. Security is everybody’s responsibility. Compliance is everyone’s responsibility.” For that reason, it’s important not to take buy-in for granted with a top-down approach.


Ask yourself: will my team be open to adopting this policy or software? Does it promote or detract from their respective top priorities?



The word of the day is “proactive”


If we had to summarize the experts’ advice in just two words: be proactive. Specifically, on the topic of lessons learned from a turbulent 2022:





quotes





I would hope that in terms of lessons learned, it allows businesses to be a little bit more proactive in their approach and in their strategies.


– Joy Bryan


GRC/Privacy Technology Analyst at RNSC Technologies, LLC






If your compliance and security strategy is only reactive, then it shows a lack of forward-thinking, meaning you’re likely to be continuously caught off guard and lagging behind. Swatzie suggests that compliance professionals and business leaders “put on their auditor hat.”





quotes





I’m used to being heavily regulated and audited so I’ve learned enough from the auditors to know exactly what they’re going to ask me before they ask me. So going back to what Joy said earlier, be as proactive as possible.


– Deena Swatzie


SVP, Cyber Security Strategy and Digital Innovation at Truist






Where possible, brace your business for what’s likely to come down the compliance pipeline by studying the standards themselves. With an intimate understanding of the “spirit of the law” you should be able to intuit what’s next and prepare accordingly.


That being said, it’s not a lack of motivation that leaves security and compliance professionals in a reactive position. When it comes to cyber incidents, board and senior leadership members sometimes struggle to see prevention as the cure — waiting until after an event has occurred to implement more stringent security measures.


To learn more about how to get buy-in from colleagues and management before the fact, read our guide on how to campaign internally for cybersecurity.



Summary


Facing increasingly savvy and appropriately demanding consumers, businesses should understand that they will be held accountable for breaches of personal data and plan accordingly.


But, that doesn’t necessarily mean rushing to acquire additional talent and technological resources. Invest wisely and make it count. In particular, security software should be multi-functional.


Finally, the key to success is in forward-thinking. Adopt a proactive strategy to avoid a constant scramble to respond after-the-fact.
								

				

				

				

							
		

						

						

					

			

						

				

									
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.
								

				

					

		

					

		

				

		

						

				

					

		

					

		

				

		
   
Finding OpenSSH servers
		

						

						

					

			

						

				

									
The OpenSSH team surfaced a security issue earlier this month that specifically affects OpenSSH server version 9.1p1 (a.k.a. version 9.1). This version contains a memory double-free vulnerability (tracked as CVE-2023-25136) that can be reached pre-authentication by a remote attacker. Researchers, including JFrog and Qualys, have been investigating and providing proof-of-concepts of a denial-of-service scenario and remote code execution for the attacker.


What is the impact? 


OpenSSH is a popular open source implementation of the SSH protocol and is available on many operating systems. While the installation base for OpenSSH is quite large (Shodan currently reports ~48k public-facing instances of OpenSSH servers running version 9.1), the potential impacts of this vulnerability are not yet fully understood and are still being investigated.


The denial-of-service attack vector may be successful against a number of operating systems running OpenSSH 9.1. However, it yields limited results because it only crashes the forked daemon instance that was spun up to handle the attacker’s SSH connection (leaving the parent ssh daemon still running to handle other incoming connections).


Exploitation of this vulnerability for remote code execution (RCE) is more complex, with a current proof-of-concept that only targets OpenBSD 7.2 without memory protections in place (such as ASLR, NX, or ROP defenses) and with code execution still contained within the ssh daemon’s sandbox. As researchers continue investigating RCE exploitation, other operating systems with attacker-bypassable memory malloc and double-free protections may be discovered. So, the ability to fully execute attacker-controlled code outside of the ssh daemon sandbox -even with memory protections in place– may be achieved.


Are updates available? 


OpenSSH version 9.2p1 (a.k.a version 9.2) was released earlier this month and patches this vulnerability (CVE-2023-25136). For systems currently running OpenSSH 9.1, admins are encouraged to update to OpenSSH 9.2 or later.


How do I find vulnerable OpenSSH services with runZero? 


To locate OpenSSH servers running the vulnerable 9.1/9.1p1 version in your network, use the following prebuilt query in your  Service Inventory:


_asset.protocol:ssh AND protocol:ssh AND (_service.product:="OpenBSD:OpenSSH:9.1" OR _service.product:="OpenBSD:OpenSSH:9.1p1")

OpenSSH query

To local all OpenSSH servers in your network, use the folloing prebuilt query in your Asset Inventory:


product:”OpenSSH”

OpenSSH query

As always, any prebuilt queries are available from our Queries Library. Check out the library for other useful inventory queries.
								

				

				

				

							
		

						

						

					

			

						

				

									
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
								

				

					

		

					

		

				

		
		

						

						

					

			

						

				

									
About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.