Skip to content

What is Data Gravity?

If you have ever wondered why data keeps growing and creating big data, there’s a simple and familiar concept behind it. As organizations grow, amassing vast amounts of data, the amount of data in their repository keeps growing, creating an ever-increasing repository of information.

This has to do with how large data attracts more data, applications, and services, increasing in size over time. This phenomenon is called data gravity. Since data gravity is unstoppable, it’s crucial to understand what it is and how to manage and optimize it.

This article explores the concept of data gravity, its effect on organizations, and how to manage it to help you use it to your benefit.

What is the Definition of Data Gravity?

Data gravity is very similar to the physical gravity you are used to. It refers to how big data attracts applications, services, and more data, leading to a snowball effect that quickly increases data size. According to Newton’s law of gravity, the earth attracts other smaller objects to it. Similarly, large data sets attract applications, services, and other data.

Typically, the larger the data set, the more data it attracts, creating a gravitational pull that keeps the data pool close by. This concept applies not only to data in physical proximity to big data but also to the digital realm, that is, data in cloud storage. Examples of data gravity are data warehouses and data lakes.

Consider a business keeping vast volumes of consumer data in a data warehouse. The warehouse expands in complexity and scale as it gathers and analyses increasing volumes of data.

This expansion will draw new uses and services, including customer relationship management (CRM), which is applied for more thorough consumer analysis. This analysis also draws in more data, creating a continuous cycle of data growth over time.

History of Data Gravity

The history of data gravity is relatively close. The term was first introduced in a 2010 blog post by Dave McCory, who was a software engineer at GE Digital. When explaining the concept of data gravity, he used the analogy of physical gravity to explain how large datasets attract IT systems, like how a planet’s gravitational pull attracts objects around it. For example, the moon orbits around the Earth because of gravity. So, similarly, large data, which in this case are applications and services, is like the Earth, attracting the moon.

David McCory also explains in another blog post that data gravity doesn’t only occur naturally; external forces like costs, specialization, and legislative can indirectly influence data gravity. This is called artificial data gravity. He gives an example of AWS S3 that allows unlimited transfer inbound traffic for free. This free unlimited transfer encourages users to gather data, leading to artificial data gravity because it is externally influenced.

Effects of Data Gravity

Data gravity has both positive and negative effects on organizations. Being aware of both sides can help you manage data gravity effectively.

Pros of Data Gravity

The perks include:

  • Centralized Data Management: Data gravity allows organizations to manage data in a centralized data hub, making it easier to manage data across multiple applications and departments.
  • Improved Data Integrity: Centralized data management reduces the risk of data inconsistencies by helping an organization manage its data from one location. Thus, they can monitor data and ensure it is up-to-date and accurate.
  • Better Data Utilization: Big data enables organizations to utilize data effectively. For example, the availability of more data provides more information when performing data analysis.

Cons of Data Gravity

Some major disadvantages are:

  • Scalability Problem: As the size of the data increases, organizations could face scalability issues. Due to the large data size, migrating to better resources or another platform could be uneconomical. This can lead to vendor lock-in as the organization will find it difficult to switch to another platform. Thus, you may become solely dependent on a single provider.
  • Latency: Organizations can face the issue of latency if the applications and services are far from the large data set. If the distance between where data is stored and processed is significant, this distance causes latency, crippling performance. To reduce latency, it’s best to ensure that the data and the gravitating applications and services are close or co-located.
  • Higher Costs: Another problem data gravity poses is the higher cost involved. For example, organizations may need to acquire new storage tools and applications, which could significantly increase data management costs.

Managing Data Gravity

Big data can be overwhelming, so managing data gravity is crucial to ensure that you take advantage of its benefits. Below are some ways to manage your growing data:

  • Cloud-Based Solutions

Opting for cloud storage offers a scalable and flexible solution, enabling organizations to manage large data sets better. Also, cloud services reduce the complexity of data management by making data accessible across different devices and departments. However, storing all data on the cloud is not always possible. So, organizations that need on-premise storage systems should opt for scalable systems that reduce latency. One such solution is hyper-converged systems, which combine storage and networking in one platform, cutting down latency and ensuring effective data management.

  • Data Integration

You can take advantage of data gravity by integrating several data sources into one data hub. Although combining data to form one gigantic data set may seem ineffective, one data source means you have to contend with only one outlet instead of several, making it more organized. Doing so also makes accessing and managing data easier, leading to better performance and fewer errors.

  • Data Governance

Robust data governance policies can also help manage and utilize data gravity. These policies include data standards, access controls, and accountability measures set to ensure the smooth management of big data.

  • Decentralized Architectures

Decentralized architectures like cloud storage can also reduce the risks associated with data gravity. Since these tools don’t need a central physical location, data can be processed closer to where it is generated. As a result, latency can be reduced, and data processing times can be improved.

  • Effective Data Planning

Generally, effective data management can help prevent the risks involved in data gravity. Taking care to consider not just the current needs, but also the future data needs of an organization. Making the right decisions for your data can help manage data gravity.

The Importance of Data Backup in Data Gravity

The more data there is, the higher the risk of corruption and loss. In the event of a data disaster, an organization will lose a large amount of data created by gravity. Thus, it’s crucial to implement robust backup solutions that will protect against data loss during disasters.

However, the biggest problem with data backup in such an environment is not its size. Data attracts new applications or services, which often decentralize data processing, creating new data sources. Therefore, without versatility, data protection can focus only on selected silos, ignoring new data sources. In such a case, we may: 1) consciously not expand the ecosystem with modern tools, 2) agree that some data will not be secured, 3) or implement an additional tool to secure modern workloads, which will only complicate the data management process and may negatively impact their consistency.

No. 4 is, of course, replacing the backup tool with Storware Backup and Recovery, which supports protection for virtual, physical, and cloud data and allows integration with enterprise-class backup devices, expanding their data protection capabilities with new sources.

Also, modern data backup facilitates data mobility by moving data to a different site, reducing the effect of data gravity. Data gravity could easily make data heavy and difficult to move around, but with backup systems, you can reduce the load through regular backup that provides bits of data available for a period. Thus, it’s crucial to prioritize data backup as data pulls more data, application, and services, increasing its bulk.

Conclusion

Like physical gravity, data gravity is inevitable, and unfortunately, if not well managed, it can lead to negative consequences like latency, high cost of operation, and scalability issues. Hence, organizations need to understand how it works, how best to manage it and how to use it to their advantage. Data gravity can lead to better data utilization, centralized data management, and improved data integrity. By following our guide on managing data gravity, you can harness these perks and ensure they work to your advantage.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Storware
Storware is a backup software producer with over 10 years of experience in the backup world. Storware Backup and Recovery is an enterprise-grade, agent-less solution that caters to various data environments. It supports virtual machines, containers, storage providers, Microsoft 365, and applications running on-premises or in the cloud. Thanks to its small footprint, seamless integration into your existing IT infrastructure, storage, or enterprise backup providers is effortless.

Guardz Launches ‘Community Shield’ – Free Plan to Strengthen MSP Cybersecurity Posture



  • Guardz introduces the Community Shield Plan, a free, comprehensive cybersecurity platform tailored for MSPs to protect their internal operations.
  • The plan offers MSPs unified detection and response capabilities across identities, emails, devices, and data, enabling them to safeguard their own operations without financial strain.
  • This initiative aims to bolster MSPs’ security, reflecting Guardz’s appreciation and continued support for the MSP community. 




MSPs operate at the intersection of technology and trust. Tasked with managing diverse customer environments, they navigate a complex web of point solutions, each with its own set of challenges and vulnerabilities. This responsibility places a significant burden on MSPs, who must ensure not only the security of their clients but also their own operations. With access to vast amounts of sensitive information, MSPs have become prime targets for cybercriminals, and the rise in supply chain and cloud attacks only adds to the pressure.

Today, the digital landscape is more dangerous than ever. Cyber threats are evolving, and MSPs find themselves in the crosshairs. The need to bolster internal security is not just a priority; it’s a necessity.  The challenge is clear: how can MSPs effectively safeguard their operations without stretching their resources too thin?

We are thrilled to announce the launch of the Guardz Community Shield Plan, which aims to empower MSPs to secure and insure their internal operations easily. The Community Shield plan offers a unified platform that provides unified detection and response capabilities across identities, emails, devices, and data—all at no cost.

This innovative plan allows MSPs to establish a strong security foundation without the burden of financial commitment. With access to the full suite of the Guardz advanced security controls, MSPs can now focus on what they do best—protecting their clients—while resting assured that their operations are equally safeguarded. For those looking to extend this high level of protection to their clients, the Community Shield plan seamlessly integrates with the Guardz cost-effective solutions.

“This offering is our commitment to supporting and protecting the MSP community, reflecting our appreciation for the partnership and trust we are building together,” said Dor Eisner, CEO and Co-Founder of Guardz. “We’ve gained so much from this collaborative community, and now we want to give back. By providing the Guardz platform for free, we aim to support MSPs’ growth and success while keeping their businesses secure. We believe that a secure MSP is better equipped to foster secure environments for their clients, creating a ripple effect of enhanced cybersecurity across the board and, ultimately, a safer digital world.”

The Guardz Community Shield plan is available immediately. Interested MSPs can sign up for a free two-week trial and claim their free licenses directly from the product.  To learn more and sign up, click here.

Start Free Trial

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

[Security News] Data Breaches from healthcare and engineering industries;OneBlood Bank, Cencora, HealthEquity, and McDowall

1. Pharma Giant Cencora confirmed the theft of personal and health information

Pharmaceutical giant Cencora confirmed that the threat actors had access to personally identifiable information (PII) and protected health information (PHI) following the February 2024 cyberattack. On February 21, Cencora announced a data breach in a filing with the Securities and Exchange Commission (SEC). At the time, the company announced that it was investigating the scope of the security breach to determine the type of data that has been infiltrated. In a new filing with the Securities and Exchange Commission (SEC), the company reported that the amount of exfiltrated data is greater than what was initially identified.

Source : Security Affairs, SC Media, Infosecurity Magazine

 

2. Ransomware Attack Hits OneBlood Blood Bank, Disrupts Medical Operations

The organization, which provides blood services to more than 300 hospitals in Florida, Georgia and the Carolinas, said the security breach impacted its software system and slowed down operations. “Manual processes take significantly longer to perform and impact inventory availability. In an effort to further manage the blood supply we have asked the more than 250 hospitals we serve to activate their critical blood shortage protocols and to remain in that status for the time being,” Forbes added. OneBlood said it is working closely with anti-malware specialists and federal, state and local agencies as part of their incident response plan.

Sources: Security Week, Security Affairs,  CNN, Bleeping Computer

 

3. HealthEquity says data breach impacts 4.3 million people

HSA provider HealthEquity has determined that a cybersecurity incident disclosed earlier this month has compromised the information of 4,300,000 people. An investigation determined that the breach occurred on March 9, 2024, but was only verified by the firm on June 26, following an internal investigation. The data that has been exposed as a result of this breach varies per individual and includes: Full names, Home address, Telephone number, Employer and employee ID, Social Security Number (SSN), General dependent information, Payment card information (not numbers).

Source : Bleeping Computer, Tech Radar, Tech Crunch

 

4. McDowall Affleck Confirms ‘Cyber Incident’ After RansomHub Claims Access to 470 GB Data

McDowall Affleck, an Australian engineering firm, has acknowledged being the target of a “cyber incident.” While the company has not identified a specific threat actor, the RansomHub ransomware group claimed responsibility for the McDowall Affleck cyberattack on August 1, 2024. The alleged perpetrator behind the attack, RansomHub, is a notorious ransomware group known for high-profile attacks. Details of the McDowall Affleck cyberattack were shared on a dark web site linked to the threat actor. According to RansomHub’s own communication, the group claims to have accessed 470 GB of McDowall Affleck’s internal data. The leaked information reportedly includes critical documents, insurance records, tender and contract details, and personal information of both employees and clients.

Source : The Cyber Express, Teiss, Cyber Daily

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Penta Security
Penta Security takes a holistic approach to cover all the bases for information security. The company has worked and is constantly working to ensure the safety of its customers behind the scenes through the wide range of IT-security offerings. As a result, with its headquarters in Korea, the company has expanded globally as a market share leader in the Asia-Pacific region.

As one of the first to make headway into information security in Korea, Penta Security has developed a wide range of fundamental technologies. Linking science, engineering, and management together to expand our technological capacity, we then make our critical decisions from a technological standpoint.

11 essential Black Friday shopping tips

Ready for the biggest shopping spree of the year? Got all the best deals in line? That might actually not be the case. Since everyone is looking for a chance to save money during this sales season, cybercriminals are locked and loaded with a diverse range of scams to cash in on the occasion.

If you’re looking out for the worst and most common Black Friday scams, we’ve got a different guide for you. If you’re aiming to be proactive and avoid scams altogether, you’ve come to the right place. Today you’ll learn how to stay safe, sane, and cautious while scouring for the best Black Friday deals.

1. The one letter that all secure sites have

Take a close look at the URL of the site you’re visiting. If it has HTTPS in the URL field and a tiny green padlock next to it, consider yourself safe – the “S” in HTTPS stands for “secure.” However, if you’ve noticed that the URL only contains HTTP, tread carefully.

To avoid visiting malicious sites, you can configure your browser’s security preferences to block potentially dangerous websites or downloads. Most popular browsers like Chrome and Firefox allow users to customize their security preferences according to their needs. You can configure your security preferences in your browser’s settings.

2. Pay with Apple Pay, Google Pay, or a credit card

These payment methods offer stronger consumer protection than can be provided by debit cards, wire transfers, or cash. For instance, Apple Pay employs security features built into the hardware and software of your device to ensure secure transactions. Google Pay and credit card purchases are covered in Section 75 of the Consumer Credit Act, which ensures legal protection if a company or seller you are buying from doesn’t deliver what it promised or goes bankrupt. You can also set up a virtual credit card with a spending limit. Even if your details are breached, the card will decline all transactions beyond the set limit.

Be especially wary of any seller that requests wire transfers. Scammers prefer such transactions because there’s virtually no way to reverse them once they are processed. Being smart and cautious about payment methods means you’ll have more success claiming your money if things go haywire.

3. Use a password manager

If you are going to do most of your bargain-hunting online, prepare to create a lot of accounts and remember dozens of passwords. To make things easier for yourself, you’ll probably reuse the same login details on most online stores, if not all of them. However, this convenience can lure you into the danger of breached login credentials – and if one of your accounts is affected, all of them are.

It’s always recommended to have unique and strong passwords for your accounts. However, that doesn’t mean you have to memorize every single one. To make your life much easier and stress-free, use a password manager which will securely store and remember your passwords for you. NordPass is a password manager that lets you store your passwords as well as your credit card details, making it a perfect fit for online shopping. NordPass comes equipped with a password generator, saving you a headache of coming up with unique passwords each time.

4. Update your software

It can be so tempting to check “Remind me later” each time a new update notification pops up. However, whether you’re shopping online or browsing new sites, you need to keep your guard up.

Make sure your apps are up to date and the latest software is installed on your devices. Scammers always look for weak spots in older software to plant their mischief, but regular updates can help you stay secure, as developers issue bug fixes to eliminate security vulnerabilities.

5. Use a VPN app

Black Friday fever can strike you anywhere. Perhaps you’re walking through a mall, spot an item you really want at one of the shops, and check to see if they have it in your size. They don’t? Not a problem – you can just connect to the mall Wi-Fi and quickly check their stock online. And just like that, you’ve opened up your data to bad actors – turns out that Wi-Fi was as accessible as it was insecure.

Instead of connecting to an insecure network directly, you should use a virtual private network (VPN) first. A VPN is a one-click security cloak. It hides your internet traffic from scammers with state-of-the-art encryption that would take hundreds of years to crack.

6. Be cautious with SMS and email offers

It’s not unusual for companies to send their clients text messages or emails with special offers during Black Friday or any other sale period. Some malicious actors like to take advantage of this and send spoofed messages of their own. Usually these messages contain a phishing link designed to look very similar to a real website. But there’s a catch: if you enter your login credentials or card details into this site, you’re inadvertently handing it over to the hackers.

If you’ve received a suspicious offer via a text message or an email, don’t click any links. Check the online store’s website and social media to see if they’ve announced similar deals. You can also get in touch with customer support to cross-check if the offer is real. If it’s not, delete the message and block the contact.

7. Avoid suspicious pop-ups and redirect links

You’re visiting a seemingly innocuous website. Suddenly your scrolling is interrupted by a pop-up window exclaiming a super exciting deal, valid only for the next ten minutes so hurry up! What do you do – click it or close it?

Aside from being annoying and distracting, pop-ups and redirects can also be dangerous. Clicking them can send you to fake sites or even prompt an unwanted malware download. Once that’s done, scammers are free to do almost anything they please with your device. So close the pop-up and back out of the website. If you accidentally clicked anything, run a system scan for viruses for good measure.

8. Watch out for too-good-to-be-true deals

The hype around Black Friday is huge. Scammers know it and try their best to cash in on the opportunity. All too often, the internet gets flooded with impossibly good deals. A brand new smartphone for just $25, no strings attached? A pair of designer sneakers or a shirt from this year’s fall/winter collection for $10? Sounds great, but remember — anything that seems too good to be true probably is.

Be careful not to let your guard down. Ridiculously low prices are a typical bait that scammers use to lure you into their trap. Generally, Black Friday deals fall within the 20-30% off range. Some websites offer price trackers to let you see how the price of the item has changed leading up to Black Friday. Can’t find any prior data for that one shop with cosmic deals? Then it was probably arranged solely to trick unassuming shoppers and rob them of their money and data.

9. Click the site’s trust badges

With so many copycat websites around, how can you be sure you’re buying from a legitimate source? Keep an eye on what trust badges the page has. Trust badges confirm that a security authority has verified the website. VeriSign, Better Business Bureau (BBB), and PayPal-Verified are some of the most easily recognizable ones. You will normally find trust badges at the bottom of most websites.

However, the badges being on the page aren’t proof alone of legitimacy. Trust badges are just images, and scammers can copy and paste them onto their fake websites. If a site is really certified, clicking on the badge should take you to the site of the issuer (for example, to verisign.com). If you’re having doubts, hover over the badge to see if it’s interactive and check what URL it links to. If the link clearly leads to the trust verification provider, you’re safe to proceed.

10. Do your research

Keeping yourself safe during the shopping craze requires some research from your end as well. After all, new scams pop up each year, and you have to be ready for anything. So do your due diligence – research news portals, forums, and Reddit boards to see what new scam tactics are popular.

Always double-check the websites you’re visiting for reviews and negative experiences. Perhaps the site is very new and conveniently only seems to be available during the Black Friday-Cyber Monday season – it could be someone trying to copy a pop-up store model online, but it’s more likely to be a scam. Make sure the URLs of the stores you’re visiting are accurate. Even if you don’t catch every great deal, it’s better to be safe than sorry.

11. Limit sharing personal information

Last but not least, be mindful of what information about yourself you’re sharing online and who might have access to it. When it comes to online shopping, the stakes are high – you need to provide your name, address, and card details.

Be mindful when you create new accounts – don’t reveal more information than necessary. If possible, select an alternative delivery method, like a parcel locker. Always check the data storage and retention policies – is the store compliant, how is your information stored and for how long? Put your privacy first and shop securely.

Conclusion

In the rush of finding a bargain, safety may be the last thing on your mind, but please do stay extra vigilant. These precautions take just a few seconds, but it will take you days to reclaim your money. Worse still, you might have your details spread all over the dark web for years to come. But there’s no need to stress this Black Friday shopping season – you’re all set to notice attempts to scam you and you’ll dodge them with ease.

Before you start your hunt for the best discounts, make sure you’re armed with the right security tools – NordPass is here to make your shopping experience smoother and safer. NordPass generates strong passwords for each new store you sign up for, auto-fills your address and card details once you get to the checkout screen, and ensures your login credentials are kept secure in your encrypted vault.

In the spirit of the season, we’re bringing you some great Black Friday deals. Planning to hit up brick-and-mortar stores first and save online shopping for later? No worries – we’ve got you covered with special offers for Cyber Monday as well. And for now – happy shopping and stay safe!

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Black Friday and Cyber Monday scams: How to detect and avoid them

For some, Black Friday and Cyber Monday are the perfect time to check the boxes on their Christmas shopping list. For others – an opportunity to use the shopping frenzy against you and steal your data. Today, we’re learning more about the most common Black Friday and Cyber Monday online scams, how to identify them, and what to do if you fall victim to them.

Common Black Friday and Cyber Monday scams

Over the years, scammers have developed numerous strategies to trick people out of their money and sensitive data. Here’s what you should look out for:

1. Websites requiring you to download an app

Imagine you’re about to make an online purchase on a website with a killer deal. Suddenly, it turns out that the only way to grab this exclusive offer is by making a purchase through the app.

It’s true that some online shops might offer exclusive deals for mobile app users. However, you need to be cautious here. If you are shopping on a website you’re unfamiliar with and the company asks you to download its app to complete the transaction – it’s time to run. You’re most likely being tricked into downloading a fraudulent app designed to steal your payment information.

2. Spoofed websites

Spoofed websites are websites that are designed to look exactly like well-known, legitimate pages. However, what lies beneath them is a system created to steal your passwords, card details, and other personal information.

The good news is that with a few tips and tricks, it’s pretty easy to catch them:

  • Check the URL. Trustworthy websites will always use HTTPS in their URLs, where the “S” stands for “secure.” Most browsers will also have a padlock icon indicating that the website is approved and trustworthy. If you see only HTTP or a broken padlock, the site isn’t safe, and you should avoid supplying your sensitive data.

  • Look out for bad grammar. Glaring spelling mistakes usually mean that the website shouldn’t be trusted. Legitimate websites have dedicated teams who put a lot of time and effort into polishing their content.

  • Check the “Contact Us” page. A registered company will typically provide its place of business and contact details. If the only way to get in touch regarding refunds or delivery problems is via email, you should probably steer clear of such a website.

  • Do your research. Look up online reviews about the company across a variety of sources – but take them with a pinch of salt. If they’re all new, written in the same tone, or sound too good to be true, they might be falsified – and that’s reason enough to become suspicious.

3. A delivery issue with your purchase

Beware of follow-up emails and text messages you receive after you’ve made online purchases. These days, scammers send notifications pretending to be from UPS, FedEx, or even online stores such as Amazon or Shein, claiming that they can’t deliver your parcel for one reason or another.

A fake delivery message might read something like this:

“We’re sorry, but your package couldn’t be shipped. Please click the link to rearrange delivery or update your method of payment.”

Like spoofed websites, scam delivery messages also often contain bad grammar, so keep your eye on that. Don’t click any unfamiliar links. If you’re having goods shipped from abroad, be wary of messages telling you to pay extra customs fees. Pause for a moment and check the delivery status on the website where you placed your order. Also, check whether custom fees were included in the delivery price.

4. Free Black Friday gift cards

Another common scam involves a notification that you won a gift card from a big retailer like Walmart. All you need to do to claim it is text back a random code or click a URL.

In reality, this is how scammers can collect your details and infect your device with malware. The scam might then be sent to all of the contacts in your address book. Simply avoid clicking any suspicious links and don’t interact with the notifications.

5. Phishing scams

In a phishing attack, the victim receives an email or a text message with bait, like a deal that is too tempting to pass up on or information you have to act upon immediately. The purpose of such bait is to lure you into a spoofed website and for you to provide your sensitive data, like your login credentials or payment details.

If you take the phisher’s bait and accidentally reveal your password, the scammers can use this stolen personal information to create fake online profiles, take out loans, ruin your credit score, or even steal your identity.

6. “Money-saving” browser extensions

What’s something people love as much as a good deal? Convenience. Combine the two and you’ll get browser extensions built to find the best deals on numerous e-commerce sites. However, extensions can also be used for more nefarious purposes, like gathering all your browser data.

Before you install a new extension in your browser, do some digging. Check if the developer is reliable – do they have any other extensions, what are the ratings, what do the reviews say? If anything seems suspicious, it’s best not to install the extension. Many browsers and extension catalogs will let you report such extensions as performing illegal activities or actively harming your device.

What to do if you were scammed

If you’ve been scammed, don’t panic. It’s not too late to protect your accounts and money. Here’s what you can do:

  • Check your bank statement. If nothing has happened yet but you think that your details might have been stolen, regularly check your bank statements for any suspicious purchases, no matter how small. Then move to the next step.

  • Notify your bank. Get in touch with your bank immediately if you have seen a suspicious charge or paid for a good or service and realize it’s a scam. Your bank will be able to tell you whether the suspicious transaction was fraudulent (or whether you just forgot about it) and in some cases can stop or revert the transaction.

  • Freeze your card. While you are in contact with your bank, request for your card to be frozen. Some top-up card providers make this solution easy; you can freeze your card in-app. That way, even if someone has acquired your card details, they won’t be able to use it.

  • Notify the seller. It’s a common scamming practice to use well-known brands to lure people into traps. If this happens to you, contact the official seller and inform its customer service that someone is using the brand’s name. The brand can make an official statement, inform its customers directly, and take further security precautions to prevent other people from falling prey.

  • Learn more about cybersecurity. Once all the steps above are completed, all that is left to do is make sure that you don’t fall prey again. The best way to do so is to learn how to recognize and avoid such scams.

Eight easy ways to avoid a scam

Even when you know how to spot a scam, accidents can happen. So to mitigate the risks further, here are some proactive steps you can take to keep your money and data safe:

1. Try alternative payments

Avoid using bank details that are directly tied to your lifelong savings or your wage. Use alternatives such as:

  • Apple Pay or Google Pay. These methods use a combination of biometrics and other digital safeguards, such as 2FA or TOTP, to secure your details.

  • Credit cards offer consumer protection in case you need to claim your money back.

  • Virtual cards can be issued for a one-time purchase or purely for online shopping with a spending limit imposed to prevent scammers from draining your funds.

If you use alternative payment methods and your data ends up in the wrong hands, the damage will be minimal. These payment methods usually don’t create access to huge amounts of money and can be frozen fairly quickly, meaning that your savings will be unaffected.

2. Protect your data with a VPN

If you’re shopping on public Wi-Fi, it’s advisable to do so with a VPN. You never know who’s “reading” the online traffic, and it’s really easy for bad actors to do so over an unprotected Wi-Fi connection. A VPN encrypts and hides the data you transmit over the internet, so cybercriminals can’t steal a thing. NordVPN can help you reinforce your security on all your devices with Meshnet and Double VPN.

3. Create complex passwords

Setting passwords for a number of online shops can seem arduous and often leads to people using the same easy-to-remember passwords everywhere. However, if the passwords are easy for you to remember, they are often just as easy to crack. And since e-commerce sites have access to your name, address, and payment details, they’re a goldmine for hackers.

Make sure you use strong passwords that contain at least 12 characters and include numbers, upper- and lowercase letters, spaces, and special characters, such as .,! @ # ? ];. Don’t worry – you don’t need to do it all on your own. The NordPass Password Generator can help you create complex passwords in a matter of seconds.

4. Keep track of your spending

Keep a close eye on your online accounts and credit card reports, and make sure you see no inconsistencies following the big shopping season. Be on the lookout for suspicious purchases, especially minor ones, because scammers tend to start small before going all in. If you spot any suspicious activity, inform your bank or credit card provider immediately.

5. Choose apps with caution

Inspect the name, description, and icon of an app you are about to download. Fraudulent apps can’t use the same name as the real app they want to disguise themselves as, so they’ll replace o’s with 0’s or change the name very slightly – for example, they can replace SwiftKey with SwiftKeyboard or WhatsApp with Update WhatsApp.

If you see the same icon in the app store more than once, be alarmed. A fraudulent app cares little for copyright laws, and not all app stores vet the catalog thoroughly. Unfortunately, it’s up to you to choose a verified app. Take a look at the developer and the number of downloads – if the numbers seem suspiciously low, steer clear of the app.

6. Stay rational

Most scams are designed to use your emotions against you. Read carefully through the sudden notification or email you’ve received. Is it trying to instill a sense of urgency, greed, or fear? These are indications that the deal or the message you’ve just received is trying to trick you into handing over your sensitive details ASAP.

Refrain from clicking on links, downloading files, or entering personal details. If you’re told that your delivery is suspended, contact the seller or the delivery company directly to confirm its status. Check the social media accounts of the stores and see whether the promotion is public and active. If everything aligns, perfect – take advantage of the deal. If not, it’s better to stay away from it.

7. Check for new scams

Scammers are a creative bunch. As such, the average person may find it difficult to keep track of all the new scams that emerge every season. One way to keep up to date is to simply use Google search.

Try running a search with these keywords:

  • Company name + scam (“Amazon scam”)
  • Product name + scam (“new iPhone scam”)
  • New method + scam (“delivery SMS scam”)

You can also check forums or recent discussions on Reddit to see if anyone’s had experiences with recent scamming attempts.

8. Use a password manager

Password managers are tools that store your complex passwords, help you generate new ones, and protect them from intruders. Additionally, they can also make your online shopping experience a breeze.

Password managers like NordPass can store your payment and delivery details, which you can then fill automatically anytime you shop online. You don’t need to cancel the purchase just because you can’t find your wallet – just log in to your NordPass account, and Autofill will do the rest.

Frequently asked questions

What are some of the red flags to watch out for?

  • Suspicious URLs and website design. Never open URLs that you don’t know and check if the domain is legitimate. Furthermore, while it’s possible the site you’re visiting has rebranded, if anything is giving off uncanny valley vibes – say, the fonts, color schemes, or the layout – it’s probably better to double-check.
  • Too good to be true offers. Always check with the official retailer’s site and social media to see the deals they’re running. If there’s no mention of the offer you received, it might be a scam attempt.
  • Unsolicited emails and messages. If you’re not subscribed to the store’s newsletter, you probably shouldn’t be receiving emails from them. Check for suspicious sender email addresses and don’t click on any links.
  • Poor grammar and spelling. Delivering quality is key to maintaining a good brand image, so online stores don’t want their sites to be riddled with typos.
  • Pressure tactics. Some online shops offer limited-time deals and include countdowns in their promotional emails. However, if you’re being coerced into buying something or dealing with your order delivery immediately, you’re probably being pressured into revealing your personal details.

Is it safe to click on ads promoting Black Friday and Cyber Monday deals?

Sometimes, but not always. If you see an ad on social media from a verified account and the information corresponds with the deals on the official website, you can go ahead and shop away. However, if the URLs seem suspicious and the domains are slightly different from the official website, it’s best not to click them.

Are mobile shopping apps safe to use during Black Friday and Cyber Monday?

If you download a shopping app from the official retailer, it’s perfectly fine to use it. However, be cautious with random downloads on the app store. Always cross-check the developer to see if it’s really the official app and check the reviews on the app store and elsewhere on the internet.

Keep a cool head this season

Who doesn’t love a good bargain, especially during the busiest shopping season of the year? It can be easy to be swept away by the maelstrom of discounts and deals. Now you’re fully equipped to identify and avoid the most common Black Friday and Cyber Monday scams.

So, shop until you drop – just remember to always double-check the merchant and what they are offering. Keep a cool head before pressing the “buy” button because, as the old adage goes, if it is too good to be true, it probably is.

If you’re looking for ways to stay safe this Black Friday and Cyber Monday, consider the NordPass password manager. NordPass uses encryption to protect your login credentials, credit card details, home address, and more. Create new secure passwords for all your favorite shopping platforms and keep them safely encrypted with NordPass. Enjoy all the best deals of the shopping season – without compromising your security.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

What is a data leak

“Data leak jeopardizes more than 150 million users.” “Hacker leaks 33 million usernames and passwords.” Sound familiar? As security technology advances and becomes more sophisticated, companies struggle to keep up with the latest requirements. Hardly a day goes by without news about a new data leak or a breach. Let’s find out how they differ and how to prevent your company’s data from leaking.

First, what is data leakage? In short, it’s a security incident where private information becomes available to unauthorized parties. People may steal, accidentally transfer, or willingly give it away. Leaked data can be digital (electronic files) or physical (documents, letters, pictures, devices). However, data leaks are not the same thing as data breaches.

Data breach vs. data leak: What’s the difference?

While you might sometimes see these terms used interchangeably, conflating them isn’t wholly accurate. Both carry the same consequence – unauthorized data exposure. The difference lies in the cause.

Data leaks typically happen due to poor security measures or someone’s accidental actions. In most cases, cyber leaks aren’t meant to be malicious, and human error is at fault. Security researchers from vpnMentor have been exploring open databases for years. One of their most significant findings was in 2020 – they discovered that the Key Ring app had used a misconfigured Amazon S3 bucket to store 44 million records, including people’s IDs, insurance information, driver’s licenses, and credit cards. Even if no malicious actors noticed it before them and the company took care to close the database, it still counts as a data leak.

On the other hand, data breaches are deliberate. A data breach occurs when a cybercriminal attacks a company or a database and manages to obtain secret and sensitive information. Common tactics used during data breaches include DDoS attacks, malware, and social engineering that can break the company’s defenses. The outcomes of data breaches and leaks are similar, but leaks lack the malicious intent of breaches.

Types of data leaks

If you want to spot data leaks quickly, you need to recognize the different incidents and strategies that may be causing them.

  • Human error

    An unintentional leak can be caused by something as trivial as sending a confidential email to the wrong address. Leaving a database with your customers’ data publicly accessible or losing a device with access to the information are also considered accidental data leaks. However, the consequences depend on who got the email or found the loophole allowing them to access the database. Some might delete it while others might get sneaky ideas.

  • Scams and system breaches

    Sometimes, people look for vulnerabilities in your security, like out-of-data software or system bugs, to prove that they exist. They will not attack you openly. Instead, they look for loopholes to access information that’s not supposed to be accessible from the outside. Others might employ social engineering tactics to create the perfect environment for a data leak.

  • Intentional data leak

    Although data leaks often aren’t malicious, they may still be deliberately instigated. A situation can result from an employee who accesses the company’s secrets or users’ records to resell for financial gain. It might also be a whistleblower who has moral objections to what they witness in their company and uses the leaked information for exposition. Either way, they know what they are doing and usually try to remain anonymous as they work from the inside.

What type of data is at risk?

Data leaks are a disaster for the victims and a golden opportunity for cybercrooks, who usually look for impacted sensitive information to make a sizable profit. They go after identifiable information such as names, addresses, social security numbers, and credit card details. Such data can then be used for identity theft and money laundering. Stolen login credentials are often packaged into password leak databases and sold on the dark web.

When bad actors look to hurt a specific business, the information they go after might expand beyond personally identifiable data. For instance, they may target sensitive company information like internal communications or strategic plans. Trade secrets and intellectual property, such as proprietary code and software, can also be on the radar.

Today, data is paramount. With the increasing frequency of cyberattacks, businesses have to take serious steps to ensure the ironclad security of their data.

How is the leaked data used?

Once hackers have their hands on leaked or stolen data, they can exploit it for their goals. Here are a few ways exposed data can be used for nefarious purposes.

Social engineering

Leaked data often includes identifiable information like names, passwords, and email addresses. Hackers can use that information in social engineering attacks. Phishing is an attack during which hackers send out fake emails that impersonate a reputable source to get the potential victim to download a malicious attachment or click on a dangerous link. Without password leaks, hackers would be less successful in targeting and carrying out their attacks.

Doxing

Doxing, or doxxing, is the act of exposing identifiable information, such as a person’s name, home address, and phone number, with malicious intent. After acquiring leaked data, hackers usually have more information than they need to dox a person. Doxing is often targeted against a specific person or group of people and has historically been used in harassment campaigns.

Slowdown or disruption of business operations

A data leak can have a tremendously negative impact on the affected organization. According to the National Cyber Security Alliance, an astounding 60% of companies go out of business within six months after falling victim to a data leak.

Real-world examples of data leaks and breaches

Data leaks and breaches are more common than ever, and experts believe that the frequency of such cyber incidents will only rise in the future. Here are a few major incidents that had companies around the world on their toes – some carrying graver consequences than others:

  • ChatGPT

    In March 2023, a bug was discovered in OpenAI’s chatbot ChatGPT, leading to the leak of customer data, including their names, chat titles, and limited credit card details. The team emphasized that full credit card numbers were not exposed, and the leaked data was limited to the last four digits of the credit card numbers, as well as the expiration dates. The platform was temporarily taken offline to fix the bug.

  • Credit Suisse

    In February 2022, a whistleblower initiated a data leak to expose a number of high-profile criminals who were employing the services of the Swiss bank Credit Suisse. The scope of the leak affected over 18,000 accounts. The exposed data was shared with the German newspaper Süddeutsche Zeitung, which published an exposé on the Swiss banking system.

  • Twitch

    In October 2021, the live-streaming platform Twitch revealed it had experienced a massive data breach. The breach exposed over 100 GB of sensitive data, including the streamers’ names, addresses, email addresses, and earnings.

  • Facebook

    On April 3, 2021, a security expert discovered a massive data leak that affected 533 million Facebook users. Overall, the leak produced 2,837,793,637 data points. On average, hackers exposed at least five types of data per user, including phone numbers, full names, dates of birth, Facebook IDs, email addresses, and user bios.

  • Experian

    In February 2021, reports came out about the most significant data breach in Brazil’s history, which exposed the sensitive information of more than 200 million people and 40 million companies. The culprit was suspected to be Serasa Experian, a company providing information and data services. The exposed data included personally identifiable information like dates of birth, full names, addresses, headshots, credit scores, income, and other financial data.

How to prevent data leaks and breaches

To minimize the risk of a data leak, you must establish security practices and procedures in your company. Remember that you can’t always control every single thing security-wise. You can never know if or when you might become a target. However, taking a few preventive measures will give you peace of mind.

  • Control your data

    You should always keep backups of your data – that said, don’t store unnecessary copies. Keeping your sensitive information in one secure database instead of multiple terminals will reduce the chances of it leaking. Knowing and controlling who has access to what information is also essential. Employees should only be allowed to access the data they need for their work. This way, you can avoid accidents and intentional leaks.

  • Place restrictions on your employees’ emails

    You can set up Google Drive to notify your employees whenever they attempt to share the company’s files with an outside party. Also, set up spam and phishing filters to cut the risk of successful social engineering attacks.

  • Train your employees

    A basic understanding of potential cybersecurity risks is essential for everyone in your company, especially those handling sensitive data. Receptionists and head analysts alike should be aware of social engineering attacks, malware types, and internal security requirements. If they know and understand how much damage a data leak would do to the company, they will act more carefully.

  • Establish strong security measures in your company

    Use firewalls to protect your network and restrict specific traffic. Ensure you’re safe from malware, like ransomware, spyware, or keyloggers. Use a VPN with robust encryption to ensure secure connections, especially if your employees often travel or work from home. Ensure they use strong passwords and enable two-factor authentication for their most sensitive accounts. Encourage using a password generator to create complex passwords, storing them safely in an encrypted vault and updating them frequently to avoid password leaks.

  • Prepare for the worst

    No one wants to go through the worst-case scenario, but accidents can happen. Therefore, it’s a good idea to set up a response and damage control plan in case of a data leak. If you suffer a cyberattack, every minute is precious, and being able to act fast could save you a lot of money – and customers’ trust – in the long run.

  • Establish proper cloud storage security

    Ensuring the security of data stored in the cloud is imperative. Without appropriate security measures, sensitive information can be exposed and stolen. Take your time configuring your cloud storage following the best security practices, and if necessary, adopt additional tools to protect your cloud storage.

  • Evaluate and monitor third-party risks

    Even if you can ensure complete security within your organization, remember that your data can be exposed via third parties such as your partners and vendors. Supply chain attacks are on the rise, and businesses need to evaluate their partnerships with third parties security-wise to minimize the risk of falling victim to data leaks.

Data leak prevention practices

First, find out what kind of data was leaked. Account names, email addresses, and passwords often end up in data leaks. If your account was affected, change the password as soon as possible. If you use the same password anywhere else, you must change it over there, too. If you don’t, you will be susceptible to a credential-stuffing attack, and all your online accounts will be at risk. If your credit card or banking details were affected, contact your bank immediately and block your cards.

If your business experiences a data leak, swift action is vital. Make sure to contain the leak as soon as you discover it. Immediately start a detailed probe into what exactly happened and why. Inform your customer base about the leak. Disclose all the relevant information: the date and type of the leak, as well as the affected systems and users. Finally, upgrade your organization’s security infrastructure to lower the risk of future cyber incidents.

Bottom line

Data leaks are an ever-growing threat in the digital landscape, and staying ahead is as important as ever. If you’re concerned about the safety of your professional and personal data, you can start taking steps to protect it. The first order of business is setting up your business password manager.

NordPass is a password manager that offers encrypted storage for all your sensitive data, whether that’s your login credentials, address, credit card details, or ID information. In addition to your secure vault, you’ll also access features that help reinforce your data safety, like Password Health, which checks whether your passwords are weak or reused, and the Data Breach Monitor, which alerts you if you’re affected by a password data leak. Stay one step ahead of data leaks and start patching the holes in the ship before your information seeps into the wrong hands.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

IPEVO Unveils the P2V ULTRA 4K/13MP Object Camera

[Sunnyvale, CA, Nov 14, 2023] IPEVO, a leader in communication solutions, proudly announces the P2V ULTRA—a compact, portable USB camera that redefines versatility and video quality. Equipped with a 13-megapixel CMOS sensor and 4K video resolution, it offers outstanding performance, including a Super Macro Focus feature for capturing intricate details as close as one centimeter. The P2V ULTRA is the ultimate choice for a wide array of applications. Whether hand-held for flexible manual positioning to different angles or clipped to a laptop’s monitor or mounted on a stand via its magnetic mounting design, it is an innovative solution that elevates convenience and video quality to new heights while ensuring clear communication and presentation of various details and perspectives.

Versatile Usage Options
The P2V ULTRA by IPEVO offers versatile usage options for a wide range of applications. Use it as a handheld camera for hands-on demonstrations from anywhere, as a webcam with a 100-degree field of view for online meetings and live streaming, or as a document camera with an optional multi-jointed stand for demos, presentations, and document scanning up to Tabloid (A3) size using IPEVO SnapCapture OCR software. Its adaptability makes it suitable for education, remote communication, medical, and retail sectors. 

IPEVO P2V ULTRA is a compact, highly portable, and versatile camera adapts to any scenarios.

Super Macro Focus for Precision
The P2V ULTRA features a Super Macro Focus that captures fine textures and details as close as 0.39 inches (1 cm). This allows you to effortlessly display small objects, artwork, or specific parts with precision and clarity, making it ideal for tasks like electronics repair and small component inspection. It also provides high-resolution output in UVC format, enabling seamless integration into various system platforms, including computer vision, AI inference, and edge systems.

Going back to 2007, when IPEVO first launched P2V, it was an immense success worldwide, especially among educators and school teachers who were pleasantly surprised by how effective a camera could be in supporting teaching and learning. The handheld point-to-view camera provides the freedom to view objects from different angles, going beyond the limitations of traditional document cameras.

Aaron Lee, General Manager of IPEVO, said, “Unlike traditional document cameras and webcams, the P2V was designed as a pen-grip camera, allowing users to freely share what they see with their own eyes. With the introduction of the brand-new P2V ULTRA, equipped with a 13MP sensor and 4K resolution, along with Super Macro Focus, we are committed to providing outstanding image quality to you.”

More to Explore
With the one-click snapshot feature and IPEVO Visualizer software, the P2V ULTRA enables you to capture timely images with ease. With just a single click of a button, you can quickly take a snapshot of current visuals, ensuring you won’t miss any important moments in your presentations, demonstrations, or recording sessions.

Additionally, the P2V ULTRA features a built-in microphone with AI noise reduction, ensuring clear message delivery. It’s as simple as plug-and-play for a seamless experience.

P2V ULTRA (Standard Pack) is now officially available for purchase through IPEVO’s global distribution channels. This model comes in two packaging options, with the Standard Pack being the first one introduced:

  • Standard Pack: P2V ULTRA Camera x1 and Camera Clip x1.
  • Full Pack: P2V ULTRA Camera x1, Camera Clip x1, Camera Stand x1 and Camera Clamp x1.

The key features of the IPEVO P2V ULTRA Object Camera:

  1. 13-megapixel CMOS sensor and 4K video resolution.
  2. Super macro focus to view close-up details
  3. 3 in 1 camera: handheld, webcam and document camera (with optional accessories required)
  4. Snapshot button to capture timely images
  5. Compact, lightweight, and portable
  6. USB-C connectivity.
  7. Plug and play on Mac OS, Windows PC, Chromebooks with a USB Type-C port.
  8. Compatible with Zoom, Google Meet, Microsoft Teams, Webex, Skype, GoToMeeting, and other video conferencing software.
  9. IPEVO P2V ULTRA is a product designed in Taiwan.

About IPEVO
IPEVO makes versatile teaching tools instead of specialized “classroom equipment”.
We go beyond the usual conventions of classroom technology—large, expensive, specialized and complex—to rethink simple and flexible solutions for interactive teaching in today’s classrooms.
IPEVO’s interactive teaching tools empower educators and teachers with radically affordable and compact technology that is simple, intuitive and flexible, so that precious time and resources can be wholly dedicated to teaching. We intend to make educational technology accessible and available to all.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

CYBERVIEW #4: AI REGULATION, OKTA BREACH, AND MICROSOFT COPILOT

Tech is buzzing these days. Joe Biden has signed a major executive order on AI, Microsoft is wading into the blossoming enterprise AI space with Copilot, and Okta, the access management giant has suffered another breach.

The Cyberview team takes a closer look.


Executive order to create A.I. safeguards

US President Joe Biden’s executive order commanded federal agencies and the booming artificial intelligence industry to adopt new standards for AI safety and security. Biden also called on Congress to create laws for AI’s use and oversight. Without legal backing, the response of federal agencies can vary in their application of an executive order. AI is the new frontier, after all. Most institutions are still figuring out where they stand with the technology. The executive order is not perfect, but with developers of the most powerful AI systems now “required to share their safety test results and other critical information with the U.S. government”, a seachange is on the wind. Sam Altman, co-founder and former CEO of OpenAI, is cautious: “There are some great parts about the AI EO, but as the government implements it, it will be important not to slow down innovation by smaller companies/research teams.” Let’s see how it plays out.

Microsoft Copilot: The new era for enterprise AI?

OpenAI’s deep-pocketed collaborator, Microsoft, has come out strong in the enterprise AI arena with Copilot, a shiny new intelligent assistant that “seamlessly” integrates with Office 365 and Windows. According to the software giant, Copilot “combines the power of large language models (LLMs) with your organization’s data”. Of course it does! Microsoft has invested billions in its long-term partnership with LLM trailblazers OpenAI, which gives Microsoft the means to offer “new AI-powered experiences” across their product suite. Apparently, Copilot will save you time by summarizing video meetings, adapting Word docs into PowerPoint decks, drafting email responses, and more. No doubt Microsoft is looking to consolidate the top spot in office productivity software and put to rest the bitter battle between venerable Office 365 and the nifty challenger that is Google Workspace.

The Okta hack: A cautionary tale

Identity and access management company Okta recently disclosed a hack of its customer support system. Their share value was heavily impacted by the attack, suffering a 20% decline in the past month. Okta pinpointed the cause: employee credential theft, specifically a personal Chrome account logged in on a work laptop. Threat actors stole data from several Okta enterprise customers and compromised internal systems. Further attacks followed on interlinked security solution providers Cloudflare and 1Password, tied to authentication tokens compromised in the initial breach. Cloudflare wasn’t too happy about it either. This is the most recent in a series of notable hacks linked to Okta. MGM and Caesars’ attacks targeted Okta installations, using sophisticated social engineering attacks that went through IT help desks. For this recent breach, though, there’s a clear lesson – don’t mix business and personal logins, folks. Stay tuned for the next episode of Cyberview.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

IPEVO TOTEM 360 and TOTEM 180 win the 2024 Taiwan Excellence Award

IPEVO Inc, a leading communications provider, announced today that its IPEVO TOTEM 360 Immersive Conference Camera + Speakerphone and TOTEM 180 Panoramic Conference Camera have been awarded the “2024 Taiwan Excellence Award” in Taipei, Taiwan. The Taiwan Excellence Award is renowned for recognizing outstanding products and innovations that exemplify the quality and excellence of Taiwanese industries. This award underscores the exceptional capabilities and innovative design of these solutions, enabling fully immersive plug-and-play meetings from any location.

“We are greatly honored to receive this prestigious international award. It serves as significant recognition of our years of dedication to the field of visual communication and our substantial entry into the commercial sector this year. As we look to the future, we will continue to harness our strong research and development capabilities and innovative spirit to develop video communication solutions suitable for various industries. Our goal is to support users worldwide as they navigate through the era of hybrid communication.” said Aaron Lee, General Manager of IPEVO.

TOTEM 360 is a groundbreaking video conferencing device that provides an all-encompassing communication experience. By seamlessly integrating a 360-degree camera, powerful speakers, and advanced AI-enhanced microphones, TOTEM 360 ensures crystal-clear audio and video. Its onboard person and voice AI tracking technology, coupled with four beamforming microphones featuring AI noise reduction, automatically identifies speakers and enhances audio quality. Additionally, the device stitches images from four cameras to offer panoramic 5K resolution video, providing users with an immersive communication experience akin to being physically present.

Designed for small and medium-sized meeting rooms, TOTEM 180 offers a rapid and efficient way to create highly immersive meeting environments. Leveraging video stitching technology through two separate lenses, it captures a 180-degree video with minimal distortion, ensuring a high-resolution, natural view. Equipped with two omnidirectional microphones featuring built-in noise reduction and an AI chip-accelerated auto-framing feature, TOTEM 180 delivers a seamless and efficient meeting experience.

IPEVO continues to lead the way in providing cutting-edge solutions for professional communication and collaboration.

About IPEVO
IPEVO makes versatile teaching tools instead of specialized “classroom equipment”.
We go beyond the usual conventions of classroom technology—large, expensive, specialized and complex—to rethink simple and flexible solutions for interactive teaching in today’s classrooms.
IPEVO’s interactive teaching tools empower educators and teachers with radically affordable and compact technology that is simple, intuitive and flexible, so that precious time and resources can be wholly dedicated to teaching. We intend to make educational technology accessible and available to all.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Password spraying – a fun name for a not-so-fun security threat

In spoof comedies and children’s films, it’s a common trope that the password the protagonist must enter to open a safe or unlock top-secret data is, literally, the word “password.” We often laugh at this joke, not realizing it reflects reality with uncanny accuracy.

As revealed in our “Top 200 Most Common Passwords” study, “password” is — for real — the most popular password across all countries and industries. “123456” ranks as the runner-up, followed by the obviously more secure “123456789.”

Cybercriminals are well aware that millions of people use the same weak passwords for “protecting” their personal and business accounts — and they take advantage of this vulnerability. One of the ways they do it is through password spraying.

What is password spraying?

In basic terms, password spraying is a type of brute force attack in which a cybercriminal picks a few frequently used weak passwords and tries them across multiple accounts within the same domain to gain unauthorized access.

Therefore, password spraying is not a cyberattack targeted at one specific individual. It’s a hit-and-try type of breach attempt based on the statistical probability that among the accounts associated with a given domain, some may be protected with the most common weak passwords.

How does password spraying work?

Here’s an example: An attacker takes a few popular passwords, such as “password123” and “guest,” and then systematically tests them across, let’s say, 500 email accounts associated with the “example.com” domain.

So, rather than repeatedly attempting to compromise a single account (which could lead either to account lockout or detection), the attacker tries these common passwords across hundreds of email accounts at the same time which allows them to remain under the radar and increases their chances of hitting the jackpot.

As you can imagine, if the attacker manages to get just one credential right, they can gain unauthorized access to sensitive data or use the account for more malicious actions.

Of course, it’s possible for the attacker to compromise numerous accounts in a single password spraying attack. The outcome, whether they achieve their goal or not, depends on the password policies and cybersecurity practices adopted by the targeted organization.

Password spraying vs brute force

As we have already mentioned, password spraying is a type of brute-force attack. However, there are several differences between what we generally call a brute force attack and password spraying.

In a brute force attack, the cybercriminal tries every possible combination of characters and symbols until they find the correct password. This method is exhaustive and can take a very long time, especially if the password is complex or lengthy.

Password spraying is less resource-intensive and can be much faster than brute force. This is because it focuses on using a limited number of common passwords rather than testing every conceivable permutation of numbers and letters.

So, a password spraying attack is a bit like a cybercriminal having a few master keys that work on lots of doors, whereas brute force is like them trying out every key in existence to open each one individually.

Password spraying vs credential stuffing

Password spraying and credential stuffing are both techniques that cyberattackers employ to gain unauthorized access to accounts and systems, but they differ in their approach.

Credential stuffing is a more aggressive method in which attackers utilize previously stolen or leaked username and password combinations, taking advantage of users’ tendencies to reuse credentials across multiple platforms. So, while password spraying is based on the premise of weak passwords being in use, credential stuffing relies on reusing compromised credentials across different online accounts belonging to a particular individual.

Password spraying vs dictionary attack

Just like credential stuffing, a dictionary attack shares similarities with password spraying in how cybercriminals utilize the two techniques to gain unauthorized access to accounts. The difference between them lies in the content that the cybercriminal tests as potential passwords.

As we have already discussed, in the case of password spraying, the attacker uses common weak passwords to break into an account, application, system, or network. In the case of a dictionary attack, however, a cybercriminal tries their luck by testing, one by one, each of the words that appear in a dictionary. Why? Because, unfortunately, some people use common words as their passwords. No unique symbols, no numbers — just plain words.

Although dictionary attacks typically have a low success rate, especially when targeted at systems with multi-word passwords, they still pose a significant threat to account security and should not be underestimated.

How to detect a password spraying attack

Regardless of whether you do it for your own security or for the entire company, detecting a password spraying attack usually requires some effort. When it’s about making sure your own accounts are safe, using the right tools can often do the trick. However, for businesses, it’s also about closely watching and understanding patterns of user behavior. Let us explain a bit more.

As a single user, you can use solutions such as a data breach scanner to check whether any of your passwords or email addresses have been stolen or made available on the dark web. Some of the platforms currently available on the market already have built-in real-time data breach monitoring systems that can keep you informed whether your data has been leaked as a result of password spraying or another cyberattack. For your personal safety, this should be enough to detect a threat.

However, if you run a company with many employees, you need to equip yourself with dedicated IT tools such as Intrusion Detection Systems (IDS) that will allow you to, for example, identify unusual login attempts and password change requests, check the rate of failed login attempts for a particular account, and quickly verify the reputation of every IP address.

What you may also need to do is set up additional security measures like rate limiting (restricting the number of login requests a user can perform within a defined time period) and account lockout (temporarily suspending access to a user account after a specified number of failed login attempts). That should help you quickly respond to any suspicious activity.

How to prevent password spraying attacks

If you want to stop someone from getting into your accounts by trying a bunch of common passwords, here’s what you should do:

  • First of all, get rid of weak passwords. The password spraying technique only works if your passwords happen to be common, easy-to-guess ones. So, do yourself a favor and make your passwords strong and unique so that nobody can easily figure them out.

  • Update your software regularly. Make sure you always install all security patches and updates to strengthen your digital defenses against potential vulnerabilities.

  • Get a password manager. Never store your passwords in a .txt file on your desktop or written down in your notebook. Get yourself a good password manager so that you can store and manage passwords in an encrypted virtual space to which only you have access.

  • Use a password generator. Coming up with strong and unique passwords for all your accounts can be quite a challenge, not to mention trying to remember them all. The good news is you don’t have to do it at all. You can simply use a reliable password generator, and it’ll create strong, top-notch passwords for you.

  • Start using passkeys. Passkeys are a new type of digital credentials that are considered much safer than passwords. Not only do they allow you to log in to websites and online services without entering a password, but they are also virtually impossible to intercept.

If your goal is to protect your business against password spraying attacks, you should consider implementing the following strategies as well:

  • Invest in password management. First, it’s important to realize that cybersecurity comes at a cost, but that doesn’t mean it has to break the bank. Nowadays, there are cost-effective options available from reliable companies that can help safeguard your company’s resources without draining your budget.

  • Enforce a strong password policy. Define and enforce rules that will get your employees to use complex passwords featuring a combination of uppercase and lowercase letters, numbers, and special characters to improve password security.

  • Educate your employees. Help the members of your company understand the importance of practicing strong password habits and spotting potential phishing threats to lower the risk of security vulnerabilities.

  • Introduce multi-factor authentication (MFA). Boost your company’s cybersecurity by requiring users to provide a second form of authentication alongside their passwords, adding an extra layer of protection.

  • Implement IP whitelisting and blacklisting. Protect your company’s network by allowing access only to trusted IP addresses while also keeping out the known malicious ones.

  • Enroll a passwordless authentication solution. Enhance your organization’s cybersecurity by implementing advanced authentication methods like biometrics or secure tokens, which eliminate the reliance on easily compromised passwords, while simultaneously providing a streamlined user experience.

How NordPass can help with password spraying

NordPass is an advanced yet very intuitive tool that you can introduce in your company as effective protection against different cyberattacks, including password spraying. How so?

First of all, NordPass allows users to securely generate, store, manage, and share passwords, passkeys, credit card details, and personal information. This means that anyone in your company can utilize it to keep all business credentials in one secure place protected by the most advanced data encryption algorithms.

Using our password generation feature, your employees can also quickly create strong, unique passwords that are not even remotely close to the common weak ones.

The safe sharing feature, on the other hand, allows you to avoid situations in which employees send business passwords to each other by email or instant messenger — which are, as you can imagine, very unsafe methods for sharing sensitive information.

Of course, with NordPass you can also enable multi-factor authentication in your organization, and easily build and enforce a strong password policy that all employees will have to comply with.

NordPass is capable of so much more than we can describe in just one blog post. So, if you want to learn about its features and the security measures used to protect companies from cyberattacks, please visit our website.

 

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.