December 15, 2022 – We have released a new version of GREYCORTEX Mendel. Version brings a new view of security and risks that individual subnets and hosts bring, advanced NetFlow processing and integration with other tools and security platforms.
The new version is already available for new installations and will also be gradually released on December 19 for an online upgrade.
BRATISLAVA, MONTREAL — December 7, 2022 — ESET researchers discovered a new wiper and its execution tool, both attributed to the Iran-aligned Agrius APT group. The malware operators conducted a supply-chain attack abusing an Israeli software developer to deploy their new wiper, Fantasy, and a new lateral movement and Fantasy execution tool, Sandals. The abused Israeli software suite is used in the diamond industry, and in February 2022, Agrius began targeting an Israeli HR firm, a diamond wholesaler, and an IT consulting firm. The group is known for its destructive activities. Victims were observed in South Africa and Hong Kong as well.
“The campaign lasted less than three hours, and within that timeframe, ESET customers were already protected with detections identifying Fantasy as a wiper and blocking its execution. We observed the software developer pushing out clean updates within a matter of hours of the attack,” says Adam Burgher, ESET Senior Threat Intelligence Analyst. ESET contacted the software developer to notify them about a potential compromise, but the inquiries went unanswered.
“On February 20, 2022, at an organization in the diamond industry in South Africa, Agrius deployed credential harvesting tools, probably in preparation for this campaign. Then, on March 12, 2022, Agrius launched the wiping attack by deploying Fantasy and Sandals, first to the victim in South Africa, then to victims in Israel, and lastly to a victim in Hong Kong,” elaborates Burgher.
Fantasy wiper either wipes all files on disk or wipes all files with extensions on a list of 682 extensions, including filename extensions for Microsoft 365 applications such as Microsoft Word, Microsoft PowerPoint, and Microsoft Excel, and for common video, audio, and image file formats. Even though the malware takes steps to make recovery and forensic analysis more difficult, it is likely that recovery of the Windows operating system drive is possible. Victims were observed to be back up and running within a matter of hours.
Agrius is a newer Iran-aligned group targeting victims in Israel and the United Arab Emirates since 2020. The group initially deployed a wiper, Apostle, disguised as ransomware, but later modified Apostle into fully fledged ransomware. Agrius exploits known vulnerabilities in internet-facing applications to install webshells, then conducts internal reconnaissance before moving laterally and then deploying its malicious payloads.
Since its discovery in 2021, Agrius has focused solely on destructive operations. Fantasy is similar in many respects to the previous Agrius wiper, Apostle. However, Fantasy makes no effort to disguise itself as ransomware. There are only a few small tweaks between many of the original functions in Apostle and the Fantasy implementation.
For more technical information about Agrius’s Fantasy wiper, check out the blogpost “Fantasy – a new Agrius wiper deployed through a supply-chain attack” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.
According to data extracted from a Cybersecurity Ventures‘ survey, ransomware costs will reach $20 billion next year. The survey also predicts this type of cyberattack will target corporations every 11 seconds.
Ransomware consists of malware used by malicious agents to block their victims’ computers and then demand a ransom. This malware has evolved, going beyond encrypting data and causing the shutdown of operations in companies: ransomware such as Maze also causes the leak of sensitive information, endangering the credibility of a company and can generate great financial losses.
The good news is that it is possible to prevent this threat by using Privileged Access Management (PAM), and this is the subject of this article. Keep reading our text to the end and learn everything about it!
Below, we explain each of these aspects in more detail:
In various types of cyberattacks, hackers use compromised credentials, and ransomware is no different, after all, to run this malicious software one needs to have privileges.
For this reason, it is recommended to discover and manage privileged credentials through Privileged Access Management (PAM). This solution makes it possible to discover, integrate, manage, switch, and audit credentials, as well as eliminate credentials that are no longer in use.
The best PAM tool for the discovery and management of privileged credentials is PAM senhasegura, which has discovery features considered best-in-class by the PAM market.
Deploying the Zero Trust-based network security model is also essential to prevent ransomware attacks.
This concept considers no user or device should be allowed to connect to IT systems and services without first being authenticated, according to the strategy ?never trust, always verify?.
In practice, the Zero Trust model works as an extremely effective protection, which verifies credentials continuously before granting access through methodologies such as Just in Time.
Just in Time is a technique that offers each user only the necessary access for the required time to perform their activities.With PAM, it is possible to ensure the granular definition of privileges through strategies based on Zero Trust, such as Just in Time. Forrester highlighted the access granularity of senhasegura in its Wave for PIM report.
One of the ways to prevent most ransomware attacks is through the Principle of Least Privilege (POLP).
This strategy also limits the impact of ransomware that can be installed in your IT environment, preventing hackers from moving laterally and diminishing their ability to elevate privileges.
That is, if the malicious attacker steals a credential with limited access or without privileges, the losses will be much lower. In this sense, endpoint privilege management tools are essential features of Privileged Access Management platforms.
This is because the connection of endpoint devices such as IoT devices, smartphones, laptops, and tablets increases the attack surface, making it easier for malicious attackers to work.
senhasegura offers GO Endpoint Manager for Windows and Linux endpoint and workstation privilege management, which allows segregation for access to confidential information, isolating critical environments.
Remote access is one of the major security vulnerabilities of companies in general. With it, employees and third-party suppliers do not always adhere to the security practices stipulated by the companies. We highlight the choice of weak or reused passwords or the use of the same password by a group of people among the main failures.
With Privileged Access Management, each user will only have access to resources indispensable to performing their tasks, thus reducing the attack surface, since administrators will be able to approve or deny access requests.
Through senhasegura Domum, secure remote access can be performed by employees and third parties with all senhasegura PAM remote session capabilities, providing Zero Trust-based access to corporate network devices without the need for a VPN.
Another capability of Privileged Access Management is to facilitate the audit of actions performed through privileged credentials, controlling risks such as improper access to these accounts.
senhasegura enables the implementation of stricter controls, which automate and centralize access to privileged credentials, protecting the IT infrastructure against data theft and compliance failures.
Through senhasegura PAM, it is possible to:
We are senhasegura, a company that integrates MT4 Tecnologia, a group founded in 2001 with a focus on digital security.
We are present in more than 50 countries, with a commitment to providing digital sovereignty and cybersecurity to our clients, granting control over actions and sensitive data and preventing information thefts and leaks.
To achieve this goal, we follow the lifecycle of privileged access management through machine automation, before, during, and after accesses. We also work for:
In this article, you saw that:
Did you like our article? Then share it with others who want to know how Privileged Access Management contributes to preventing ransomware attacks.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.
BRATISLAVA, BRNO — December 14, 2022 — ESET researchers discovered a spearphishing campaign, launched in the weeks leading up to the Japanese House of Councillors elections in July 2022, by the APT group that ESET Research tracks as MirrorFace. The investigation into the campaign, which ESET Research has named Operation LiberalFace and which targeted Japanese political entities, revealed that the members of a specific Japanese political party were of particular focus in this campaign. The spearphishing email messages contained the group’s flagship backdoor LODEINFO, which was used to deliver additional malware, exfiltrate the victims’ credentials, and steal the victims’ documents and emails. MirrorFace is a Chinese-speaking threat actor with targets based in Japan.
Purporting to be a Japanese political party’s PR department, MirrorFace asked the email recipients to distribute the attached videos on their own social media profiles to further strengthen the party’s PR and to secure victory in the House of Councillors. Furthermore, the email provides clear instructions on the videos’ publication strategy. The email was purportedly sent on behalf of a prominent politician. All spearphishing messages contained a malicious attachment that upon execution deployed LODEINFO on the compromised machine. MirrorFace started the attack on June 29, 2022, ahead of the Japanese elections in July. LODEINFO is a MirrorFace backdoor that is under continual development. Its functionality includes capturing screenshots, keylogging, killing processes, exfiltrating files, executing additional files, and encrypting defined files and folders. The attack used a previously undocumented credential stealer that ESET Research has named MirrorStealer. It is able to steal credentials from various applications, such as browsers and email clients. “During the Operation LiberalFace investigation, we managed to uncover further MirrorFace tactics, techniques, and procedures, such as the deployment and utilization of additional malware and tools to collect and exfiltrate valuable data from victims. Moreover, our investigation revealed that the MirrorFace operators are somewhat careless, leaving traces and making various mistakes,” says ESET researcher Dominik Breitenbacher, who discovered the campaign. MirrorFace is a Chinese-speaking threat actor targeting companies and organizations based in Japan. While there is some speculation that this threat actor might be related to APT10, ESET is unable to link it with any known APT group. Therefore, ESET is tracking it as a separate entity named MirrorFace. In particular, MirrorFace and LODEINFO, its proprietary malware used exclusively against targets in Japan, have been reported as targeting media, defense-related companies, think tanks, diplomatic organizations, and academic institutions. The goal of MirrorFace is espionage and exfiltration of files of interest. For more technical information about Operation LiberalFace by the MirrorFace APT group, check out the blog post “Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.
source:crowdstrike in the asset or vulnerability inventory to see CrowdStrike-sourced data. Use the following queries to track down common concerns:
source:crowdstrike AND has_public:tsource:crowdstrike AND os_eol:<now AND severity:criticalexploit_status:=0exploit_status:=30exploit_status:=90
edr.name asset attribute is now updated to show when a runZero scan no longer detects the EDR.--api-url parameter handling has been improved.--ldap-thumbprints flag.About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.
A SCADAfence New Feature report
The first question we’re usually asked by any CISO who wants to increase their OT security posture is about asset visibility and management. Gathering a comprehensive and accurate inventory of all the devices attached to an OT network is often the primary need driving an organization to seek assistance, and the biggest barrier to achieving their goals for security and compliance. It’s the right question to be asking, and the best place to start.
Cisco recently published vulnerability details which affect their 7800 and 8800 series of IP (VoIP) phones. These phones are sold across many different model numbers and can be found in businesses and organizations of varying sizes. Originally reported to Cisco by Qian Chen of the Codesafe Team of Legendsec at QI-ANXIN Group, this vulnerability does not require authentication for successful exploitation and can provide attackers remote code execution and/or denial-of-service (DoS) capabilities.
Cisco assigned a CVSS “high” rating to this vulnerability (tracked as CVE-2022-20968) and has acknowledged that proof-of-concept exploitation code exists. Firmware for all 7800 and 8800 series IP phones (with the lone exception of Cisco Wireless IP Phone 8821) contains this vulnerability, which resides in the input validation logic of received Cisco Discovery Protocol packets. Attackers who have presence in the same VLAN or network segment as vulnerable devices can send specially-crafted Cisco Discovery Protocol packets to trigger a stack overflow, resulting in a denial-of-service condition or potential code execution.
All firmware versions (14.2 and prior) for these 7800 and 8800 series IP phones contain this vulnerability (CVE-2022-20968), and Cisco is not planning on releasing patched firmware –which is currently expected to be version 14.2(1)– until next month (January 2023).
In the meantime, Cisco does offer the following mitigation for vulnerable IP phones:
Administrators may disable Cisco Discovery Protocol on affected IP Phone 7800 and 8800 Series devices. Devices will then use LLDP for discovery of configuration data such as voice VLAN, power negotiation, and so on. This is not a trivial change and will require diligence on behalf of the enterprise to evaluate any potential impact to devices as well as the best approach to deploy this change in their enterprise.
You can find the full details around this mitigation in the associated Cisco Security Advisory (see “Workarounds” section).
From the Asset Inventory, use the following pre-built query to locate Cisco 7800 and 8800 series IP phone assets which may need remediation:
type:"IP Phone" and (hw:"Cisco CP-78" or hw:"Cisco CP-88")
As always, any prebuilt queries are available from our Queries Library. Check out the library for other useful inventory queries.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.
Earlier this week, researchers with Eclypsium shared findings on three vulnerabilities present in American Megatrends (AMI) MegaRAC firmware. MegaRAC can be found in many server manufacturers’ Baseboard Management Controllers (BMCs), including AMD, Ampere Computing, ASRock, Asus, ARM, Dell EMC, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan. Successful exploitation of these vulnerabilities can provide an attacker with remote code execution, an administrative shell, and user enumeration. Given American Megatrend’s broad reach across server manufacturers and models the number of systems with vulnerable MegaRAC BMC firmware could be quite large.
These vulnerabilities are scored as CVSS “critical” and “high” severities, and the reported vulnerability details include:
The Eclypsium report does mention that public exposure of vulnerable BMCs appears to be “relatively low compared to recent high-profile vulnerabilities in other infrastructure products.” That said, data centers where many similar servers exist -–including data centers providing cloud-based resources-– could yield many opportunities for an attacker who has attained access, and detection of BMC exploitation can be “complex” and is likely to be missed with traditional EDR/AV.
While American Megatrends has not made a security advisory available at the time of this publication, owners and administrators of systems with MegaRAC BMC firmware should check with their server manufacturers for patched firmware updates.
Mitigations are offered in the Eclypsium report (see the “Mitigations” section), including (but not limited to) the following suggestions:
From the Asset Inventory, use the following pre-built query to locate BMC assets running MegaRAC firmware which may need remediation:
type:"BMC" and (hw:"MegaRAC" or os:"MegaRAC")
You can also locate all BMC assets in your environment by searching your Asset inventory for type:"BMC", which can then be triaged further.
As always, any prebuilt queries are available from our Queries Library. Check out the library for other useful inventory queries.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.
ESET welcomes the decision of EU legislators to adopt the second Network and Information Security Directive (NIS2) aimed at strengthening cyber resilience across the Union. The new legislation comes as a response to the growing dependency of critical sectors on digitalization and their higher exposure to cyber threats.
The directive now approved replaces the NIS directive introduced in 2016 as the first-ever EU-wide legislation on cybersecurity. NIS2 introduces a broader scope of action, impacting more entities in “high criticality” sectors, both the public and private sectors, such as energy, transport, banking, water and waste water, among other critical infrastructure. Whilst new obligations are brought in for those in other “critical” sectors such as manufacturing, food, chemicals, waste management, postal and courier services.
Enterprises classed as “High Criticality” will be required to take both technical and operational measures to comply with NIS2, including incident response, supply chain security, encryption and vulnerability disclosure, adequate risk analysis, testing and auditing of cybersecurity strategies, and crisis management planning in view to ensure business continuity. In case of a cyber incident, these entities will also be required to submit an initial notification within 24 hours and more detailed information within 72 hours. NIS2 also introduces fines for failure to comply, including suspension of certification and personal liability to managerial positions, in line with national laws.
Finally, the directive establishes the European Cyber Crises Liaison Organization Network, EU-CyCLONe, to enable cooperation between national agencies and authorities in charge of cybersecurity, and each Member State will also be required to clearly identify a single point of contact to report cyber incidents.
Are SMEs also obliged to comply?
NIS2 establishes “the application of the size-cap rule, whereby all medium and large enterprises, as defined by Commission Recommendation 2003/361/EC, that operate within the sectors or provide the type of services covered by this Directive, fall within its scope”. While it excludes Small and Micro enterprises from having to comply with the new rules, some exceptions apply for example for SMEs in the sectors of electronic communications networks or of publicly available electronic communications services, trust service providers or top-level domain name (TLD) name registries.
Small and medium-sized enterprises are increasingly becoming the target of supply chain attacks due to limited security resources. Such supply chain attacks can have a cascading effect on entities to which they provide supplies. Member States should, through their national cybersecurity strategies, help small and medium-sized enterprises to address the challenges faced in their supply chains. Member States should have a point of contact for small and medium-sized enterprises at national or regional level, which either provides guidance and assistance to small and medium-sized enterprises or directs them to the appropriate bodies for guidance and assistance with regard to cybersecurity related issues.
In March last year, the European DIGITAL SME Alliance, EU’s largest SME network in the field of ICT, published its position paper to the consultation on the proposal for NIS2, welcoming the new directive, but also alerting for the indirect impact of NIS2 on SMEs.
In conversation with ESET, James Philpot, Project Manager at DIGITAL SME, notes that the first step SMEs should be taking to “understand specific needs to boost their cybersecurity practices” is looking at their “national cybersecurity center and ENISA’s guides and recommendations”. However, “it might be easier or harder” to get the right information as “different Member States provide different resources”. Nonetheless, NIS2 “mandates that States should provide support and resources” mainly when it comes to getting a detailed understanding of the scope of this legislation “and whether their customers will be subject to it”, which will “help plan ahead”.
Turning challenges into opportunities.
“Downstream suppliers are likely to be the most disrupted”, and it can be challenging for some companies to have the needed technical capabilities but mainly to understand “reporting requirements and how NIS2 interplays with other legislation”, explained Philpot.
“But in a more general sense, we have to be positive about it”, and “efforts to improve the level of cybersecurity in European businesses are generally welcomed”. The only caveat, alerts Philpot, is the level of “implementation and support, and how that is managed, that will ultimately be the difference between the legislation helping SMEs and the legislation being regulatory overburden”.
Moreover, ESET and DIGITAL SME are convinced that this new framework might be an opportunity. “Yes, it can be an opportunity, there are technical solutions available in Europe to provide the level of cybersecurity required”, but companies need to avoid “looking for the biggest name or cheapest offer, which tends to come from outside of Europe”. This is why it is so important to “link support and resources” to “leverage this legislation and to strengthen European innovation”.
SMEs can also reach out to their local CSIRTS to mitigate some of the deficiencies of other national bodies, or take advantage of resources such as the DIGITAL SME/SBS guide, the DIGITAL SME Guide on Information Security Controls or cybersecurity certificates.
Moving towards safer enterprises.
ESET’s SMB Digital Security Sentiment Report, published just last month, discovered that while 83% of SMEs believe that cyber warfare is a very real threat and 71% had moderate to high confidence in their ability to investigate the root cause of cyberattacks, 43% consider the lack of awareness of employees as the leading cause for concern, while the actual uptake of EDR (end-point detection and response) solutions, which specifically assist in this area, was only at 32%.
As Philpot also notes in the conversation with ESET, “the impacts of cyber incidents are well known” to SMEs: data leaks, considerable financial impact and loss of customer confidence. So “in a more general sense, we have to be positive” about NIS2; at the very least, this directive will play an important awareness role, even for those companies that “aren’t required to comply, they may develop greater awareness”
The NIS2 will become applicable after the EU Member States transpose the Directive into their national law: by September 2024. Nevertheless, organizations might want to be ready sooner than later, not only to be timely on the implementation process, but also to test different good practices on incident handling, control policies and reporting mythologies. Above all, NIS2 defines a minimum common level of cybersecurity in Europe, one that should be seen as the floor under our feet, not as a ceiling.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.