Skip to content

Network Authentication is Just One Piece of the Network Security Puzzle

Establishing an Effective Network Security Posture Requires the Unification of Access Control, Risk Mitigation & Endpoint Remediation Capabilities

There’s a movement underway in cybersecurity today to adopt tools for enterprise network authentication. This trend makes sense. After all, authentication is just a fancy way of saying identity verification. Proving one’s identity has been a way of granting one’s access to something since time immemorial. From the secret passwords used to enter Chicago’s famed speakeasies to the retinal scanners used to clear you through airport security today – proving identity ensures trustworthiness and minimizes risk. 

Today, there are three primary methods that organizations rely on for network and application authentication: 

  • Password-Based Authentication – Passwords are the most common methods of authentication. Passwords can be in the form of a string of letters, numbers, or special characters. To protect yourself you need to create strong passwords that include a combination of all possible options. Of course, humans are lazy and tend to stick to what they know…meaning the same password gets used almost universally 
  • Multi-Factor Authentication –  MFA authentication methods and technologies increase the confidence of users by adding multiple layers of security. MFA may be a good defense against most account hacks, but it has its own pitfalls. 
  • Certificate-Based Authentication –  Certificate-based authentication technologies identify users or devices by using digital certificates. A digital certificate is an electronic document based on the idea of a driver’s license or a passport. This is perhaps the strongest means of authentication. 

Now,  Mission Impossible fans might say  hey, wait a minute, biometric authentication is missing off this list.  They’re not wrong, but frankly we’re not really focused on physically breaching CIA headquarters at Langley to get our hands on the coveted NOC list here. Rather, let’s focus on the day-to-day use of authentication techniques adopted by employees during business hours. 

I’m On the Network: Great, Now What?

The efficacy of the network authentication methods above can be debated to no end. That’s not why we’re here. Once a person’s device is authenticated to a corporate network, there are several security considerations that pure-play authentication tools can’t address. 

For example: 

  • Is the connected user an employee, guest, or contractor? 
  • What’s the user’s role within the organization (i.e. seniority or department)? 
  • What can the user access on the network? 
  • What’s stopping the user from accessing resources that shouldn’t be available to them? 
  • How do you monitor the risk posture of the connected device? 
  • How do you know if that user’s device becomes infected with malware? 
  • Can you prevent that infected device from moving across the network? 
  • Is there a way to return a non-compliant device back to a healthy state? 

Inside that medley of questions are a grab bag of other more detailed and technically intricate considerations that network security administrators may worry about. The point is this: once a user authenticates their device to the network, how can you prevent that device from posing a risk to the organization, even if unintentional? If you’re solely relying on authentication methods for network security, the answer is: you can’t. 

Closing the Gap on Network Security Blind Spots

The list of considerations above boils down to needing three primary capabilities on top of network authentication when it comes to network security. Without these, you’re essentially flying blind, unable to determine the true security posture of your network.  

These capabilities include: 

  • Access Control –  If authentication is the first step, employing access control is the second. Here, you’re aiming to dictate who can access what across your network. For example, you may not want Marketing to access Accounting’s VLAN. Why? Because Accounting’s VLAN holds sensitive financial information that has no bearing or relevancy to the day-to-day operations of Marketing. 
  • Endpoint Risk Posture Assessment –  The ability to continually monitor the risk threshold of each endpoint connected to your network means knowing how vulnerable you are to compromise. N etwork administrators will typically define a risk assessment policy, which assigns a risk score to each device. This score will indicate the level of risk posed by the device, taking into consideration the status of the device’s firewall, antivirus, applications in use and more. 
  • Proactive Device Remediation –  In some instances, the network security team may define a series of remediation policies. Essentially, a remediation policy consists of unattended corrective and preventive actions (CAPA), automatically applied to devices upon every transmission or on a recurring basis. A remediation policy can be used to reduce devices’ risk scores and increase compliance levels for network access. 

Unifying these Security Essentials With NAC

There is only one type of cybersecurity technology that brings together network authentication, access control, risk monitoring and remediation. That’s network access contro l (NAC). NAC, such as  Portnox CLEAR NAC-as-a-Service , unifies these network and endpoint security essentials in a single platform, and helps you fill in these critical gaps that an authentication-only approach fails to cover: 

  • Device profiling for contextual understanding 
  • Role-based and location-based access control 
  • Segmentation through dynamic VLAN assignment upon authorization 
  • Risk mitigation through device posture monitoring 
  • Device quarantining based on risk score policies 
  • Automated device remediation of non-compliant devices 
  • …the list goes on… 

Ultimately, anything less than complete network security coverage enforced through a NAC system that brings together these essential capabilities isn’t “network security” – it’s holding on to a hope and a prayer. Rely on standalone authentication tools at your own peril – we’ll just have to say we told you so.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

ESET Research discovers DazzleSpy: macOS malware spying on visitors of Hong Kong pro-democracy news site

  • A watering hole attack compromised a Hong Kong pro-democracy radio station news website.
  • The attackers served a Safari exploit that installed cyberespionage malware DazzleSpy on site visitors’ Macs.
  • Targets are likely to be politically active, pro-democracy individuals in Hong Kong.
  • The vulnerability could also have been exploited on iOS, even on devices such as the iPhone XS and newer. In fact, this campaign has similarities with one from 2020 where LightSpy iOS malware was distributed the same way.
  • The payload – DazzleSpy – is capable of a wide variety of cyberespionage actions.
  • ESET Research can conclude that the group behind this operation has strong technical capabilities.
  • The malware uses China Standard Time and contains a number of internal messages in Chinese.

BRATISLAVA, MONTREAL — January 25, 2022 — ESET researchers have discovered that the news website of Hong Kong pro-democracy radio station D100 was recently compromised to serve a Safari exploit that installed cyberespionage malware on site visitors’ Macs. The watering-hole operations the attackers have pursued show that the targets are likely to be politically active, pro-democracy individuals in Hong Kong. The malware delivered to vulnerable visitors of the site was new macOS malware ESET has named DazzleSpy. The malicious code is capable of collecting a wide variety of sensitive and personal information.

The first report about the watering-hole attacks leading to exploits for the Safari web browser running on macOS was published by Google last November. ESET researchers were investigating the attacks at the same time as Google and have uncovered additional details about both the targets and malware used to compromise the victims. ESET has confirmed that the patch identified by the Google team fixes the Safari vulnerability used in the attacks.

“The exploit used to gain code execution in the browser is quite complex and had more than 1,000 lines of code. It’s interesting to note that some code suggests the vulnerability could also have been exploited on iOS, even on devices such as the iPhone XS and newer,” says Marc-Étienne Léveillé, who investigated the watering-hole attack.

This campaign has similarities with one from 2020 where LightSpy iOS malware was distributed the same way, using iframe injection on websites for Hong Kong citizens leading to a WebKit exploit.

The payload – DazzleSpy – is capable of a wide variety of cyberespionage actions. It can collect information about the compromised computer; search for specified files; scan files in Desktop, Downloads, and Documents folders; execute the supplied shell commands; start or end a remote screen session; and write a supplied file to disk. 

Given the complexity of the exploits used in this campaign, ESET Research can conclude that the group behind this operation has strong technical capabilities. It’s also interesting that end-to-end encryption is enforced in DazzleSpy meaning it won’t communicate with its command and control (C&C) server if anyone tries to eavesdrop on the unencrypted transmission.

Among other interesting findings about this threat actor is that once the malware obtains the current date and time on a compromised computer, it converts the obtained date to the Asia/Shanghai time zone (aka China Standard Time), before sending it to the C&C server. In addition, the DazzleSpy malware contains a number of internal messages in Chinese.

For more technical details about this watering-hole attack and the DazzleSpy malware, read the blogpost “Watering hole deploys new macOS malware, DazzleSpy, in Asia”  on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research. 

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Invest in disaster recovery strategies and avoid damages to your company

Failures in the IT infrastructure can compromise the continuity of a business. For this reason, organizations must have a disaster recovery strategy to avoid losses.

This solution is useful to circumvent problems that can have different origins: natural disasters such as fires, human error, and cyberattacks are some examples. 

In this article, we go into more detail about disaster recovery and its importance for the security of institutions. We have broken down our text into the following topics:

  • What is Disaster Recovery and What Is Its Importance?
  • Emergence of Disaster Recovery
  • What are the Main Obstacles Faced by Disaster Recovery?
  • Threats to Cybersecurity in Organizations
  • Top Disaster Recovery Methods
  • What is the Best Disaster Recovery Method for my Organization?
  • Building a Disaster Recovery Plan
  • Understand RPO and RTO 
  • Synchronous Replication: Excellent Method for Companies that Cannot Tolerate High RPO from Data to Disaster Recovery
  • Asynchronous and Mixed Replication

Enjoy the read!

1. What is Disaster Recovery and What Is Its Importance?

As we suggested in the introduction to this article, disaster recovery is important to ensure the continuity of a business. 

This is because it is designed to avoid data loss and enable the company’s operations again whenever there is an interruption generated by unforeseen events, such as natural phenomena, cyberattacks. or system failure.

Thus, it is possible to prevent these inconveniences from negatively impacting the organization’s image in the eyes of its customers and causing great damage to the company.

2. Emergence of Disaster Recovery

 Disaster recovery came on the scene in the early 1970s. Before that, companies were less dependent on computer-based operations. 

In the following decade, American banks had to adapt to a government requirement: according to the determination, they would have to present a backup plan that could be tested. As a result, companies in other areas had adopted the same strategy in order to avoid long pauses in operations. 

In the 2000s, the dependence on network services was greater among companies, which began to capture and store a large amount of data, making disaster recovery a highly complex solution. 

This was simplified after 2010 with cloud computing and disaster recovery services, or “data recovery as a service” (DRaaS).

With the evolution of malicious actor tactics in virtual environments, adopting a disaster recovery plan has become imperative. After all, cyberattacks can affect a company’s work to the point of destroying its credibility, in addition to the immediate financial impacts.

3. What are the Main Obstacles Faced by Disaster Recovery?

In this topic, we cover some inconveniences that can be avoided or tackled by a disaster recovery plan. Check it out:

  • Human Error

People are subject to failures, which can result in incalculable damage if not properly addressed. These errors can occur on purpose or accidentally.

In the case of professionals who deal with computer equipment, any error can jeopardize data and operations and bring great financial impacts to companies. 

  • Equipment Problems

Machines can have faults that generate great inconvenience. This could be associated with software crashes, slow equipment. or system crash. 

This type of failure causes loss of productivity or even downtime when it is necessary to send the equipment for repair. Inevitably, this generates losses for organizations. 

  • Natural Phenomena

While not a frequent issue, natural disasters can occur and be devastating for companies that do not have a disaster recovery plan in place. 

A storm, for example, can destroy a company’s headquarters and computer equipment. For this reason, one needs to be prepared for such situations. 

  • Power Outages

Outages in electricity supply occur much more frequently than a natural disaster and also have a great potential to interrupt the activities of organizations, causing incalculable damage.

This type of unforeseen event can damage IT equipment and cause data loss, which is a major inconvenience. That is, the possibility of having a power outage is one more reason to adhere to a disaster recovery plan.

  • Equipment Theft

Having the equipment stolen creates problems that go beyond the initial scare and the damage caused by the need to replace the machines.

Besides the devices, it is possible to lose customer data and information about the business itself, which can even affect the company’s credibility. 

In this sense, it is advisable to have resources that allow you to recover lost data and keep operations in full swing to avoid damage.

  • Cybercrimes

With the evolution of technology and the action of hackers, organizations are increasingly vulnerable to cybercrimes. 

Cyber intrusions can occur for different purposes: demanding a ransom or appropriating data relating to that business.

Thus, it is essential to have a disaster recovery plan to recover information and files that may eventually be lost.


4. Threats to Cybersecurity in Organizations

Cyberattacks are increasingly sophisticated, which requires security solutions and, often, disaster recovery. Here are some threats:

  • Phishing: This is a social engineering attack (it is based on the manipulation of victims). Its most common methods include links that copy websites of trusted companies used to collect information to steal bank accounts, among other malicious actions.
  • Ransomware: In this type of malware, malicious actors demand payment of ransom to give victims back access to systems and files lost in traps such as spam.
  • Backdoor Attack: A backdoor allows an administrator to access a certain system in order to solve a problem. However, this mechanism can represent a loophole for hackers.
  • DoS and DDoS Attacks: DoS is a malicious action that overloads a server, making access to a website unavailable. In turn, DDoS affects multiple machines, flooding them with false requests and undermining real demands.


5. Top Disaster Recovery Methods

Currently, there are several disaster recovery strategies and organizations often use more than one to ensure their security. Check out the main resources used:

  • Cold Site

Here, the disaster recovery strategy works as follows: the institution has a second facility so that employees can continue to perform their duties even if incidents such as storms or fires occur.

This solution prevents business downtime, but does not enable data recovery. For this reason, we strongly recommend that it be paired with other disaster recovery tools.

  • Hot Site

This feature is very efficient when it comes to avoiding downtime. That’s because it copies data frequently, keeping it always up to date. However, their setup takes a long time and they are not among the most cost-effective solutions.

  • DRaaS

This solution ensures that computer processing is transferred to a cloud infrastructure. In this way, the company can carry out its activities even if the servers are down. 

You can access DRaaS plans through subscription or pay-per-use.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Every programmer deserves a Vagrant File

Vagrant File: Working with virtual IDE’s

An Integrated Development Environment is like the personal office of every software programmer, because we have all the components in order to focus on the task. Today everything is oriented towards web applications and in a previous article we mentioned how large companies have taken advantage to offer such services quickly, in what have become known as “Architecture without server”, euphemistically. For these cases we tell you that a Vagrant File could be developed to simulate this environment without a server to perform tests, saving time and money before hiring these services and creating our web application.

In this article we will show you how the field of programming has evolved, always with concise narratives and additional links.

In the 20th century…

Computers were expensive, even more than today; so many of us didn’t have computers at home. Those were simpler times, and mobile phones were only used by our bosses, so when we left the office we were really disconnected and could get by without Internet. But when we turned on our computer to program we had already placed all the variables -and programs- necessary to begin our work. We had to have the whole programming environment set up and ready.

In those days, going to the office physically was common, but now, it’s not.

In this 21st century

Now programmers can work remotely and for several clients or companies from anywhere, but such flexibility brings the dreaded thing of “it works on my machine”, but not on that of other developers who work with us. Virtual machines have solved, in part, this problem and even its complexity has increased exponentially with the networks defined by software.

As we said, each application is unique and its components can become very unique or specific. All of the above may not fully meet our needs, but it is not yet time to say goodbye to our personal computers, at least not in our profession.

Vagrant File

vagrant file

vagrant file logo

Continuous Software Release and Continuous Integration have taken the demands much further to meet deadlines and goals: we must copy from the repositories the algorithms we are working on, to make very specific modifications and then return them to the common cause. Whether we are in America or Europe we must always be ready for any work, and this is where the Vagrant File comes in.

A Vagrant File describes both an operating system and the provisioning and also configuration of a development environment. For the programmers it is a complete and rather tedious work: it takes away our energy to program. With a Vagrant File created and adapted by all the members of the team, not only will we have a development environment, we will also have an environment identical to the one used in production, a task that we will do in a single opportunity in the device where we usually work.

Installing Vagrant

To install any Vagrant File we will first need to have VirtualBox installed, and in our case we use Debian/Ubuntu. Once we have installed this hypervisor we can proceed to install Vagrant. In a GNU/Linux environment it is common to use apt-get install vagrant or for CentOS and related yum install vagrant, but if you have a problem it is better to download the installation packages directly from the official site rather than the default repositories of your operating system. At the time of writing this post the supported platforms are as follows:

  • Linux (64 bits, package in AppImage format, which is very appreciated by Linus Torvalds, creator of Linux, who explains how it works)
  • Debian (32-bit and 64-bit, package in .deb format)
  • Microsoft Windows® (32-bit and 64-bit)
  • CentOS® (32-bit and 64-bit, .rpm package)
  • macOS® (32-bit and 64-bit, .dmg package)
  • ArchLinux (64 bits, package in .tar.xz format)

First steps

The first thing we run is the vagrant -v command in a terminal window, to see which version we have installed (2.1.2, to date). Then we will be able to choose the operating system we are going to use; in Pandora FMS the selected one is CentOS 7, so we will create in our user documents a folder called vagrant-home:

# mkdir ~/vagrant-home 
# cd ~/vagrant-home 
# vagrant init centos/7

This is where we need to be patient: we proceed to download an image of the desired provider, in this case a Content Delivery Network (CDN) from vagrantcloud.com:

“vagrant init centos/7” and “vagrant up”

It is fair to say at this time that many companies have collaborated by publishing each by their own means an image file for different hypervisors. In the case of CentOS we have for Microsoft Hyper-V®, Libvirt, VMWare Fusion® and, of course, for VirtualBox.

vagrant file

Vagrant images supported by CentOS for different hypervisors

Do we need a Percona database? We can search VagrantUp for a Vagrant Archive that suits our needs, or we can create our own Vagrant Archives and share them!

Finally using a Vagrant File

Now we will do all our work of server configuration management with a Vagrant File and we will start by reviewing the one we just created… When? Well, when we issued the vagrant up order in our vagrant-home folder:

Vagrant File

The famous Vagrant File, file in plain text

All the lines are commented, except the one that describes the virtual machine; there we can quickly change anything we need (IP address, listening ports to connect via SSH, etc.). For now we’ll use the vagrant halt order to shut down our machine.

The “mantra” of Vagrant

The idea is, by means of a Vagrant File that we get to download a virtual machine and, in addition, with additional instructions to carry out the provisioning and configuration of a development environment (or of production). This way we will have our own machine, we will turn on and off, and if at a certain moment we want to restart and start again we will use vagrant destroy.

Remember to save OUTSIDE the virtual machine all your work, or if you use Git apply the command git push; in Pandora FMS we use GitHub to store the source code since 2014.

Working with Vagrant

How do we connect to our Vagrant File (as we saw, this file is the core of the matter)? Because always located in our folder to that effect created, we introduce vagrant ssh and we will be connected to begin our work.

Do we want to connect in a “normal” way, as we have always done? The only change human beings like is the diaper change; if we want to connect with the command, ssh, first we must run vagrant ssh-config to know the configuration we will use.

vagrant file

“vagrant ssh” and “vagrant ssh-config”

Monitoring Vagrant

From the SSH connection we can add the parameter “-o LogLevel=VERBOSE” to know what happens with our connection (by default it is configured to “FATAL”, the other possible values are QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2 and DEBUG3). Also for logs, if we use VirtualBox, they are located at
“~/VirtualBox VMs/vagrant-nombre_de_nuestra_carpeta_default_XXX/Logs/VBox.log” in a very particular format… But before going deeper into that, we tell you that it is just the tip of the iceberg, because it only shows us the record of SSH connections and perhaps we should aim higher.

To keep track of the boot of our virtual machines we must use the parameter “–debug”to be able to get all the details of each boot and shutdown:

vagrant file

Result of the command “vagrant up –debug”

Note: always “VBox.log” will contain the last record, the previous ones will be listed and kept and if we want to monitor we must automate so that it always reads the record after a “vagrant halt” or “vagrant destroy”. The other possible values are: info, warn and error. If we want to save absolutely all the startup record we must send all the output to a file in the same folder where we run: “vagrant up –debug &> nuestro_registro.log” (the debug parameter has two dashes as prefix).

Any information we send you to register may contain personal information and/or sensitive data of the device where you are running Vagrant. Be careful.

Using Pandora FMS as a monitoring tool

We saw that Vagrant has a very particular way of keeping records. Therefore, the default option we have to monitor with Pandora FMS is like any other device, either installing a Software Agent or performing a Remote Monitoring, having the foresight to provide an IP address to the Vagrant virtual machine to communicate with the Pandora FMS server, central or satellite.

A few steps beyond

Once we have experienced working with third party Vagrant Files, it will be time to create our own well-customized virtual machines to share with our colleagues. To do this, we must use Packer, a tool specially designed for such tasks.

When we are very experienced we can even review the logs without having to connect via SSH through a very elaborate artifice called codeyourinfra, which consists of an Apache web server with Jenkins, which will allow us reading access.

Don’t hesitate to contact us in Pandora FMS to start working in your company or office. We have years of experience and a well-qualified team at an international level.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

How to Protect Your Network Against a Ransomware Attack

Cyberattacks against mid-market and enterprise organizations are on the rise. From man in the middle (MitM), distributed denial-of-service (DDoS) and SQL injections, to zero-day exploits and phishing, cyberthreats are getting more sophisticated, more prevalent and more costly. But one type of cybercrime reigns supreme: ransomware.

Not-so-fun facts about ransomware today:

  • Ransomware cost the world $20 billion in 2021. That number is expected to rise to $265 billion by 2031.
  • In 2021, 37% of all businesses and organizations were hit by ransomware.
  • Recovering from a ransomware attack cost businesses $1.85 million on average in 2021.
  • Out of all ransomware victims, 32% pay the ransom, but they only get 65 percent of their data back.
  • Only 57% of businesses are successful in recovering their data using a backup. Source: Cloudwards

COVID-19 is not the only pandemic to emerge and gain a global stronghold as we push on into the 2020s. Ransomware has its tentacles everywhere. No network – corporate or personal – is immune. The financial damage being inflicted, especially at the corporate level, is only getting more and more severe. It has the potential to bring some institutions to their knees and send ripples through the global economy, eventually impacting the everyday consumer.

If we’re to right the ship, the castle walls around our ever-expanding networks must become stronger, more dynamic and more intelligent. It also requires vulnerable entities to step into the realm of psychology. What’s motivating these threat actors? What do we as an organization have that they want?

Stopping Ransomware Just as we wear masks and get vaccinated to protect ourselves from the threat of contracting COVID-19, we must take the proper precautions to limit or eliminate the possibility of a ransomware attack.

Know Your Enemy For most companies, the enemy (or hacker) just wants money. More rarely, they’re after corporate data for some personal gain – again, that could be to sell it or leverage it for other malicious initiatives that could be politically or ideologically motivated. Even more rarely, they’re just looking to tarnish your brand’s reputation.

Regardless of their intent, however, there is one simple commonality: they want to breach your network through clandestine means. The emphasis is on the network even if that network is not physical. Today, it doesn’t need to be. In 2022, your network is merely where your corporate endpoints are in use, and ultimately where data accessed via those devices is stored.

The attempt to understand the enemy has given rise to threat intelligence services that can help you profile your attackers. Such tools can determine whether these individuals have a hold on your network, endpoints and/or users. But threat intelligence alone isn’t enough – organizations need to know themselves, which requires a unified stack of security technologies and tactics that when deployed in conjunction with one another can thwart even the most sophisticated ransomware attack.

Know Your Organization Corporate endpoints serve as the initial entry points to any corporate network. These devices store proprietary, sensitive data – the hostage in this hostage taking scenario. To effectively secure the network requires instituting a bevy of endpoint security measures as part of a larger security posture strategy. Frameworks such as the CIS Critical Security Controls outline these best practices.

Ultimately, however, organizations can start with these basics:

  • Use Multi-Factor Authentication (MFA) when possible; discourage the use of corporate applications that do not allow for MFA activation; use a password manager when MFA is not available.
  • Have a mechanism to isolate any infected machine in use across your network to prevent lateral movement and further spread. Network access control (NAC) solutions have been purpose-built to do just this.
  • Employ an email content inspection software that proactively inspects all links and attachments within incoming emails; this aids in stopping malware via phishing attempts.
  • Deploy an Endpoint Detection & Response (EDR) program on all machines – managed devices, BYOD & IoT / OT – that runs 24/7 with automatic system updates.
  • Ensure you’ve instituted proactive device remediation for all connected endpoints that can automatically update firewalls, antivirus and VPN services in use. NAC also incorporates this functionality.

If you follow those principles, you can win every battle. As legendary military strategist Sun Tzu wrote in his classic work, The Art of War: “If you know the enemy and know yourself; you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.”

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Load Balancer: what is it and what is its importance?

When a given system is heavily accessed, it is recommended to invest in a load balancer.

This solves the problem of slowness caused by system overload as it distributes traffic among different web servers in the resource pool. Thus, you can optimize its performance and significantly reduce its response time.

In this article, we bring more details about this solution, which can be applied in hardware and software, alone or together. Our text is divided into items to make it easier for you to understand the subject. These are:

  • What is a Load Balancer and How Does it Work?
  • Benefits of a Load Balancer
  • Brief History of the Load Balancers
  • Load Balancing and Cloud Environments
  • Load Balancing Algorithms
  • Other Load Balancing Algorithms
  • Situations where Load Balancing is Essential

Enjoy it!

  • What is a Load Balancer and How Does it Work?

As mentioned in the introduction, a load balancer is intended to distribute traffic to different web servers in the resource pool. This way, it ensures no server is overloaded. 

The consequence is the reduction of the server’s response time, which starts to work with maximum performance. 

This is because this solution has the function of routing requests to the right places, providing performance and security for complex IT environments and the operations developed through them.

Let’s suppose you have three computers, but only two are operating, while the third is idle. In this case, load balancing will redistribute the workload between the equipment in order to ensure efficiency in their deliveries.

  • Benefits of a Load Balancer

Using a load balancer is very beneficial for several reasons. Check out its main benefits:

  • It increases efficiency: When you have a heavy workload, your network slows down. With load balancing, you can distribute it on more than one computer and/or server, increasing efficiency.
  • It allows you to manage the traffic flow: Many companies deal with a large volume of traffic in their daily activities. This traffic must be managed in such a way as not to overload the system and maintain the speed of operations. A load balancer helps manage traffic by distributing the workload across multiple computers or servers. 
  • It upgrades without downtime: With load balancing, networks gain more flexibility. The redundancy inherent in this solution makes it possible to transfer the workload to a defined server or server cluster for the others to be updated. Thus, these updates will not affect data access and operations.
  • It eliminates system failures: A load balancer also helps prevent network failures, which can occur as a result of failures in a server cluster. 

When configuring or updating your network, you should create server clusters using the same application. In this way, you can remove a failed server from your system easily. What’s more, the load balancer also allows you to transfer the workload to a functioning server without causing problems.

  • Brief History of the Load Balancers

This concept was created in 1990, with the proposal to enable the distribution of traffic in networks through specific hardware.

Subsequently, the development of Application Delivery Controllers (ADCs) provided more security to the load balancer, as new ways were sought to guarantee access to applications without interruptions and at any time.

ADCs can be: Hardware Appliance, Virtual Appliance, and Software Native Load Balancers. Today, ADCs created from software have the function of performing operations as hardware would and in a more scalable, functional, and flexible way.

  • Load Balancing and Cloud Environments

Large workloads in cloud environments can overload a single server. For this reason, load balancing is ideal for ensuring operations are performed efficiently in this context.

Another important function of a load balancer is to ensure the scalability of a cloud: This is what provides more speed for servers and the execution of various applications through the distribution of traffic.

With load balancing, servers receive inbound traffic in a coordinated fashion. Thus, it is possible to avoid that some servers are overloaded while others are with zero traffic.

Moreover, a load balancer makes it possible to identify unavailable servers to direct traffic to those that are operating. That way, you can have infrastructures in different places, as long as you sign up with a cloud service provider.

This is critical as regions can experience natural disasters and become inoperable. In this case, traffic is directed to another region, which has not been impacted by the catastrophe.

A load balancer can also determine which server is likely to be overloaded in the least amount of time and share the traffic with others. This capability reduces the possibility of service becoming unavailable.

The more demands an organization has, the greater will be the traffic of employees, suppliers, partners, and clients. 

As such, your cloud infrastructure must be able to support this load without becoming unavailable or reducing its responsiveness. That is the purpose of load balancing.

  • Load Balancing Algorithms

Load distribution is performed using an algorithm. This means the user has access to the websites using a URL associated with an IP and the load balancer, which directs the request to the server. 

Load sharing is directly related to the type of algorithm used, and the four most known are:

  • Round Robin: This is a method capable of placing incoming requests in a queue. With load balancer management, one can distribute these requests to servers, responding to them according to the availability of computers.

This solution is adaptable to locations where the servers have the same features. On the other hand, the algorithm can assign overload to less powerful equipment.

  • Weighted Round Robin: 

Unlike traditional Round Robin, it works according to the capacity of each server, which is pre-set with a value. It works like this: While the most powerful can have a value of 10, it is possible to assign the least powerful a value of 1. 

With that, the most powerful equipment will receive the greatest load. Therefore, this method is more recommended for use with different servers.

  • Least Connections

Round Robin and Weighted Round Robin do not work taking the number of connections the servers will handle into account. Thus, some servers can be overloaded, when receiving a backlog of connections. 

This problem is easily solved by Least Connections, which works considering the requests that already exist on the server when distributing new ones. 

However, this algorithm may not work depending on the technical capabilities of the servers. For this reason, it is recommended to be used in environments whose servers have the same features. 

  • Weighted Least Connections

This algorithm works as a complement to Least Connections. In an infrastructure whose servers have different resources, it considers the requests for each piece of equipment, in addition to the weighting established by the administrator.

As with Weighted Round Robin, the most powerful server has the most weight. With this, one can distribute the load strategically, as new requests are directed to a server with the lowest assets/weight.

  • Other Load Balancing Algorithms

In addition to the four best-known load balancing algorithms presented in the previous topic, other types perform load balancing. Check some methods below:

  • Lower Bandwidth Algorithm: In this case, traffic is measured in Mbps. Thus, it is possible to send requests to servers with a smaller number of Mbps of traffic.
  • URL Hashing: This algorithm is capable of evenly distributing writes across multiple websites and directing reads to a specific website.
  • Resource-based Algorithm (Adaptive SDN): This method involves knowledge of all application layers and the inputs of an SDN controller, which determines decisions regarding traffic distribution.
  • Resource-based Algorithm: Here, a computer program is installed on the server so that it provides the current load for balancing. This is possible based on an assessment of the servers and the availability of resources that allow traffic to be properly directed.
  • Source IP Hashing: It mixes client and server IP addresses, creating a unique hash key, capable of allocating traffic to certain servers.
  • Situations where Load Balancing is Essential

To understand the importance of investing in load balancing, it is worth looking at the cost-effectiveness of this investment. In other words, how much it costs to have this service and how much your business can lose without correct load distribution.

If you have an e-commerce business operating during periods such as Black Friday, Christmas, Mother’s Day, Valentine’s Day, or other important dates for commerce, for example, the load balancer can avoid major losses.

In this article, we discussed what a load balancer is, its benefits, and its importance for companies. If our content was helpful to you, please share it with more people who might be interested in the subject.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

What is, how to install WSL2 and why is it great news for the IT industry?

What is and how to install WSL2 and why is it great news for IT?

Background

Before diving into what WSL2 is, how to install it, and how to use it – which we will – I would like to add some background information you might relate to if you were born in the 80s like me.

From a very young age I have felt attracted to computers, and in my childhood they were not as common as they are today, when almost everyone has one within reach.

I think my first encounter with a computer was when I was 11 or 12 years old, with an old computer that my father had in his office. I remember spending hours in front of the screen, although I’m not quite sure what I was doing, because at that time there was no internet.

That old computer had Windows 3.1; my first computer also meant my first Operating System was Windows, which I used in all its versions (and I will also spoil that I still use it). From then on I kept on using it, in fact, I didn’t know about anything else until I got to college and some friends told me about Linux (Mac was not an alternative for me).

Since I met Linux I fell in love with the penguin operating system, its philosophy and its fantastic terminal, so I started testing it on my home computer, with all the compatibility issues it involved at the time, when you spent half a day installing and two more looking for drivers. However it was a new experience and, although frustrating, totally rewarding when you achieved this sense of accomplishment. Of course, for me it was no more than an experiment for many years.

Half of my professional life revolved around Windows, from my first jobs as a microcomputer technician to managing servers and services based on Microsoft OS. I even studied at a Microsoft partner academy and got certified in Microsoft Windows Server 2012. It wasn’t until early 2013 that I had my first professional experience with Linux on an old web server that someone had to maintain. Indeed, that someone was me and I devoted many more hours than necessary to that lonely server.

Like many of you, I find myself in the following position: I love Linux and its ecosystem but it seems to me that Microsoft does a very good job on its OS and, for some reason, I always end up coming back to it. The ideal thing would be to have the best of both worlds. I’ve tried dual boot, virtualization, and cwin, but none felt like a full experience. I thought it was the best I could get even if it wasn’t ideal and just moved on, until Microsoft announced WSL.

What is WSL?

WSL stands for Windows Subsystem for Linux, which was nothing more than a compatibility layer for native Linux environments within Windows. Its first version was announced in 2016 and it was big news. I remember having the Ubuntu 16.04 terminal running natively on Windows and thinking “this is what I’ve been waiting for, everything I need without losing compatibility”.

Unfortunately WSL, although very useful, had several shortcomings: all the executions were interpreted, there was no access to all the hardware of the machine, the overall performance was quite poor, etc. I didn’t stop using it, but it wasn’t suitable for everyone. Still, it was the first step. In 2019 they announced WSL2, which would no longer be interpreted, it would have the entire native Linux kernel and would be running on Windows at full performance. WSL2 was recently released for all Windows 10 2004 version users. It seems that having everything I needed is now becoming a reality. It’s not perfect, that’s for sure, but it’s impressive how well it works.

Why WSL2 and not a Linux distro?

“It depends”, that’s the answer. Many of you, due to company policies, will not be able to change the OS of your computer or will be stuck with Windows for using the Office suite or Adobe tools, or even because you feel more comfortable on Windows rather than Linux.

In my case, I have the freedom to choose the operating system I use, my company does not enforce any restrictions as long as it stays updated and has an antivirus active. I have tried using Linux straight away and in the end I always have to go back to Windows or virtualize it and I prefer to virtualize Linux on Windows rather than the other way around.

In my day to day I have many different tasks, although I have a WSL2 terminal always open on one of my virtual desktops, I spend half of the day in meetings with different providers (webex on Linux is a nightmare). I use different VPNs and virtual client desktops, I edit videos for Pandora FMS YouTube channel, etc. And I do many of these things with tools that do not work quite well in Linux, so WSL2 has given me the almost perfect solution for my daily tasks.

(If you think you would be interested in reading an article about my workflow and all the tools I use, leave a message in the comment box).

Deploy WSL2

If you are here, it is because you relate to one of the cases here exposed. Installing WSL2 is very simple, but let’s go step by step.

Remember that you must have Windows 10 version 2004 or higher to be able to use WSL2.

Checking it is as simple as pressing the start key, typing winver and pressing enter.

wsl2

It will show you a screen like this, where you will see Windows 10 version.

wsl2

If you comply with the correct Windows version, let’s get to work. If not, it is time to go update Windows.

Step 1: Enable WSL on your system.

The easiest way is to open a PowerShell terminal as administrator and run:

dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart

Don’t close the terminal or restart yet.

Step 2: Enable virtualization.

Execute the following command in the PowerShell terminal open as Admin.

dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart

Now restart the machine.


Step 3: Activate WSL version 2 as default.

Open a PowerShell terminal again as administrator and execute:

wsl --set-default-version 2

You will see a message similar to: “WSL 2 requires an update to its kernel component. For information, please visit https://aka.ms/wsl2kernel”. Go to the URL and download the package following the wizard steps.

wsl2

Step 4: Download the distro, preferably from Windows store. Type in wsl in the search engine so that the options come out (personally I use Arch, but it is not in the store so it is a bit more complicated to install). I recommend installing Ubuntu, the first to be released and in my opinion the one with the most covering support.

wsl2

Once downloaded, open it and the distro installation will start. It will ask for the username and password. For the Linux system you can set the one you prefer, it has nothing to do with the Windows user.

wsl2

Once the installation is finished, you will see a screen similar to the following and the prompt ready to use Ubuntu bash.

wsl2

Step 5: Check the installation from a PowerShell terminal, executing:

wsl --list --verbose

Where it will list the distros installed and their versions. I already said that it used arch and yes I also have Windows running in WSL2 for Docker. In your case, it will show just the one that you have installed, in this case Ubuntu, and it would have to be version 2.

wsl2

Conclusions

With these simple steps you will have Ubuntu installed within Windows with its kernel at 100% and you can run all the tools you need, such as Docker natively directly in the Linux kernel (something that before with HyperV was not working for me and that WSL1 did not support).

Implementation is not perfect, it has many advantages but it also has some problems to figure out. Even so, I think it is the best current implementation to have a hybrid system where to enjoy the best of both worlds, so I recommend it 100%.

If you are interested in the subject, we can write an article listing the advantages, disadvantages and alternative solutions to certain problems that this technology currently poses. Let me know if you are interested in the comments.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

ESET Research investigates Donot Team: Cyberespionage targeting military & governments in South Asia

  • ESET has analyzed two variants of the yty malware framework: Gedit and DarkMusical. ESET researchers have decided to call one of the variants DarkMusical because many of the names the attackers chose for their files and folders are inspired by the movie High School Musical. 
  • These attacks are focused on government and military organizations, Ministries of Foreign Affairs, and embassies and are motivated by cyberespionage.
  • Targets are primarily located in South Asia – Bangladesh, Sri Lanka, Pakistan and Nepal. However, targeting embassies of these countries in other regions, such as the Middle East, Europe, North America, and Latin America, has been observed.
  • ESET’s investigation spans more than a year from September 2020 to October 2021.
  • A recent report by Amnesty International links the group’s malware to an Indian cybersecurity company that may be selling the spyware.
  • The group has consistently targeted the same organizations for at least the last two years and it’s possible that the attackers have compromised the email accounts of some of their victims.

BRATISLAVA, MONTREAL — January 18, 2022 — ESET researchers have uncovered recent campaigns and an updated threat arsenal of the infamous APT group Donot Team (also known as APT-C-35 and SectorE02). According to research findings, the group is very persistent and has consistently targeted the same organizations for at least the last two years. For this research, ESET monitored Donot Team for more than a year from September 2020 to October 2021. According to ESET telemetry, the APT group focuses on a small number of targets primarily in South Asia — Bangladesh, Sri Lanka, Pakistan and Nepal. However, targeting embassies of these countries in other regions, such as the Middle East, Europe, North America, and Latin America, is not outside the group’s realm. These attacks are focused on government and military organizations, Ministries of Foreign Affairs, and embassies and are motivated by cyberespionage.

Donot Team is a threat actor operating since at least 2016 that is known for targeting organizations and individuals in South Asia with Windows and Android malware. A recent report by Amnesty International links the group’s malware to an Indian cybersecurity company that may be selling the spyware or offering a hackers-for-hire service to governments of the region.

“We have been closely following the activities of Donot Team, and have traced several campaigns that leverage Windows malware derived from the group’s signature yty malware framework,” says ESET researcher Facundo Muñoz, who led the investigation into the group’s activities.

The main purpose of the “yty” malware framework is to collect and exfiltrate data. The malicious framework consists of a chain of downloaders that ultimately download a backdoor with minimal functionality, used to download and execute further components of Donot Team’s toolset. These include file collectors based on file extension and year of creation, screen capturers, keyloggers, reverse shells, and more.

Countries targeted in recent Donot Team campaigns

According to ESET telemetry, Donot Team has been consistently targeting the same entities with waves of spearphishing emails every two to four months. The spearphishing emails have malicious Microsoft Office documents attached that the attackers use to deploy their malware.

Interestingly, the emails that ESET researchers were able to retrieve and analyze did not show signs of spoofing. “Some emails were sent from the same organizations that were being attacked. It’s possible that the attackers may have compromised the email accounts of some of their victims in earlier campaigns, or the email server used by those organizations,” says Muñoz.

In the latest blogpost, ESET has analyzed two variants of the yty malware framework: Gedit and DarkMusical. ESET researchers have decided to call one of the variants DarkMusical because of the names the attackers chose for their files and folders: many are western celebrities or characters in the movie High School Musical. This variant was used in campaigns targeting military organizations in Bangladesh and Nepal.

For more technical details about the Donot Team’s latest campaigns, read the blogpost “DoNot Go! Do not respawn!” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET awarded for its Advanced Threat Protection solutions

ESET, a global leader in cybersecurity, has been awarded top marks for its business and consumer offerings in two separate AV-Comparatives tests. The ESET PROTECT Cloud solution ranked at the top among competitors in the AV-Comparatives Advanced Threat Protection Test – Enterprise. And ESET Internet Security for consumers was a high achiever in the AV-Comparatives Advanced Threat Protection Test – Consumer.

AV-Comparatives, a leading independent testing organization, well-known for offering innovative real-world environment testing, has subjected ESET’s enterprise solution to hacking and penetration techniques that allow attackers to access internal computer systems and which mimic threats used in the real world. ESET PROTECT Cloud came out of this rigorous testing with AV-Comparatives’ certification for Advanced Threat Protection, which is awarded to products that pass, and in ESET’s case the product not only passed but also achieved the top results among its peers, being the only solution that detected 14 out of the 15 attack scenarios.

ESET’s consumer solution was also put through rigorous testing in a separate AV-Comparatives test, which aimed to uncover how well the solution can protect the end user rather than simply detect threats. ESET Internet Security achieved solid marks for its protection and was awarded the Advanced Threat Protection certification Advanced+ level.

Juraj Malcho, ESET’s Chief Technology Officer commented on the achievement, “No cyber security solution is perfect but at ESET we always strive to be the best, and we are very happy to see that a highly respected independent testing organization like AV-Comparatives confirms that we are delivering on our promise.”

To learn more about ESET’s Advanced Threat Protection solutions for businesses click here, and ESET’s Advanced Threat Protection solutions for consumers click here. 

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

High Availability: technology that guarantees productivity and credibility

Computer equipment is subject to failures that can bring great inconvenience and damage to companies. In this sense, high availability systems are essential for carrying out activities that rely on energy, location, operation, software, and hardware.

This technology ensures services are available 24/7 without interruptions or loss of information. For this reason, it is extremely important for large organizations, such as public agencies, critical infrastructure, and banks.

In this article, we dive deeper into the subject. Our text is divided into topics to make it easier for you to understand. These are:

  • What is High Availability?
  • What is a High Availability Cluster?
  • How Important is High Availability to Organizations?
  • Advantages of Infrastructure with High Availability Versus Infrastructure Without High Availability
  • High Availability, Redundancy, and Fault Tolerance: What is the Difference?
  • High Availability Products
  • Important Points for the Implementation and Maintenance of High Availability Systems

Enjoy it!

  • What is High Availability?

A high availability (HA) system consists of a technology that must be applied to the computer equipment of large companies and data centers in order to avoid the interruption of activities resulting from failures.

This is possible through an infrastructure designed for maximum uptime, known as 99.999 percent or the “five 9s”.

It works through the allocation of hardware and software, among other solutions, in a redundant way. In practice, this means they will work automatically if any of these items fail.

  • What is a High Availability Cluster?

The word cluster (or clustering) is the same as “agglomeration”, as explained in this article. It is a term used in the most diverse contexts.

In the case of computing, it refers to a technology applied to two or more computers. We call these equipment nodes, and the number of nodes that can compose a cluster is unlimited.

A high availability cluster can be of two types: to be used in hardware and applications. In hardware high availability, we have a connection that makes it possible to change a component if there is an outage.     

In application high availability, the purpose is to ensure that applications work. As such, the cluster avoids long downtime when a system goes down. This model is useful with:

  • Monitoring tools;
  • Replication of systems and computers to replace equipment that may present problems; and
  • Power generators.

In application high availability, a database is synchronized with the instances that make up the cluster, which divides operations among them, assuring that the system will continue to function normally even if an instance is stopped.

  • How Important is High Availability to Organizations?

Regardless of the company’s industry, most of its departments need Internet access to function. A few examples are:

  • Employees responsible for the sales sector use emails and social media to communicate with clients; 
  • Those who lead the teams also use online means to communicate with their subordinates;
  • The purchasing sector needs to be in constant contact with suppliers; and
  • People who take care of marketing also access several platforms to carry out their activities.

We can conclude that high availability systems are of utmost importance to prevent loss of productivity related to time lost with IT disaster recovery.

Likewise, they preserve the credibility of the company, which is also critical, as damage to a brand’s reputation can be a major barrier to its growth. Key benefits of high availability include:

  • Reduction of scheduled downtime;
  • Guarantee of service continuity;
  • High-level performance;
  • Secure data.

  • Advantages of Infrastructure with High Availability Versus Infrastructure Without High Availability

High availability hosting providers perform the same hosting services as traditional infrastructure. However, this is done in a way that eliminates the possibility of downtime by almost 100%. 

What must be taken into account is the cost of this downtime, which is often much higher than most people realize.

A company with affected infrastructure could have impacts on productivity, reduced to almost zero while that infrastructure is down, or still have an interruption that leads to bankruptcy.

That is because the loss of productivity is a secondary concern to the loss of reputation caused by downtime hassles. 

After all, clients prefer to hire the services of accessible and prepared organizations to serve them whenever they need it. In other words, investing in high availability hosting is of paramount importance to keep your company and brand available to your audience.

  • High Availability, Redundancy, and Fault Tolerance: What is the Difference?

A system that features redundancy is not necessarily a high availability solution. For this, it needs to have means to detect failures, the possibility to perform high availability tests, and correct failures related to unavailable components.

Redundancy is hardware-based, while high availability strategies use software most of the time.

When it comes to the difference between high availability and fault tolerance, you should know that the latter requires complete redundancy in hardware. It is also essential to have hardware that identifies failures to ensure the entire system works together.

The advantage of this technology is the ability to retain memory and data for your programs. On the other hand, the adaptation to complex systems can take a little longer. Another problem is that the entire network can crash due to similar software failures presented by redundant systems.

Fault-tolerant systems are effective in preventing equipment problems, but in addition to being expensive, they do not prevent software failures, unlike high availability solutions.

  • High Availability Products

If you have understood the importance of investing in high availability, we cover features that are critical to achieving the performance your business needs in this topic. Among the aspects that should be considered, we highlight:

  • Hardware resilience;
  • Environmental conditions;
  • Data quality; and
  • Durable software.

To have an efficient, high-availability system that addresses these points, it is essential to have resources such as servers, network interfaces, and hard drives that are resistant to problems such as power outages and hardware failures.

Also, you should strategically install multiple web application firewalls on your networks, which enable you to eliminate failures. Another extremely important resources are software stacks capable of resisting failures that may eventually occur.

  • Important Points for the Implementation and Maintenance of High Availability Systems

High availability systems are adaptable to the needs of the organization hiring this service. Nevertheless, certain practices are widely indicated. Some of them are:

  • Redundancy of systems and data through different machines;
  • Deployment of applications on more than one server, in order to avoid machine overloads;
  • Use of components to ensure maximum stability and availability;
  • Spare resources for any failures;
  • Tests capable of guaranteeing availability, performance, and security;
  • Effective data backup and recovery strategies;
  • Conducting tests that help prevent failures related to confidential information; and
  • Use of 100% redundant router, load balancer, firewall, reverse proxy, and monitoring systems.

 

In this article, we discussed what high availability is and its importance to organizations, as well as the difference between redundancy and fault tolerance. We also pointed out aspects that are essential for the implementation of this technology.

If our text was helpful to you, please share it with others who might benefit from this knowledge. On our blog, you can find more content on high availability and information security, check it out. 

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.