Skip to content

ESET Research: CosmicBeetle group joins forces with other ransomware gangs, targets businesses in Europe and Asia

  • ESET Research investigated ScRansom, a novel ransomware developed by the CosmicBeetle threat group.
  • CosmicBeetle has been experimenting with the leaked LockBit builder and trying to mimic LockBit’s brand.  
  • Furthermore, CosmicBeetle is likely a recent affiliate of the ransomware-as-a-service actor RansomHub, active since March 2024.
  • ScRansom is continually improving; however, it is impossible to restore some files.
  • CosmicBeetle exploits years-old vulnerabilities to breach SMBs with a focus on Europe and Asia.

BRATISLAVA, PRAGUESeptember 10, 2024 — ESET researchers have mapped the recent activities of the CosmicBeetle threat group, documenting its new ScRansom ransomware being deployed and discovering connections to other well-established ransomware gangs. CosmicBeetle has been spreading ransomware to small and medium businesses (SMBs), mainly in Europe and Asia. ESET Research has observed the threat actor using the leaked LockBit builder and trying to leverage LockBit’s ransomware reputation. Besides LockBit, ESET believes that CosmicBeetle is probably a new affiliate of ransomware-as-a-service actor RansomHub, a new ransomware gang active since March 2024 with rapidly increasing activity.

“Probably due to the obstacles that writing custom ransomware from scratch brings, CosmicBeetle attempted to leech off LockBit’s reputation, possibly to mask the issues in the underlying ransomware and in turn to increase the chance that victims would pay,” says ESET researcher Jakub Souček, who analyzed the latest activity of CosmicBeetle. “Additionally, recently, we observed the deployment of ScRansom and RansomHub payloads on the same machine only a week apart. This execution of RansomHub was very unusual compared to the typical cases we have seen in ESET telemetry, but quite similar to CosmicBeetle’s modus operandi. Since there are no public leaks of RansomHub, this leads us to believe with medium confidence that CosmicBeetle may be a recent affiliate of theirs,” adds Souček.

CosmicBeetle often uses brute-force methods to breach its targets. Besides that, it misuses various known vulnerabilities. Small and medium-sized businesses from all sorts of verticals all over the world are the most common victims of this threat actor because that is the segment most likely to use the affected software, or lack robust patch management processes in place. ESET Research has observed attacks on SMBs in the following verticals: manufacturing, pharmaceuticals, legal, education, healthcare, technology, hospitality leisure, financial services, and regional government.

Besides encrypting, ScRansom can also kill various processes and services on the affected machine. ScRansom is not a very sophisticated piece of ransomware, though CosmicBeetle has been able to compromise interesting targets and cause great harm to them. This is mostly because CosmicBeetle is an immature actor in the ransomware world, and problems plague the deployment of ScRansom. Victims affected by ScRansom, who decide to pay, should be cautious.

ESET Research was able to obtain a decryptor implemented by CosmicBeetle for its recent encryption scheme. ScRansom is undergoing constant development, which is never a good sign for ransomware. The overcomplexity of the encryption (and decryption) process is prone to errors, making restoration of all files doubtful. Successful decryption relies on the decryptor working properly and on CosmicBeetle providing all the necessary keys, and even in that case, some files may be destroyed permanently by the threat actor. Even in the best-case scenario, decryption is long and complicated.

CosmicBeetle, active since at least 2020, is the name ESET researchers assigned to a threat actor discovered in 2023. This threat actor is most known for the usage of its custom collection of Delphi tools, commonly called Spacecolon, consisting of ScHackTool, ScInstaller, ScService, and ScPatcher.

For more technical information about the latest activity of CosmicBeetle, check out the blogpost “CosmicBeetle steps up: Probation period at RansomHub” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

Heatmap of CosmicBeetle attacks since August 2023, according to ESET telemetry

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

The Importance of Upgrading

The Importance of Upgrading 

When thinking about keeping your network safe, upgrading networking hardware is often overlooked. It’s hard enough to get everything to play nicely together, and once it does, the last thing you want to do is disrupt that delicate balance. Plus, there’s a lot of planning, a lot of meetings, and probably a lot of money to spend. No wonder just the thought of upgrading infrastructure makes most admins want to run and hide.

Not upgrading, though, can put you at risk in a variety of ways.

EOL?  EOE?  EOS? SOL!

Nothing gold can stay, and that is as true for networking hardware as much as anything else.  As vendors develop new and exciting feature sets, old hardware gets strained more and more until, finally, it just can’t keep up.  You might not necessarily be interested in those new features – as long as the packets are flowing, who needs the latest and greatest?  And that makes sense – there’s a lot to be said for not being an early adopter.  As cool as cutting-edge innovation often sounds, it sometimes fails to deliver on its promises  (Look at the ill-fated Lily Drone, the Juicero Juicer, and the Cisco Umi – all products that showed great promise, but fell far short of expectations.)

We all understand how important it is to at least keep up with security updates, but products don’t get updates forever.  Watch out for these 3 phases of the product life cycle signify it’s time to get ready for replacements:

EOE: End of Engineering

No new features or fixes will be developed during this phase, although critical security fixes might still be released, and you can still get support….although the answer to most of your support questions will probably be “Upgrade.”

EOS: End of Support

There is no support and probably no security fixes (although if a critical vulnerability is uncovered, you might get a patch). For all intents and purposes, the product is dead. You might be able to get support assistance to upgrade, or they might help you if you run into an already-known bug.

EOL: End of Life

Stick a fork in it; it’s done – no support, no patches, no nothing.  For all intents and purposes, this product no longer exists.

Still Lurking Out There

Why does it matter if something still has vendor support?  Well, just because the vendor has seemingly forgotten about these devices does not mean hackers have.  Here’s an example:  In 2021, six years after Western Digital ended support for their My Drive line of external hard drives, a remote code execution bug resulted in many users losing all of their data.  The worst part is the vulnerability was reported to Western Digitial in 2018, a full three years before the bug was exploited, but since support for the drives had already ended Western Digital chose not to fix it.  

Sometimes those new features become default standards.  Devices in the late 90’s that shipped with 802.1a or 802.1b wireless networks were quickly rendered obsolete when a critical design flaw was found in  WEP.  Anyone not wanting a laughably easy to hack wireless password had to get completely new hardware.  Now all networking hardware ships with some form of WPA enabled.  

If you’re still not covinced, consider this: you could run afoul of the law if you use out-of-date hardware.  Many regulatory standards like GDPR, HIPAA, PCI DSS and more require organizations to take reasonable steps to protect sensitive information.  If you are the victim of a data breach, you will have a hard time justifying the use of old hardware.  It could also impact your certifications – if you maintain SOC 2 or ISO 27001, EOL hardware might put you out of compliance.   

Upgrading networking may not be the most exciting prospect, but as technology evolves and grows, it’s crucial to ensure you’re not falling behind. Proactive upgrades not only enhance your ability to stay secure, but they also keep you safe from regulatory and legal penalties in the case of a data breach.  Investing in the future by keeping your network infrastructure current will ensure you can support your organization’s goals for security, growth, and innovation going forward.  

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

The Role of Data Backup in ESG and Sustainability

Data has become more essential than ever in businesses, especially as companies shift toward eco-friendly models. However, this greater dependence on data also brings various risks, such as data loss and theft. To meet environmental, social, and governance (ESG) goals and sustainability targets, it’s crucial to have strong data backup strategies in place. Thus, organizations should not overlook the need of data backup even as they give increasing focus on these investment ideas.

Effective data backup solutions stop data loss and promote the ESG performance and sustainability of a company in the data-driven environment of today. This article discusses the role of data backup on ESG and sustainability to assist you in harnessing its benefits in achieving your ESG goals.

What is the Role of Data Backup in ESG (Environmental, Social, Corporate Governance)?

ESG (Environmental, Social, and Corporate Governance) is a framework for evaluating a company’s sustainability and ethical impact. It is a model that allows firms to recognize and evaluate the non-financial hazards and opportunities resulting from daily corporate activities. However, attaining ESG and sustainability depends critically on data backup. In the following sections, we will explore its role in each vital area.

Protecting the Environment through Efficient Data Storage

Data centers and IT systems consume much energy, contributing to an organization’s carbon footprint. However, you can reduce this environmental impact using backup solutions that help to optimize energy use in several ways:

  • Energy Efficiency

Efficient backup strategies can minimize the data used, leading to a smaller environmental footprint. Moreover, modern data backup solutions centers employ energy-efficient data tools, such as cloud storage, that use renewable energy. Thus, using these advanced tools also helps to reduce your overall carbon footprint instead of using inefficient methods. Offline storage media, such as magnetic tape and external hard drives, reduce energy use by storing data inactively.

  • Efficient Resource Management

Regular data backup can help an organization optimize its data storage practices, allowing it to use resources more efficiently. This includes avoiding redundancy by only storing necessary data and discarding outdated storage practices that consume excessive energy and materials.

  • Reduction in Physical Storage Need

Traditional storage methods, such as paper records, take up physical space and materials, leading to deforestation, increased waste, and inefficiency. However, with modern data backup solutions, organizations can reduce the need for physical storage, reduce waste, and conserve natural resources.

  • Disaster Recovery

Backing up your data will ensure quick recovery without needing extensive physical resources in the event of a natural disaster or other environmental impact that could lead to data loss. When such events happen, an organization can minimize downtime and the environmental costs of starting from scratch due to data loss.

Enhancing Social Responsibility through Data Backup

Data backup plays a major role in fulfilling an organization’s social responsibility:

  • Protection of Sensitive Information

Sensitive information must be protected and safeguarded. Thus, when organizations collect and store sensitive information, including customers’ and employees’ data, they must ensure privacy and security. Using efficient data backups that employ high-standard security solutions ensures maximum protection for such sensitive information, fostering customer trust.

  • Regulatory Compliance

When your organization performs regular data backups, it complies with legal and regulatory requirements. Thus, data backup solutions help organizations adhere to data regulations and standards, enabling them to perform their social responsibilities and ensure data integrity.

  • Stakeholder Trust

Generally speaking, stakeholders such as partners, customers, workers, and investors want to collaborate with and support an organization prioritizing data security. Therefore, you gain the trust of stakeholders when you use backups to guarantee the availability and integrity of data. Also, a robust backup solution will ensure immediate business continuity after a data disaster, fostering and maintaining trust with stakeholders, especially customers.

  • Positive Social Impact

Companies can make positive social impacts when they back up data to protect their digital assets. Many modern businesses operate with these digital assets, including information. Thus, data backup indirectly supports employment and economic stability, which leads to a positive social impact.

Strengthening Corporate Governance through Data Backup

Data backup also plays a crucial role in strengthening an organization’s corporate governance. By implementing robust data backup strategies, organizations can:

  • Regulatory Compliance

Many industries are subject to strict data protection that mandates regular backups. Compliance with these regulations shows good governance practices, helping to avoid legal penalties.

  • Risk Management

By safeguarding an organization’s data from possible loss brought on by hardware failures, human mistakes, cyberattacks, or natural disasters, data backup solutions assist to control data risk. This is absolutely important since these events can seriously damage the company’s reputation and cause operational slowdown in the lack of a trustworthy backup plan. However, with a robust backup system, you can ensure quick data recovery, preventing loss of customer trust.

  • Accountability and Transparency

Consistent data backup practices enhance transparency and accountability. They ensure that accurate records are available for audits, reporting, and stakeholder communications, which is vital for maintaining trust.

  • Ethical Data Management

Data backup supports the ethical handling of data, which aligns with the governance principle of integrity and ethical conduct. As a result, an organization can showcase its commitment to protecting stakeholders’ information and ensuring proper data security.

  • Decision-Making

An organization can access accurate and complete data with a reliable backup system when needed. Thus, you can make strategic decisions backed by correct information.

How Does Data Backup Foster Sustainability?

Data plays a crucial role in any organization, so data backup enables its sustainability by ensuring continuity, security, and efficiency. The following are some significant ways that data backup supports organizational sustainability:

  • Quick Disaster Recovery

Backing up the data of a firm helps to stop human error, cyberattacks, or data loss during natural disasters. Having a good backup plan and disaster recovery strategy guarantees swift recovery in case of data loss, so reducing downtime and ensuring business operations carry on fast.

  • Data Security

Preserving data in its original form is crucial, and regular data ensures that you can always restore data to the state it was before a cyber attack or disaster. Thus, an organization can always preserve data integrity and prevent unauthorized alterations.

  • Cost Efficiency

Data loss can incur a significant loss for an organization, including lost revenue, legal fees, and damage to reputation. However, backup solutions prevent such loss by enabling quick recovery and optimizing data use and management, leading to long-term cost savings.

  • Reputation Management

Improper data management can ruin an organization’s reputation during situations like a data breach or significant downtime after a data disaster. However, with robust data solutions, you can manage your reputation by fostering trust among customers and stakeholders. Quick data recovery also shows that an organization is reliable and trustworthy, ensuring sustainability.

  • Operational Efficiency

Regular backups guarantee that data is constantly accessible for the operational requirements of an organization—that is, for analytics, reporting, and decision-making. It also lessens the effects of data loss on a company’s operations so that staff members may continue to be productive long after a data disaster.

Conclusion

Data backup plays a crucial role in ESG. Therefore, it has to be given great attention to guarantee responsible social and environmental effect, the improvement of corporate governance, and a sustainable company environment. Giving data backup top priority in your environmental, social, and governance (ESG) and sustainability plans can assist in safeguarding data assets and support the development of a more ecologically friendly digital future.

Storware places great importance on sustainability. That’s why we’re happy that the technology solutions we create support these values. Learn more from our other articles:

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Storware
Storware is a backup software producer with over 10 years of experience in the backup world. Storware Backup and Recovery is an enterprise-grade, agent-less solution that caters to various data environments. It supports virtual machines, containers, storage providers, Microsoft 365, and applications running on-premises or in the cloud. Thanks to its small footprint, seamless integration into your existing IT infrastructure, storage, or enterprise backup providers is effortless.

Why MSPs Are Essential in Safeguarding SMBs from Google Sheets Exploitation in Cyber Attacks

Main Takeaways: 

  1. Growing Threats: Cyber attackers are now using everyday tools like Google Sheets to orchestrate and manage malware campaigns, making it harder for small and medium businesses (SMBs) to detect and defend against these attacks.
  2. MSPs as Frontline Defenders: Managed Service Providers (MSPs) play a crucial role in protecting SMBs by implementing advanced security measures, continuously monitoring for threats, and educating businesses on potential vulnerabilities in commonly used platforms like Google Sheets.
  3. Proactive Measures: MSPs can help SMBs implement practical steps, such as using advanced threat detection tools, regular software updates, and employee training, to minimize the risk of falling victim to these sophisticated cyber threats.

Blog Content:

As the digital landscape evolves, so too do the tactics of cyber attackers. Recent reports reveal that attackers are now exploiting Google Sheets, a widely-used cloud-based spreadsheet tool, to control malware campaigns. This alarming development highlights the critical role Managed Service Providers (MSPs) must play in safeguarding small and medium businesses (SMBs) that rely on these tools but may not be aware of their potential vulnerabilities.

How Cybercriminals Exploit Google Sheets:

  1. Remote Command and Control (C2): Cyber attackers are using Google Sheets as a command-and-control (C2) infrastructure. By embedding malicious scripts or commands within Google Sheets, attackers can remotely control infected machines. This allows them to execute commands, exfiltrate data, and even update the malware without being detected by traditional security tools.
  2. Evasion of Detection: Google Sheets, being a legitimate and widely-used tool, is often trusted by security systems. Attackers take advantage of this trust, using Google Sheets as a communication channel that flies under the radar of many security products. This makes it difficult for traditional firewalls and anti-malware software to detect and block these malicious activities.
  3. Phishing and Social Engineering: Attackers often combine this technique with phishing campaigns. They send emails or messages that lure victims into clicking on links that lead to Google Sheets, where malicious content is hosted. Once the victim interacts with the sheet, the malware is triggered, and the attackers gain control.

Impact on Businesses:

  1. Data Breaches: Businesses that fall victim to these attacks may suffer severe data breaches. Confidential information, including customer data, financial records, and intellectual property, can be stolen and sold on the dark web or used to blackmail the business.
  2. Operational Disruption: Once an attacker gains control of a company’s systems, they can disrupt operations by locking out legitimate users, corrupting files, or even deploying ransomware. This can lead to significant downtime, affecting productivity and potentially causing financial losses.
  3. Reputational Damage: When a business is hit by a cyber attack, especially one that leads to a data breach, it risks losing the trust of its customers and partners. The negative publicity and loss of confidence can have long-term repercussions, including loss of revenue and difficulty in acquiring new customers.
  4. Financial Costs: Beyond the immediate costs associated with downtime and lost business, companies may face fines for failing to protect sensitive data, especially if they are in regulated industries. They may also need to invest in new security measures and undergo audits to regain compliance, further adding to the financial burden.

Why MSPs Are Vital for SMB Security

Managed Service Providers serve as the first line of defense for SMBs against these sophisticated attacks. With their deep understanding of cybersecurity and access to advanced tools, MSPs can:

  • Detect and Respond to Threats: MSPs can deploy advanced threat detection systems that monitor activity within platforms like Google Sheets, identifying and neutralizing suspicious behaviors before they can cause harm.
  • Educate and Train Employees: Cybersecurity is not just about technology; it’s also about people. MSPs can provide essential training for SMB employees, helping them recognize phishing attempts, suspicious activity, and best practices for using cloud-based tools safely.
  • Regularly Update and Patch Systems: MSPs ensure that all systems and software used by SMBs are up-to-date with the latest security patches, significantly reducing the likelihood of exploitation by cyber attackers.

Practical Steps for Businesses:

To protect against these types of attacks, businesses, especially SMBs, should consider the following steps:

  1. Enhance Security Awareness: Regularly train employees on the dangers of phishing and how to recognize suspicious links, even those that appear to come from trusted sources like Google Sheets.
  2. Implement Advanced Threat Detection: Use security solutions that can detect and respond to unusual activity within cloud-based applications like Google Sheets.
  3. Restrict Access: Limit access to sensitive documents and ensure that only authorized personnel can edit or share these documents.
  4. Enable Two-Factor Authentication (2FA): Implementing 2FA adds an extra layer of security, making it harder for attackers to gain unauthorized access to accounts.
  5. Regular Security Audits: Conduct regular security audits to identify vulnerabilities in your systems and address them before attackers can exploit them.
  6. Engage with an MSP: Consider partnering with a Managed Service Provider (MSP) to ensure that your business is protected with the latest security practices and tools, and that there is continuous monitoring for potential threats.

In an era where cyber threats are increasingly sophisticated and pervasive, the role of MSPs in protecting SMBs has never been more crucial. By staying informed and proactive, MSPs can ensure that their clients remain secure, even as attackers evolve their methods to exploit the very tools that businesses depend on.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Guardz
Guardz is on a mission to create a safer digital world by empowering Managed Service Providers (MSPs). Their goal is to proactively secure and insure Small and Medium Enterprises (SMEs) against ever-evolving threats while simultaneously creating new revenue streams, all on one unified platform.

New GPU-Enabled Hardware Release Delivers Accelerated Performance From Scale Computing

Introducing the HC3450FG for Data-Intensive Applications and AI Workloads

INDIANAPOLIS — September 4, 2024 — Scale Computing, a market leader in edge computing, virtualization, and hyperconverged solutions, today announced the release of the HC3450FG, the first new appliance in its HC3000 series of Scale Computing Hardware. Designed to deliver exceptional performance, flexibility, and ease of management, the HC3450FG is a cutting-edge hyperconverged infrastructure solution with integrated NVIDIA L4 24GB advanced GPU capabilities.

In today’s rapidly evolving IT landscape, businesses face increasing demands for performance, efficiency, and scalability. Traditional IT infrastructure often struggles to keep pace with these requirements, leading to bottlenecks and costly downtime. Organizations need solutions that can handle processing massive datasets, running simulations, real-time rendering, or managing advanced computational tasks beyond what can be accomplished with CPU resources while still maintaining ease of management and affordability. To meet these demands, Scale Computing remains dedicated to delivering innovative, right-sized solutions that simplify management, optimize performance, and provide exceptional value. The company’s latest offering, the HC3450FG, delivers on this promise.

“The HC3450FG marks a significant milestone in Scale Computing’s HC3000 hardware series,” stated Jeff Ready, CEO and co-founder of Scale Computing. “Unlike traditional servers that can struggle with high-intensity workloads, our newest appliance offers customers a seamless and high-performance experience for demanding applications. The GPU-enabled architecture provides the computational muscle to handle large datasets and complex algorithms with ease, making the HC3450FG the ideal solution for anyone tackling data-intensive workloads and AI inferencing applications. It’s also incredibly flexible in terms of configuration, making it scalable and cost effective. The appliance is a true testament to our commitment to delivering cutting-edge technology for the evolving needs of our customers.”

Designed to meet the escalating demands of modern enterprise environments, the HC3450FG leverages the power of NVIDIA L4 24GB advanced GPU capabilities to seamlessly blend power with efficiency. Recognizing the diverse needs of its customers, Scale Computing engineered the HC3450FG to be highly customizable. With the flexibility to configure individual GPU units and storage options, organizations can tailor the appliance to align with their specific workload requirements. This building block approach enables businesses to optimize their investment while also ensuring infrastructure can effortlessly scale to accommodate future growth.

Key Benefits of the HC3450FG:

  • Unmatched Performance: Leverage the power of market-leading NVIDIA L4 GPUs to accelerate demanding workloads and achieve exceptional results.
  • Optimized for AI: Handle complex AI models and algorithms efficiently with Scale Computing’s GPU-accelerated platform built for data-intensive workloads.
  • Flexibility and Scalability: Customize the HC3450FG to meet specific needs and avoid overprovisioning.
  • Simplified Management: Benefit from Scale Computing’s user-friendly SC//Platform for easy deployment and management.

The HC3450FG represents a strategic investment for organizations seeking to elevate their IT capabilities. By seamlessly integrating advanced GPU technology with Scale Computing’s proven hyperconverged infrastructure, businesses can unlock unprecedented performance, efficiency, and innovation. To explore how the HC3450FG can transform your IT operations, please contact Scale Computing.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Scale Computing
Scale Computing is a leader in edge computing, virtualization, and hyperconverged solutions. Scale Computing HC3 software eliminates the need for traditional virtualization software, disaster recovery software, servers, and shared storage, replacing these with a fully integrated, highly available system for running applications. Using patented HyperCore™ technology, the HC3 self-healing platform automatically identifies, mitigates, and corrects infrastructure problems in real-time, enabling applications to achieve maximum uptime. When ease-of-use, high availability, and TCO matter, Scale Computing HC3 is the ideal infrastructure platform. Read what our customers have to say on Gartner Peer Insights, Spiceworks, TechValidate and TrustRadius.

Proven fingerprinting techniques for effective CAASM

One of the key components of runZero’s ability to provide asset discovery, exposure management, and attack surface management data is its ability to identify an asset’s operating system (OS), hardware, and services aka fingerprinting. This is often performed with very little or even conflicting data.

In this blog, we explore commonly used fingerprinting techniques and gain insights from the runZero Research Team on their approach to deciphering a real-world fingerprinting challenge. Let’s go!

Fingerprinting concepts

For the purposes of this blog, “fingerprinting” is defined as the process of trying to identify, with as much precision as possible, some aspect of an asset. There can be significant variation in the precision that can be achieved when fingerprinting. With certain data we may be able to identify the operating system and exact build number. With different data, it may only be possible to vaguely bucket the asset into an OS family such as “Windows” or “Linux.” For services we can sometimes even determine the programming language it was written in and perhaps a range of language versions that may have been used. All outcomes can be possible against the same asset depending on which protocols and services we can observe.

Fingerprinting techniques generally fall into one of three categories:

An example of self identification based fingerprinting would be an SSH MOTD banner of “Red Hat Enterprise Linux Server release 5.11 (Tikanga)”. That is pretty straightforward and doesn’t require any additional data. Attribute based fingerprinting, which we will discuss further in the next sections, includes looking at various response and data attributes such as TCP field values such as MSS or Window Scale. Behavior based techniques typically take more work to find and implement. An example would be when a particular OS or service implementation drops a TCP connection only when sent a certain payload at a particular stage in protocol negotiation.

A hat by any other name #

Identifying the OS of a network-connected system, without credentials, and with minimal services, has always been a game of precision. Some of the trickiest examples are the forks of the Red Hat Enterprise Linux (RHEL) distribution.

CentOS and certain other Linux distributions such as Oracle Linux were originally forks or “bug and binary compatible” redistributions of Red Hat Enterprise Linux. The relationship changed in 2021 when Red Hat, which acquired CentOS in 2014, discontinued CentOS Linux and created CentOS Stream. With this change CentOS would no longer be downstream of RHEL but would instead be the upstream source from which RHEL is created. The logical flow has since changed again and now has Fedora as the root with both CentOS Stream and RHEL downstream. In response to CentOS Linux being discontinued two new distributions were created: AlmaLinux OS and Rocky Linux.

Often, the only real difference between these distributions is the replacement of Red Hat trademarks and branding with that of the particular Linux project. In many cases, these distributions are byte-for-byte identical at the software package and network levels. These present a challenge to remote fingerprinting as a result.

To overcome these challenges, we collect and analyze enormous amounts of data. Our first pass at trying to differentiate the RHEL derivatives used a combination of two attributes, such as SSH version negotiation strings and the TCP Receive Window size. Over time, we realized this wasn’t going to be sufficient and that we needed more and better data.

Analyzing data at scale is useful, but in situations like this it is vital to know exactly what combination of distribution and version leads to what results. For this effort we built hundreds of virtual machines running as many versions of the different distributions as we could. In some cases, these releases were over two decades old!

Verify target, one SYN only #

From each of these virtual machines we collected as much information as we could about how the TCP stack communicated. While it is true that fingerprinting an operating system via TCP stack quirks has been a thing for years, our challenge was to improve our detection while sending the absolute minimum amount of traffic and, importantly, to look for evidence that would persist through common configuration changes by the system administrators.

To explain our findings, we first need to define some terms:

  • TCP Receive Window: Maximum amount of data that a particular endpoint can receive and buffer. The sending host has to stop after sending the maximum amount of data and wait for ACK and window updates.

  • MTU: Maximum Transmission Unit, which is the largest packet that the network interface can accept.

  • MSS: Maximum Segment Size, which is the maximum amount of TCP data that can fit into a single packet, calculated as the MTU minus the protocol headers.

  • TCP Window Scale: An optional factor by which the TCP Receive Window is scaled; this allows receive windows to exceed the maximum of 65535 bytes that can be specified in the TCP Receive Window field.

Of the TCP attributes that we observed, the one that provided the murkiest fingerprinting results was the TCP Window Scale. The values for it, when present, range from 0 to 14. With this information, we can usually determine if the target is running a general family of operating systems.

 

FIGURE 1 – TCP Window Scale by operating system.

Combining the TCP Receive Window and MSS offered the next significant improvement. In our past work, leveraging the Receive Window size sometimes yielded values that seemed to change unexpectedly. The reason why became clear when we looked at the data from the lab.

The key points were:

  • Changes to the link-layer MTU impacts the value of MSS, since MSS is calculated as the MTU minus the size of certain TCP/IP headers.

  • MSS is different between IPv6 and IPv4 due to the IPv6 IP headers being 20 bytes larger.

  • For Linux-based systems, Receive Windows less than the maximum value were almost always an even multiple of MSS. Due to the MSS difference mentioned above this means that the Receive Windows would vary as well.

  • Critically, the MSS multiplier for Linux-based OSs correlated with the Linux kernel version.

With the information above in hand, we can organize Linux systems into specific kernel version buckets based on the observed multiplier. That is quite a bit of information from the response to a single SYN packet!

FIGURE 2 – Relationship between IPv4/IPv6 MSS Multiplier and Linux Kernel version.

The kernel version also offers a hint as to the relative age of the system. A MSS multiplier of 4 indicates that the machine is likely running an ancient version of Linux, far beyond EOL, and certainly not something that should still be in production.

A little from column A, a little from column B #

TCP-based fingerprinting by itself doesn’t improve fingerprinting of RHEL derivatives as much as we’d like. Since most of the systems in our analysis had SSH running, we looked for patterns in RHEL-derivative type and version in the light of SSH version negotiation advertisements (for example, SSH-2.0-OpenSSH_8.7) combined with the Linux kernel version. This strategy quickly yielded results. We found that we could generally identify the distribution’s major version, and in some cases, minor version range as well.

The screenshots below demonstrate how specific patterns pop out under bulk analysis.


FIGURE 3 – Relationship between different Enterprise Linux distribution versions and various network attributes.

As we can see in this screenshot, by combining SSH version advertisement and various measured TCP attributes, it is possible to narrow the Linux distribution involved, sometimes down to individual point releases. Even when it is not possible to precisely determine the version, it is almost always possible to determine if the distribution in question is derived from RHEL.

FIGURE 4 – runZero detecting operating systems derived from Red Hat Enterprise Linux.

While determining which RHEL-based distribution an asset is running from just SSH remains unsolved, the work involved resulted in greatly improving the ability to assert the OS family, major version, and sometimes minor versions of the OS. This provides customers insight into the state of their asset fleet as well as the age, support, and end of life status of these assets. The same techniques also allow us to fingerprint other operating systems, such as OpenBSD, down to the specific release version.

Final thought #

Precise fingerprinting is the foundation for delivering actionable asset discovery, exposure management, and attack surface management data to any type of organization. The runZero Research Team’s process behind precise fingerprinting enables security and IT teams to better understand where and when to take action against potential threats in their environments.

Want to learn more about runZero’s unique research on the state of asset security? Check out the runZero Research Report for a deeper look into the drivers behind CAASM.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Backup Under the Sign of Sustainable Development

Backup and DR solutions are generally not associated with sustainable development. However, in the changing landscape of data protection, “green skills” that combine technological awareness with technical knowledge will become increasingly important.

The price of the solution, functionality, efficiency (measured by RTO and RPO indicators), functionality or relations with suppliers are the most common factors that determine the choice of a backup tool. So far, a small group of customers attach importance to energy efficiency, although creating backups and disaster recovery processes can have an impact on electricity bills. It is not excluded that with rising energy prices, as well as new directives such as the CSRD (Corporate Sustainability Reporting Directive), entrepreneurs will start to pay more attention to this factor.

According to Moor Insights & Strategy, by 2025 data centers will consume over 3% of electricity. On the other hand, storage accounts for 30% of the total energy consumption of data centers. This coefficient is likely to increase. Managing and storing constantly growing data and the associated processes of starting storage systems, migrating resources, creating backups, replicating or ensuring a safe and functional environment require more and more electricity.

IT departments are under constant pressure from management, employees, and consumers who are making increasing demands on system performance, their security, and cost reduction. As if that weren’t enough, in the coming years there will be another challenge. Under the CSRD (Corporate Sustainability Reporting Directive), around 50,000 European companies will be obliged to report on sustainable development. This will also indirectly affect the functioning of IT units. Sustainable development in the case of IT is not only about using less energy, especially when it comes to its use in server rooms, but also about designing a more thoughtful infrastructure and rational data management.

Less data, less energy

A lot of unnecessary data lies on the disks of computers or smartphones – old photos, paid bills, never used recipes or emails from a few years ago. The same is true for corporate resources. On NAS servers, there is a lot of completely useless data that is often replicated. While for consumers, the mess on disks does not have a major impact on the household budget, for business users it can lead to a significant increase in costs. Organizations that want more sustainable data storage must be aware that there are costs associated with this, and the transition to new systems and operations can be difficult. However, with careful planning, some of the obstacles can be avoided or at least mitigated.

Energy-intensive tasks such as storage and backup significantly increase energy consumption, but the value of this data – especially in the case of older or “dark” data – can be negligible. They also have a negative impact on the natural environment. A classic example is video files. It is estimated that they are responsible for 70% of CO2 emissions generated by data centers. It often happens that a large broadcaster stores over a hundred versions of the same episode of a series on its servers, although it would be enough to limit this number to a dozen or so. Meanwhile, long-available deduplication and compression techniques help to clean up the server room of unnecessary data. These methods eliminate redundant or duplicate data, reducing storage requirements and increasing overall system performance. Minimizing the data footprint saves costs, shortens backup and recovery times, and reduces energy consumption. Everything indicates that deduplication and compression technologies will likely play a significant role in sustainable digital information storage practices.

However, in order to see irregularities and then put things in order, you need to have insight into data and storage environments. With greater visibility, organizations can make informed decisions about deleting or archiving unnecessary data, archiving it to the cloud or to tape. Pure Storage introduced a sustainability assessment function to its offer less than two years ago, which controls the level of energy consumption and carbon dioxide emissions by the disk array, and then recommends how to reduce both coefficients.

It is worth noting, however, that according to IDC, about 90% of carriers in data centers are hard drives. Their manufacturers also have their own arguments for energy efficiency and sustainable development. For example, specialists from Western Digital recommend that in the case of HDDs, the entire life cycle of the carrier should be assessed. Although from the point of view of I/O, flash memory is more energy-efficient than mechanical disks, although much more energy is needed to produce SSDs than in the case of HDDs. In addition, interesting solutions are appearing on the market that allow you to limit the energy consumption of mechanical disks. One such example is a product offered by the Estonian startup Leila Storage.

While some manufacturers, such as Pure Storage, are announcing the imminent end of mechanical disks. that even by 2026. However, this is an unlikely scenario. Leil Storage is trying to prove that HDD users can also save a lot of energy and reduce carbon dioxide emissions into the atmosphere.

Collaboration Between Storware and Leil Storage

According to the Estonian startup, companies often make the mistake of assuming that erasure coding, media recycling, tape longevity, or 50% compression will achieve sustainable development goals. However, it is not that simple. Therefore, Leil Storage offers a shortcut, providing its own backup and archive storage systems, available in three versions: standard (maximum capacity 1.5 PB), advanced (9 PB), and enterprise green (up to 15 PB). Leil Storage uses 28TB UltraSMR disks manufactured by Western Digital.

This choice is not accidental. SMR disks are currently only used by hyperscalers. Unlike universal models with CMR recording technology, data is not written to magnetic tracks located next to each other on a single platter, but overlaps. This design allows you to fit 30% more data on the same area as with CMR media. Additionally, an SMR disk consumes the same amount of energy as a CMR disk, which translates to greater energy efficiency per 1TB of disk space (Leil Storage estimates it to be around 18%).

The startup will introduce a special ICE (Infinite Cold Engine) module this summer, which will cut power to unused disks. According to Leil Storage’s analysis, this will allow for a 43% reduction in energy consumption compared to a classic disk array. The startup predicts that as ICE evolves, savings will increase to 50% in 2025 and even 70% in 2026.

Leil Storage devices are currently compatible with products from companies like Acronis, Cohesity, and Rubrik. Recently, the Estonian startup began work on integrating its product with Storware software.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Storware
Storware is a backup software producer with over 10 years of experience in the backup world. Storware Backup and Recovery is an enterprise-grade, agent-less solution that caters to various data environments. It supports virtual machines, containers, storage providers, Microsoft 365, and applications running on-premises or in the cloud. Thanks to its small footprint, seamless integration into your existing IT infrastructure, storage, or enterprise backup providers is effortless.

A quick guide to remote access protocols

Remote access is a business necessity. Around 50% of workers use remote access technologies to work from home or on the move. Many of those workers access remote desktops to recreate workplaces outside the office.

While workers see Office 365 or SalesForce on their displays, a lot happens under the hood. Businesses rely on remote access protocols to connect devices and transfer data. In every case, companies must secure remote access methods while ensuring optimal performance. 

This blog will explore remote access protocols and introduce some popular varieties. We will also list some remote access best practices to help you find the perfect setup.

What are remote access protocols?

Remote access protocols enable connections between remote devices and servers. Protocols set the conditions for transferring data packets, allowing workers to access desktops hosted on centralized data centers. Many protocols also strengthen security by applying encryption to hide traffic from outsiders.

Common types of remote access protocols

Almost every device has an in-built remote access protocol. Windows uses the Remote Desktop Protocol (RDP), while Linux and Macs use the Secure Shell Protocol (SSH).

Protocols have default settings, which often suit user needs. However, there are occasions when customizing remote access protocols is essential. You may also add extra protocols to improve security or ensure compatibility with other systems.

When you deviate from default setups, it’s important to understand how remote access protocols work. Let’s explore the main remote access protocols and how to use them.

10 types of remote access protocols

Remote Desktop Protocol (RDP)

Microsoft created the Remote Desktop Protocol in 2012. RDP uses a server and client setup to organize shared connections between remote devices and central servers. Engineers use RDP to access remote devices securely, and the protocol works with Windows, Linux, Mac OS, and even Android.

RDP uses port forwarding and the TCP/IP transfer protocol to send and receive data over a network channel. This channel carries data about keystrokes, mouse movements, and visual information from remote servers.

With RDP, users don’t need to host apps on their devices. They can access central assets via RDP and work via the remote desktop.

Secure Shell (SSH)

The Secure Shell remote transfer protocol allows remote users to deliver command-line instructions to central devices. The SSH protocol encrypts commands and enables secure file transmission. These features make it a popular protocol for server management.

SSH may also be a good option for secure remote access. The SSH protocol uses public and private keys to authenticate connections. RDP relies on password credentials supplied by remote users, which can be vulnerable to theft or brute force attacks.

Virtual Network Computing (VNC)

Like RDP, VNC users remotely control applications stored on central servers. Unlike RDP, VNC uses the Remote Frame Buffer Protocol (RFB). The screen-sharing protocol allows remote capture of devices, providing greater control compared with RDP.

VNC is popular because it is platform-independent. Many users can connect to a VNC instance, regardless of their operating system. It is a common choice for IT or customer service teams who need secure access to user devices.

Serial Line Internet Protocol (SLIP)

SLIP is one of the oldest remote access technologies, having appeared in the 1980s. First used to connect Unix devices, SLIP is still a popular way to control TCP/IP data transmission.

SLIP creates point-to-point pathways between serial devices. Serial communication is rarely used in remote working as it struggles with audio-visual data flows. However, companies commonly use the technique to control internet-of-things devices due to its low cost and simplicity.

Point-to-point protocol (PPP)

Point-to-point protocols use TCP/IP to create secure connections between remote devices and central servers. Operating at the link layer, PPP is a go-to protocol for Internet Service Providers.

PPP is the foundation of other remote access technologies. For example, Point-to-Point Protocol over Ethernet (PPPoE) allows rapid file transfers over Ethernet connections. PPPoE also enables network monitoring to track user activity.

Virtual Private Networks (VPNs)

Virtual Private Networks use variants of the Point-to-Point Tunneling Protocol (PPTP) to create secure tunnels between clients and servers. Tunneling enhances user privacy by encrypting data and assigning fresh IP addresses.

These features make VPNs some of the most secure remote access solutions. However, VPN protocols are not specialized for remote desktop access. They tend to operate alongside RDP and other remote access technologies.

Remote access VPNs create digital gateways to secure other forms of remote access. That’s especially useful for remote workforces that connect via home offices and unsecured public networks.

VMWare Blast

Blast is VMWare’s virtual display protocol and uses the H.264 video compression standard to transfer video data. Compression makes Blast a good option if companies rely on video conferencing and virtual meetings. It also suits remote desktop access with complex visual demands.

VMWare Blast is platform-neutral, supporting Linux, MacOS, and Windows. It uses the UDP and TCP/IP framework for data transfers, while encryption and authentication functions provide additional security.

Citrix ICA

Citrix ICA is a proprietary remote desktop protocol focused on high-performance desktop access.

The “Independent Computing Architecture” resembles RDP’s client and server architecture. Unlike basic RDP, Citrix ICA optimizes data flows for graphics and audio. This reduces latency and enhances efficiency.

Hypertext Transfer Protocol Secure (HTTPS)

HTTPS is a secure version of the Hypertext Transfer Protocol that transmits most web traffic.

Companies can use it to secure remote access via web applications. For example, HTTPS enables collaboration via Google Docs or access to publishing tools like Canva.

The problem with HTTPS is it only applies to web-based traffic. Users will need additional protocols to secure other forms of traffic.

Apple Remote Desktop (ARD)

Apple’s version of the Remote Desktop Protocol, ARD, allows remote management of MacOS systems. It provides similar services to RDP, including remote admin and file transfers.

IT teams can use ARD to remotely manage software on Apple devices or control many Macs on a company network. ARD also features screen-sharing, file distribution, and software installation to ease the workload for security teams.

ARD is only used with Apple systems. You can use it as part of remote access systems, but other protocols are needed if PCs or other devices are involved.

How should you choose the right remote access protocol for your needs?

Take care when choosing different types of remote access protocol, as the protocol you select influences overall performance.

Remote access solutions should balance criteria and take business needs into account. In some situations, security is critical. In others, speed matters slightly more. Here are some criteria to guide your decision-making:

  • Security. If security is foremost, choose remote access protocols that support strong encryption and authentication systems. A smart remote access setup based on combining VPNs and RDP should protect critical data.

  • Speed and performance. Fast protocols consume minimal bandwidth and generate very little latency—handy if you rely on split-second connectivity. Protocols may also support file compression to reduce transfer volumes, another good way to improve performance.

  • Compatibility. Think about how remote access protocols fit into your network environment. Some RAPs support all operating systems. Others, like RDP or ARD, are less wide-ranging. Check your protocol works with visualization platforms like Citrix (if you use them).

  • Cost. Sourcing a proprietary remote access protocol like VMWare Blast can be expensive, as companies must buy licenses for every user. RDP or other solutions may be better suited to small businesses on cost grounds.

Best practices for using remote access protocols

Challenges remain after choosing remote access protocols. How should you use protocols securely and efficiently to achieve your business goals?

Implementing remote access technologies varies between businesses, but some best practices apply across the board:

  • Use multi-factor authentication (MFA). MFA requires extra user credentials before establishing a remote access session. Most protocols support authentication, which cuts the risk of outsiders gaining control of network devices.

  • Encrypt data securely. Encryption scrambles data packets transported via remote access protocols. Tools like RDP do not provide strong encryption by default. The safest option is applying encryption over the top via VPN protocols.

  • Segment networks for added security. Strengthen protection by isolating remote access servers in secure network segments. Control access to this secure zone and minimize east-west movement if attackers breach remote access defenses.

  • Update software regularly. Remote access protocols can be vectors for exploit attacks. Regular patches and software updates keep network assets current and protected against known vulnerabilities.

  • Monitor remote access. Security teams can monitor data transferred via remote access protocols to detect suspicious activity. Maintain activity logs and schedule regular audits to identify potential problems.

  • Organize user training. Users must know how to use remote desktop protocols securely. Password hygiene, VPNs, patching, and avoiding unsafe public spaces should all appear in training programs.

  • Use load balancing to scale RAP solutions. Scaling remote access protocols can cause performance issues. Load balancing helps you manage bandwidth and avoid network bottlenecks.

Remote access protocols: How NordLayer can help

To connect to a remote device, you need a remote access protocol. Products offering this service should be compatible with popular protocols.

The best solutions not only establish the connection but also ensure it is encrypted and secure, like NordLayer. NordLayer’s Smart Remote Access works with SSH, VPC, and RDP protocols. Additionally, NordLayer provides extra security like encryption and access controls, enhancing the safety of remote connections.

Our Smart Remote Access (SRA) feature allows organizations to create virtual LANs interconnecting several work devices. Users can easily reach other devices connected to the same Virtual LAN as if they were on the same physical network.

Virtual LANs created with NordLayer’s SRA are extremely safe, as only authorized users and devices can access network assets. Employees can upload and delete files securely while VPN technology runs in the background—making connections secure wherever users are. IT admins can troubleshoot issues remotely and manage servers from different locations without hassle. Remote desktops can run without security concerns, keeping sensitive data protected.

For example, a sales team on the road can access internal resources and update the CRM in real time, improving response times and data accuracy. A development team spread across different locations can collaborate on code, share files, and use shared servers, boosting productivity and keeping projects on time. Healthcare professionals can access patient records securely from various locations, ensuring timely and accurate medical care.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Why SWG and CASB solutions are essential for preventing data leakage and cyber threats

Everyday, people fly the friendly internet skies, visiting different websites, and sharing files with each other. They are accessing everything from Gaming to Gambling to General Entertainment websites and sharing files that may contain personal information. Now this is fine if it’s personal activity—but what if you’re part of a professional organization?

If I’m part of the security team at that organization, I’d want some controls to know where you’re going on the internet, how you’re accessing it, and who you’re sharing files with in order to keep you safe from malicious attacks and data leakage.

Is that really necessary?

Let’s take a look at some trends we’ve seen:

Total Blocks in the last 7 days? Over 60k! Where were these users going?

Almost 50% of the blocks were…you guessed it: AI/ML

Organizations are clamping down on Artificial Intelligence usage.

An example of an organization’s blocked content

Top blocked categories

  • 49.1% AI/ML: ChatGPT, Gemini, DALL-E, etc.
  • 8.8% File Storage: Dropbox, Box, WeTransfer, etc. 
  • 7.8% Malicious/Suspicious: Block users from being unknowingly exposed to dangerous sites
  • 1.9% Software Downloads: Prevent employees from downloading non-approved IT apps

This data begs the question, are employees doing this intentionally?

While it’s hard to know for sure without asking them directly, we can deduce a few things.

  1. AI is on the rise, and every employee is looking to automate their work, the data clearly shows a desire to access these tools. But they’re being blocked because company policies don’t want you uploading proprietary code or sensitive content.
  2. Categories like ‘File Storage’ are blocked to ensure employees can not access their personal cloud storage drives, reducing the risk of data exfiltration. The most common use case we see here is a recently terminated employee trying to take company files with them.
  3. Most of the time employees are completely unaware they are accessing a Malicious site so these blocks are protecting the accidental misstep.

This is why having a reliable and easy to use secure web gateway solution is so important. You need to be able to monitor activity and block access to sites that could be harmful, or non-productive to your organization.

Now what about those company files? I can not tell how many times leaders have said, “No I’m good…we have tight controls and I know we don’t have any publicly exposed files.”

Well, we challenged one of those leaders to run CASB Neural, here are those results:

Out of 84M Files scanned, 2.4% are Publicly exposed. That may not sound like a lot, but it’s over 2M publicly exposed files.

2M Publicly exposed files!

Another way of saying this is that the file is “publicly accessible.” That means while you personally may have never shared this file or folder with anyone outside of your organization, it still has the ability or “sharing permissions” that allow it to be exposed to an external party.

Of those 2M files, over half a million, or 25% of the found public files, fall into either Intellectual Property (IP), Personally Identifiable Information (PII), Protected Health Information (PHI) or Payment Card Industry (PCI).

  • IP 6.2%
  • PII 53.2%
  • PHI 5.8%
  • PCI 34.8%

That means either your data, your customers, vendors, or anyones data who you work with could potentially be at risk of being exposed.

What are some examples of the types of files and data we found in these categories?

  1. Publicly exposed data rooms where anyone could download sensitive information (stock purchase agreements, equity, offer letters, etc.) about major startups
  2. PHI documents publicly available because it was the default setting when creating a sharing link
  3. Troves of sensitive files shared publicly, with no possible way to find out, including bank statements, etc.

So what does all this mean?

Most of the time people are not sharing sensitive information, or going to malicious websites on purpose. So having these filters in place is crucial for catching those accidental human errors that will ultimately happen.

Because as the data shows, people are trying to access sites they shouldn’t be, and unknowingly have file sharing permissions that could be huge security risks to your organization.

These solutions keep you productive and safe. So make sure you have a SWG and CASB DLP solution that is fast, reliable and invisible because at the end of the day you want it to work really well and not get in the way.

About Dope Security
A comprehensive security solution designed to protect individuals and organizations from various cyber threats and vulnerabilities. With a focus on proactive defense and advanced technologies, Dope Security offers a range of features and services to safeguard sensitive data, systems, and networks.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Detecting LOTL Attacks Requires Effective Event Logging

Event logging is an essential component of cybersecurity, particularly when it comes to detecting and responding to Living Off the Land (LOTL) attacks. These attacks leverage legitimate tools and processes to conduct malicious activities, making them notoriously difficult to detect using traditional methods. However, with the right event logging practices, organizations can significantly enhance their ability to identify and mitigate these sophisticated threats.

Understanding LOTL Attacks

Living Off the Land (LOTL) attacks represent a category of cyber threats where attackers use tools and features native to the target environment to carry out their malicious activities. Instead of relying on external malware or tools, these attackers exploit pre-installed system binaries, scripts, or admin utilities to achieve their objectives. This approach allows them to blend in with regular system activities, evading detection by traditional security measures like antivirus software and signature-based intrusion detection systems (IDS).

LOTL attacks are particularly insidious because they don’t rely on introducing foreign code into the system. Instead, they use what’s already there, meaning that typical defenses are often powerless to stop them. For example, an attacker might use PowerShell—a legitimate scripting tool included in most Windows installations—to download additional malicious scripts or execute commands that grant them further control over the system. Because PowerShell is a trusted tool, these actions might not immediately raise red flags.

The Role of Event Logging in Detecting LOTL Attacks

Event logging refers to the process of recording detailed information about various activities within an IT environment. This can include user logins, file accesses, system changes, and network connections. Effective event logging provides a wealth of data that security teams can analyze to detect unusual patterns indicative of an ongoing LOTL attack.

Here’s why event logging is critical:

  1. Visibility into System Activities: LOTL attacks thrive on their ability to masquerade as legitimate system activities. By maintaining comprehensive logs of all system events, including the execution of common tools and scripts, security teams can identify anomalies that might suggest malicious intent. For example, if PowerShell is used to download a file from an external server at an unusual time or by an unauthorized user, this could be a red flag.
  2. Correlation and Analysis: With extensive event logs, security analysts can correlate seemingly benign events to uncover malicious patterns. For instance, a series of PowerShell commands might individually appear harmless, but when correlated with other logs (e.g., unexpected network connections or user behavior), they could reveal a coordinated attack. Event logging allows these connections to be made, providing a more comprehensive view of potential threats.
  3. Auditing and Accountability: Event logs serve as an essential audit trail, documenting all actions taken within a system. In the event of a suspected breach, these logs can be crucial for forensic analysis, helping to reconstruct the attacker’s actions and identify compromised assets. This not only aids in remediation but also supports efforts to prevent future attacks.
  4. Compliance Requirements: Many regulatory frameworks and industry standards mandate rigorous event logging practices. For example, compliance with standards like ISO/IEC 27001 or frameworks like the NIST Cybersecurity Framework requires organizations to implement robust logging and monitoring capabilities. By adhering to these requirements, organizations not only enhance their security posture but also avoid potential legal and financial penalties.

Implementing Best Practices for Event Logging

While event logging is vital, it’s not enough to simply log everything indiscriminately. The key to effective threat detection, particularly for LOTL attacks, lies in implementing best practices tailored to your organization’s specific needs.

  1. Prioritize Critical Systems and Applications: Focus your logging efforts on the most critical systems, applications, and processes within your organization. This includes administrative tools like PowerShell, Windows Management Instrumentation (WMI), and other scripting environments commonly exploited in LOTL attacks. By prioritizing these areas, you ensure that the most relevant data is captured and available for analysis.
  2. Implement Centralized Log Management: Centralizing your logs in a Security Information and Event Management (SIEM) system enables more effective analysis and correlation of events. A SIEM system can aggregate logs from various sources, apply advanced analytics, and generate alerts based on predefined rules or behavioral patterns. This centralization is essential for identifying the subtle indicators of LOTL attacks that might otherwise go unnoticed.
  3. Regularly Review and Tune Logging Policies: Logging policies should not be static. Regular reviews are necessary to ensure that they remain aligned with the evolving threat landscape and the organization’s operational needs. This includes tuning log verbosity to strike a balance between capturing enough detail for effective analysis and avoiding an overwhelming volume of data.
  4. Ensure Data Integrity and Security: Event logs themselves can be targets for attackers looking to cover their tracks. Therefore, it’s crucial to implement measures that protect the integrity and confidentiality of log data. This includes encryption, access controls, and regular integrity checks to detect tampering.

Conclusion

In the face of increasingly sophisticated LOTL attacks, event logging stands out as a key defensive measure. By providing deep visibility into system activities, enabling correlation and analysis of events, and supporting auditing and compliance efforts, effective logging practices empower organizations to detect and respond to these elusive threats. Implementing best practices for event logging, as outlined in the recent multi-agency report, is not just about compliance—it’s about equipping your organization with the tools it needs to stay one step ahead of attackers who are determined to live off your land.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。