Skip to content

Better to watch Troy than have trojan malware on your Android TV

Alžbeta Kovaľová

A group of malware researchers recently discovered a new trojan variant of the notorious Mirai malware botnet. The story of Mirai has been a fascinating one, to say the least. From one of the most prevalent and widely detected threats dating back to 2016 to its many variants and global reach that never truly seems to die, the Mirai botnet has evolved to hijack consumer-grade Internet of Things (IoT) devices on and off for more than seven years. The creators have since been caught; however, Mirai-based botnets remain a threat as the code lives on. It has given birth to many variants and continues to mutate, resulting in the tale at hand today.

A botnet is a large network enslaved by threat actors. Botnets are mainly used for DDoS attacks and stealing of data, but can be misused for other malicious campaigns as well.

This new variant of the Mirai malware has been spotted infecting inexpensive the Android TV set-top boxes of millions of users. This new trojan is a new version of the “Pandora” backdoor that first appeared in 2015.

Its primary targets are budget-friendly Android TV sets, but ESET Mobile Security has been able to block it on both Android TVs and Android smartphones in over 30,000 instances since September 2023. The way it infects a device is by the user downloading a seemingly legitimate app to stream content. These apps can be downloaded from websites dedicated to smartphones, TVs, and Fire TV Sticks.

Try ESET Mobile Security today!

The apps themselves promise to provide a wide range of TV shows and movies for the user to watch for free, via a trial account or with a premium account. The specifics of this particular type of threat is that its malicious functionality doesn’t present visually to the user, and there are virtually no signs that any malicious activity is happening on the device, or signs that the app might be malicious. Even the permissions the apps asks for don´t appear to be intrusive.

 

One of the reasons people are tending to opt for cheaper streaming services and TV boxes may be the cost of living crisis, as well as the high prices associated with multiple mainstream streaming platforms. However, there are costs to users who try to get “a deal.” These cheaper hardware options are often manufactured quickly without much thought to their security, a feature they share with many other IoT devices. This leaves them more vulnerable to tampering, specifically the potential for firmware alterations. So, even for those who are conscious and selective about the apps that they install, the device might arrive to them with preloaded malware.

The importance of trusted security software

As we have established earlier, in this instance, to the naked eye, it is virtually impossible to realize whether or not a device has been infected. Furthermore, since users have no way of knowing if apps they’d like to use with their devices are malicious or not, they would have no reason to uninstall and delete them from their devices.

To avoid infection and worry, users can employ ESET Mobile Security (EMS), which is able to detect and block this and similar threats during the download process, even before installation occurs. This means that the threat never reaches the user. EMS can also be used to scan already existing apps and downloads to double-check that you haven’t bought the devil in disguise. In the case of a malicious app or download, EMS alerts users that malicious code has been detected — as seen on the picture below.

 

While it is always essential to stay alert, use of a security solution proves itself time and time again to be critical in combating the cyberthreats of today. It adds a layer of security, one that human vigilance cannot, and ensures you have a smooth, safe, and uninterrupted online experience. 

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

The Quest for Yeti

Meet the newest rockstar on our squad: Zeti, the runZero Yeti! 🎉 This sub-zero hero is now our official mascot, and we’re excited to give you the lowdown on how Zeti came to be. Why a Yeti, you ask? Keep reading to find out! 

The Trail to Yeti #

We set out on our epic journey to find the perfect mascot for runZero, with a big hairy goal (yeah, we went there) to find an elusive creature who could capture the personality of runZero. We wanted our mascot to reflect who we are as a company, and also provide a glimpse into the quirkiness, nerdiness, and kindness that permeates life in runZero land. We thought about the roots of our name, the mission that lights a fire in us every day, and what makes our product unique and special.

Our name. With a zero built right into our name, we started thinking about all things ‘below zero’ and ‘arctic’ and the creatures that inhabit these spaces. We’re also a remote-first company, and you can’t get much more remote than the places where temperatures are frequently below zero. The Yeti fits right into our arctic landscape and inhabits remote, farflung locations on the planet.

Our mission. runZero helps people find unknown things in their environments, and reveals the mysteries lurking on their networks so they can take action and improve their security. The Yeti has a mystical allure and knack for staying undetected and off the radar (just like all those unmanaged devices and shadowy subnets on your network), mirroring our mission of unveiling the unknown in networks.

Our product. We believe the runZero Platform is rewriting the story of what a CAASM is and should be. And we aim to bust myths left and right — forget the idea that full network visibility is a mythical beast that demands sacrifices like long setups, pricey gear, and annoying credentials. Heck, we’re even cool with you trying it for free without enduring a sales pitch! We’re all about embracing outlandish ideas and flipping the script. So, a Yeti who emerges from the shadows to the light to blaze a new trail? That’s the Yeti we want to hang with.

After some wild brainstorming (with a few detours involving narwhals and penguins), our Yeti was ready to hit the scene. Enter our amazing illustrator.

Bringing Our Yeti to Life #

We (kind of) love you, Generative AI, but this time we decided to tap into human creativity to help us put a face (and a big furry body) on our Yeti. Shoutout to Kennon James, the genius illustrator behind our Yeti’s makeover. Kennon has worked on all sorts of cool illustration projects over the years, including bringing Marvel superheroes to life, illustrating some popular games you know and love, and creating a pantheon of Cthulhu-inspired artwork. The rabbit hole of his Instagram can be found here — and you can thank us later.

With Kennon’s help, we explored Yetis of all shapes and sizes — short Yetis, tall Yetis, Yetis without necks, Yetis with big shoulders, scary Yetis, muppet-like Yetis, goofy Yetis, serious Yetis… you get the picture. And finally we found our match. This Yeti was a cool character, but also friendly, approachable, and ready to lend a big (really big) hand.

And speaking of hands, it took us a few weeks to realize our Yeti only had four fingers. We aren’t sure what happened to the fifth, but luckily with the magic of the marker, our Yeti now has all five digits. ✋ Check it out for yourself:

Giving Our Yeti a Proper Name #

Next up: picking a name for our Yeti. At our team summit in Austin during the Austin City Limits Festival (because why not?) – we unveiled our Yeti and handed out t-shirts worthy of the festival and the Live Music Capital of the World. Then, we challenged the team to brainstorm the perfect name for our new Yeti.

Our creative geniuses proposed names like Seymour, I.C Moore, and Prints. But the chosen one? Zeti. Rhymes with Yeti, memorable as heck, and totally runZero. And all runZero alums? You’re officially Zetis for life!

To jazz things up, we invited Kennon to join the party and illustrate live with creative input from the crew. Check out the artist at work!

This is just the start, folks! Stay tuned for more Zeti adventures—trust us, you won’t want to miss this! 🚀

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

HIPAA Compliance Guide

Nowadays healthcare organizations must not only comply with strict regulations but also implement robust security measures to protect sensitive information. One such important aspect is Health Insurance Portability and Accountability Act (HIPAA) compliance.

The Significance of HIPAA Compliance


HIPAA is a United States federal law enacted in 1996 that establishes privacy and security standards for protecting medical information.

The primary purpose of HIPAA is to ensure the confidentiality, integrity, and availability of patients’ protected health information (PHI) created, maintained, processed, transmitted, or received electronically. PHI covers eighteen kinds of data including names, geographic information, phone and fax numbers, email addresses, social security and medical record numbers, biometric identifiers, and any other unique identifying number, code or characteristic, etc.

Organizations Subject to HIPAA


HIPAA applies to Covered Entities including healthcare providers (hospitals, clinics, doctors, psychologists, dentists, chiropractors, nursing homes, pharmacies, and home health agencies), health plans (health insurance companies, health maintenance organizations, government programs paying for healthcare, and military and veterans’ health programs), healthcare clearinghouses (organizations transforming nonstandard health information into standardized formats, as per the guidelines set by the HIPAA administrative simplification regulations). Also, HIPAA expands to Business Associates, performing services for Covered Entities involving the use or disclosure of PHI, and contractors providing services to Business Associates.

Teaching organizations providing medical services to both students and the public are qualified as “Hybrid Entities”. In this case, students’ health information is subject to FERPA, and the public’s health information is protected by the HIPAA Privacy and Security Rules.

HIPAA does not require specific technologies for protecting health information. However, implementing a web filter can greatly enhance security and help in complying with the act.

Web Filtering for HIPAA Compliance

Today the majority of healthcare organizations rely heavily on digital platforms for communication, research, and patient care. However, this increased connectivity also brings the risks of cybersecurity threats, potentially compromising the confidentiality and integrity of PHI. Here’s where web filtering steps in as an important component of HIPAA compliance.

  1. Blocking Malicious Content: The internet is full of malicious content, and healthcare organizations must shield their networks from potential threats. Web filtering capabilities extend to blocking websites hosting malware, ensuring a secure online environment for accessing patient records and other sensitive information.
  2. Mitigating Phishing Threats: Phishing attacks remain a prevalent threat to healthcare data security. Quality web filtering services employ advanced threat intelligence to identify and block phishing websites, reducing the risk of employees falling victim to schemes aiming to obtain PHI.
  3. Bandwidth & Productivity Control: Web filtering services allow healthcare organizations to set filtering policies that restrict access to non-work-related websites, ensuring that employees remain focused on their tasks. This enhances productivity, reduces the risk of accidental data breaches resulting from distractions and bandwidth wasting so that all employees can enjoy fast Internet.
  4. Detailed Reports: Modern solutions provide admins with detailed reports on users’ online preferences which allows organizations to make rational decisions on further restricting access to the network.
  5. Easy Scheduling: A feature that is provided by rare web filtering services (SafeDNS among them) is scheduling. This allows filtering to be tailored to staff schedules and needs.

The digital transformation in healthcare comes with great benefits but also introduces security challenges. HIPAA compliance is non-negotiable, and web filtering emerges as a robust solution to address cybersecurity concerns. By leveraging web content filtering, healthcare organizations can not only meet HIPAA requirements but also fortify their defenses against evolving threats.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

What is SSH?

SSH stands for “Secure Shell.” It’s a network protocol used to securely access and manage devices and servers over an unsecured network. It provides an accurate form of authentication as well as encrypted communication between two systems, making it especially useful in environments where security is a concern.

SSH is commonly used to access remote servers through a command line interface, but can also be used to securely transfer files (through SFTP or SCP). It uses encryption techniques to protect transmitted information, making it difficult for third parties to intercept or manipulate data during transmission.

One of the main advantages of SSH is its ability to authenticate both the client and the server, which helps prevent man-in-the-middle attacks and other security threats. SSH replaces older, less secure methods of remote access, such as Telnet, which transmits information in an unencrypted manner, making it susceptible to interception and data theft.

SSH is an operating system independent protocol. Although it was conceived for UNIX environments, it is present in operating systems such as OSX (Mac) and in the latest versions of Microsoft Windows servers. SSH is, de facto, the standard for connecting to servers by command line. 

It uses port 22/TCP, but can be configured to listen and connect over different ports. In fact, it is considered a good security practice to change the default listening port to avoid being identified by remote scanning tools.

Content:

A brief look at the history of SSH and OpenSSH

The trajectory of OpenSSH dates back to 1999 and is closely linked to the original software called “SSH” (Secure Shell), created by Tatu Ylönen in 1995. SSH is a network protocol that enables secure connection and remote control of a system through a command line interface.

In its early days, SSH was proprietary software and although it was available for free for non-commercial use, it required licenses for use in commercial environments. This led to the creation of several open source SSH implementations to fill the gap in terms of accessibility and software licensing.

In this context, the OpenSSH project was initiated by Markus Friedl, Niels Provos, Theo de Raadt, and Dug Song in December 1999. The creation of OpenSSH was carried out in response to a series of events that included the release of the SSH protocol source code by Tatu Ylönen and concerns about ownership and licensing of existing proprietary software.

The initial goal of the OpenSSH project was to create a free, open-source protocol that was compatible with existing versions, especially SSH-1 and SSH-2. OpenSSH also sought to circumvent the licensing restrictions associated with proprietary SSH deployments.

As the project progressed, it became the de facto implementation of SSH on Unix- and Linux-based systems. OpenSSH’s growing popularity was due to its open source code, ability to provide safe communication, and features such as strong encryption, key-based authentication, and secure file transfer capability (SFTP).

OpenSSH also benefited from collaboration with the free and open source software community. Over the years, it has undergone continuous improvements, security updates, and functional extensions, making it an essential tool in remote system administration and network security.

In short, OpenSSH emerged as a response to the need for a free, open-source SSH implementation. Over the years, it has evolved to become the most widely used SSH implementation on UNIX and Linux systems and remains a key element in the security of communication and system administration in distributed environments.

Remote command execution with SSH

SSH not only provides a way to interactively access the shell of a remote machine, it can also be used to execute remote commands on a system, with the following syntax:

ssh user@host:/path/ofthe/command

SSH is frequently used in scripts for the automation of all types of actions and processes, for that it requires automatic authentication by means of certificates, since, by default, it will require the user to enter a password manually and interactively through the keyboard.

Security at SSH

SSH stands for Secure Shell, so security is part of SSH’s foundational design.

SSH also has the ability to create TCP tunnels that allow a host to be used to create a kind of dedicated VPN, between two IPs, that can be bidirectional. It is what is known as “TCP Tunnel” and that when misused, can be a security problem.

SSH allows automatic authentication through certificates, which allows a user to connect to a system through SSH without knowing the password. To do this, the public key of a digital certificate must be copied to the server, so that you identify that user through their certificate. This is an advanced option that allows command execution automation through SSH, but which presents inherent risks to any automation.

What are the differences between Telnet and SSH?

SSH and Telnet are two network protocols used to access remote systems, but there are significant differences in terms of security and features.

SSH is the current standard for remote access in all types of environments. Telnet, on the other hand, is older and less secure, and its use is discouraged, unless it is impossible to use SSH.

Security

SSH: It provides a safe environment for communication between two systems. All data, including usernames and passwords, are encrypted before being transmitted, making it much more difficult for an attacker to intercept and understand the transmitted information.

Telnet: It transmits data, including login credentials, in an unencrypted form. This means that if someone has access to the network between the client and the server, they can easily capture and read the information.

Encryption

SSH: It uses encryption to protect data during the transmission. Encryption algorithms in SSH can be configured to meet the latest security standards.

Telnet: It does not provide encryption, which means that all information, including passwords, are transmitted insecurely.

Authentication

SSH: It supports several authentication methods, including the use of passwords, public key, and token-based authentication.

Telnet: Depending on your settings, it generally uses only usernames and passwords for authentication.

Ports

SSH by default. SSH uses port 22, unlike Telnet, which uses port 23. However, these ports can be changed at any time.

Top SSH customers

Listed below are some of the best-known SSH customers on the market.

OpenSSH

OpenSSH (Linux, macOS, Windows with WSL) and other operating systems such as BSD or communications devices that support a version of OpenSSH.

OpenSSH is a free and open source implementation of the SSH protocol. It comes pre-installed on most Linux distributions and is widely used in Unix environments.

It is highly reliable, secure, and the default choice on many Unix-based operating systems, as well as being 100% free.

Putty

PuTTY is a free and open source SSH client for Windows and is therefore very popular. Although it was initially designed for Windows, there is also an unofficial version called “PuTTY for Mac” that works on macOS, there are also alternative versions for Linux.

It’s lightweight, easy to use, and can be run as a portable app with no installation required. However, it lacks a powerful interface, does not allow sequence recording, and in general, lacks more advanced features that you may find in other “visual” SSH clients. It also doesn’t have a specific interface for file transfer.

Of all the options, PuTTY is the most basic one, but at least it’s a visual interface, unlike the standard operating system’s SSH client that’s free, but where all the “features” are command-line-based.

Downloads and Updates

It can be downloaded from its own web, although there are several sites in parallel that offer alternative versions for Mac and even Linux.

Price & Licenses

It’s free and under an OpenSource license, so you may modify its code and compile it on your own.

BitVise

Bitvise SSH Client is a solid choice for Windows users looking for an easy-to-use and secure SSH client. Its combination of an intuitive interface, advanced file transfer features, and robust security makes it a well-liked tool for remote system management and safe file transfer.

SSH Server

BitVise offers both an SSH client and an SSH server. Generally, Windows systems do not use SSH so it can be a very good option to implement it, despite the fact that the latest versions of Microsoft Windows Server already implement it. It is an excellent option for implementing SSH in older Windows versions, as it supports a wide selection of versions, almost since Windows XP:

  • Windows Server 2022
  • Windows 11
  • Windows Server 2019
  • Windows Server 2016
  • Windows 10
  • Windows Server 2012 R2
  • Windows Server 2012
  • Windows 8.1
  • Windows Server 2008 R2
  • Windows Server 2008
  • Windows Vista SP1 or SP2
  • Windows Server 2003 R2
  • Windows Server 2003
  • Windows XP SP3

SSH Tunneling and Port Forwarding

It allows SSH tunnel configuration and port forwarding, which is useful for securely redirecting network traffic over SSH connections.

Advanced Session Management

Bitvise SSH Client offers advanced options for session management, including the ability to save session configurations for quick and easy access to frequently used servers.

Session Log and Audit

It provides a detailed session log, which can be useful for auditing and activity tracking purposes.

Proxy Support:

Bitvise SSH Client supports several proxy types, allowing users to bypass network restrictions and connect through proxy servers.

Downloads and Updates

A 30-day trial version can be downloaded from their website https://www.bitvise.com.

Price & Licenses

Only for Windows, it is priced at around 120 USD per year.

SecureCRT

It is available for all platforms: Windows, macOS, and Linux. A functional demo can be downloaded from their website at https://www.vandyke.com.

SecureCRT is a commercial client that offers support for multiple protocols, including SSH. It provides an advanced graphical interface, scripting and automation functions, and is widely used in enterprise environments.

Terminal Emulation

It offers terminal emulation for a wide variety of types, including VT100, VT102, VT220, ANSI, among others. This ensures effective compatibility with different remote systems and devices.

Secure File Transfer

SecureCRT includes support for secure file transfer protocols, such as SCP (Secure Copy Protocol) and SFTP (Secure File Transfer Protocol). This allows users to securely transfer files between local and remote systems. To manage file transfers, use an additional product called SecureFX (with an additional license fee).

Automation and Scripting

It makes it easy to automate tasks by running scripts. It supports different scripting languages, such as VBScript, JScript, and Python, providing flexibility in process automation.

Efficient Session Management

SecureCRT offers an efficient session management interface that allows users to easily organize and access previous connections. It also makes it possible to import and export sessions for easy configuration transfer between systems. It allows advanced session configuration, including authentication options, function key configuration, port forwarding, among others. This gives users precise control over their remote sessions.

SSH Key Integration

SecureCRT supports key-based authentication, which means users can manage and use SSH keys for safe authentication without relying on passwords.

Additional Protocol Support

In addition to SSH, SecureCRT also supports other protocols such as Telnet, rlogin, and Serial. This makes it a versatile tool for different network environments.

Price & Licenses

A full version for one user, including safe transfer features (SecureFX) is about $120 per year.

ZOC

ZOC Terminal is an SSH client and terminal emulator that offers advanced features for users who need a powerful and versatile tool to work with SSH remote connections. It is also compatible with other protocols such as Telnet and Rlogin, which extends its usefulness in different environments not only as an SSH client but also as a Telnet client.

ZOC is compatible with Windows and macOS and publishes regularly updated versions. A demo version can be downloaded from their website at https://www.emtec.com.

Terminal Emulation Functions

ZOC supports multiple terminal emulations, such as xterm, VT220, TN3270, and more. This allows users to connect to a variety of remote systems and mainframes.

File Transfer

It includes secure (and insecure) file transfer features, such as FTP, SFTP (SSH File Transfer Protocol) and SCP (Secure Copy Protocol), allowing users to securely transfer files between the local and remote system. The feature is included in the product itself.

Automation and Scripting

ZOC makes it easy to automate tasks by running scripts. It supports different scripting languages, such as VBScript, JScript, and Python, providing flexibility in process automation. It also allows you to record a key combination and play it back to, for example, automate login sessions that require the use of sudo or su.

Session Management

The ability to manage and organize sessions is crucial for those who work with multiple connections. ZOC offers an efficient session management interface that allows users to easily organize and access previous connections. You can have a catalog of systems where you can easily connect.

Price & Licenses

The basic license is around 80 USD, but its free version allows you to work easily, except for the somewhat annoying popup at the beginning.

Pandora RC: Alternative to using SSH

Pandora RC (formerly called eHorus) is a computer management system for MS Windows®, GNU/Linux® and Mac OS® that allows you to access registered computers wherever they may be, from a browser, without having direct connectivity to your devices from the outside.

Security

For greater security, each agent, when configured, may have an individual password that is not stored on the central servers of Pandora RC, but each time the user wishes to access said machine, they will have to enter it interactively.

Remote access without direct connection

One of the most common SSH issues is that you need to be able to access the server IP. With Pandora RC, it’s the server that connects to a cloud service and so it’s available from anywhere, without the need for a VPN or complex firewall rules.

Integrated with Pandora FMS

It integrates natively with Pandora FMS monitoring software, so that it is possible not only to monitor the servers, but to access them directly from the same interface, without the need to install SSH clients, remember passwords or generate duplications.

Price & Licenses

Free up to 5 devices. There are use licenses for unlimited machines from €19/month. More information on the website: https://pandorafms.com/en/remote-control/prices/

Remote Shell and All-in-One Remote Desktop

Pandora RC has a remote control system through access to the Desktop in a visual way. In both cases, a web interface is used to operate with the remote server, whether it is Windows, MacOS or Linux. It also provides a file transfer mechanism and process/service management. All integrated into one WEB application:

Example of remote Shell on a Mac system:

Example of a remote desktop on a Mac system:

Example of a file share on a Linux system:

Sancho is the one who created and founded Pandora FMS. Among his many hobbies, besides technology and the internet in general, is reading, playing the guitar and sports like fencing or boxing. In his personal blog he dares to write about business and technology issues when he has the time, which is almost never the case.

sancholerena.com
 
 

 

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

What is Information Technology (IT) Management?

According to Computer Weekly, Information Technology Management “…is the process of overseeing all matters related to information technology operations and resources within an organization…” Its objective is to ensure that all technological resources, including hardware, software and networks (on-premise or in the cloud or in hybrid environments) are available and reliable, being used correctly and providing value for the organization, through productivity and better user experiences for the organization’s employees.
To understand its importance, you must bear in mind that, in all industries and in organizations of all sizes, the combination of technology and digital skills is key to participating in the digital economy, where data, connectivity, automation and process improvements impact the employee experience and the customer experience through new business models, omnichannel (integrating more digital channels), integration, modernization and consolidation of technologies.
To achieve this, IT strategists must constantly monitor operation, security, compliance (industry provisions and regulations), the integration of new technologies and, of course, budget management.

Content:

Fundamental role of IT in business structures

In digital businesses, the critical asset is Information Technology (IT), so risk mitigation is essential not only to anticipate threats and protect the integrity of digital assets but also to ensure business continuity, through processes to:

  • Identify risks: como primer paso en la gestión de riesgos, debiendo identificar (ambientales, regulatorios, de mercado, etc.) y priorizar en cuáles se encuentra expuesta la organización.
  • Analyze: As a first step in risk management, having to identify (environmental, regulatory, market, etc.) and prioritize those in which the organization is vulnerable.
  • Assess: Risks should be classified by their importance to define specific actions to mitigate them.
  • Mitigate: From the evaluation, develop a plan to mitigate risks including risk prevention tactics and contingency plans.
  • Monitor and review risks: There will be risks that you cannot get rid of (environmental or market risks, for example), but that can be monitored. Also in risk management, constant updating must be considered in accordance with the needs of the organization.

IT strategists can use emerging technologies such as advanced analytics and artificial intelligence to analyze risk data and automate IT staff tasks, with a proactive approach to new or negative conditions that could affect the business. Keep in mind that the repercussions of not mitigating risks can be quantifiable, such as reduced productivity, claims expenses, sales losses, etc., and unquantifiable, such as reputational damage to the organization.

Roles and Responsibilities of IT Managers

The IT Area has become extremely important in the Digital Transformation of organizations, being in charge of the following and responsibilities to provide constant and reliable access to IT services and systems:

  • Develop business plans related to IT management: This includes defining the hardware and software needs of the company based on the business strategy and the particularities of all areas that make use of technology (Human Resources, Finance, Sales, Marketing, Operations, among others). Consider upgrading technologies, renewing licenses and usage contracts, as well as storage needs.
  • Guarantee the security and availability of IT networks and services: From the maintenance and repair of IT infrastructure and resources, the installation and integration of equipment and technologies to advice on new technological solutions.
  • Provide support and resolution on issues in services, hardware and software, offering assistance to personnel who need access to service resources, networks, software and hardware. It also involves deploying and training employees in the use of existing and new systems.
  • Manage online processes, from website configuration, design and maintenance to e-commerce processes, from testing and improving features and interfaces, to setting up safe channels for transactions and operations from multiple channels.
  • Ensure compliance with company quality standards, including service level agreements (SLAs). It is also to assist in IT assessments and inventories and research on new equipment and its acquisition.
  • Evaluate potential threats to the company’s digital infrastructure, as well as seek alternatives for a quick response, including third-party support and contingency measures, seeking business continuity.
  • Integrate new technologies into the business structure, especially due to the pace of digitization in which it is essential to constantly be evaluating and testing technologies that optimize services and operations in the organization, but that add more value to the business.

Skills Needed for IT Managers

The value of an IT Manager lies in leveraging existing data, ensuring business continuity, optimizing processes and connecting employees with each other and with suppliers, business partners and the end customer. To achieve these objectives, key competencies are required to manage IT, which must be constantly reinforced and updated.

An IT Manager must have Hard Skills, which are technical skills necessary for a job and which are acquired and improved through education, usually through training and certifications, along with experience, such as:

  • Knowledge of Codes and Operating Systems, including knowledge of programming languages for coding websites, software development, database management and other technological systems, as well as the use, operation and possible problems in operating systems on equipment and devices.
  • Management of databases, networks, hardware and software, knowing how to navigate database software and how to use forms and forms integrated into a database, integration with equipment and knowing how to effectively manage a company’s computer network.
  • Software development, essential for those engaged in IT operations, as an organization may require IT professionals involved in programming to develop new software.
  • IT security to keep information safe and confidential. It takes a working knowledge of this technical skill and constant updating as the sophistication of cyber threats evolves.
  • Consolidation, IT modernization and integration of new technologies, especially emerging ones (Robotics, Artificial Intelligence, 3D Printing, among others) that contribute to efficiency in an organization.

Soft skills are also required, which are non-technical attributes, characters and interpersonal skills that define how a person deals with their professional colleagues and other people in the work and social environment. The soft competencies of the IT manager have become essential for their strategic role in the organization:

  1. Business understanding (integral vision), which implies understanding the needs of their peers in IT and business areas, especially since more and more technology expenditure is financed by departments other than IT, because technology has become accessible to end users and there is also consensus in more multidisciplinary teams on technology decisions, and even budgets previously only managed by the IT area are shared. Hence, the IT Manager must have a comprehensive view of the business and its value chain.
  2. Efficient and effective stakeholder management: IT managers should not only approach, understand needs and engage with users, but also with suppliers and strategic partners (stakeholders). IT Managers must also involve the parties involved in the innovation processes, to improve or create new services or products.IT managers must lead the change so that their teams stops thinking in terms of putting together applications that meet feature requirements and move on to designing user experiences that are intuitive and empowering. This change of philosophy in the IT function forces us to show more empathy towards users, who begin to value and require both the experience and the result. Likewise, the IT Manager must not lose sight of their team and provide them with the appropriate training. Attracting and retaining talent in the IT area becomes a fundamental task for the sustainability of the area and the fulfillment of business goals.
  3. Efficient and effective project management, including the management of internal and external projects and demands, the execution and management of mixed budgets, personnel and supplier administration, with transparency and efficient resource control. It also includes change management for users to adopt and make correct use of the technology, communicating about its impact on the business.
  4. Lead the innovation process in the organization, not only being up to date with technological changes and new trends, but knowing how to recommend, to generate new digital revenue streams, working closely with the areas involved in the creation and development of physical and digital combinations that ensure the best customer experience. In customer acquisition and retention, IT Managers assume a strategic role to know and segment customers and monitor marketing campaigns.

As it can be seen, today’s IT Managers must have communication, teamwork and project management skills, in close collaboration with the areas of the organization to understand the needs and look for courses of action that drive efficiency and constant innovation.

Difference between IT Managers and IT Leaders

As it can be seen from the above, the role of IT Managers has transformed from simple suppliers of IT equipment and resources to leadership roles in business, becoming the expert voice to recommend and influence key business decisions. To describe what an IT leader is, let’s look at 7 characteristics that make them indispensable:

  1. Curiosity as a cornerstone: Always seeking knowledge of the market, being an insightful advisor, assuming a role of business partner, with a clear perspective of the organization, the desired results and its value chain.
  2. Up-to-date and future vision: Constantly evaluating and testing the technologies that can be currently integrated and preparing to integrate new ones, especially those that could be implemented in the short or medium term. The leading IT Manager sets everything up to optimize costs, get rid of repetitive or low-value tasks, relies on automation, and drives their team to work efficiently and at the forefront.
  3. Humility: As a characteristic that differentiates the indispensable leader from the average leader. This leader recognizes and seeks support to inspire their teams to find solutions to issues, and trusts and values their team’s contributions. An IT leader can inspire confidence for input, becoming a mentor to their team. This also involves recognizing mistakes to learn from them.
  4. Union: The IT leaders of today are players of a team, able to build cohesion so that everyone works towards a goal and towards success. The IT Leader should be able to talk to other teams as well to foster collaboration, inside and outside the company (including suppliers and strategic partners).
  5. Discretion: This is one of the most particular and difficult characteristics to develop for IT leaders: allowing their team to do the work without intense supervision, without constantly telling them what and when to do certain tasks. To do this, it is clear that they must trust the capabilities of an adequate team with the necessary knowledge to do their job. This leader is also able to mentor when needed, celebrate successes, and encourage learning about failures.
  6. Optimism: IT leaders must be able to encourage optimism, seek improvements even in times of uncertainty and constant disruptions such as those we experienced in recent years around the world. The optimistic IT leader gets employees to understand their contribution and accept causes for which to seek improvements and work shoulder to shoulder with the same goal.
  7. Empathy: The lead IT Manager can understand interests from all areas to find courses of action towards the same mission. IT teams and employees of the organization feel identified and have a clear understanding of how they can participate in the common good and the expected business results. IT Leaders take their time to understand potential conflicts or miscommunication.

Finally, IT leaders are also able to recognize the gaps in competencies and can persuade their teams about the need to continue training through Continuous Education, something that has become the standard in IT ecosystems due to the dizzying speed at which technology changes

Key Features of Effective IT Management

According to ComputerWeekly, effective IT management “enables organizations to optimize resources and staffing, improve business and communication processes, and apply best practices. Individuals working in IT management should also demonstrate skills in general management areas such as leadership, strategic planning, and resource allocation.”
Based on this description, IT Managers must ensure that technological resources are used, maximizing as much as possible investments in IT and limiting the risks in its implementation. To do this, they must combine:

  • Structures: How the IT function is organized, its assigned responsibilities, and the role in decision making.
  • ·Processes: Including information systems and the measurement of their performance.
  • Relationship mechanisms: With stakeholder participation, collaboration between business areas and IT staff.

To carry out this, it is necessary to rely on innovative technology and tools that streamline the functions of the staff and the IT leader, such as:

  • Data analytics to get valuable insights that help improve operations, as well as identify the root of problems and even anticipate incidents.
  • Cloud computing for convenient access to data and services from any location, taking advantage of the benefits of cost efficiency, scalability, security and continuity with data recovery strategies. For teams, the cloud allows them to modernize systems and streamline their work so they can focus on other priorities.
  • Artificial Intelligence (including Cognitive Computing, which simulates human thinking) to analyze data, learn and predict problems, in order to improve the quality of IT services. Cognitive computing can be essential to managing IT and accelerating innovation. For technical issues and user support, you may leverage the use of AI-based chatbots acting as virtual agents.
  • Internet of Things, (IoT), by incorporating the Internet into everyday objects to drive efficiency, whether by collecting or analyzing data from devices and sensors. Cognitive Computing in IoT allows you to identify patterns and provide additional context, which improves decision making in an accurate and timely manner.

Now more than ever, IT Managers will always be a key in adopting new technologies to improve operations and meet business challenges.

IT Teams: Types and Functions

IT Teams, as we have seen, work with a wide range of IT services and equipment and each one is different, according to the needs of the company. Some are permanent and others have a specific duration according to the particular goal for which they were created. The types of IT Equipment and their functions are:

  • Operations Teams: in charge of critical infrastructure for business operations, including networks, data centers and web services. Their job is to monitor and ensure the availability of services and systems to support business operations. They are also known as IT Service Management (ITSM) teams. These teams are permanent.
  • Project Teams: focused on specific solutions for particular problems, the implementation of a system or a substantial change in IT. Their efforts are temporary, as once a project is completed the team can be disbanded or reassigned to other functions.
  • Support Teams: with responsibility for the maintenance and sustainability of the systems. They are usually permanent teams, (just like operations teams). They are in charge of IT service management to keep operations running. Also, like project teams, they are assigned to address specific problems and even several mini-projects.
  • Process Teams: in charge of improving processes related to business growth, also known as enterprise IT support teams. Their job is to manage and improve IT systems for a business process. These teams include analysts, project managers, and data analysts. They work closely with project teams to achieve specific results.

Conclusion

In the digital world, IT Management has become vital to achieve business results and to give continuity to operations regardless of contingencies or disruptions that may arise now and in the future. Also, IT Management must ensure that the employees of the organization adopt the technology and are involved in the strategic decisions of the technology. At the same time, the IT team must ensure that the company’s staff is productive and focused on the business. That is why IT Managers must become leaders in technology decisions, with well-structured teams capable of doing their job and contributing to innovation to face challenges and forge the competitive differentiation of the organization.

Market analyst and writer with +30 years in the IT market for demand generation, ranking and relationships with end customers, as well as corporate communication and industry analysis.

Analista de mercado y escritora con más de 30 años en el mercado TIC en áreas de generación de demanda, posicionamiento y relaciones con usuarios finales, así como comunicación corporativa y análisis de la industria.

Analyste du marché et écrivaine avec plus de 30 ans d’expérience dans le domaine informatique, particulièrement la demande, positionnement et relations avec les utilisateurs finaux, la communication corporative et l’anayse de l’indutrie.

 

 

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

ESET Threat Report: H2 2023 full of significant security incidents, AI-themed attacks, and Android spyware cases

  • ESET has released its latest Threat Report, which summarizes threat landscape trends seen in ESET telemetry from June 2023 through November 2023.
  • Cl0p, a notorious cybercriminal group known for carrying out ransomware attacks on a major scale, launched the extensive “MOVEit hack,” which surprisingly did not involve ransomware deployment.
  • ESET Research has identified specific campaigns targeting users of AI tools such as ChatGPT and the OpenAI API.
  • SpinOk spyware increased the overall count of Android spyware cases.
  • Android/Pandora malware compromised smart TVs, TV boxes, and mobile devices to utilize them for DDoS attacks.

BRATISLAVA — December 19, 2023 — ESET has released its latest Threat Report, which summarizes threat landscape trends seen in ESET telemetry and from the perspective of ESET threat detection and research experts, from June 2023 through November 2023. The second half of 2023 witnessed significant cybersecurity incidents. Cl0p, a notorious cybercriminal group known for carrying out ransomware attacks on a major scale, garnered attention via its extensive “MOVEit hack,” which surprisingly did not involve ransomware deployment. In the IoT landscape ESET researchers have identified a kill switch that had been used to successfully render the Mozi IoT botnet nonfunctional. Amidst the prevalent discussion regarding AI-enabled attacks, ESET has identified specific campaigns targeting users of tools such as ChatGPT and the OpenAI API. With spyware, there has been a significant increase in Android spyware cases, mainly attributed to the presence of the SpinOk threat.

“The Cl0p attack targeted numerous organizations, including global corporations and US governmental agencies. A key shift in Cl0p’s strategy was its move to leak stolen information to public websites in cases where the ransom was not paid, a trend also seen with the ALPHV ransomware gang,” explains ESET Director of Threat Detection Jiří Kropáč.

A new threat against IoT devices, Android/Pandora, compromised Android devices — including smart TVs, TV boxes, and mobile devices — and used them for DDoS attacks. ESET Research also noticed a considerable number of attempts to access malicious domains with names resembling “ChatGPT,” seemingly in reference to the ChatGPT chatbot. Threats encountered via these domains include web apps that insecurely handle OpenAI API keys, emphasizing the importance of protecting the privacy of users’ OpenAI API keys.

Among Android threats, SpinOK spyware is distributed as a software development kit and is found within various legitimate Android applications. On a different front, the second most recorded threat in H2 2023 is malicious JavaScript code detected as JS/Agent, which continues to be injected into compromised websites.

On the other hand, the increasing value of bitcoin has not been accompanied by a corresponding increase in cryptocurrency threats, diverging from past trends. However, cryptostealers have seen a notable increase, caused by the rise of the malware-as-a-service infostealer Lumma Stealer, which targets cryptocurrency wallets.

For more information, check out the ESET Threat Report H2 2023 on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) for the latest news from ESET Research.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Top 10 cybersecurity trends to watch in 2024

As we navigate through the rapidly evolving landscape of cybersecurity in 2024, it’s crucial to recognize the dynamic nature of cyber threats. Gartner forecasts that worldwide end-user spending on security and risk management will reach $215 billion in 2024, a 14.3% growth from 2023. This investment reflects the increasing complexity of digital risks. 

We explore the top 10 cybersecurity trends, each of them presents unique challenges and requires nuanced responses from cybersecurity professionals.

Key takeaways

  • Global cyber conflicts are escalating rapidly.

  • Data breaches in healthcare are increasing.

  • Remote work brings new security challenges.

  • Human error is the main reason for cybersecurity breaches.

  • Ransomware attacks require better response strategies.

Cyber warfare: an evolving threat in cybersecurity

In 2024, cyber warfare mirrors global tensions, growing in sophistication.

Russian cybercriminals disrupt Ukrainian and European supply chains, impacting aid delivery. A new group, “Cyber Toufan,” believed to be backed by Iran, attacked Israeli companies.

The U.S. grapples with cyber threats from Chinese state-linked threat actors. They have infiltrated about 25 organizations, including U.S. government agencies. Such cyber strikes demonstrate the growing scope of state-sponsored cyber-attacks and emphasize the need for robust cyber defenses.

Impact on the 2024 presidential elections

In the 2024 presidential elections, the shadow of past cyber intrusions looms large. The 2016 election was marred by Russian state-sponsored cyber-attackers who stole and leaked emails from the Democratic National Committee (DNC) and Hillary Clinton’s campaign chairman, John Podesta.

The trend persisted into 2020, when Fancy Bear, the Russian military intelligence-linked unit involved in the 2016 breaches, attempted to gain access to accounts of both Republican and Democratic political consultants, advocacy organizations, and think tanks. Although a specific attack on a Democratic presidential candidate’s advisory firm was thwarted, these incidents signal potential risks for the 2024 elections.

Healthcare sector vulnerabilities

The Health Insurance Portability and Accountability Act (HIPAA), established in 1997, sets strict rules for patient data protection in the healthcare sector. Despite this, healthcare continues to face significant cyber threats.

Recent trends in healthcare cybersecurity show both challenges and progress. The breaches, often due to unauthorized data access, underscore how vulnerable the sector is to cyber-attacks. In 2022, the U.S. healthcare sector saw 344 data breaches. By October 2023, this number decreased to 69 cases, a decline from the peak in 2015.

The consequences of these cyber-attacks are profound. They not only cause financial and reputational damage but also affect patient care. Recent data links ransomware attacks to higher mortality rates and longer hospital stays.

The high cost of health data breaches

From March 2022 to March 2023, the healthcare industry faced the highest costs for data breaches. On average, each breach cost nearly 11 million U.S. dollars. The financial sector ranked second in comparison, averaging 5.9 million U.S. dollars per breach. Across all sectors, the global average data breach cost was 4.45 million U.S. dollars.

Scheme with healthcare sector vulnerabilities in 2023 and 2024

Cybersecurity challenges in the hybrid work environment

In the hybrid work model, several cybersecurity risks are evident. The introduction of various devices and networks expands the potential for cyber threats. Limited control over remote workers and workspaces makes securing devices a challenge. Using public Wi-Fi, especially when traveling, increases exposure to cyber-attacks. Additionally, working across borders can lead to compliance issues with different data privacy laws.

Despite these risks, the shift towards hybrid work persists, making it essential for companies to enhance their cybersecurity strategies to navigate the changing environment.

Generative AI: a new frontier in cyber threats

Generative artificial intelligence, particularly in the form of deepfakes, has emerged as a novel threat in the cyber world.

In August 2023, Mandiant, a cybersecurity firm owned by Google, reported a groundbreaking discovery. They found deepfake video technology being explicitly crafted and marketed for phishing scams. Remarkably, the cost for these deceptive tools was minimal: $20 per minute, $250 for an entire video, or even $200 for a training session.

This development signals a trend in the cybercrime landscape, where advanced artificial intelligence becomes a tool for fraud at surprisingly low prices. This marks a new challenge in cybersecurity.

Supply chain attacks: a growing concern

In June 2023, a North Korean cybercriminal group breached JumpCloud, a SaaS provider, targeting cryptocurrency companies. A report by Chainalysis states that North Korean-linked groups stole about $1.7bn in digital cash through multiple attacks last year.

Supply chain attacks have surged, with a 633% increase in 2022 alone, becoming a prominent part of cybersecurity trends. Factors driving this trend include complex, global supply chains and the sophistication of cyber-attacks.

Picture showing third-party cyber risks

Cloud security and the threat of cloud jacking

Cloud jacking, where attackers hijack cloud accounts, surged in 2023. Cybercriminals exploited cloud vulnerabilities, used phishing or stolen credentials. Once inside, they could steal data, plant malware, or disrupt services. The growing reliance on cloud services widened the potential for such attacks.

Key trends in 2023 included more frequent attacks on SaaS applications and increased automated scanning for cloud weaknesses. Ransomware became a favored tool, locking organizations out of their own cloud data. In 2022, API security lapses contributed to the risks, with a 286% increase in API threats and 34% of organizations without a strategy to protect APIs, leaving 91% of APIs exposed to data theft.

Double and triple extortion

The trend of double and triple extortion in cybercrime has escalated. Techniques combining encryption, data theft, and DDoS attacks are more frequent. Data exfiltration is on the rise, with an increase from 40% in 2019 to 77% in 2022, with 2023 on course to surpass 2022’s total. With this upward trajectory, 2024 is likely to see a continuation of these cyber extortion tactics.

Double and triple extortion image with iconsSocial engineering and user privacy: the human factor

The human element is a significant factor in cybersecurity incidents, with 95% of breaches attributed to human error. This makes it not only a common issue but also a costly and serious one.

In 2023, several major security breaches occurred due to human errors. On January 11, 2023, MailChimp employees fell victim to social engineering by an external party, affecting 133 customers. This incident involved WooCommerce, a widely-used eCommerce plugin for WordPress, leading to the exposure of customer names, store URLs, and email addresses. MailChimp responded by restricting access and informing those affected. They assured that no credit card or password information was compromised. However, the breach highlighted the risk of potential phishing attacks aimed at obtaining credentials or introducing malware.

Picture saying '95% of cyber security incidents are caused by human error'

Ransomware threats: evolution and response

In 2023, ransomware attacks continue to threaten organizations, with attackers demanding payment to decrypt critical data. The impact is growing; U.S. healthcare organizations faced an average downtime of 18.71 days due to these attacks, up from 16 days in 2022. This underscores the evolving nature of cybersecurity trends in ransomware.

The rise of mass ransomware attacks

This year also witnessed a surge in mass ransomware attacks, with ransom-as-a-service groups exploiting software vulnerabilities to target numerous companies simultaneously. Notable incidents include the MOVEit and GoAnywhere software breaches, affecting hundreds of companies. Such widespread cyber-attacks signal a significant challenge for the cybersecurity and insurance sectors, potentially changing the industry’s approach to risk assessment and claims management.

Advancements in Zero Trust security

In the context of current cybersecurity trends, a positive development is also emerging. Zero Trust security, once a strategic goal, is rapidly becoming standard practice. By 2026, it’s expected that 10% of large enterprises will fully implement mature Zero-Trust programs, a significant rise from less than 1% currently.

Implementing Zero Trust is complex, requiring the integration of various components. The key to success lies in demonstrating its business value. Beginning with a simple, scalable approach allows organizations to progressively understand and adopt the framework, managing its complexity step by step.

Strategies for business safety in 2024

  1. Use multi-factor authentication (MFA) to regulate network access.

  2. Add extra authentication factors for administrative accounts.

  3. Assign minimal user privileges in line with Zero Trust principles.

  4. Secure remote devices with VPNs.

  5. Require strong, regularly-changed passwords.

  6. Encrypt all high-value data.

  7. Use data loss prevention (DLP) tools to track valuable data.

  8. Use intrusion detection systems/intrusion prevention systems (IDS/IPS) to track threats in depth.

  9. Back up data regularly.

  10. Audit backups and threat responses to ensure quick disaster recovery.

  11. Regularly test your security systems.

  12. Risk assess core threats and create response plans.

  13. Train all staff to detect phishing attacks.

New to NordPass?

You don’t need to be a rocket scientist to start using NordPass on a desktop device. Just add the standalone extension and you’re all set — no need to download or install the app!

Check out our detailed support guide for getting started with NordPass quickly and easily.

Once you have the new extension running on your browser, you can start using NordPass to its fullest extent.

If you have any further questions regarding the changes or NordPass in general, do not hesitate to contact our tech-minded support team at support@nordpass.com — they’re ready to take care of any issues you might have. Also, if you have any suggestions or feedback, simply submit a request for our team — we’re all ears, all the time.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Channel Program’s 2023 Holidaze is Here

Holidaze – 10 Days of Giveaways and Prizes

Join us in celebrating the holiday season! We’ve partnered with Channel Program as one of the sponsors for their Holidaze giveaway event.

For 10 business days, from Dec 4th – Dec 15th 2023, you can win prizes like gift cards, travel vouchers, tech gadgets, and more!

Channel Program will draw 2 prizes each day, with 3 grand prizes announced on the final day, December 15th, to help you kick off this holiday season.

Comet is giving away a PlayStation 5 to one lucky winner as one of the Grand Prizes.

Register today to enter the daily prize drawings starting on December 4th!

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

Don´t let cybercriminals steal your Christmas joy

Roman Cuprik

A new smartphone may sound like the perfect Christmas present until there is malware hidden in the device or the person´s identity gets stolen.

Smartphones have become an inseparable part of our lives, allowing us to communicate, make transactions, play games, or read news on the go. These devices became so prevalent that average screen time for users around the world reached 3 hours and 46 minutes in 2023, according to the Independent. Given this number, it is no surprise that 22% of people in the US have asked for a mobile phone as a Christmas present in 2022, according to Statista’s Global Consumer Survey.

 

The joy of finding a new smartphone under the tree is undeniable. However, there are a few things you should keep in mind before you start using it.

  1. Update software – keeping your software up to date is a crucial step in security as new updates fix bugs and vulnerabilities.
  2. Review app permissions – check and manage app permissions to restrict access to sensitive information and only grant necessary permission for each app.
  3. Review and customize privacy settings – go through the settings and customize them according to your preferences (or even better, security experts’ recommendations).
  4. Use a reliable security solution – using a reputable security software is key to making sure your device stays healthy longer, so you can continue enjoying your gift for as long as possible.

There are other Christmas temptations than just sweets

With its holidays and festivities, the end of the year is often a period when cybercriminal activity surges. The most common threats around the holidays include online shopping scams, delivery phishing scams or even gift card scams and identity theft and much much more.

Sometimes scammers even create fake online stores offering Christmas sell-offs with the intent to steal your money and data. Most likely, they want to trick you into downloading malware or get hold of your personal data.

For example, in late 2022, the holidays celebrated in December led to increased phishing activity impersonating unspecified online shops. Moreover, when mobile game developers rolled out new releases before Christmas, attackers exploited the hype by uploading their modified malicious versions to third-party app stores, according to ESET Threat Report T3 2022.

In turn, ESET researchers observed a significant increase in Android adware detections by 57% in the last few months of 2022, having been driven by a staggering 163% increase in adware and a growth of 83% in HiddenApps detections.

These are just the campaigns that ESET researchers detected at the end of 2022. Your brand-new smartphone can also fall victim to a ransomware attack, it´s vulnerabilities can be exploited and don’t forget the “old-fashioned” physical theft. 

How to bring the Christmas joy back?

To protect your smartphone, stay vigilant when browsing the web or the app store and install a high-quality cybersecurity solution that protects against most of these threats. 

ESET Mobile Security (EMS) Premium for Android deals with all of the situations we outlined earlier. Besides Antivirus Scan and Adware Detector, which are part of the free version, ESET Mobile Security Premium also includes features that turn this solution into a complex, multilayered protection capable of deflecting a wide scope of attacks.

The long list of features includes Payment Protection, Anti-Phishing, Call Filter, Anti-Theft and much more. On top of that, the latest version, EMS 9, brings a new, redesigned, and simplified installation wizard.

All these juicy features now come with a generous price drop, making it a gift that keeps giving. From December 23rd to January 6th , the premium version of ESET Mobile Security will be 50% off. There is no need for a promotional code; the discount will automatically be added to your checkout! It couldn’t be easier.

Try ESET Mobile Security today!

Boost your smartphones security for a more connected and hassle-free holiday. Stay safe, not just during Christmas, but all year round. The gift of a smartphone is one that can keep on giving or taking. May your holiday season be filled with joy and your digital experiences be not only festive, but also secure.

Wishing you a merry Christmas and a digitally protected New Year! 

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

7 ransomware attacks in 2023 you should know about

Ransomware is malicious software designed to block access to a computer system until a ransom is paid and remains a significant threat to organizations. In 2023, we witnessed some of the most prominent ransomware attacks.

Central to this wave of digital assaults is exploiting a vulnerability in a managed file transfer software product, MOVEit. The vulnerability exploited by the Russia-linked Clop ransomware group has left a trail of disruption across various sectors, affecting over 500 organizations and exposing the personal information of more than 34.5 million people.

Blog images 7 ransomware attacks in 2023 + SoMe

The evolving cyber threat landscape underscores a crucial reality: no sector is immune to the sophisticated tactics of modern cybercriminals. Let’s look at the biggest ransomware attacks of the last year.

7. Maine government data breach

Industry: Government

Location: United States

Affected users: 1,300,000

The government of Maine confirmed a significant data breach where over a million individuals’ personal information was stolen by a ransomware group linked to Russia. The breach exploited a vulnerability in the MOVEit file-transfer system used by the state government. Stolen information includes names, birth dates, Social Security numbers, driver’s licenses, and possibly medical and health insurance details. Maine’s Department of Health and Human Services and the Department of Education are the most affected agencies.

The breach’s extent was revealed after a recent assessment, and the state is notifying affected individuals. It’s unclear how recent the stolen data is. This incident is part of a larger MOVEit system breach, deemed one of the largest of the year. The US Securities and Exchange Commission has subpoenaed Progress Software for information related to the MOVEit vulnerability, and the company has pledged full cooperation.

6. McLaren Health Care data breach

Industry: Healthcare

Location: United States

Affected users: 2,200,000

A Michigan-based healthcare provider, McLaren Health Care, experienced a significant cyberattack resulting in the compromise of sensitive personal and health information of 2.2 million patients. The breach, later claimed by the Alphv ransomware gang (also known as BlackCat), involved hackers accessing patient names, dates of birth, Social Security numbers, and extensive medical information, such as billing, claims, diagnoses, prescription details, and Medicare and Medicaid information. The cyberattack was only detected a month after it happened.

The organization in question operates 13 hospitals across Michigan and employs about 28,000 people. The news of the breach became public in October, but McLaren’s spokesperson declined to provide further details or comment on whether a ransom was paid. Due to this cyberattack, McLaren now faces at least three class-action lawsuits.​

5. Mr. Cooper outage

Industry: Financial Services

Location: United States

Affected users: 4,000,000

A Texas mortgage and loan company, Mr. Cooper, acknowledged a cyberattack leading to a data breach. On Wednesday, the company experienced a technical outage on its website, preventing customers from online payments. It was later revealed that the outage was caused by a cyberattack that led to a system lockdown to protect customer data.

The company’s IT team took immediate containment measures and investigated the incident for potential data theft, promising identity protection services if needed. Later, the organization confirmed that customer data was compromised in the breach.

4. PharMerica data breach

Industry: Healthcare

Location: United States

Affected users: 5,800,000

A major US pharmacy service provider, PharMerica, has reported a data breach affecting nearly six million patients. The breach was discovered due to suspicious network activity and involved an unauthorized third party accessing PharMerica’s systems. The leaked data includes names, birth dates, Social Security numbers, medication, and health insurance details. Additionally, sensitive health information like allergy, Medicare details, and mental health diagnoses was also stolen.

The Money Message ransomware gang published the data on the dark web, which claimed responsibility for the attack and allegedly obtained 4.7 terabytes of data from PharMerica and its parent company, BrightSpring Health. PharMerica has announced measures to prevent future breaches but has not detailed these steps.

3. MCNA Dental ransomware attack

Industry: Insurance

Location: United States

Affected users: 8,900,000

One of the largest US dental health insurers, Managed Care of North America (MCNA) Dental, was targeted by a ransomware attack that compromised the personal data of about 9 million individuals. The breach exposed patients’ personal and health insurance information, including Social Security numbers and driver’s licenses.

The LockBit ransomware group claimed responsibility and demanded a $10 million ransom, eventually releasing the data as the ransom wasn’t paid. MCNA is unaware of any data misuse and has bolstered its security measures. Affected individuals are being notified and offered complimentary credit monitoring services in line with state law requirements. LockBit, which experienced a setback with the arrest of an alleged leader, reportedly stole 700GB of data, including sensitive patient information.

2. Maximus data breach

Industry: Business services

Location: United States

Affected users: 11,000,000

A US government services contractor, Maximus, confirmed a data breach potentially affecting 11 million individuals. The breach occurred through a zero-day vulnerability in MOVEit Transfer, a tool Maximus uses to share data with government clients. The hackers accessed personal data, including Social Security numbers and health information. While the exact number of affected individuals is still uncertain, estimates suggest at least 8 to 11 million people could be impacted.

Maximus has not specified the types of health data accessed and is in the process of notifying affected customers and regulators. They estimate the cost of investigation and remediation at around $15 million.

1. Lyca Mobile cyberattack

Industry: Telecommunications

Location: United Kingdom

Affected users: 16,000,000

UK-based mobile virtual network operator Lyca Mobile confirmed a cyberattack on its systems, which led to unauthorized access to customers’ personal information. Lyca Mobile took immediate action, such as isolating and shutting down compromised systems. However, intruders accessed personal data, including names, birth dates, addresses, identity documents, customer interactions, and payment card details.

Lyca Mobile encrypts data, including passwords, during transmission and when it’s not actively used. However, the company has not disclosed the encryption methods used, and it remains uncertain whether the attackers obtained the encryption keys. The company has not provided details on how the breach occurred, or its nature, but data theft suggests a potential ransomware connection.

Lyca Mobile has informed the UK’s Information Commissioner’s Office (ICO), and the ICO is assessing the information provided.

How to protect your business

As ransoms for data decryption range from a few hundred to thousands of dollars, it’s one of the most lucrative opportunities for cybercriminals. Therefore, protecting your business from ransomware involves a multifaceted approach. Here are some effective strategies to protect your business against ransomware.

Educate employees

Employees are often the weakest link in cybersecurity and the first defense against cyber threats. Educating them about warning signs, safe practices, and response strategies is crucial for preventing malware intrusion. In addition, conduct regular training sessions to educate them about phishing scams, a common entry point for ransomware. Timely recognition of a phishing email can save millions of dollars.

Implement access controls

Limit user access to data and information, granting access only to those who need it for their work. This principle of ‘least privilege’ can minimize the extent of a ransomware attack. Software installation and execution abilities on your network devices should also be limited as it minimizes the network’s vulnerability to malware.

Regular data backups

Regularly back up your data and ensure these backups are not connected to your main network. Offsite or cloud-based backups can be effective as they shouldn’t be affected during a breach of your main network. In the event of an attack, you can restore data without paying a ransom.

Update systems and software

Keep your operating systems, software, and applications updated. Cybercriminals exploit vulnerabilities in outdated software. Implement a patch management strategy to ensure timely updates. Also, consider implementing methods for regular scans to help maintain system efficiency.

Use email filtering solutions

Exercise caution with links in emails or pop-up messages. Don’t click unless you’re sure of their legitimacy. When in doubt, hover over a link to see the real URL before clicking. Be wary of email attachments or downloads, as they can contain malicious software. Implement advanced email filtering solutions that can detect and block phishing emails, a common ransomware delivery method.

How can NordLayer help?

In light of these incidents, organizations and individuals must prioritize cybersecurity measures. Regularly updating security software, implementing robust backup strategies, and training staff on recognizing phishing attempts are key steps in mitigating the risk of ransomware attacks.

Upgrading your current remote network access solutions could also enhance the organization’s overall security. NordLayer aids businesses by offering sophisticated network access and management solutions. Our services authenticate each access request in line with the Zero Trust security model, boosting data protection and limiting the attack surface.

NordLayer’s security offerings include a VPN and multi-factor authentication, all tailored to meet your business requirements without needing extra hardware.

Get in touch with our sales team to learn more about our offerings.

New to NordPass?

You don’t need to be a rocket scientist to start using NordPass on a desktop device. Just add the standalone extension and you’re all set — no need to download or install the app!

Check out our detailed support guide for getting started with NordPass quickly and easily.

Once you have the new extension running on your browser, you can start using NordPass to its fullest extent.

If you have any further questions regarding the changes or NordPass in general, do not hesitate to contact our tech-minded support team at support@nordpass.com — they’re ready to take care of any issues you might have. Also, if you have any suggestions or feedback, simply submit a request for our team — we’re all ears, all the time.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.