Skip to content

Understanding the Ins & Outs of Cyber Risk Quantification

Introduction

In today’s digital world, cyber risk is high and growing. The best way to control this risk is with a proactive cyber security strategy that quantifies and measures your company’s vulnerability to theft, fraud, or data breach.

The cyber threat landscape is diverse, and there is a wide range of potential threats in this sector, such as intellectual property theft, ransomware, data breaches, DDoS attacks, and insider threats. As cyber criminals improve on new methods for making threats, it is therefore important for cyber security professionals to be on top of where the latest threats are to hide from evolving threats. But for a company to achieve this, it must first understand the risks of cybersecurity, be vigilant in its security stance, and be aware of its accompanying risks.

Cyber risk quantification (CRQ) is the primary route to understanding the cyber threat landscape and mitigating risks within a cyber security environment. Cyber risk quantification is also part of Cyber Security Risk Management and is a crucial part of an organization’s overall security posture. It involves assessing risks relating to various cybersecurity topics, such as vulnerabilities, threats and impacts. Quantification addresses measurement, tracking and reporting on the risks relating to specific topics to prepare for cyberattacks effectively.

Risk quantification is determining how likely a threat or attack is to be successful against your organization and then assessing the severity of such an event. Cyber risk quantification is a part of this process, and it pertains specifically to threats that target information on computer networks or in physical systems, like computer networks or smartphones. These include both internal threats (such as employees) and those from external sources (hackers).

Risk quantification is an enterprise tool to help them understand their existing cyber risk environment. It also enables them to devise effective strategies for reducing those risks by implementing appropriate controls.

 

What is Cyber Risk Quantification?

This process of cyber risk quantification has been described as a three-step process: identifying the “pen-testing assets”, counting vulnerabilities, and measuring the potential threats. These steps represent a holistic approach, allowing a comprehensive view of one’s cyber risk posture and its vulnerabilities, threats, and risks.

At its core, cyber risk quantification is not a specific set of rules or methodologies but rather a method for conducting a rigorous, in-depth analysis of subjecting any IT infrastructure. The intent is to obtain objective evidence to develop strategies for reducing risks and ultimately strengthening an organization’s cyber resilience.

Benefits of Cyber Risk Quantification

Cyber risk quantification is important in ensuring that cyber threats are understood and can help cyber security teams analyse vulnerabilities and risks and create cyber risk mitigation strategies. The following are the benefits of cyber risk quantification.

Provides Insights into Vulnerabilities

An analysis of the information technology assets allows companies to understand their cyber risk posture and quantify their security vulnerabilities. The process makes companies feel more secure in knowing they are not as vulnerable as they originally assumed.

Helps Identify & Mitigate Threats

Cyber risk quantification is a process that helps identify the number of potential threats within an organization. It helps determine what the company needs to do to prevent a cyber attack.

Provides Information for Basing Decisions

The cyber risk quantification process allows the creation of an actionable and detailed plan for organizations to make informed decisions about protecting themselves from cyberattacks.

Helps Identify the Need for Resources

Companies can use the cyber risk quantification process results to determine what resources are required to reduce or eliminate current organizational threats and vulnerabilities.

Risk Management Decision

After a cyber risk quantification process, one can better understand their current security posture and related cyber risks to well-informed decisions about reducing this risk.

Automating the Process

Can automate cyber risk quantification to save time and labour. It means that technicians will not have to spend time performing cyber risk quantification on each piece of information technology equipment.

Cost-Effective

The overall cost of implementing cyber risk quantification will not be much more than processing a security vulnerability assessment.

 

Determining the Company’s Cyber Tolerance

Can use the information obtained for identifying and developing cybersecurity strategies for the foreseeable future. It means that the consequences of an attack during this planning period are less severe than those that would experience after a cyber attack once an organization has planned out their cyber security strategy.

Determining the Potential Cost of a Cyber Attack

Companies can use cyber risk quantification to estimate the cost of a successful attack and use this to determine how much money should be allocated towards mitigating the impact of an attack.

Planning Effective Training Programs

The results of a cyber risk quantification process can be used to create more effective training programs and plan for an organization’s IT infrastructure training needs.

 

How to Leverage on Cyber Risk Quantification

Cyber risk quantification can be leveraged on the following levels:

Organizational Levels

The senior management of an organization needs to determine the organizational level of cyber risk quantification. The level at which this model is used will depends on how large and how organized an organization is.

For example, an enterprise with thousands of employees or many systems will benefit from applying this model at a higher level (e.g., enterprise-wide) than a smaller company that runs just one corporate system.

Site Level

Organizationally focused cyber risk quantification methods can be applied to each site. It is the level at which most companies are structured; they have one or a few locations and may have dozens of sites. The IT personnel at each site may also not have direct access to all the data needed for an effective cyber risk quantification model.

Process Level

Many organizations are involved in processing large amounts of data (e.g. processing credit card information or handling employee information). These organizations can apply the same data processing methodologies to cyber risk quantification and perform a different amount of manual data analysis.

Asset Level

Cyber risk quantification can be applied to a specific asset (e.g., a server, router, switch). It is an effective method for performing cyber risk quantification on small network environments or those with limited access to the underlying devices on a network.

Information System Level

This level is useful for the entire IT infrastructure. Most organizations would benefit from a more holistic enterprise approach to cyber risk quantification.

Individual Asset Level

Some organizations may have large network environments that do not need a holistic enterprise-level approach to quantifying cyber risk. Some systems are relatively small and easy to manage individually with minimal use of IT resources.

Application Component Level

An individual application component (e.g. a web server) is typically not a significant resource on its own, and it has unique vulnerabilities that need to be fixed. In most instances, cyber risk quantification of an application component will include looking at its counterpart components. It would be a rare occurrence for those performing cyber risk quantification on an individual asset level.

Challenges of Cyber Risk Quantification

Cyber risk quantification is a challenging task because of the numerous variables can have an impact on how risks are quantified. Some of the most common factors that have to be considered when performing cyber risk quantification include:

Data Visibility

The amount of data for analysis is often limited in the cyber risk quantification process. It means that the available data has to be collected from a relatively small number of sources and then analyzed using an automated method.

Can’t Calculate Risk

Cyber risk quantification could be a better science. Often, organizations will need a higher level of understanding concerning the vulnerabilities they are trying to quantify and the impact a successful cyber attack would have on their company.

Partial Remediation

Sometimes, a company can perform some level of remediation, but not all of its IT infrastructure components. It is often the case in smaller companies where policy and security costs can be very high.

Time Frame of Analysis

Cyber threat intelligence is always changing, and so is the level of risk for an organization, even for an asset within that organization. Cyber risk quantification models must be set up to keep pace with these changes.

Data Manipulation

The information is also analyzed against other data that has been manipulated and stored for analysis. While this does not mean that all data is manipulated, it does mean that some data may have been tampered with or changed to alter the analysis’s findings (e.g., personal information).

No Consistent Methodology

Cyber risk quantification is not an exact science; therefore, it cannot be performed consistently.

No Standardization

The model used for cyber risk quantification may depend on the organization and the structure of its IT infrastructure. It is challenging to translate results from one organization to another or even use it across various industries.

No Known Method

Studies have shown that industry and IT experts do not widely accept any known cyber threat quantification methodology.

 

Conclusion

Cyber risk quantification stands as an emerging field in cybersecurity, that will undoubtedly play an increasingly crucial role in the future of cybersecurity for assessing organizational risk before potential attacks occur.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

You Are Concerned About Data Privacy – but Are You Doing Anything About It?

You’d be hard-pressed to find someone who doesn’t care about their privacy. It’s human nature. You want control over what private information you share and who you share it with. Unfortunately, you can lose this control with a careless click.

What is private data?

Private data is anything that reveals information about you. It can be your name, your photos, your posts on social media, your email addresses, or your IP.

Some of these details are highly sensitive, including your banking information, genetic data, health records, social security number, and home address. As a rule of thumb, any information that could cause you financial or reputational damage can be considered sensitive.

What is data privacy and why is it important?

Data privacy, also known as information privacy, generally refers to a person’s right to choose for themselves when, how, with whom, and to what extent they want to share their private data with others.

As internet usage has become ubiquitous over the years, so has the importance of data privacy and protection. Various websites and applications often collect your private data in exchange for its services.

Some platforms and applications may exceed their reach when it comes to data collection, storage, and usage. Others may have a lax attitude toward private data protection.

The key questions to ask when talking about data privacy are:

  1. Who has access to information about you?

  2. Who controls this access?

  3. Is it secure?

When private data falls into the wrong hands, consequences can be dire. A data breach on an online platform could put your sensitive information into the hands of cyber crooks. Users whose data is leaked are put at risk of identity theft, bank fraud, and other online-related scams and crimes. These days, data is king and there’s no way around it. Thus, it’s not surprising that protection is paramount.

Your privacy in the hands of the government

Various entities handle your private data. First – the government and its institutions. Let’s take the justice system as an example. You cannot go to court or file a claim without revealing your identity. And that’s fine — it wouldn’t be fair to the other side if you were suing them anonymously.

Similarly, you can’t get public services (for example, electricity, a high school education, or healthcare) without identifying yourself.

In a perfect world, the government does not infringe upon your privacy more than necessary. In the real world, some governments store every bit of data they can get their hands on. Even worse, others engage in mass surveillance of their citizens.

Your privacy in the hands of businesses

You can buy apples at a fruit stand and remain a stranger to the vendor. But buy apples online, and you’ll give away private information about yourself. It may be a fact as simple as you liking apples. This information will be sold to an advertiser, and the next time you go online, an ad for apples will pop up on your screen.

Almost everything you do online leaves a data footprint. You have little control over how your digital footprint is collected.

Usually, it works like this. Before you start using a new online service, you have to read a wall of fine print. But you don’t, because who has time to wade through paragraphs of legal jargon? You click “Agree,” and that’s how you begin to give away your private data. The agreement can’t be changed, and you cannot bargain — take it or leave it. This service will collect your data and use it for marketing purposes or sell it to the highest bidder. And there’s nothing you can do.

It’s easy to say “Don’t use these services.” The problem is that most online services collect information. If you want none of your private data on the internet, you have to quit using the internet. And that’s a price most people find too high to pay.

Data protection laws

Over the years, as technology and the internet came to be an inseparable part of our lives, governments around the globe took part in creating and passing laws regulating private data. Most countries today have various laws governing data collection, storage, and usage. Here are some of the most important and impactful ones:

The General Data Protection Regulation (GDPR)

The GDPR regulates data privacy laws across all EU member countries. It was designed to replace previous data regulation laws and provide greater protection and rights to individuals, essentially giving subjects the right to control their personal data and ensuring the right to be forgotten. The GDPR also outlines how individuals’ private data should be collected, stored, and used as well as outlining the limitations. The GDPR is one of the most impactful and comprehensive regulations developed in the past decade.

Data privacy laws in the US

At the moment, the United States has no federal law or legislation that comprehensively addresses data privacy. However, individual states have enacted their own laws and regulations to address issues of data privacy in different industries such as healthcare, finance, and marketing. But, even with all these different laws and regulations, there’s still one important agency that helps to make sure everyone is following the rules.

The Federal Trade Commission (FTC) is the agency that oversees data privacy regulations and ensures consumer protection. The FTC Act grants the organization the authority to prevent unfair or deceptive trade practices and enforce privacy laws.

The FTC can take action against organizations that fail to implement reasonable data security measures, violate consumer data privacy rights, or engage in misleading advertising practices.

There are also other federal laws that govern the collection of information online, such as the Children’s Online Privacy Protection Act (COPPA), the Health Insurance Portability and Accounting Act (HIPAA), the Gramm Leach Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), and the Family Educational Rights and Privacy Act (FERPA). These laws focus on ensuring the protection of specific types of information, such as data related to children, health, and finances.

National data protection laws

Many countries around the world, including Australia, Canada, and Japan have comprehensive data protection laws in place that outline the ways personal data should be handled, much like the GDPR.

Increasing use of AI and ML in data protection

As we move into 2023, the use of artificial intelligence (AI) and machine learning (ML) in data security and privacy is becoming increasingly prevalent. AI can be a powerful tool for protecting consumer privacy.

In 2023 we’ll start seeing an increase in the use of both AI and ML to proactively identify and prevent cyber threats and detect patterns that may indicate a potential data breach.

However, data protection through automation has not yet advanced as much as we would like. Nevertheless, in 2023 and beyond, we can expect to see significant improvements in this area as the technology matures and becomes more suited for ensuring the privacy and security of sensitive data.

Data security and privacy will be a priority for consumers

Because data breaches are more common and sophisticated than ever, consumers are unsurprisingly becoming more vigilant about the security of their personal information. Increasingly more people these days are being selective about who they trust with their data. A company’s data-sharing practices and policies now are a crucial factor for many consumers.

In 2023, businesses should be ready for increased scrutiny around their data security and privacy practices. If you are a company that looks to succeed this year, it is vital for you to earn and maintain the trust of your clientele by being transparent about your data protection approach. Trust is a two-way street, and in today’s digital age, it’s more important than ever.

Increasing collaboration between government entities and private companies

Because a decrease in cyber criminal activity is nothing we can bet on in 2023, expect to see heightened levels of collaboration between private companies and government entities aiming to improve data security and privacy.

The collaboration between private and government entities may take many forms, from joint research and development of new security technologies and processes, to more information-sharing in an effort to craft well-rounded regulatory mechanisms.

The rise of passwordless authentication and regulation of biometric data

Passwordless authentication methods are already gaining popularity due to their convenience and security benefits. In 2023, we can expect to see more online service providers adopting various forms of passwordless authentication.

The major advantage of passwordless authentication is that it eliminates the need for users to remember and manage multiple passwords. Additionally, passwordless authentication greatly reduces the risk of password-related security breaches. However, most passwordless technology leverages biometric data for authentication purposes and 2023 might be the year when we will see more regulatory entities coming up with standards and requirements to ensure the secure storage and handling of biometric data. We might see laws and regulations establishing best practices as well as penalties for entities that fail to comply with such standards.

What can you do to protect your data privacy?

Information privacy will become an even hotter topic once technologies create more invasive tools. You’ll be surrounded by facial-recognition cameras, smart speakers that listen to your conversations, e-textiles, wearable health monitors, and other data-gathering gadgets.

That means you must take action now:

  • Foster healthy online habits. Refrain from publicly sharing your personal information on social media. Leverage privacy settings and make your social media profiles private to limit exposure. Be weary of attachments or links in emails that come your way from unknown senders. Make use of multi-factor authentication (MFA) and enable it on your online accounts whenever possible. Use strong, unique passwords for all your accounts and employ a password manager to securely store your passwords and other sensitive information.

  • Use tools and services that enhance your privacy. Choose private search engines, private email providers, and privacy-focused browsers. And use encryption tools — they’re much more user friendly than they sound. NordPass itself uses state-of-the-art encryption to protect your passwords. In addition, NordVPN makes sure your traffic is invisible to your internet service provider.

  • Don’t need it? Then don’t use it. Don’t sign up if you don’t really need the service. And if you do need it, read the fine print before clicking “Agree.” If the fine print is too complicated, look for comments and reviews regarding the service’s privacy policies.

Fight for information privacy and make the internet better for all.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Google Cloud Security best practices

Cloud adoption continues at a rapid pace. Security is becoming a critical priority as companies move assets and data to locations like Google Cloud Platform (GCP).

Cloud platforms host customer databases, powering worldwide eCommerce empires. They allow workers in different countries to communicate, share files, and collaborate on complex projects. And they reduce hardware overheads, driving down costs.

Whatever role they play, cloud services need robust protection. This blog will look at how to secure assets on GCP. While Google’s tools offer some protection, there are plenty of things companies can do to supplement those tools. Let’s look in more detail and offer some best practices to boost your Google Cloud security.

What is GCP?

Google Cloud Platform is a collection of cloud-based services based on the powerful Google Compute Engine. GCP allows users to host apps, store data, implement machine learning processes, and manage app development. It also integrates with other Google services, including Gmail and Docs.

GCP can host a few SaaS apps or scale up to IaaS and PaaS implementations. It is a go-to platform for hosting Kubernetes cubes and cloud storage containers, with a strong record for resource availability. However, clients must implement their own security controls to protect resources hosted by GCP.

GCP security seeks to protect assets hosted on the Google Cloud Platform. The scope of security policies varies depending on each user’s cloud architecture. For example, if you use a single SaaS service, security mainly relates to access control to that individual app. But if you use a PaaS solution, security must apply across the infrastructure stack.

What challenges does Google Cloud Platform face?

GCP users face a range of security challenges. Here are some critical issues you will likely face when following GCP security best practices.

1. Ensuring visibility

The flexibility of GCP makes it popular with cloud architects. But flexibility comes with a price: confused and complex visibility. Cloud assets can come online and disappear within hours. Security teams may not know when app configurations change. Keeping track of cloud-based assets can become extremely difficult.

Tracking threats and applying security controls is impossible without strong visibility. You cannot secure apps that change constantly. Environments with poorly controlled user privileges can spiral out of control, creating huge surfaces for data thieves to exploit.

2. Managing privileges

Over-provisioned users pose a critical threat to cloud environments. If attackers gain the credentials of over-provisioned users, they can access confidential data, change app settings, and compromise cloud performance. Watertight access control is essential.

Security teams must create logical privileges for roles and individuals. Every GCP-hosted app requires a separate privileges policy. And admins must classify data, keeping sensitive information locked away from most users.

3. Application sprawl

Without clear policies on provisioning apps, GCP environments easily fall victim to application sprawl. It is extremely easy to spin up virtual machines or add new apps on the Google platform. The resource hierarchy can change in an instant.

Balancing flexibility and security is a central challenge. Companies need clear hierarchies that reflect their organizational needs. But users need the freedom to reshape cloud environments to fit different circumstances.

4. Identity management at the cloud edge

Managing access to on-premises networks is simple. Authentication occurs at a well-defined edge. But this isn’t the case with GCP. Users can access a cloud resource anywhere. They can use multiple devices and log on via insecure public networks. This makes robust IAM essential.

Security teams require ways to authenticate every connection request. This is particularly difficult in multi-cloud settings. As a result, companies often implement Single Sign On (SSO) to bring all cloud assets together.

5. Cloud misconfigurations

Poorly configured GCP apps present an open door for attackers. For instance, researchers have expressed concerns about attacks originating from misconfigured virtual machines.

Users can also misconfigure the internal IAM tools that Google provides. Administrators may fail to apply domain restricted sharing to GCP containers. Or they might fail to engage logging services to detect threats and weaknesses.

Another common issue is misconfigured VPC firewalls. These firewalls surround cloud data with additional protection. But admins can set overly broad IP address ranges, permitting too much access to sensitive data.

6. Uncontrolled outbound access

Users must secure access to networks. But they also need to manage data flows from cloud assets. Data Loss Prevention (DLP) tools can track files and data and block unauthorized exfiltration. But restrictions on outbound access are not always applied properly.

7. Unpatched GCP assets

Unpatched VMs present a constant security risk. Attackers can exploit privileged access to connected resources or launch horizontal attacks if cloud environments are improperly segmented.

GCP users are responsible for patch management. However, they are not always aware of their duties under the shared responsibility model. Legacy threat scanning tools can also miss unpatched cloud assets. Cloud-native, automated update management tools can fill the gap if security teams choose to use them.

Why is GCP security Important?

There are three core reasons to follow GCP security best practices:

  • The GCP hosts vast amounts of confidential information. Data encryption, robust authorization and authentication processes are critical to prevent malicious access to this data.

  • Assets on GCP are available 24/7 for companies to access. This maximizes uptime and availability. But it broadens the threat surface, requiring robust security counter-measures.

  • Data security regulations apply to critical assets. Users of GCP must protect information covered by GDPR, HIPAA, or PCI-DSS.

These three issues demand a comprehensive security response. Companies must classify and secure data. They must manage access and apply encryption. And they need to apply regulatory frameworks through auditing and security planning.

Cloud-based security features in GCP

Google has included a wide range of security features in GCP. Best practices include leveraging these features where possible while supplementing them with external tools. Important internal security features include:

  • Virtual Private Cloud (VPC) – Allows users to create segmented VMs or VM groups, with stateful firewalls and network security controls.

  • Data encryption – All data in transit through the GCP is encrypted. Data at rest is also encrypted and unreadable to outsiders.

  • Cloud Key Management – Centralized customer-managed keys tools allow administrators to distribute and change keys. This can integrate with hardware keys for secure remote access.

  • Logging – Google provides access to continuous activity logs. Users can visualize security easily with real-time data.

  • Data Loss Prevention (DLP) – Targets sensitive data and prevents outward transmission to unauthorized actors.

  • Binary Authorization – Secures Kubernetes clusters by creating trusted workloads.

  • Web App and API Protection (WAAP) – Monitors API activity for common cyberattacks. Allows users to assess integrations with GCP environments, making new app implementations safer.

  • Identity and Access Management (IAM) – Enable users to control access to GCP environments. Provides a way to authorize actions within apps and groups. Unifies GCP workloads into one pane of glass.

  • Cloud Asset Inventory – Allows admins to quickly inventory connected apps and track any changes as they occur.

External security systems work alongside these internal tools. For example, network penetration testing by third-party software can verify the effectiveness of GCP security. SSO and external IAM cover hybrid networks with multiple cloud deployments. VPNs encrypt data outside GCP, guarding user credentials.

Google Cloud Platform (GCP) security best practices

Companies need to create and implement a data security strategy for their GCP deployments.

This strategy should leverage the internal tools listed above while taking into account specific business needs. Best practices for GCP security include:

1. Implement Google Cloud IAM

Identity is the new battleground in cloud security. Attackers constantly seek high-value user credentials and access to confidential customer or corporate data. That’s why implementing Google’s native IAM systems should be a core priority.

Google IAM allows you to:

  • Set privileges for GCP resources – The most important role of IAM. Admins can set permissions for roles or individuals and determine which apps or workloads are available to each cloud identity. Privileges can be extremely detailed to protect sensitive data. Or they can be more general for low-value assets.

  • Enforce safe email policies. Only allow access to cloud platform services from corporate email accounts. Prevent access by personal accounts.

  • Strengthen admin accounts with security key enforcement. Security keys are even more robust than MFA factors. They apply to high-privilege users such as senior developers or administrators.

  • Prevent user access to service accounts used by VMs and automated processes. Reduce the number of user-managed service account keys to an absolute minimum.

A strong IAM system locks down user and service accounts. Insecure connections will be denied or limited. Access to resources will only be possible to authorized users based on need.

However, don’t stop with Google’s internal IAM. Some critical IAM cloud functions require outside assistance.

For example, when you use the GCP, you can allowlist IP addresses to block dangerous devices or networks. There is no realistic native way on Google Cloud to allowlist IP addresses. But you can use external allowlisting solutions like NordLayer to harden your overall cloud security setup.

2. Visualize your cloud environment

Google allows companies a lot of control over how they segment cloud environments. But to create a secure architecture, assets and data must be visible and well-understood.

Use GCP’s internal tools to discover connected apps and create a map of the assets you need to protect. Try to trace the connections between resources. If you understand data flows and user requirements, you can create efficient groups to apply security controls.

Connect roles to cloud assets and target privileges to guard resources. For example, accountants or sales teams may require access to cloud SQL instances, but other employees do not. Always map roles to assets to avoid over-privileging users.

3. Protect assets via Virtual Private Clouds (VPCs)

VPCs are guarded by internal firewalls but can communicate securely via VPC peering. IAM tools enable precise controls over VPC access, and you can create private clouds for projects or departments.

This segments the cloud environment, preventing horizontal movement for malicious actors. For instance, you can set robust barriers around cloud storage containers handling financial information – a valuable aspect of compliance strategies.

4. Use Customer Supplied Encryption Keys (CSEK)

Google Cloud Platform users can rely on keys supplied by Google. But they can also provide their own encryption keys. This is potentially a more secure option.

With CSEK, keys are only known to your employees. Nobody within Google can access them. You have total responsibility to manage and change them when needed.

By default, data handled by the Compute Engine is protected by 256-bit AES encryption. Customer-supplied keys supplement this protection. They also give you more control over assigning keys and managing access.

5. Enable MFA for Google Cloud resources

Multi-factor authentication adds an extra layer of identity protection when logging onto cloud assets.

MFA is not a default setting, so admins will need to remember to engage it via the IAM console. Google Cloud users can add third-party identity providers if required. This allows users to connect via external apps, making remote access more secure.

MFA options on GCP include various cloud identity factors. This includes one-time passwords, email codes, or secure links sent to user devices. You can use separate authentication hardware for high-security connections or rely on less secure SMS-based authentication for a smoother but less secure access process.

6. Centralize logging processes

Google Cloud’s best practices include achieving total awareness of user activity and app configurations. Google provides a suite of logging tools that collect and present information for security teams to monitor.

Users can implement Cloud Logging to collect data from Google Cloud projects. Each project has its own log bucket to contain data, and users can analyze this information via the Logs Explorer tool. You can also enable flow logs to gather information from Kubernetes clusters or VM groups.

If possible, integrate Cloud Logging with your enterprise-wide SIEM systems. Google lets you export log data to many popular SIEM solutions. This makes it easier to track network security via a single pane of glass. Specialist SIEM solutions also tend to provide more functionality than Google’s internal monitoring tools.

7. Use security foundations blueprints

Security managers do not need to work in the dark when implementing GCP best practices. Securing novel cloud settings such as GCP can be challenging without prior experience. That’s why Google offers a series of security foundation blueprints.

Blueprints provide guidance and recommended security practices. Subjects covered include critical tasks like key management, network segmentation, logging, and authentication. The information is presented in a general format but includes plenty of suggestions that will apply to most GCP implementations.

8. Automate security to boost efficiency

Administrators can automate many security functions on Google Cloud. Automation reduces the risk of human error and liberates time to spend on critical security tasks.

The Security Command Center collects threat intelligence and can automatically transfer alerts to third-party SIEM systems. Users can also create automated compliance policies to check that GCP assets are properly configured.

Admins can automate password security, demanding regular resets and enforcing strong passwords. And automated app updates help stay on top of virtual machine patches. Most tasks on Google Cloud have automation settings. Leverage them where possible as part of Cloud Security Posture Management (CSPM).

How NordLayer secures access to Google Cloud

Google Cloud Platform is an easy-to-use, flexible, and feature-rich cloud hosting platform. And many companies use Google Cloud as a location to store or exchange confidential data. This is efficient and cost-effective, but relying on GCP comes with security risks.

Following the GCP security best practices outlined above will help achieve data security. Users can encrypt information, set internal IAM policies for apps and containers, and create firewalls around virtual machines.

However, a robust GCP security posture requires a mix of Google’s internal security functions and external solutions. NordLayer provides the ideal solution when securing Google cloud deployments.

NordLayer allows admins to integrate GCP security into their general IAM setup. Users can ensure secure access to apps via MFA and use Single Sign On to access all cloud assets quickly. They can strengthen access control with IP address allowlisting, which admits authenticated users and blocks unknown or insecure IP addresses. NordLayer applies network segmentation to separate GCP assets and encrypts data in transit to hide it from outsiders.

Add another layer to your GCP security posture with NordLayer. Our tools allow you to combine external and internal security controls. The result will be a GCP security setup that covers every vulnerability. Contact the NordLayer team today to find out more.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Ransomware attack on insurance MSP Xchanging affects clients

Global IT services and solutions provider DXC Technology announced over the weekend a ransomware attack on systems from its Xchanging subsidiary.

Xchanging is known as a managed service provider for businesses in the insurance industry but its list of customers includes companies from other fields: financial services, aerospace and defense, automotive, education, consumer packaged goods, healthcare, manufacturing.

Several customers affected

DXC Technology notified its investors in an 8-K form filed with the U.S. Securities and Exchange Commission that Xchanging has detected a ransomware attack on some of its systems.

The company reported the incident on July 5, expressing confidence that it did not spread outside the Xchanging network. For the moment, the investigation did not reveal any indication of data being affected. It is unclear when the company detected the attack.

An undisclosed number of customers was impacted by the cyberattack, denying access to their operating environment, reads the notification from the company. Containment and remediation measures were deployed to resolve the situation.

In a statement to BleepingComputer, a company spokesperson said that the problem is isolated to a subset of the Xchanging business and that customer data was not compromised or lost.

Efforts to restore services to customers are ongoing and at the moment remediation work is being done for just a few of them.

“While the revenue from those impacted customers is not material to DXC financial position, we nevertheless take this situation very seriously and have already restored services as nearly all of them” – DXC Technology spokesperson

As is typically the case with such incidents, the company is working with law enforcement and authorities on the investigation. This is also why there are few details available at this time.

There is no information about the family of the file-encrypting malware used in the attack and BleepingComputer does not know of a ransomware gang claiming the attack.

Related Articles:

Ransomware hits Technion university to protest tech layoffs and Israel

The Week in Ransomware – February 10th 2023 – Clop’s Back

Clop ransomware claims it breached 130 orgs using GoAnywhere zero-day

City of Oakland systems offline after ransomware attack

A10 Networks confirms data breach after Play ransomware attack

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Bullwall
BullWall is a fast-growing international cybersecurity solution provider with a dedicated focus on protecting critical data during active ransomware attacks. We are the only security solution able to contain both known and unknown ransomware variants in seconds, preventing encryption and exfiltration across all data storage types.

Hardening, do you know what it is?

For a long time in Pandora FMS blog we have devoted ourselves to defining and shelling with elegance that extensive and convoluted glossary offered by technology terminology.

You know our saying: The key is to make an impression in technical talks with your boss!

Therefore, today we are going to choose a very trendy word in the meetings of executives in The City of London and in those among the new school of developers in Silicon Valley:

Big-boss-campaign!

Didn’t you know it? Seriously?

Well… yes, calm down, we’re kidding. As it says in the title and in the keyword, today we will delve into the explanation of the term  Hardening. One of the most preppy words that our head of support Mario Pulido will help us dissect, also known over here as “The quiet man”.

Do you already know what hardening is and how it can help you?

Very good afternoon, Mario. We are sorry to unexpectedly enter your quarters here, but a doubt has suddenly come to us and our dear readers:

What is hardening?

Very good afternoon, Dimas! Don’t worry, you just caught me at my Zen tea break. So, no problem, I’ll fill you in!

In computing, hardening is a set of activities carried out by system administrators to shield systems as much as possible against the possible attacks they may receive.

I understand, but what kind of “activities” do you mean?

Ufff, there are many, I’ll improvise a list if you want me to.

Yes, sure, go ahead!

Take a look at this:

  1. Service deletion. Delete all services that won’t be used in the system. That way you avoid having some open door for attackers with default configurations that are always the most vulnerable.
  2. Updated software. It is very important for all applications being used in the system to be updated, as well as the security patches of the operating system itself. That way we’ll rule out the possibility of having a known and fixed vulnerability in our system and we will close that door to attackers.
  3. Protection against possible physical attacks. Disk Encryption, safe BIOS Configuration, Firmware update, disable auto logon, disable USB usage… Any blockage that you may activate in the face of the possibility of a physical attack is necessary.
  4. Active and updated security applications. Use of antivirus, anti-spam, firewall… Having a policy for the usage of this type of software and an automatic update system. Through the firewall it is necessary to keep all unnecessary accesses and ports closed.
  5. Use of encrypted data and disk encryption. It is important that whenever there is confidential information, there is encryption or an encryption policy of the means by which this information is sent or stored.
  6. Do not open mails from unreliable senders. It is essential to have an email server with spam blocking options and avoid opening attachments or mails from unknown senders to avoid possible attacks.
  7. Periodic system audits. All systems must be audited periodically to check for possible attacks, or attempted attacks, that may have taken place in our systems to, that way, take measures of higher securitization levels in environments that may suffer a higher number of attacks.
  8.  Correct backup management and monitoring. It is essential to have full backup creation and management of all the most critical services in the organization, as well as their reliable monitoring so that, in the event of an attack or system degradation, you may recover a new instance as soon as possible with the backups saved.
  9. Monitoring important metrics for safety. Logs, accesses, number of connections, service load (CPU, Memory), disk growth. All these metrics and many more are important to find out if you are suffering an attack. Having them monitored and knowing them in real time can get you rid of many attacks or service degradations.

The use of inventory modules to monitor installed software, installed patches, users… gives us a detailed report of how our server park is, as well as through the inventory alerts themselves you may find out whether any user installed any software not allowed in the organization.

Yes, sir, there is work to be done. And what does Pandora FMS have to do with hardening?

In these last two points I mentioned to you is where Pandora FMS comes in. By monitoring all these metrics and the subsequent report generation you will have an overview of your systems and may identify, at a glance, systems with security issues.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Finding VMware ESXi assets

Popular hypervisor ESXi has been in the news recently due to fresh targeting by a new strain of ransomware. Known as ESXiArgs, this ransomware leverages a 2-year old heap overflow issue in the OpenSLP service that can be leveraged to gain remote code execution on exploitable targets (CVE-2021-21974). Many vulnerable public-facing ESXi servers have already been affected by this malware (currently over 1,900 via Censys search results).

What is the impact?

Targets of this new ransomware campaign are older ESXi servers running certain versions of 6.5, 6.7, or 7 releases and also have the OpenSLP service enabled (it has not been enabled by default in ESXi releases since 2021). Upon successful exploitation of CVE-2021-21974, the ESXiArgs ransomware will encrypt a number of file types on the target system, including VM-related files with extensions .vmxf, .vmx, .vmdk, .vmsd, and .nvram. Ransom notes are saved as HTML files on compromised systems for admins and users to subsequently discover. While some of these ransom notes claim to have stolen data from vulnerable targets, no data exfiltration has been observed at this time.

Are updates available?

VMware made patches available when the OpenSLP heap-overflow vulnerability was initially reported in 2021. The following ESXi releases have been patched against this attack vector currently being exploited by the ESXiArgs campaign:

  • ESXi version 7+ (ESXi70U1c-17325551 and later)
  • ESXi version 6.7+ (ESXi670-202102401-SG and later)
  • ESXi version 6.5+ (ESXi650-202102101-SG and later)

VMware also offers patched releases for Cloud Foundation (ESXi), which includes an ESXi component:

  • Cloud Foundation (ESXi) version 4.2+
  • Patching instructions for Cloud Foundation (ESXi) version 3.x can be found here

Patching (and also ensuring that your ESXi servers are running a supported, not end-of-life/end-of-support version) is the best course of action. If patching is not a near-term option, VMware has a recommended mitigation via disabling the OpenSLP service.

How do I find potentially vulnerable VMware ESXi assets with runZero?

From the Asset Inventory, use the following pre-built query to locate ESXi assets which may need remediation:

os.product:"ESX" and (os.version:="1.%" or os.version:="2.%" or os.version:="3.%" or os.version:="4.%" or os.version:="5.%" or os.version:="6.0%" or os.version:="6.5.0 build-4564106" or os.version:="6.5.0 build-4887370" or os.version:="6.5.0 build-5146843" or os.version:="6.5.0 build-5146846" or os.version:="6.5.0 build-5224529" or os.version:="6.5.0 build-5310538" or os.version:="6.5.0 build-5969300" or os.version:="6.5.0 build-5969303" or os.version:="6.5.0 build-6765664" or os.version:="6.5.0 build-7273056" or os.version:="6.5.0 build-7388607" or os.version:="6.5.0 build-7967591" or os.version:="6.5.0 build-8285314" or os.version:="6.5.0 build-8294253" or os.version:="6.5.0 build-8935087" or os.version:="6.5.0 build-9298722" or os.version:="6.5.0 build-10175896" or os.version:="6.5.0 build-10390116" or os.version:="6.5.0 build-10719125" or os.version:="6.5.0 build-10868328" or os.version:="6.5.0 build-10884925" or os.version:="6.5.0 build-11925212" or os.version:="6.5.0 build-13004031" or os.version:="6.5.0 build-13635690" or os.version:="6.5.0 build-13873656" or os.version:="6.5.0 build-13932383" or os.version:="6.5.0 build-14320405" or os.version:="6.5.0 build-14874964" or os.version:="6.5.0 build-14990892" or os.version:="6.5.0 build-15256468" or os.version:="6.5.0 build-15177306" or os.version:="6.5.0 build-15256549" or os.version:="6.5.0 build-16207673" or os.version:="6.5.0 build-16389870" or os.version:="6.5.0 build-16576879" or os.version:="6.5.0 build-16576891" or os.version:="6.5.0 build-16901156" or os.version:="6.5.0 build-17097218" or os.version:="6.5.0 build-17167537" or os.version:="6.7.0 build-8169922" or os.version:="6.7.0 build-8941472" or os.version:="6.7.0 build-9214924" or os.version:="6.7.0 build-9484548" or os.version:="6.7.0 build-10176752" or os.version:="6.7.0 build-10176879" or os.version:="6.7.0 build-10302608" or os.version:="6.7.0 build-10764712" or os.version:="6.7.0 build-11675023" or os.version:="6.7.0 build-13004448" or os.version:="6.7.0 build-12986307" or os.version:="6.7.0 build-13006603" or os.version:="6.7.0 build-13473784" or os.version:="6.7.0 build-13644319" or os.version:="6.7.0 build-13981272" or os.version:="6.7.0 build-14141615" or os.version:="6.7.0 build-14320388" or os.version:="6.7.0 build-15018017" or os.version:="6.7.0 build-15160134" or os.version:="6.7.0 build-15160138" or os.version:="6.7.0 build-15999342" or os.version:="6.7.0 build-15820472" or os.version:="6.7.0 build-16075168" or os.version:="6.7.0 build-16316930" or os.version:="6.7.0 build-16701467" or os.version:="6.7.0 build-16713306" or os.version:="6.7.0 build-16773714" or os.version:="6.7.0 build-17167699" or os.version:="6.7.0 build-17098360" or os.version:="6.7.0 build-17167734" or os.version:="7.0.0%" or os.version:="7.0.1 build-16850804" or os.version:="7.0.1 build-17119627" or os.version:="7.0.1 build-17168206" or os.version:="7.0.1 build-17325020")

Each ESXi asset returned in the query results should be checked if the OpenSLP service is enabled. If OpenSLP is enabled, then the asset is vulnerable to exploitation.

VMware ESXi prebuilt query is available in the Queries Library

As always, any prebuilt queries are available from our Queries Library. Check out the library for other useful inventory queries.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

AR vs VR: What’s the difference?

It would seem like the line between science fiction and reality is increasingly blurred. We no longer see this only in the movies and games, but in e-commerce, education, entertainment, staff training, remote diagnostics or architectural projects. Today Virtual Reality and Augmented Reality are changing the way we use screens by creating new, more interactive and immersive experiences. But… How do we define Virtual Reality and Augmented Reality? 

Content:

Virtual Reality or VR refers to an artificial environment created with hardware and software, presented to the user in such a way that it looks and feels like a real environment. To “enter” a virtual reality, the user puts on gloves, headphones and special glasses, from which information is received from the computer system. In addition to providing sensory input to the user (three of the five senses: touch, hearing, and vision), the devices also monitor the user’s actions.

For Augmented Reality or AR), technology capable of inserting digital elements into real-world environments is used to offer customers and professionals a hybrid experience of reality. Although Augmented Reality is compatible with multiple devices, it is more popular for smartphone applications, with real-time interactions. In fact, most current AR tools are customer-oriented, although organizations are beginning to embrace AR in business processes, products, and services.

While AR is different from VR, both innovations represent a field of technology called extended reality (XR), encompassing all environments, real and virtual, represented by computer graphics or mobile devices. The goal of XR is to combine physical and virtual realities until users are unable to differentiate them, in addition to being available to anyone to improve their lives.

The importance of understanding each reality (AR and VR) is the potential to alter the digital landscape in life and business, transforming the way we communicate and interact with information and changing the way multiple industries can operate. We look at this in more detail below.

Augmented Reality (AR)

This reality incorporates virtual content into the physical world to improve user perception and interaction with a real environment. AR is experienced with smartphones, tablets or AR glasses, which project virtual objects, text or images so that users can interact simultaneously with virtual and physical elements.

For example, a camera on the device records the user’s environment and gyroscopes and accelerometers monitor the camera’s orientation and location. The AR software analyzes the camera’s transmission, which identifies objects and features in the environment. From there, users may interact with virtual objects using touchscreens, gestures, and voice commands. For example: from a Tablet, you may check suggestions for those who visit a city. The screen shows places to shop, eat, visit a museum, etc., based on the user’s preferences.

On the production floor of a manufacturing company, through AR lenses and software, maintenance engineers can obtain information on the health status of a piece of equipment, so that they can make decisions in real time and more proactively.

Another example can be seen in the design of spaces and architecture. From a lens you may get an image of what the completed project would look like to present the executive project to investors or detect improvements in the design and/or impact on the environment.

Operation and example of Virtual Reality (VR)

Within Extended Reality, virtual reality is the most popular form. Users wear headsets or virtual reality goggles (wearables) that have sensors to track movements and allow them to explore computer-generated virtual environments, as well as to interact with objects and participate in different activities displayed on screens or lenses.

In VR, users see three-dimensional (3D) images that create the feeling of depth and immersion, while spatial audio enhances the experience through headphones or speakers. We must also understand that the immersive experience is a format whose goal is to completely “immerse” the person in a specific real or virtual environment or context.

One of the most widespread applications of VR is in games, in which users interact directly with the game through devices such as glasses, belts, gloves and other accessories that improve player experience.

In industries, VR can support design and training with elements that could be risky for the operator in an induction stage. Risks are also reduced in product design or construction and architecture analysis.

In the field of health, VR has contributed to improvements in the diagnosis of both physical and mental illnesses, training of medical personnel, application of telemedicine, patient education about their condition, or a new approach to recovery or rehabilitation therapies (which transfers the mechanics of games to the educational-professional field). A very important thing in VR is that immersive content is as important as the hardware from which the user has interactions. Without hardware, there is no “simulated environment” that can be brought to life.

To arrive at what we understand today as VR, in 1961, what is considered the first virtual reality helmet was built (by scientists Corneau and Bryan), based on a system of magnetic sensors, incorporating the elements of virtual reality: isolation, freedom of perspective and an immersive sensory experience. A year later, Morton Heilig presented the Sensorama, which reproduced audiovisual content. Users fitted their heads into a device specially designed to live a three-dimensional experience where even odors were reproduced. It was a mechanical device, predating digital electronics. In 1965, Ivan Shuterland, laid the foundations of a multi-sensory system based on a computer. In 1968, Shutherland created the first head-mounted display (HMD) for use in immersive simulations. The graphs that comprised the virtual environment the user was in consisted of simple model rooms rendered from the wireframe algorithm (a visual representation of what users will see and interact with). This device was called The Sword of Damocles (the helmet was so large that it needed to be suspended from the ceiling).

Over time, advances were made, until in the 80s and 90s, the game companies Sega and Nintendo developed virtual reality game systems. In 2009, the Oculus Rift glasses emerged in a project by Palmer Luckey, to develop devices in the video game industry. Until the 2010s, the Oculus and HTC Vive companies introduced high-quality virtual reality headsets, being able to take advantage of powerful graphics and motion tracking technology. Recently, Apple, with Vision Pro, and Meta, with Oculus Go headphones, have generated great expectations about the use of VR.

As for the origins of AR, in 1974, Myron Kruger, a computer scientist and artist, built a lab at the University of Connecticut called ‘Videoplace’ that was entirely dedicated to artificial reality. Within these walls, projection and camera technology were used to cast on-screen silhouettes surrounding users for an interactive experience. Then, AR came out of the labs for use in different industries and commercial applications. In 1990, Tom Caudell, a researcher at Boeing, coined the term “augmented reality”. In 1992, Louis Rosenburg, a researcher at the USAF’s Armstrong’s Research Lab, created “Virtual Fixtures,” which was one of the first fully functional augmented reality systems. The system allowed military personnel to virtually control and guide machinery to perform tasks such as training their U.S. Air Force pilots in safer flying practices.

In 1994, Julie Martin, a writer and producer, brought augmented reality to the entertainment industry with the stage production Dancing in Cyberspace. The show featured acrobats dancing alongside virtual objects projected onto the physical stage.

In 1998, Sportsvision broadcasted the first NFL game live with the 1st & Ten virtual graphics system, also known as the yellow yard marker. The technology showed a yellow line overlaid on top of the transmission so you could quickly see where the team advanced to get a first try. In 1999, NASA created a hybrid synthetic vision system for its X-38 spacecraft. The system leveraged AR technology to help provide better navigation during test flights.

From those years to the present, AR has been widely adopted in various fields such as entertainment, industrial, personnel and design: Esquire magazine used augmented reality (2009) in print media for the first time in an attempt to bring the pages to life. When readers scanned the cover, the augmented reality-equipped magazine showed Robert Downey Jr. talking to readers. Volkswagen introduced the MARTA (Mobile Augmented Reality Technical Assistance) app in 2013, which mainly provided technicians with step-by-step repair instructions within the service manual. Google introduced Google Glass, which is a pair of augmented reality glasses for immersive experiences. Users with AR technology communicated with the Internet through natural language processing commands, being able to access a variety of applications such as Google Maps, Google+, Gmail and others. In 2016, Microsoft introduced HoloLens, which is a headset that runs on Windows 10 and is essentially a wearable computer that allows users to scan their environment and create their own AR experiences. In 2017, IKEA launched its augmented reality app called IKEA Place that changed the retail industry forever. The app allows customers to get a virtual preview of their home décor options before making a purchase.

Similarities and Differences between AR and VR

As we have seen, AR and VR are quite similar and offer virtual objects in real life. Their similarities can be summarized like this:

  • They can display enlarged and life-size objects and use the same devices.
  • 3D content is needed.
  • They can be used on laptops, PCs, smartphones, etc.
  • They include tracking of movement of hands, eyes, fingers and more.
  • Inmersion is offered.

However, there are differences that we can summarize as follows:

Augmented RealityVirtual Reality
It uses a real-world scenario to add a virtual item or object that can be viewed through a lens. AR augments the real-world sceneEverything is completely virtual, even the environment. VR is a fully immersive virtual environment
Users can control their minds and their presence in the real world. Users can feel their own presence along with virtual objects.VR systems guide users in the virtual environment. Visual senses are controlled by the system. Only objects, sounds, etc., of the image can be perceived in your view
The user can access AR on their smartphone, laptop or tablet.To access virtual reality, you need a headset.
AR enhances the virtual and real world and simplifies your work. In AR, the virtual world is 25% and the real world is 75%VR enhances fictional reality. In VR, the virtual world is 75% and the real world is 25%
AR requires higher bandwidth, around 100 Mbps.Virtual reality can work at low speeds. About 50 Mbps connection is required.
Audience: for those who need to add virtuality to the real world and improve both the virtual and real worlds. AR detects user locations and bookmarks, as well as system calls in predefined content. It is partially immersive and open.Audience: for those who need to replace all reality and improve virtual reality for many purposes, such as games, marketing, etc. VR is an immersive sequence of animations, URLs, videos, audio. VR is fully immersive and closed

As for the audiences for which each one is focused, AR is for those who need to add virtuality to the real world and improve both the virtual and real world. AR detects user locations and bookmarks, as well as system calls in predefined content. It is partially immersive and open. While VR is for those who need to replace the whole reality and improve virtual reality for many purposes, such as games, marketing, etc. taking into account that VR is an immersive sequence of animations, URLs, videos, audio. VR is fully immersive and closed.

Examples of AR and VR Applications

Some examples of how organizations have adopted AR are:

  • Development of translation applications. These applications interpret text, which is scanned, from one language to another.
  • In the gaming industry, to develop real-time 3D graphics.
  • Analysis and recognition of an item or text. Example: With image capture using Google Lens, the app will start analyzing the image and recognize what it is about. Once done, it will offer you actions to perform related to the type of item or text.
  • In advertising and printing, AR is used to display digital content at the top of magazines.
  • In design, as we mentioned in the IKEA Place example, AR provides a virtual preview of decoration options before making a purchase. Another example is YouCam Makeup, a free application that allows you to design and create makeup styles, hairstyles, face and body touch-ups with filters, dyes, eyelashes, among others.

VR has gained momentum in several industries, such as:

  • The Armed Forces using virtual reality technology to train their soldiers by showing flight and battlefield simulations.
  • Medical students learning better with 3D scanning of each organ or the entire body with the help of VR technology.
  • Virtual reality being also used to treat post-traumatic stress, phobias, or anxiety by making patients understand the real cause of their illness and in other healthcare settings.
  • Professionals using virtual reality to measure an athlete’s performance and analyze techniques with the digital training device.
  • Virtual reality-based devices (Oculus Rift, HTC Vive, google cartoon, etc.) helping users imagine an environment that doesn’t exactly exist, such as an immersive experience in the world of dinosaurs.
  • From manufacturing and packaging to interior design, companies can use virtual reality to give customers a demo of the product and a better understanding of what goes into making it. An example is Lowe’s Holoroom, where customers can select home décor items, appliances, cabinets, and room designs to see the end result.
  • This approach can also be implemented to engage both customers and employees, driving inspiration, collaboration, and interactions. For example, in personal banking, some benefits or rewards can be offered to loyal customers.
  • In the specific experience of a particular product, VR makes it possible to highlight its most exclusive features and at the same time provide the opportunity to experience its use. Vehicle manufacturer Volvo used virtual reality technology implementation to help customers who did not have easy access to their dealerships to test their cars. This experience was provided through the use of the Google Cardboard VR headset.

Using AR on Mobile Devices

At first, it seemed that AR would be intended only for military applications or games, but today we see that they play an important role in innovation in the mobile market, allowing users of smartphones and tablets to interact virtually with their environment thanks to greater bandwidth and better connectivity. In the words of Mark Donovan, analyst at ComScore, “…The idea that a mobile device knows where I am and can access, manipulate, and overlay that information on real images that are right in front of me really gets my sci-fi juices flowing…This is just getting started and will probably be one of the most interesting mobile trends in years to come.”.

A major factor in the mobile market is GPS and location-based technologies, which allow users to track and find friends while traveling or “check in” at particular locations. That information is stored and shared with others through the internet cloud and can be used so that marketers can use it to publicize special promotions or discounts, or a city promoting its hotspots could embed facts on the screen and about the neighborhood and the people who lived there. Other visitors may leave virtual comments about the tour. In education, biology students, for example, could use an augmented reality app and a smartphone to gain additional insight into what they see while dissecting a frog.

The way smartphones are driving AR usage, Qualcomm recently showcased augmented reality technology on its devices. Qualcomm’s Snapdragon processors and a new Android smartphone software development kit have been designed to provide the necessary foundation in building and using augmented reality technology in mobile phones. With toy maker Mattel, they collaborated on the virtual update of a classic game called Rock ‘Em Sock ‘Em Robots. Using Qualcomm technology and the smartphone’s built-in camera, players could see virtual robots superimposed on their smartphone screens. The robots appeared in the ring, which was a piece of paper printed with the static image of the ring and its strings. Players used the buttons on their phones to throw punches and their robots moved around the ring while players physically surrounded the table where the image of the ring was placed. The company also sees the potential in marketing, as an example it mentions the insertion of animated coupons on top of real images of its products in stores, so that, when consumers pass by a cereal box, for example, in the supermarket and look at their phone screen, they can get an instant discount.

Now, what is needed for AR on mobile devices? You need a real image capture device, software that is simultaneously transcribing this information and the virtual elements that are going to transform that reality. There are also different types of augmented reality: the one that is transcribed through a geolocation and the one that is based on markers:

  • AR Projection: Artificial light is projected onto real-world surfaces. Augmented reality applications can also detect the tactile interaction of this projected light. This way, user interaction is detected by an altered projection on the expected projection.
  • Overlay of the AR: Before the overlay, the application must recognize which element it has to replace. Once achieved, an object is partially or totally superimposed.
  • AR Markers: Using a camera or a visual marker (a QR, for example), a marker is distinguished from any other real-world object. This way, information is superimposed on the marker.
  • Geolocation of AR: It is based on the geolocation emitted by the smartphone through GPS to know its position and location.
  • Devices for AR: In AR it is necessary to have sensors and cameras. The projector, usually a very small one, allows you to project reality in any space without using a mobile phone or tablet to interact. Glasses or mirrors also use augmented reality.

There are also 2 types of sensors:

  • Sensors used for Tracking: They are responsible for knowing the position of the real world, users and any device in the solution. That way it is possible to achieve that synchronization or registration between the real and virtual world that we discussed when giving the definition of augmented reality. In turn, these sensors are classified into:
    • Camera (computer vision): Perhaps one of the most important technologies. There are also the ‘fiducial markers’, that is, marks in the environment that allow the vision system and the solution as a whole, not only to be aware of what is there and what its performance is like, but also to place it spatially.
    • Positioning (GPS): A technology not very specific to augmented reality but also sometimes used for spatial positioning.
    • Gyroscopes, accelerometers, compasses and others: Which allow you to appreciate the orientation (gyroscopes), direction (compasses) and acceleration (accelerometers). Most of these sensors are already incorporated, for example, in mobiles and tablets.
  • Sensors to collect information from the environment: Humidity, temperature and other atmospheric information. Another type of possible information is pH, electrical voltage, radio frequency, etc.
  • Sensors to collect user input: These are fairly common devices such as buttons, touch screens, keyboards, etc.

Cinematic Influences on Public Perception of VR and AR

Undoubtedly, cinema has been one of the factors that have influenced the perception of Virtual Reality and Augmented Reality. As an example, we have these well-known films where these technologies played a leading role:

  • Iron Man: This film is a great example of how military forces can use technology in the field using information fed by a central computer.
  • They Live: It is the story of a drifter who discovers a pair of glasses that allow him to see the reality of aliens taking over the Earth. The whole concept of putting on glasses to see what others can’t is the big idea behind AR.
  • Minority Report: Futuristic sci-fi film set in 2054, filled with AR technology from start to finish. From the computer interface that appears in the air to the interaction with a 3D computerized board and the ads that offer what the user would like to have.
  • Avatar: The main character, Jake Sulley, is on a huge AR device that allows his host to experience a completely different level of sensory perception.
  • Robocop: Detroit officer Alex Murphy becomes Robocop. His helmet is connected to the most advanced augmented reality technology that allows him to continue fulfilling his role as a police officer, albeit at a more impressive level.
  • Wall-e: futuristic 3D animated film. This film somehow made a subtle statement that AR technology is not just for law enforcement use.
  • Top Gun: The HUDs found in the cockpits of the F-14 Tomcats used in the film are the real reason they are called HUDs. These things allowed pilots to keep their heads up in the heat of the action and not look at their instrument panels.
  • Tron/Tron: Legacy: Legacy – These two films delve into what could happen if you were unexpectedly thrown into a video game. Although for many passionate gamers it may seem like a dream come true, the movies quickly prove that it is not without its drawbacks.
  • Virtuosity: This film poses what could happen if a virtual reality character were placed in our reality. There is a virtual reality simulation built by combining the characters of multiple serial killers that makes its way into reality.
  • Matrix: It examines a world dominated by human-created machines, combining action sequences with innovative special effects. Unlike Skynet in the Terminator trilogy, which aimed to annihilate humanity, the artificial intelligence in Matrix has discovered a more useful purpose for our species: energy. Machines do this by absorbing energy from bodies while keeping people entertained in a virtual reality realm known as Matrix.
  • Gamer: In the film, users control death row convicts in real life in the Internet Slayers game. Gerard Butler plays one of these convicts and, in order to get released, he must survive the game with the help of the person who controls it. It is an intense and visceral experience that explores the border between virtual and genuine violence.
  • Ender’s game: It portrays a society where children are educated to be military soldiers through virtual reality simulations. It’s a depressing concept countered with vivid and extremely beautiful images, particularly in the recreated landscapes.
  • Ready Player One: It chronicles how virtual reality has changed cultural conventions thanks to a new technology called Oasis. Although it started as a video game platform, Oasis has expanded into a way of life. People work in the Oasis, children go to school there, and companies try to monetize every square inch of the Oasis. In the game, the winner receives Halliday’s enormous riches, as well as ownership of the Oasis.

In addition to representing the use of AR and VR, the films also raise aspects of ethics and governance as in all emerging technology.

Technological and Business Challenges

AR and VR are technologies that will be increasingly present in people’s daily lives and in the work of companies. Of course, there are challenges that organizations should consider when adopting them:

  • Excessive Expectations: It is often speculated that it is possible to execute in virtual environments absolutely all the actions that can be actually performed. It is important to carry out all the necessary procedures so that there is consistency between the virtual and the real world.
  • Specific development: Considering that the development of skills in specific fields and in regards to the needs of each organization must be carried out, with defined results from its design in the business model and where a positive impact is generated for the organization.
  • Limited resources: Understanding the current limitations in the development of better apps and learning items with AR and VR, from the necessary equipment, software and hardware, and the human talent that can develop and support the applications.
  • Technological gap: Reducing the educational-digital gap between institutions, regions and social sectors with access to AR and VR technology and those that do not yet have the same opportunities or technological capabilities.
  • Learning Curve: From the first business model where it is planned to integrate AR and VR and the organizational culture that allows the consistent and continuous development of these technologies.
  • Transdisciplinary aspects: AR and VR involve transdisciplinary aspects from different knowledge and business areas: information technologies, marketing, sales, operations, human resources, etc.
  • Accelerated change: Technology is very agile and the change of electronic devices that give life to this type of tools is updated at an accelerated speed, which triggers challenges in investments in technologies that support it and in the human talent that knows these technologies and that can implement them.

Another important aspect in the reality of many countries is that bandwidth and low latency requirements for these technologies that take up multimedia resources are at an insufficient level, in addition to the fact that current networks often cannot support high-quality AR and VR transmissions, perform high-speed data transmission, stable connection that gets rid of fluctuations and offers a seamless experience.

Future of Augmented and Virtual Reality

While AR and VR remain emerging technologies, faster, lighter and more affordable technology is envisioned in the future. On the one hand, advances in smartphone technology (with better cameras and processors) will mean that you can enjoy more innovative AR and VR experiences. The advancement in 5G wireless networks will also make it possible to enjoy these technologies from anywhere in the world.

Although this high technology is associated with science fiction and the gaming industry, Virtual Reality has the potential to revolutionize several industries, especially when looking for innovative ways to increase their productivity, improve processes and, as remoteness gains ground, the possibilities of virtual reality help achieve goals.

For VR, the development of more powerful processors such as Meta’s Oculus Quest and Apple’s 8KVR/AR headset is anticipated. As devices become more robust in functionality and lighter in use, the adoption of this technology will play an important role in creating more immersive and intuitive experiences in all fields.

We can also mention some predictions and budding improvements:

  • LiDAR will bring more realistic AR creations to our phones. iPhone 12 and iPad Pro are now equipped with LiDAR LiDAR (Light Detection and Ranging) technology is essentially used to create a 3D map of the environment, which can seriously improve the AR capabilities of a device. In addition, it provides a sense of depth to AR creations, rather than a flat graphic.
  • VR headsets will be smaller, lighter and incorporate more features. Hand detection and eye tracking are two prominent examples of the technology built into virtual reality headsets. Because hand detection allows VR users to control movements without clunky controllers, users can be more expressive in VR and connect with their VR game or experience on a deeper level. And the inclusion of eye-tracking technology allows the system to focus the best resolution and image quality only on the parts of the image the user is looking at (exactly as the human eye does). Delay and risk of nausea are reduced.
  • There will be new XR accessories to further deepen the experience. The startup Ekto VR has created robotic boots that provide the sensation of walking, to adapt to the movement in the headphones, even if you are actually standing. The rotating discs at the bottom of the boots move to match the direction of the user’s movements. In the future, accessories like this may be considered a normal part of the virtual reality experience.
  • We’ll even have full-body haptic suits. There are already haptic gloves that simulate the sensation of touch through vibrations. The full-body suit is proposed as the TESLASUIT, which today are not affordable for most virtual reality users. Over time they could reduce their cost which in turn will increase their adoption.

According to companies surveyed by PWC in 2022, VR learners absorb knowledge four times faster than learners in the classroom and are 275% more confident when it comes to applying the skills they learned during training in the real world.

In the workplace, remote work is more popular than ever, but there are still aspects of face-to-face interactions that are difficult to replicate. As a result, mixed reality collaborative work tools will increasingly leverage virtual reality and augmented reality to capture and express the more subtle aspects of interaction that are not translated into video calls.

In commerce, virtual reality and augmented reality will more often become part of the marketing and sales process. Brands will invest in creating virtual environments where they can interact with shoppers to help them solve their problems, encouraging them to make the leap from being customers to being loyal followers.

In health, from using AR to improve liver cancer therapy to creating surgery simulations in virtual reality, healthcare systems are using these technologies in a variety of applications. The development continues, due mostly to the growing demand driven by more connectivity, costs in devices that will be reduced and the need to reduce costs and risks in interventions.

According to Forbes, global investments in augmented reality are estimated to grow from $62.75 billion in 2023 to $1,109.71 billion by 2030, at a CAGR of 50.7%. For virtual reality, Forbes estimated that global investments in virtual reality (VR) reached $59.96 billion in 2022 and are expected to grow at a compound annual growth rate (CAGR) of 27.5% from 2023 to 2030. Undoubtedly, double-digit growth makes it clear that organizations must consider how to address these emerging technologies to achieve business results.

Conclusion

AR and VR are technologies that should be reviewed in the Digital Transformation strategy of organizations, for the advantages they represent, from the display for customers of outstanding product characteristics, the feasibility of a project or design; practical guides on the use of products, demonstrations, advertising or promotions; the training and development of staff skills on new equipment or security protocols through VR motivating interactive learning; the holding of virtual meetings or events that simulate the true presence of customers and colleagues; virtual visits to facilities, shops, educational institutions, museums, etc.; up to the best customer service, with a better approach saving time and resources.

Of course, the use of augmented reality and virtual reality depends on the internal capabilities, budget and objectives of the organization. Although there are already many applications on the market that use augmented reality, the technology has not yet become widespread; however, as devices, processors and software add more power and sophistication, the level of information that can be added will increase. AR and VR can help improve decision-making ability, communication, and understanding by experiencing a scenario that is artificial but looks and feels natural. As we have seen throughout this article, AR and VR have many applications in the entertainment, military, engineering, medical, industrial, and other industries. It is recommended, for best results, to combine both technologies by doing an analysis of each use case on adaptability, productivity, time to market, return on investment and expected results. It is also recommended to approach an information technology partner who has the expertise in your industry and understands your challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

How to Guarantee a Completely Secure Migration to M365

Many organizations are now choosing to migrate to Microsoft 365 for a number of reasons including collaborative working options and Microsoft 365. Doing so has a number of advantages, but the movement of data can be difficult. A main consideration during the migration process can be maintaining data integrity whilst securing the data throughout the migration. Here are some migration security measures to consider to ensure a secure migration to Microsoft 365.

 

Encryption of Data
End-to-end encryption is the most secure way to communicate securely and with privacy online. The messages are encrypted at both ends of the conversation which prevents anybody in the middle from reading the private communications. Neither hackers nor unwanted third parties can access the encrypted data on the server.

CloudM Migrate has end-to-end encryption between migration endpoints. The option to Self Host CloudM Migrate will completely isolate your migration data from your source environment to the destination cloud tenant.

Both primary and secondary servers use the following components to temporarily store migration data during a migration.

  • Encrypted SQLite databases (AES256)
  • Encrypted temporary file storage (AES256)

Where CloudM Migrate requires a username or password to interact with a system, and stores sensitive data like this, that data is stored encrypted within SQL Server (AES256). SQL Server 2019 Express is installed by default but you can specify your own SQL instance.

Know your source data
Before you start migrating data, you need to know exactly what it is you’re moving. Ensure you know the format of the data, where it is in the system, and if it does actually need to be migrated. Ensure the data is clean and any data that does not need to be kept, can be disposed of to reduce costs and decrease the chance of security risks.

Know your destination
Knowing everything about where the data is coming from is half the battle, the other half is knowing where it’s going.

Ensure that you know the exact destination your data will be going to. From simple things like username conflicts to license fees, the new system will have its own set of rules and regulations.

For example, if you are moving from a legacy endpoint to Microsoft 365, you need to know that all data will be working as expected and the appropriate security compliances are in place. It is also important to ensure everything will be compatible
Back up data
Before the migration begins, ensure all data has been backed up, especially the files you will be migrating. If there are any issues or problems during the migration, such as corrupt or missing files, then you can always restore from the backup.

Get us to help
Migrations are a specialized area, bringing with them their own challenges and solutions, and the right advice from experts like us can make things go a lot smoother. It’s important to understand your limitations, as mishandling a migration can have disastrous consequences.

We know how important security is during migrations. Move to the cloud with confidence with guaranteed data integrity with zero downtime for users with our secure cloud migration tool.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About CloudM
CloudM is an award-winning SaaS company whose humble beginnings in Manchester have grown into a global business in just a few short years.

Our team of tech-driven innovators have designed a SaaS data management platform for you to get the most from your digital workspace. Whether it’s Microsoft 365, Google Workspace or other SaaS applications, CloudM drives your business through a simple, easy-to-use interface, helping you to work smarter, not harder.

By automating time-consuming tasks like IT admin, onboarding & offboarding, archiving and migrations, the CloudM platform takes care of the day-to-day, allowing you to focus on the big picture.

With over 35,000 customers including the likes of Spotify, Netflix and Uber, our all-in-one platform is putting office life on auto-pilot, saving you time, stress and money.

Introduction to CloudM Migrate Self Hosted

Cloud migrations are complex, always changing, and unique to every organization. You need the flexibility and control to tackle your project in the way that suits you best. This is why we have multiple migration deployment options to suit all businesses. 

In this blog, we break down exactly what CloudM Migrate Self-Hosted is as well as explain security, endpoint, and installation information so you have more guidance when selecting a deployment option.

Definition
CloudM Migrate Self-Hosted is the downloadable version of CloudM Migrate, ideal for large and complex migrations. Migrate (Self-hosted) is highly configurable, allowing you to complete the most complex and demanding migrations seamlessly. Using our web interface, you can run a multitude of virtual machines to complete your self-hosted migration to Microsoft 365. Once set up in your environment, Migrate (Self-hosted) can securely migrate your mailboxes, files, SharePoint sites, mailbox archives, and more to Microsoft 365.

Security
If the organization has compliance obligations that do not permit you to use a third-party service, Migrate Self-Hosted is most appropriate. The software can be run behind your own organization’s firewall, critical data is kept internally and no other party has access to it.

CloudM Migrate already has end-to-end encryption between migration endpoints. The option to Self Host CloudM Migrate will completely isolate your migration data from your source environment to the destination cloud tenant.

CloudM has adopted the ISO 27001 standard as its framework and is externally certified. ISO27001 is one of the most popular information security standards in the world, focusing on protecting three key aspects of information; confidentiality, integrity, and availability.

Installation
Basic installation will install all components to a single machine and is suitable for performing migrations from a single server or as the main server in a multi-server migration.

If you have specialized requirements, have a pre-existing SQL Server instance you would like to use, or will be performing multi-server migrations using a server farm, you should also review the advanced installation documentation.

The following components makeup and are used by CloudM Migrate:

  • Web Application and Primary Service
  • Secondary Service
  • SQL Server Express 2017
  • Redis

Clustering
With Self-Hosted the option to create a cluster of CloudM Migrate servers can be leveraged to increase migration velocity. Each CloudM Migrate cluster node can handle processing 20 migration threads. While this does increase velocity, more nodes do have ever-decreasing returns in overall velocity as destination throttling ramps up.

Legacy Endpoints
Moving legacy applications to the cloud can help to address multiple concerns businesses have regarding their data storage needs. Every business wants to be agile, flexible, up-to-date & adapt quickly to demand. CloudM helps businesses achieve these goals by supporting a wide range of source and destination endpoints, enabling migrations from almost any platform including various legacy endpoints.

We’re here to help inform you about the most compatible deployment options for your business. Get in touch today to discuss your available options with one of our experienced solutions architects.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About CloudM
CloudM is an award-winning SaaS company whose humble beginnings in Manchester have grown into a global business in just a few short years.

Our team of tech-driven innovators have designed a SaaS data management platform for you to get the most from your digital workspace. Whether it’s Microsoft 365, Google Workspace or other SaaS applications, CloudM drives your business through a simple, easy-to-use interface, helping you to work smarter, not harder.

By automating time-consuming tasks like IT admin, onboarding & offboarding, archiving and migrations, the CloudM platform takes care of the day-to-day, allowing you to focus on the big picture.

With over 35,000 customers including the likes of Spotify, Netflix and Uber, our all-in-one platform is putting office life on auto-pilot, saving you time, stress and money.

Same Integrations, Different (& Better) Views

The New integration screen just got published. The screen’s rework includes much simpler and intuitive navigation between all integrations options. Check it out now!

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.