2022 Archives - Page 2 of 54 - Version 2 Limited

Why OT Research Is Controversial – But Necessary

I want to discuss a subject that doesn’t get enough attention in the world of OT/ICS cyber security considering how fundamental it is, and also sparks a surprising amount of controversy. The topic is the importance of conducting ongoing research into OT endpoint device vulnerabilities, particularly for legacy devices.

It should be a unanimous opinion that this research is important. The more we know about vulnerabilities and the more CVEs we generate, the better for everyone involved. However, I frequently encounter industry analysts and self-styled experts that repeatedly question the need and validity of research in the OT sector. Their argument is that legacy equipment is guaranteed to have vulnerabilities, that it is flawed by design and therefore advanced endpoint research is unnecessary. I find this argument ironic because these same experts are often involved in creating products that help detect and manage the vulnerabilities found by researchers. They state publicly that there is no point in doing research and then in the same breath talk about how their product can help mitigate the problems.

SCADAfence 2022

CISA BOD 23-01: Why vulnerability scanners miss the mark on asset inventory

On October 3, 2022, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks. The directive requires that federal civilian executive branch (FCEB) departments and agencies perform automated discovery every 7 days and identify and report potential vulnerabilities every 14 days. Additionally, it requires the ability to initiate on-demand asset discovery to identify specific assets or subsets of vulnerabilities within 72 hours of receiving a request from CISA.

To meet these requirements, agencies will need to start with an accurate asset inventory. Most agencies will attempt to leverage existing solutions, like their vulnerability scanners, to build their asset inventories. It seems reasonable to do so, since most vulnerability scanners have built-in discovery capabilities and can build asset inventories. However, they will quickly learn that vulnerability scanners are not up for the task and cannot help them sufficiently and effectively meet the requirements laid out by CISA.

Let’s take a look at why agencies need a solution solely focused on asset inventory, in addition to their vulnerability scanner, if they want to tackle CISA BOD 23-01.

Asset inventory is a foundational building block

Every effective security and IT program starts with a solid asset inventory. CISA BOD 23-01 reinforces that imperative. Specifically, it states, “Asset discovery is a building block of operational visibility, and it is defined as an activity through which an organization identifies what network addressable IP-assets reside on their networks and identifies the associated IP addresses (hosts). Asset discovery is non-intrusive and usually does not require special logical access privileges.”

What does this mean? FCEB agencies looking to meet the requirements outlined by CISA BOD 23-01 must be able to discover managed and unmanaged devices connected to their networks. Internal and external internet-facing assets must be cataloged with full details and context. All within the timeframe outlined by CISA.

So now, the question is why vulnerability scanners can’t be used to meet the requirements laid out in the directive.

The challenges of asset inventory with vulnerability scanners

As the number of devices connecting to networks continues to grow exponentially, agencies need to stay on top of these devices; otherwise, they could provide potential footholds for attackers to exploit. However, common issues like shadow IT, rogue access, and oversight continue to make it difficult to keep up with unmanaged devices. BOD 23-01 highlights the importance of identifying unmanaged assets on the network. That’s why the need for a fully comprehensive asset inventory is the key to adequately addressing the directive.

So, why can’t vulnerability scanners deliver on asset inventory? Most vulnerability scanners combine discovery and assessment together, resulting in slower discovery times, delayed response to vulnerabilities, and limited asset details. As a result, most agencies are left wondering how they can do a better job building their asset inventories.

Combining discovery and assessment slows everything down

Vulnerability scanners typically combine asset discovery and assessment into one step. While on the surface, this appears to be efficient, it is actually quite the opposite. In regards to asset discovery, CISA BOD 23-01 specifically requires that FCEB agencies perform automated discovery every 7 days and identify and initiate on-demand discovery to identify specific assets or subsets of vulnerabilities within 72 hours of receiving a request from CISA.

Because vulnerability scanners leverage a lot of time-consuming checks, they’re not able to scan networks quickly enough. Add in the complexity of highly-segmented networks and maintenance windows, and it is nearly impossible to effectively utilize vulnerability scanners for discovery and meet the timing requirements outlined by CISA.

Under the new directive, assessing the potential impact of vulnerabilities becomes even more urgent. Agencies will need to perform on-demand discovery of assets that could be potentially impacted within 72 hours, if requested by CISA. When security news breaks, agencies need to respond as quickly as possible, but vulnerability scanners slow down the process. In a scenario like this, it would be more efficient to have a current asset inventory that agencies can search–without rescanning the network. This is particularly useful if agencies know there are specific assets they need to track down, they can query their existing asset inventory to identify them immediately.

For example, let’s say a new vulnerability is disclosed. Vendors will need some time to develop the vuln checks, and agencies will need to wait for the vuln checks to become available. Once they’ve been published, agencies can finally start rescanning their networks. Imagine waiting for the vuln check to be released, and then delaying the rescan due to scan windows. Without immediate insight into the potential impact of a vulnerability, agencies are playing the waiting game, instead of proactively being able to assess the risk.

How agencies can speed up discovery

So, what can agencies do? Let vulnerability scanners do what they do best: identify and report on vulnerabilities. Complement them with a dedicated solution that can automate and perform the discovery of assets within the timeframe set by the directive. In order to accomplish this, the asset inventory solution must be able to quickly and safely scan networks without a ton of overhead, be easy to deploy, and help security teams get ahead of new vulnerabilities.

Agencies need to have access to their full asset inventory, on-demand, so they can quickly zero in on any asset based on specific attributes. This information is invaluable for tracking down assets and investigating them, particularly when new zero-day vulnerabilities are uncovered. When the new zero-day is announced, agencies can find affected systems by searching across an existing asset inventory–without rescanning the network.

Meet CISA BOD 23-01 requirements with a dedicated asset inventory solution

It is increasingly evident that decoupling discovery and assessment is the most effective way to ensure that agencies have the data needed to accelerate vulnerability response and meet the requirements outlined in the directive. Because let’s face it: vulnerability scanners are really good at vulnerability enumeration–that’s what they’re designed to do. However, they really miss the mark when it comes to discovering assets and building comprehensive asset inventories. Because vulnerability scanners combine discovery and assessment, they aren’t able to scan entire networks quickly, and at times, they don’t fingerprint devices accurately.

As a result, many agencies are wondering how to meet the requirements outlined in CISA BOD 23-01 if they can’t depend on their vulnerability scanner for discovery. Agencies will need to start looking for a standalone asset inventory solution that is capable of performing unauthenticated, active discovery, while also enriching data from existing vulnerability management solutions.

How runZero can help agencies focus on asset discovery

runZero separates the discovery process from the vulnerability assessment stage, allowing agencies to perform discovery on-demand. Because runZero only performs discovery, it can deliver the data about assets and networks much faster than a vulnerability scanner. Customers have found that runZero performs scans about 10x faster than their vulnerability scanner, allowing them to:

Get a more immediate day one response to new vulnerabilities.
Gather as much information as possible about assets while waiting for vulnerability scan results.

That means, while waiting for vulnerability assessments to complete, agencies can already start digging into their asset inventory and identifying assets that may be impacted by a vulnerability. runZero regularly adds canned queries for assets impacted by newly disclosed vulnerabilities and highlights them via Rapid Response. Users can take advantage of these canned queries to instantly identify existing assets in the inventory that match specific identifiable attributes. For example, querying by hardware and device type can narrow down assets to a specific subset that may be affected by a vulnerability. All of the canned queries can be found in the Queries Library.

All in all, runZero is the only asset inventory solution that can truly help FCEB agencies stay on top of their ever-changing networks. By decoupling asset discovery from vulnerability assessment, agencies will gain visibility and efficiencies, while meeting the requirements set by CISA BOD 23-01.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

2022 runZero

How to Manage Privileges in Endpoints?

If you are running an organization, you should be concerned with managing endpoint privileges to ensure devices such as laptops, smartphones, and tablets do not pose a threat to the cybersecurity of your company.

In this sense, one can use a PAM solution to support privilege management and avoid risks when not implementing the principle of least privilege.

In this article, we explain how this works and how GO Endpoint Manager can help you. To facilitate your understanding, we divided our text into topics. They are:

What is Endpoint Privilege Management?
How does a PAM Solution Support Privilege Management?
GO Endpoint Manager as a Solution for Managing Privileges in Endpoints
About senhasegura

Enjoy the reading!

What is Endpoint Privilege Management?

Endpoint privilege management combines application controls and privilege management and enables a company’s employees to have enough access to perform their activities without having full entitlements to the IT system.

Through endpoint privilege management (EPM) technologies, professionals have access only to trusted applications and companies are able to remove local administrator access with little impact on end users.
In practice, we are referring to the implementation of the principle of least privilege, according to which employees receive only the necessary permissions to perform their tasks.

How does a PAM Solution Support Privilege Management?

Privileged Access Management (PAM) consists of a set of information security strategies and technologies that aim to protect accounts by controlling privileged access and permissions for users and reducing risks of external attacks as well as insider threats.

With its evolution, Gartner included two classifications that describe different PAM solution approaches. They are: Privileged Account and Session Management (PASM) and Privileged Elevation and Delegation Management (PEDM), which is nothing more than the endpoint privilege management.

The focus of PEDM is to provide more specific access controls than those provided by PASM, minimizing threats generated by excessive privileges. PASM is based on more basic methods to protect access, such as the use of passwords.

To gain access, machines and users check administrator accounts that have full or no access privileges.
With PEDM solutions, one can grant only the necessary access for the performance of certain tasks. Moreover, access can be limited to a specific time.

At the end of a session, privileges are revoked and if credentials are compromised, attackers will not be able to persist in their actions.

PASM associated with PEDM makes it possible to control the privileges of administrator accounts, consequently reducing insider and external threats.

Another important function of PEDM tools is to allow administrators to request new roles to obtain the necessary permissions to perform tasks so that privileges are assigned through a flexible approach.
In addition, they help organizations to comply with some criteria, as they often provide reports as well as monitoring capabilities.

GO Endpoint Manager as a Solution for Managing Privileges in Endpoints

GO Endpoint Manager is senhasegura’s PEDM solution. This tool is used to control the delegation of privileges to Windows and Linux-based endpoints, including Internet of Things devices and other wireless devices for corporate networks.

Through this feature, endpoints can be brought into compliance with the security standards of cybersecurity organizations and regulations, such as NIST, CIS Controls, and ISO 27001.

About senhasegura

We, from senhasegura, are part of MT4 Tecnologia, a group of companies focused on information security founded in 2001 and operating in more than 50 countries.

We propose to guarantee digital sovereignty and information security to our clients, granting control of privileged actions and data, and avoiding theft and leaks of information.

For this, we follow the lifecycle of privileged access management through machine automation, before, during, and after accesses. We also seek to:

Prevent companies from suffering interruptions in their operations;
Automatically audit the use of privileges;
Automatically audit privileged changes to detect privilege abuse;
Provide advanced PAM solutions;
Reduce cyber risks;
Bring organizations into compliance with audit criteria and standards such as HIPAA, PCI DSS, ISO 27001, and Sarbanes-Oxley.

Conclusion

By reading this article, you saw that:

Endpoint privilege management allows employees of a company to have enough access to perform their activities, without having full entitlements over the IT system;
PAM has two complementary approaches to protect accounts, namely: Privileged Account and Session Management (PASM) and Privileged Elevation and Delegation Management (PEDM);
GO Endpoint Manager is senhasegura’s PEDM solution. This tool is used to control the delegation of privileges to endpoints.

Was this article helpful to you? So, share our text with someone who might be interested in the topic.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Segura 2022

Backup Strategy and the 3-2-1 Principle

Data loss comes in all sizes: small (individual files), medium (SharePoint site), and large (ransomware and disaster recovery). No matter the size of the loss of data, none of them are fun, and even the smallest of data loss events could leave you lacking your most critical data. That one spreadsheet or that one hard disk drive could have what you and your business rely on most – it’s not always something someone can “just create again” on a whim as data loss is indiscriminate in its impact. All data loss events negatively impact workflow, and all are risk and data protection concerns that ultimately are a business imperative. Proactive data protection through backup and data management is at the forefront of all of our minds—or at least should be. Now why is that? Years ago, the assumption prevailed that cloud services would “take care of everything” once you signed up for a cloud service, with backup being lumped in. But now, more than ever, as the awareness of shared responsibility models for SaaS applications grows which states it is the user who is responsible, it’s clear the onus is on you to have that backup strategy in place. That’s why the 3-2-1 backup rule—a principle established for on-premises infrastructure which requires multiple copies of backup data on different devices and in separate locations—is still relevant to today’s cloud-based infrastructures by providing essential data-protection guidelines.

Why Back Up Cloud SaaS Data, and Why Now?

Your data is critical to your business operations, and in many cases, maintaining control of and access to it is required by law. (Read more about how third-party security keeps companies in control of their data here.)

SaaS Shared Responsibility Model

Software-as-a-service providers have established documentation that clarifies the areas of responsibilities they have and also those responsibilities that are retained by the customer. Microsoft, well known for its Microsoft 365 SaaS offering, delineates the boundaries of shared responsibility in the cloud.

While Microsoft does provide some degree of data protection, many people are not aware of the limitations of this protection. The short of it is that Microsoft does not provide suitable backup and restore functionality to customers. Learn more about why your M365 is not backed up (and how to fix it) in our in-depth article here.

And it’s not only Microsoft that has a shared responsibility for their SaaS services. Google (and backup files to Google drive) has what they refer to, almost ominously, as “shared fate” on Google cloud shared responsibilities. Likewise, Amazon Web Services (AWS) have their own shared responsibility model. It’s vital customers know and understand the extent of their agreement.

Risks to Data Security

In the days of on-premises backup, the only credible risks were acts of mother nature and hardware failure. That is, of course, if you ignore software issues. Lots of software (from firmware on RAID adapters to drivers to operating system filesystem implementations and the user applications) problems would cause data loss and a need for restore, from system level down to file level. (That’s one thing I don’t miss about the ‘90s.) However, in the cloud-computing era, the risks have evolved as much as the ways in which we create, share, and store data, so things are much more complicated now. With both the prevalence and penetration of ransomware, cybercrime, and not to mention the increased access users have in order to streamline collaboration interactions and boost productivity, data—the lifeblood of a company—has, in many ways, never been more susceptible to data loss, regardless of whether it’s international (malicious actors, ransomware, etc.) or unintentional (human error, accidental deletion). Sometimes going back to basics can be the place to start in developing or hardening security.

3-2-1 Backup Method

The 3-2-1 principle comes from the days of on-premises data storage. It is still commonly referenced today in the modern, cloud-computing area. Even though it isn’t directly applicable, word for word, to cloud data, this well-known and widely used principle can still be used today to guide security decision makers in their process of improving their security infrastructure against today’s data risks.

Roughly speaking, the 3-2-1 backup rule requires 3 copies of data, across two types of storage media, with one off-site copy stored.

What Is the Origin of the 3-2-1 Rule?

Backup and recovery solutions have existed since long before cloud computing. However, the methodologies have shifted due to the modernization of the infrastructures, behaviors, needs, and of course a lot more variables (but we won’t get into that here), which has resulted in some discrepancies between best-practice principles and their application to modern data infrastructures. This is also the case with the 3-2-1 backup rule, with the biggest change being the shift of how data is created and stored (or rather where). Formerly, production data was created on site and stored in on-premises hardware, alongside one backup copy, and the third being stored off premises and typically on tapes. ComputerWeekly has a feature on if the cloud has made 3-2-1 obsolete. In the cloud era, data is created in numerous places by remote workers in SaaS applications, where it is often transferred around the globe, and is stored “somewhere else” from a business’s physical office. More than likely, the extent of an answer to the question of “where is your data stored” is that it’s in the cloud. But is that backup? And what is true backup in the cloud?

How Does the Rule Apply to Cloud Backup?

We often see iterations of this backup principle in fancy infographics that almost forget to translate the rules to apply to the current scenarios. However, with a few tweaks, there’s plenty of relevant guidance that can help lead to a successful, modern, data security system.

Let’s look at the rules with a modern lens:

3 Copies of Your Data

The ‘3’ in the rule refers to the number of “copies of your data,” with one being the primary dataset in the production environment while the remaining two copies are backups. This is still applicable to modern data protection best practices.

2 Administrative Domains

As mentioned, the ‘2’ can be understood as “two administrative domains” so that copies are managed independently from the other or are stored within separate logical environments. You often see this written as “two types of media,” which is a relic from the on-prem past when it was made up of disks and tapes. Now, it’s about having copies across multiple disks and across two administrative domains so that one data-loss event cannot possibly—or is extremely unlikely to—impact all copies of the data. This is known as a logical gap. Without it, should there be a cloud-wide compromise (such as a breach) or data loss event of the cloud where your primary data lives, your data would not be available to you. One of the best-known examples of this is the Danish shipping giant Maersk and the infamous NotPetya cyberattack, dubbed “the most devastating cyberattack in history” in the full Wired story here. When working “in” the cloud, the building you are in isn’t of any real consequence to the data. Rather, it’s the cloud you are working in and storing data in that matters. In many regards, this step could envelop the step below, “1 copy external,” but in respect to the principle, it serves us here to keep it a separate consideration. Should there be a cloud-wide compromise or data loss event of the cloud where your primary data lives, your data would still be available to you by following the rule. Without doing so, you’ve lost access to your data (or even lost your data permanently), with an impact that has a massive potential for business disruption and costs (as in the case of Maersk).

1 Copy External

Formerly the ‘1 off-site storage copy,’ this still applies for the same reasons as it did in the past: You don’t want to store all of your data in the same exact location, and whether all are aware or not, the cloud is located in physical data centers. From the on-premises days, this meant literally having a copy of disks and/or tapes in a different location from your business in case someone, something, or some event with the power to destroy the building did so. Let’s call this the “in case of fire” step. In cloud computing, this means having a backup copy outside the cloud of the production environment and outside the administrative domain of the other backup. Remember, the cloud is ‘just’ physical data centers, so by working in the cloud, the centers you are storing your data in are of real importance to the data. What if the data center of the cloud you are working in is also the same data center that your backup cloud data is stored in? Should there be a data loss event at that center, all of your data would be at risk from that event. That’s bad.

Use Case: What would this look like in real life?

If, for example, you are working on a Microsoft Word document and you save it to OneDrive that has OneDrive Backup turned on, you’re totally protected, because it says “backup,” right? This is an example where the 3-2-1 principle still helps shed light on modern data protection in the cloud. By following the 3-2-1 rule above, one can deduct that this example isn’t backup (but neither is a lot of what SaaS providers offer as ‘backup’) because true backup requires a logical infrastructure separate from the primary data. As the “in case of fire” step requires, you must have one copy outside of the administrative domain. By working in and backing up OneDrive data to Microsoft’s cloud services, the data remains in the same administrative domain. What if something were to happen to Microsoft servers? You’d lose access to your primary data and the copies “backed up” since they all relied on the same cloud. What’s even worse is that since the backup is configured by “you” (i.e., the admin), a compromise of your account can unconfigure it, too. So, a simple case of ransomware could completely and automatically disable or work around such in-service protections—even leading to immediate backup data deletion. Keepit, on the other hand – aside from being separate (and therefore unlikely to be compromised at the same time by the same mechanism), as a dedicated backup solution – will actually protect even the administrator from quickly or immediately deleting backup data. In this respect, Keepit offers some of the most desirable features of “the tape in an off-site vault” in a modern cloud service solution.

Here’s how to use the 3-2-1 backup rule to ensure you’re covered: Independent cloud

If you’re interested in further reading, check out our e-Guide on SaaS data security for a thorough look into leading SaaS data security methodologies and how companies can raise the bar for their data protection in the cloud era. Convinced you need backup, but want to know more about data protection and management for your particular SaaS application, then explore how Keepit offers cloud data backup coverage for the main SaaS applications here.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

2022 Keepit

Pandora FMS: What do you know about sending additional information in email alerts?

When monitoring the software components of a server, sometimes you may need to find out some additional information about the performance of the metrics you monitor.

Sending additional information in email alerts

This is all about putting data into context, because 25 is not the same if it is 25% of a CPU, or 25% of a CPU with other three more CPUs, all of them at 100%, or 25% of a CPU of a computer about to be blocked by excess of I/O transactions that has been overloaded for hours, which has risen the system’s temperature to the maximum.

Isn’t it true that “25” can mean many things? Let’s dig a little deeper into it

Continuing with the previous case, suppose that you wish to measure the CPU usage in one of the servers you manage, and where you defined thresholds that force notifications by email to computer managers.

This threshold (CRIT for CPU > 80) would be reflected in the module configuration as follows:

The alert is defined using the template “Critical condition” and I use the action of sending custom email to send to a specific mailbox.

Okay, so far it’s kind of basic.

But you may like to be able to send some additional information about the problem, something to collect only when needed, real-time information that is useful for you to find a solution automatically.

But…. Can Pandora FMS do this?

Well, you may include information from other modules in the email using alert macros that reference other modules.

You may check the full list of macros in our documentation, but we will give you a quick summary of some interesting ones:

moduledata_X_: It will show the data of the “X” module of the same agent as that of the module that triggers the alert.

That way, if you have a module called LoadAVG, calling the macro _moduledata_LoadAVG_ you may dump the value of the system load.

Likewise, to show a graph of the last 24 hours of that module, you should use the macro _modulegraph_LoadAVG_24_

*This last thing about the graph is still experimental, until version 772 it will not be available to everyone.

Showing procedures

Perhaps you would like to include textual information about what to do in case your module is set into CRITICAL, as some kind of instructions or procedure. To that end the macro _alert_critical_instructions_ will return the text that you configured in said module for this case.

Showing previous data

You may also be interested in showing the previous data on this monitor before the alert was triggered; to that end you may use the macro _prevdata_

Showing agent informational custom fields

Imagine that you have a field in the agent that collects data, which tells you the name of the system administrator and their phone number, as custom agent fields with ID 7 and ID 9.

To that end we would use the macro_agentcustomfield_n_ as macro_agentcustomfield_7_ and macro_agentcustomfield_9_ and thus be able to add to the email the name and phone of the person in charge of the system.

A full example, using macros in an email

Let’s now see an example!

If you wanted to send a somewhat more complete email, edit the email action you are using to add new macros:

Using dynamic information

What if you want to go further?

What if you want to execute a command every time something happens and collect the value to send it in the email?

That way, you do not need to have a constant additional metric when monitoring so as not to fill the database with information that is only useful in critical situations.

In order to submit additional information, it will be necessary to create a previous module in your software agent so that it collects the information only when necessary.

With that purpose in mind, enter the following structure within your module:

module_begin

module_name MODULE_NAME

module_type async_string

module_precondition > X COMMAND_TO_RUN_AS_CONDITION

module_exec FINAL_COMMAND_TO_BE_EXECUTED

module_end

The module will have to be asynchronous and with the type of data that you will collect.

This is due to the need for this module not to go into an unknown state, thus giving a false perception of failure, when it does not meet the module’s precondition.

A condition expression will have to be incorporated so that you may run the module normally.

For that purpose, run a previous command from which to obtain the numerical information to obtain the data. Following the example of the CPU described above (which is higher than 80%) it would be something like:

module_precondition > 80 uptime | awk -F “,” ‘{print $3}’ | awk ‘{print $3}’ | tr d “\n”
Finally, use the command to obtain such additional information in order to attach it to your email.

In the previous case, it would be convenient to know the processes that are using more CPU (top 5 processes), so you may enter the following case:

module_exec top -n1 | head -12

So in the previous example there would be a module as follows:

module_begin

module_name TOP5_CPU_Proc_Usage

module_type async_string

module_precondition > 80 uptime | awk -F “,” ‘{print $3}’ | awk ‘{print $3}’ | tr d “\n”

module_exec top -n1 | head -12

module_end

Once you create the module that will only be executed when necessary, enter this information in your email.

For that purpose use the following macro within the email:

_moduledata_TOP5_CPU_Proc_Usage_
This is only a way of using it to send the additional information, you may use it for other cases such as for example if the disk usage of a server is reaching the limit, you may show the five heaviest files saved on the server using the command “du -Sah/ | sort -rh | head -5”

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Pandorafms 2022

Top 10 cybersecurity predictions for 2023 you need to know

The cybersecurity landscape is ever-shifting. With new and advanced technologies developing at lightning speed, we can expect major digital security changes — and challenges — this year. So, what cybersecurity predictions can we make for 2023? Read on to find out.

#1 Possible spike in state-sponsored attacks

With Russia continuing to wage war in Ukraine and China’s president securing an unprecedented third term, we may see a spike in state-sponsored attacks.

In China, another five years in power may give the president the opportunity to launch more large-scale cyberattacks on Taiwan and other countries seen as a threat to the regime.

We can also expect Russia to launch cyber attacks on Ukraine or lash out against the states supporting Ukraine. These malicious activities may also come in response to the economic sanctions imposed on Russia.

#2 5G may present new security challenges

With the growing adoption of the 5G network, we’re likely to see new 5G security challenges in 2023.

Every new technology comes with security concerns — and 5G is no exception.

While 5G technology offers much greater speeds than 4G and potentially unlimited connectivity, it has several system vulnerabilities. The technology needs new cloud-based infrastructure to work, which creates more access points for hackers to exploit.

With the rapid 5G adoption and the significant global shortage of cybersecurity professionals, this technology could bring new cybersecurity challenges that are easy to overlook.

#3 Government surveillance may increase in some regions

Democratization has suffered a lot over the last few years, with global democracy reaching an all-time low.

Countries with strict authoritarian regimes, like China, Russia, and Iran, may increase government surveillance and censorship to maintain control. One example of surveillance could be China’s plans to review social media comments before they’re published.

The leaders of these countries may take even more steps to cut off users from the global internet, potentially resulting in more isolation, restrictions, and prosecution.

#4 This year could be big for data privacy

With corporations and criminals continuing to compete for your information, data privacy is more important than ever.

2023 may be the year data privacy gains much-needed legal protection from governments worldwide.

India, one of the world’s fastest-growing online markets, is expected to pass the Personal Data Protection Bill — its version of the GDPR — this year. The legislation will include requirements for companies to get individual consent, correct inaccurate personal data, and protect data rights.

We may also see data privacy laws tightening in the U.S., depending on Congress’ actions.

2023 could be the year that the American Data Privacy and Protection Act gains traction and finally establishes a data privacy framework on the federal level.

#5 We may see more blockchain-based cybersecurity solutions

Blockchain technology is beneficial for secure, decentralized information storage and exchange. Blockchain delivers unrivaled data integrity, transparency, and decentralization.

In 2023, blockchain will likely be applied to cybersecurity in new ways, helping to create advanced and virtually unbreakable digital security solutions.

Until now, using blockchain in cybersecurity has been very expensive because of how new the technology is.

However, blockchain is maturing and attracting substantial investment. Therefore, this year we may see blockchain technology increasingly being used in cybersecurity solutions.

#6 This year could be the end for third-party cookies

Google is working on phasing out third-party cookies in Chrome — another huge win for data privacy.

Third-party cookies are trackers that advertisers and website owners use to collect data and track user behavior. While first-party cookies mainly collect data about your user experience, third-party cookies track you around the web and pose privacy and security risks.

Firefox and Safari browsers already protect users from third-party trackers, and you can even disable cookies yourself. However, removing third-party cookies from Google Chrome is a major win for privacy because two-thirds of all internet browsing happens on Chrome.

#7 Hackers may carry out more supply chain attacks

Hackers are predicted to continue targeting organizations by launching attacks on weaker supply chain links. We’re already seeing this trend in 2022, and it is expected to grow in 2023.

The supply chain consists of a network of organizations, resources, individuals, and activities involved in the creation of one single product.

By targeting a weaker point in the attack chain, cybercriminals can take advantage of the trust organizations place in third-party vendors.

These attacks are likely to increase in 2023 — with businesses continuing to lose large sums due to production disruptions.

#8 Fileless malware may become a more serious threat

Fileless malware is malicious software that uses built-in applications to infect a device, making it extremely difficult to detect and eliminate.

This malware exploits software vulnerabilities in well-known and trusted applications you’ve already downloaded, leaving no trace of the attack on the device’s memory.

Fileless malware has been a cybersecurity threat since its emergence in 2017 — but it is likely to become even more damaging in 2023. Cybersecurity technologies are constantly evolving — but so are cyber threats.

Fileless malware has always been difficult to detect, but the sophisticated methods and tools attackers use make it even harder. While fileless malware isn’t easy to develop and execute, it can cause immense damage if done successfully.

#9 Cloud security may become more important

Most companies use cloud computing for storing files. Cloud technologies provide a centralized location for applications and data and are more secure than storing files on-premises.

However, several cloud security issues still exist. For example, misconfiguration of security settings or hijacking accounts could lead to data breaches or unauthorized access.

With more and more companies moving their data into the cloud instead of storing files locally, we are likely to see a growing number of attacks on cloud vulnerabilities. Therefore, improving cloud security is expected to be a crucial element of organizations’ security strategies.

#10 Consumer data breaches may decline

The following prediction may be good news for customers — but not for businesses: we’re likely to see a decline in consumer data breaches in 2023.

Cybercriminals are finding new and more profitable ways to make money. An increasing number of hackers turn to ransomware — demanding that the breached company pay a large sum of money to retrieve the stolen data.

Bot sales are becoming more common, too. Hackers can purchase bots with customer information without initiating a data breach.

These sophisticated techniques mean that hackers are less likely to leak your personal information and opt for the “big wins” instead.

How to increase your online security in 2023

We can expect many cybersecurity challenges this year, so taking the necessary steps to protect yourself online is paramount. Here are the main ways to stay safe and secure in the digital world:

Use strong, unique passwords. Weak passwords can cause serious damage. If your passwords are short, common, or something that could be easily guessed by a hacker, it’s like you’re leaving your door unlocked at night. Create strong, long, and unique passwords — or secure your passwords with a reliable password manager.
Stay in the know. Hackers are more successful with people who don’t know much about the dangers of the digital world. Make sure you know about the most common cybersecurity threats and what new, sophisticated hacking techniques are on the rise. Staying in the loop will help you spot anything suspicious — and protect yourself before anything happens.
Use a VPN. A VPN secures your internet connection and hides your IP address, protecting you from hackers and keeping your data private. If you choose NordVPN, you’ll also get free Threat Protection — an advanced cybersecurity feature that blocks annoying ads and intrusive trackers and scans downloads for malware. On top of that, a VPN protects you on public Wi-Fi, keeping your data safe and secure.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

2022 Nord Security

Zero Trust: What Is It and How to Implement

Zero Trust and Data Security in Companies

Due to the surge of ransomware attacks, the increased risks for data loss, and the continuous adverse effects cybercrime poses, many organizations have adopted the zero-trust principle to harden the security of their systems, thereby increasing their cyber resiliency.

Cyberattacks have become so ubiquitous that the Biden White House issued a statement urging American business leaders to strengthen their organization’s cybersecurity measures.

As it stands, GlobeNewswire reported that zero trust security is expected to reach a market value of $29 million USD by the end of 2022 and increase to US $118.7 billion by 2032. This significant growth in the coming decade comes from the value zero trust brings companies.

The simple fact is that business leaders are following its principles, like consistent monitoring and validation, because these principles help prevent data breaches and mitigate data loss.

This post will dive into what the zero principle is, as well as its capacity to tighten workplace data and security, effectively ushering in what Microsoft calls:

A new security model that more effectively adapts to the complexity of the modern environment, embraces the hybrid workplace, and protects people, devices, apps, and data wherever they’re located.

What are the cybercrime trends that zero trust can help curb?

One trend that’s risen in recent years is ransomware. Ransomware cripples businesses by locking their computer systems until a sum of money is paid. These attacks are expected to have a price tag of $265 billion USD annually by 2031, according to Cybersecurity Ventures.

With how easy it has become for ransomware gangs to deploy ransomware on a multinational scale, businesses need to deploy enhanced cybersecurity solutions to lessen system vulnerabilities, because “when it comes to ransomware attacks, it’s a matter of when, not if.” Read more from the Keepit blog article on how to prepare for ransomware.

It should come as no surprise that ransomware attacks can result in operational downtime. A Statista report stated that the average length of interruption after ransomware attacks is 20 days.

Even minor disruptions can decrease employee productivity, impede communications with clients—among other issues such as the significant fines Marriott faced—and impact business continuity. One might struggle to fully comprehend the serious implications that 20 days of downtime would have for businesses.

Zero trust, in a nutshell, is guided by the principle of ‘never trust, always verify.’

Why Zero Trust?

Zero trust, in a nutshell, is guided by the principle of “never trust, always verify.” It’s a modern security architecture which assumes that internal and external threats exist on the network at all times due to the pervasiveness of cybercrime. And as such, it requires all network users to undergo verification and validation processes before they can access the network resources.

Is zero trust really needed?

Generally, employees within a company access multiple networks simultaneously. There are many, many data exchanges between multiple user devices, across potentially numerous networks – of course, depending on the complexity of a company’s IT infrastructure.

This architecture boosts productivity through increased collaboration. However, this can come with a hidden risk when not following the zero-trust security model.

Zero trust use cases

What might that risk look like? Let’s suppose that one employee working on a single device is validated as “trusted.” But that device has become infected with malware by the user opening a dangerous email. (Learn how to identify a dangerous email.)

Since this user’s device was previously validated and is now assumed harmless, it still has access to all the users and networks as before being infected without having to provide or verify any credentials.

The result is unrestricted access to spread malware from this “trusted” device to other users within the network and to other devices within overlapping networks, allowing the malicious actor to expand their reach and damage, gaining access to more and more of a company’s business-critical data.

This example is the main reason zero trust architecture rejects assuming any device is safe. Rather, the system reduces risks through continuous authentication, thereby enhancing protection for your company’s network system by always verifying and authenticating. According to TechTarget:

This protects your organization in ways other models can’t. It stops malware from entering your network; gives remote workers more protection without affecting productivity; simplifies management of security operations centers with enhanced automation; and extends visibility into potential threats to improve proactive remediation and response.

TechTarget

How to Adopt Zero Trust

According to a Microsoft zero trust business plan, “digital transformation forces re-examination of traditional security models.” And as such, there are many companies offering guidance. Microsoft alone has helped aid zero trust deployments in thousands of organizations with insightful (and practical) guides on how to adopt a zero-trust business plan.

Global cybersecurity leader Palo Alto Networks shares that there are three crucial steps you need to follow to deploy zero trust architecture in your business:

Define your protected surface: Zero trust architecture can be costly and complicated. As such, identify your protected surface—including components like company applications and assets— rather than focusing on a large network area.
If your business utilizes Microsoft 365, then you’ll know that documents, email, SharePoint data, and Teams chat must be secured against cyberattacks. Attackers can breach an account with access to the data or hijack your system admin, making it imperative to find a SaaS data backup solution that can maintain multiple backup copies with the needed granularity of data and metadata.
Map your data flow: Plan your business’ flow of instructions and data as this will provide you with information on overlapping networks.
For instance, where and in which formats is the data stored? If your employees utilize digital, desktop, mobile, or cloud, identify them so you can see how data is moved and shared.
Design your architecture: Essentially, the network architecture should prevent unauthorized access to individuals who aren’t part of your company.
This is especially relevant if you want to encrypt data before it moves to cloud storage devices. If you want to back up your company’s Microsoft 365 data, for instance, we offer blockchain-based encryption technology that guarantees your backups will remain immutable to ransomware threats and data loss. At Keepit, we also offer comprehensive coverage for M365 applications such as SharePoint, OneDrive, Groups and Teams, and Exchange Online.

Of course, implementation isn’t as simple as one, two, three: It involves a massive undertaking and a focused effort to implement and maintain. There are many, many other variables and considerations.

For instance, you can also adopt multi-factor authentication (MFA) and ensure use of updated devices.

MFA is especially relevant for companies who have stored their digital information on cloud computing systems. With MFA, you can prevent unauthorized users from accessing your organization’s resources.
Similarly, encourage your workforce to update their devices with the latest firmware as this typically offers security patches for known vulnerabilities.

Continuously monitor your network and device attributes. Adopting zero trust architecture can prove futile if your workers do not audit and maintain a log for monitoring network traffic.

Do I still need to get backup for my SaaS data?

Ultimately, zero trust makes it much more difficult for external threats to gain access to an organization’s business-critical data – but not impossible. It also does not protect you against internal threats nor from human errors such as accidental overwrites and accidental deletions.

Data protection best practices tell us to always have a backup. That is a fundamental responsibility for you, the data creator and customer of a SaaS service like Microsoft 365, due to the well-documented yet often misunderstood shared responsibility model. Securing an independent backup is still the best way to ensure 24/7 availability to your data.

With the offerings from specialized third-party backup and data management providers, peace of mind can be had quickly and from a cost-effective service. This is why Keepit was created: Your data, here today, here tomorrow.

Want backup now?

Learn more about Keepit’s SaaS data backup service offerings here.

If you’d like to explore more about backing up a particular SaaS workload like Microsoft 365, find the relevant Keepit blog posts below, as Keepit offers a suite of cloud SaaS data protection services:

Read our blog about why you need to back up M365
If you’re using Salesforce, read that blog article here
Why back up Active Directory (Azure) here
And for Google Workspace
Finally, read why to back up Zendesk here

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

Keepit 2022

Why adding “End of Life” to your cybersecurity vocabulary is a good idea

Life seems to be moving at a blazingly fast pace. As so does technology. Maybe even more so. Meaning, it is no wonder we sometimes feel overwhelmed and questioning whether we can keep up. Yes, it is hard to keep up with new technological advances and the threats accompanying them. But the fact is that because technology is moving so fast, that is exactly the reason to stay on top of the latest cybersecurity knowledge and solutions.

The saying “New is always better” is clearly not always true, but when it comes to securing our devices, there is some truth to it. We trust what we know, and with technology changing rapidly, we may prefer to keep on using outdated, but trusted, products. But there are a few things to consider, especially in the field of digital security. There are malicious threats we need protection from that are testing and honing exploitation techniques against software product – especially older versions.
Upgrading to new software can be a difficult decision, especially when a business has invested heavily in a particular product or funds are scarce to ensure continuity after an upgrade. Some businesses may not want to update at all. Yet sometimes the manufacturer or software provider can press the issue by bringing products to their end of life. End of Life. Also known as a product sunset, this date is a communicated conclusion to the manufacturer’s support for a product (or service) and is generally preceded by a period of limited support. In basic terms, this means that change is afoot.

What is EOL?
End of Life is a policy change, applying to platforms or products, that has reached the end of its useful life. This decision is made by the manufacturer and typically occurs many years after the software’s or hardware’s production.

EOL policies evolve with the aim of reducing the number of older product versions that demand constant attention and maintenance. Why do providers do this? To focus time and resources on newer products so that they get the attention they need to protect our customers against new arising threats. Progress cannot be stopped, but attempts are constantly made via new threats to interrupt our journey forward. ESET is here to protect progress, so instead of resisting this momentum, we should ensure we not only appreciate the new technology but also the new threats. The newer the product, the better it is adapted to protect in the current threat environment. This will allow for better protection and make for a smoother experience for our business customers.

It is very important, and we strongly advise our users, to always run the latest version of ESET products. Users should also ensure that other critical software, especially your device’s Operating System (OS), is up to date and fully supported. The status of your OS is very important as it can have many implications to core functions and security too. For example, there have recently been changes to Window´s End of Life policy. To read more click on this link.

The upgrade to the latest ESET product versions has always been at “no cost,” and that is still the case to this day; the fact that access to new product versions is included in the price of your valid license remains unchanged. In this way, updates allow users to employ the most advanced security technologies that are high performing and easy to use, all of which help make our products more effective for you. To check ESET´s End of Life policy click this link.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2022

‘Tis the season not to get smished!

We all hope to have some peace and quiet during the holiday season, not just in the physical world, but also in the digital one. But we got used to using our devices for ordering presents online, communicating with family through video chat, and looking for good deals online. And those are exactly the snippets of your time, that cybercriminals take advantage of.

It´s no wonder there is a surge of holiday-themed SMS phishing or smishing. According to Proofpoint research, instances of smishing doubled in 2021 in comparison to 2020 during the holiday season. Most of the texts sent during this time are related to delivery or retail messaging. Cybercriminals pray on Black Friday, Cyber Monday and other retail-important events, but also deliveries post purchase. But why exactly do they choose SMS as their threat vector?

Text messages are easier than email, since they can be short, and what´s more, text messages have a 98% open rate, and 95% of texts are opened and responded to within the first three minutes of its delivery. And what is even more, the chance of a person being cautious with a text compared to an email is much lower. The click through rate for text messages is eight times higher than email, and yet less than 35% of the population knows smishing exists.

These text messages claim to be good deals, or delivery information for a non-existent package. And since many people order not just one package from just one online store, they don’t always give it much thought as to what this particular item might be. These smishing texts contain a click-through link to a landing page attempting to steal your personal information.

So what exactly would a smishing message look like?

There are certainly some characteristics to look out for.

Unfamiliar sender – this may be an unknown or strange-looking number
Urgency – just like traditional email phishing campaigns, smishing messages urge you to act quick, or your package will be returned to sender, or the offer deal is about to end
Links – links to landing pages and sites where you are expected to enter your personal information
Requests – they may often request you to provide personal or financial details

How not to become a smishing victim?

First of all, think twice before clicking on any links and requests, is a great rule of thumb for your cybersecurity in general. But more specifically, when receiving an unknown or suspicious text message, do not click on any links, reply to the message or provide any personal information. Instead, either ignore or completely delete the message. And if you are still not sure if the message is real or not, search for the organization, government body or e-store online, contact them, and assure yourself of the legitimacy of said message

Best cybersecurity gift

To make your life easier, and this season more peaceful, give yourself the gift of cybersecurity and opt for a good mobile security solution. ESET Mobile Security aims to provide a safe environment for you to enjoy time with loved ones without worrying about your digital safety.

The solution aims to protect and secure your device from criminal activity using manipulation of users, known as social engineering, into gaining access to sensitive data such as bank account credentials, card numbers, PIN numbers, usernames and passwords.

The anti-phishing protection feature is now bolstered by a new Anti-smishing feature. This defends and warns the user against any messages containing malicious links after delivery, making sure you are protected even before opening the message and any links the message might contain.

We recommend you turn this feature on from its default off state, to ensure you are fully protected, especially during quality time with loved ones. All malicious websites, listed in our ESET malware database, will be blocked and a warning notification will be displayed informing you of the attempted attack.

ESET Mobile Security makes your Android phones and devices easy to find and harder to steal, as well as helping to protect your valuable data. ESET is already trusted by millions of users around the world to keep their data safe. ESET helps protect the Google Play store and is trusted by millions of users like you around the world, and is dedicated to the online safety and education of children and their parents. Click here to find out more.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2022

Building an Incident Response Plan for Ransomware

Ransomware is considered one of the biggest threats to business in 2022. In this type of cyberattack, hackers block their victims’ computers and charge a ransom to unlock them.

You may be wondering: what are the basic steps of an Incident Response Plan for ransomware or what an Incident Response Plan should include? So we prepared this article.

Here are the aspects a proper response to a ransomware attack should include:

Risk Assessment
Identification of a Ransomware Attack
Defining the Scope of the Attack

Isolation of Affected Systems Elimination of Malicious Software Disclosure of the Attack Environment Recovery Incident Recovery Plan Application of Lessons Learned

Keep reading this article and learn all about it!

Basic Steps of an Incident Response Plan An Incident Response Plan involving ransomware shall cover the following steps:

Risk Assessment The first step for those who want to design an Incident Response Plan involving ransomware is to assess the risks and threats faced by the company. In this step, you should understand which types of ransomware your company is most vulnerable to and which assets and data would be most impacted. In addition, it is important to know how and to what extent your organization would be affected by a ransomware attack.

Identification of a Ransomware Attack When implementing an Incident Response Plan for ransomware, it is possible to identify an attack, taking into account there are many types of malware similar to ransomware, and the main signs of the latter are encryption and file blocking.

Defining the Scope of the Attack In an Incident Response Plan for ransomware, defining the scope of the attack is equivalent to measuring how much data and systems were affected by it. That is when you will know if the attack affected a single server, or if all your files kept in the data center or the cloud were impacted as well.

Isolation of Affected Systems The next step is to stop ransomware activities by isolating the affected systems in order to contain the attack and immediately putting the affected systems and networks offline. If this is not possible, disconnect the compromised devices or remove them from Wi-Fi to prevent ransomware infection from spreading.

Elimination of Malicious Software After containing the attack and isolating the affected systems, you must respond to the incident by eliminating malicious software and making sure the attack has been stopped. In the Incident Response Plan for ransomware, this is the time to assess the extent of the damage and check for backups to the locked files.

Disclosure of the Attack

Certain data protection laws and compliance regulations provide that attacks affecting sensitive data must be notified to authorities and persons who have had their information exposed.

So, if a ransomware attack has affected your customers’ data, be prepared to make the disclosure, according to the steps established by the regulatory bodies.

Environment Recovery

After removing the malicious software and disclosing the attack, the focus should be on restoring systems and data by using the backup to retrieve information and reinstalling the systems.

In this step, the security team must work in collaboration with the IT team, ensuring all security mechanisms are updated before reinstalling the impacted systems.

Incident Recovery Plan

If you are not prepared to restore systems and data after the attack, you will need to create an Incident Recovery Plan for ransomware.

This activity may be a bit time-consuming, but it is essential to avoid errors during recovery. In this step, you should also look for ways to recover files that were not saved in backups.

Application of Lessons Learned

Once you have recovered the data and restored your business operations, it is essential to check what has happened. Making a solid assessment of what motivated the ransomware attack will help your company not make the same mistakes and prepare employees to deal with future situations.

Relevant Statistics on Ransomware

Here are some relevant figures about ransomware attacks:
9% of Americans have been targeted by this type of attack;
Two-thirds of ransomware infections are caused by phishing emails;
Annually, ransomware attacks generate $1 billion for malicious attackers;
It is believed a ransomware attack will take place every 11 seconds by the end of 2022.
In 2020, schools and colleges were the main targets of ransomware attacks.

About senhasegura

We are senhasegura, a company widely recognized as a leader in cybersecurity. Our purpose is to provide sovereignty over sensitive data to the companies that hire us, using PAM to prevent data theft and leaks, as well as shutdowns in activities, which damage the results of corporations.

To achieve this goal, we track the lifecycle of privileged access management and use machine automation before, during, and after access.

Moreover, we automatically audit the use of privileges and privileged actions to prevent abuse, reducing cyber risks. We also bring organizations into compliance with audit criteria and standards such as HIPAA, PCI DSS, ISO 27001, and Sarbanes-Oxley.

Conclusion

In this article, you saw that:

Ransomware is a cyberattack in which hackers block their victims’ computers and charge a ransom to unlock them;
An Incident Response Plan involving ransomware must include the risk assessment, identification of the attack, definition of the scope of the attack, isolation of the affected systems, elimination of malicious software, disclosure of the attack, and recovery of the environment among its steps;
It is also critical to verify what happened after implementing the Incident Response Plan for ransomware; and
Alarming numbers reveal ransomware is one of the main cyber threats today.

Did you like our article? Then share it with someone who wants to learn more about Incident Response Plan for ransomware.