Anyone who works with technology has certainly heard of or uses Microsoft Exchange, Microsoft’s server solution for email and calendar. Exchange is used worldwide by companies of all sizes, being preferred for its versatility and ease of use, and billions of electronic messages pass through it daily. However, even with all these advantages, Exchange is not free of flaws.

At the beginning of March this year, the giant creator of Windows released emergency patches for zero-day vulnerabilities that were discovered and were being exploited by malicious attackers to install malicious software through Exchange. Also called ProxyLogon, these vulnerabilities allowed improper access to e-mail accounts and data extraction, in addition to lateral movement in the infrastructure, affecting other critical devices.

The four Exchange Server vulnerabilities discovered were as follows:

• CVE-2021-26855: CVSS 9.1: it is an SSRF (Server-side Request Spoofing) vulnerability, which results in HTTP requests being created by unauthenticated attackers. For this flaw to be exploited, servers must be able to accept untrusted connections over port 443.
• CVE-2021-26857: CVSS 7.8: a failure in the Exchange’s Unified Messaging Service, allowing arbitrary codes to be implemented in the server’s SYSTEM. Nevertheless, this vulnerability must be combined with others or the attacker must have stolen credentials.
• CVE-2021-26858: CVSS 7.8 and CVE-2021-27065: CVSS 7.8: Post-authentication arbitrary file write vulnerabilities in file paths.

These vulnerabilities are being exploited by a group called HAFNIUM, which operated in China and was supported by the Beijing government, and is primarily targeting organizations located in the United States. However, it is estimated that at least 10 other hacking groups are exploiting these same Exchange’s vulnerabilities in the form of ransomware or cryptoware. It is not yet known how the groups discovered the vulnerability and how the information reached the other hacker groups.

Also, automated attack scripts used in proof-of-concept have been found, which makes it possible for unknowing attackers to exploit vulnerabilities and further compromise servers around the world.

The malware developed by these groups allows the creation of a pre-authentication Remote Code Execution (RCE), which allows attackers to take full control of the servers without access to any Exchange credentials. One of the main malware created to exploit these flaws is the DoejoCrypt or DearCry ransomware.

DearCry uses a combination of AES-256 and RSA-2048 encryptions, renaming files with the .CRYPT extension, and includes a readme.txt file with instructions on how the victim can recover their original files.

If the victim has a backup of the files, one action would be to ignore the ransom requests and recover the environment. There are already records of ransom requests accounting for tens of thousands of dollars. However, even if there is no ransom payment and the files are recovered, there is a possibility that copies of the infected files are made by the ransomware, which can result in data leaks by malicious attackers.

At least 30,000 organizations of all types and sizes in the United States alone are believed to have fallen victim to campaigns orchestrated by HAFNIUM and other hacker groups based on flaws discovered by Microsoft. The total number of companies affected can reach hundreds of thousands worldwide though, as many of them are unaware that they may have been impacted by the vulnerabilities.

To try to protect Exchange users, Microsoft has launched an automated vulnerability remediation tool in March. The tool, developed mainly for customers who do not have specific security teams, allowed for a reduction in the risks associated with the exploitation of vulnerabilities while the patches were not properly applied. Microsoft has estimated that 92% of organizations applied security fixes related to the ProxyLogon vulnerabilities by the end of March/2021.

This type of attack further reinforces the need for companies to invest in specific cybersecurity teams, such as red teams, to test security controls, look for flaws and vulnerabilities, and correct them accordingly, causing the least possible impact. By structuring these teams, it is possible to ensure the proper management of assets, including e-mail servers, in addition to their respective owners. Thus, it is possible to guarantee that updates and fixes are installed as soon as they are released by the providers. The result is a reduction in the attack surface and a lower risk of cyberattacks, which can avoid millionaire sanctions provided for by data protection laws, such as LGPD and GDPR, in addition to permanent data loss, which can affect business continuity directly.

If your security team has not installed security patches yet, they must do so as soon as possible. Remember that installing updates may not ensure that your Exchange servers will not be affected by the exploitation of other zero-day vulnerabilities. Therefore, a scan of the infrastructure is recommended to find out if the environment has been affected by the exploitation of other flaws not yet discovered by the manufacturers; and if discovered, security teams should use efforts to identify and respond to any detected security incidents. This can make the difference between a minimum correction effort without major losses and loss of revenue and trust of customers, partners, and employees.

The digital transformation process brought an increase in the number of connected devices, including industrial devices, in what we call Industry 4.0. Ensuring cybersecurity is essential to keeping any business system up and running. With that in mind, we have brought here the main vulnerabilities of cybersecurity in industry 4.0, which corresponds to the period of technological breakthroughs we are experiencing.

It is no surprise that everyone is connected and so are businesses. However, just as regular users are at risk, business data is also in vulnerable, even dangerous, situations.

Industry 4.0 and cybersecurity

With the high volume of data circulating on several servers, malicious attackers and cybercriminals obviously arise. As such, they develop techniques for stealing data that often have financial value involved.

Considering that many companies operate through electronic and automated systems, the risk is high. Even with all the existing security, there are still no 100% secure systems against hackers.

With the increasing number of cyberattacks, it is crucial to guarantee protection against intrusions. In this scenario, cybersecurity arises in order to prevent and protect important data from these attacks.

Mainly marked by the large volume of data, Industry 4.0 simply lacks protection against virtual threats. Therefore, it is important to understand the main vulnerabilities that all technological developments have.

The dangers of interconnecting systems

Despite making the automation processes much easier for companies, services such as Cloud need to have increased security. If information was previously separated and organized in different locations, this technology has changed that.

With the interconnection of systems and with increasingly centralized storage, attackers have access to all information at once. If, on the one hand, the system becomes more and more intelligent, on the other hand, the risk becomes increasingly greater.

And that is why several companies invest in security. The hackers behind these attacks are constantly looking for loopholes in these systems. If a company does not keep up to date, it becomes a potential victim.

The biggest vulnerability in industry 4.0 is the inability to stop

The technological dependence of industry 4.0 is one of the most striking characteristics of the current period. Having information interrupted or leaked can mean immense monetary losses.

According to data from ITU (International Telecommunication Union), about R$ 80 billion have already been lost in cyberattacks in Brazil. And this figure refers to the period of 2017 and 2018 alone.

Therefore, In 2020 it could not be different. The jump was immense, and according to a report by McAfee, the impact on the economy for these crimes reaches US $ 1 trillion.

In this way, malicious criminals already have greater knowledge about the importance of data. Ransoms for data recovery are increasing and the attempts are becoming increasingly sophisticated.

The main vulnerabilities in cybersecurity and attacks today

With the ever-greater connection between data, it becomes much easier for an attacker to gain access to all of them. This is because of malicious software, which can access all centralized information.

The most common attacks, therefore, are:

• Through malware: here, apparently harmless software is installed on the computer with the user’s permission. With the virus inserted in the program, the attacker receives access to various data. Also, through this program, the criminal can limit the functions of the machine itself. The data can become inaccessible and be stolen by the attacker.
• Through ransomware: this type of attack is much more common in companies. This involves data hijacking, where the attacker can leave the data inaccessible and release it to the user through ransom payments.
• Phishing: it is a very recurring attack. In it, hackers can simulate a page identical to that of a bank, for example. Thus, the user is prompted to enter important data such as individual taxpayer ID, account, and others.
• ZeroDay: this type of attack is a little more common and occurs in newly launched applications. The criminal seeks, in several ways, to find flaws in applications before they are corrected.

Cloud storage and Artificial Intelligence are pillars of industry 4.0. What happens is that a lot of stolen information can easily allow access to much more valuable data.

The interconnection of systems, therefore, generates a lot of concern among cybersecurity experts. On the other hand, information will always be essential to prevent these attacks from being successful.

How to manage cybersecurity in industry 4.0

We can consider that many attacks occur by prior permission from users (as is the case with Trojan horses and Phishing). Although it is not the only factor that guarantees security, restricting users can minimize threats.

By limiting the number of people within the company that can access valuable data, the risk of losing them is much less. This is because, in cases of invasion of any of the machines, the main information will be, for the most part, protected.

It is very important that, for the maintenance of cybersecurity, a company pays attention to the following measures:

• Greater access controls;
• Data encryption; and
• Blocking of certain accesses (mainly from anonymous users);
• Keep the system updated, always exploring and correcting security flaws;
• Scanning for viruses and using an antivirus;
• Frequent updating of passwords and privileged users;
• Monitoring of security services.

The cybersecurity vulnerabilities are directly associated with the lack of maintenance in an organization’s security systems. Keeping systems up to date can be a chore, but it is always a must.

Considering the increasingly sophisticated and intelligent cyberattacks that we come across, we need to update ourselves too.

Otherwise, loopholes are exploited by hackers. The result? Even before a company learns about them, they have already been used for the invasion. A reliable security service is therefore essential in industry 4.0.

senhasegura has the shortest deployment time on the market – just 7 minutes – and offers much faster protection. Contact us and learn more about how we can help your company against security flaws!

The Covid-19 pandemic has caused massive adoption of remote working models in organizations of all sizes. Besides, security leaders have also accelerated the migration of their infrastructure to cloud environments. According to a study conducted in partnership by Forrester and CloudFare, 52% of the organizations surveyed indicated that the pandemic has caused a shift to cloud-based working models.

In these models, both employees and third parties need to have access to critical systems through privileged credentials, so that they can perform their daily tasks. And with the increase in the number of third parties, there was also an increase in the number of data leaks attributed to them. According to a study by Trustwave, 63% of these security incidents were caused by third parties, which makes this type of access an important attack vector in organizations. The associated costs are also higher. According to the Cost of a Data Breach 2020 report, the average cost of a data leak reaches USD 3.86 million. And leaks caused by third parties were one of the factors associated with even greater losses.

Considering this infrastructure that is distributed outside the security perimeter, many people responsible for Information Security have made their cybersecurity policies less restrictive, allowing access through insecure devices and networks (including BYOD or Bring Your Own Device), even VPNs without the proper security controls in place. And we already know that it is impossible to track what is not managed.

All of these aspects introduced new business risks and concerns for cybersecurity teams. In a study published by PDM Insights, 73% of IT decision-makers who responded to the survey recognize these new challenges. The related risks include opening phishing emails (for 38% of respondents) and inappropriate administrative access (37%), which required CISOs to seek the implementation of Zero Trust-based approaches.

In Zero Trust models, there is no concept of trust within the perimeters of the organizations’ infrastructure, and all actions taken by users must be continuously verified. Forrester reports that the percentage of IT leaders who have accelerated their investments in Zero Trust-based technologies reaches 76%. In addition, the same percentage also identified Identity and Access Management (IAM) as the biggest challenge for their Security teams. An example of Zero Trust-based IAM technology is just-in-time access.

In just-in-time accesses, access to applications or systems is allowed only at predetermined periods and on-demand. Therefore, through just-in-time it is possible to grant the required privileges for the performance of certain administrative tasks through the provisioning and de-provisioning of access in time of use, thus reducing the attack surface and the associated cybersecurity risks. As organizations adapt to a new working model, which includes the consolidation of remote work and the increase of third parties in the infrastructure, the use of PAM tools is imperative for security leaders to ensure compliance with policies and security regulations, such as PCI-DSS, HIPAA, and SOx. Also, it is possible to meet the requirements of data protection laws, such as LGPD and GDPR, mitigating security risks and preventing data leaks that can cost millions in fines, in addition to the loss of revenue, customers, and corporate reputation.

To solve the problems involved in the remote work of employees and third parties, senhasegura has launched Domum, which offers users secure access based on Zero Trust to devices of the corporate infrastructure wherever they are, without the need for VPN, installation of agents, and additional licensing or configurations. Access is granted instantly, easily, and securely, without exposing device passwords and without the user needing access credentials to the PAM security platform.

It works as follows: whenever it is necessary for an employee or third party to perform remote access to any device managed by the PAM platform in the infrastructure, senhasegura Domum will perform the provisioning of access using a just-in-time approach, sending an approved access link to the user, allowing immediate access only to authorized devices.

senhasegura Domum allows configuring access workflows at multiple levels to allow access, in addition to the high granularity offered by the PAM security platform, already recognized by the market. In this way, it is possible to have maximum adherence to the organization’s access policies, allowing the reduction of implementation and customization costs. After the predetermined time of authorization, access is revoked and the link is no longer valid, preventing the employee or third party from proceeding with malicious privileged actions on devices in the infrastructure, which allows for a smaller attack surface and security risks associated with the exploitation of privileged credentials. Besides, by automating the process of granting and revoking privileged access on devices used by third parties, senhasegura ensures the reduction of operational expenses with access management.

Domum also offers all the features offered by the senhasegura PAM platform, such as real-time monitoring of the actions performed. Through LiveStream, an auditor can check the actions taken by a user, allowing the blocking or closing of the remote session in case of non-compliance or if a malicious action is detected. Other features of senhasegura also offered by Domum include session recording, analysis of threats user behavior. Thus, one can reduce the time to detect and respond to malicious actions before the malicious attacker is able to take them. As a result, there is maximum visibility of privileged actions performed in the environment and compliance with regulatory standards.

Ensuring the protection of remote access for a lot of users working remotely is more than an optional security requirement, it is a business must. Therefore, by using the senhasegura PAM platform and senhasegura Domum to manage privileged access, you can reduce the attack surface and the associated security risks, avoiding data leaks and ensuring business continuity.

One of the most debated subjects on the market is Digital Transformation, now boosted by the Covid-19 pandemic. We heard about the adoption of technologies to transform business processes not only during “lives”, but also in articles, conferences, and even family gatherings. In addition to the migration to distributed models, the home office, and new working tools, the digital transformation has also resulted in the modernization of communication channels with customers.

The strategic plans of organizations and projects considered to be of low priority had to be revised; medium and long-term goals had to be accelerated to take place in a few weeks; also, strategies never thought of have been implemented in the short term. Organizations and their leaders realized that if they did not implement the required changes, business continuity would be affected. So much so that, according to the Gartner CEO and Senior Business Executive Survey, 82% of CEOs have some initiative related to digital transformation, in comparison with 62% in 2018.

In these times of high competitiveness, one of the greatest advantages offered by organizations is the relationship approach with customers. More and more people in companies consider their responses during the entire consumption process, from identifying the purchase need to after-sales.

Gartner itself brings what they call the Total Experience as one of the 10 strategic technology trends for 2021. Total Experience combines multi-experience, Customer Experience (CX), Employee Experience, and User Experience (UX) to transform business results. The goal, according to Gartner, is to improve the overall experience, in which all these areas intercede, from technology for employees to consumers and users.

Taking into account that employees are giving more value to the user experience with the products and solutions available on the market, Gartner launched Peer Insights, so that users could share their impressions and opinions about IT suppliers.

Gartner Peer Insights is a free evaluation and review platform for Technology solutions and services, covering more than 300 markets, aligned with the categories from the Magic Quadrant and Market Guide reports, including 3,000 suppliers. Each review submitted by users is verified by the Gartner team to ensure that their perceptions and views at each of the different stages of the purchase process are completely authentic. And to ensure that reviews are impartial, Gartner does not allow vendors to offer any financial incentives to users who evaluate their products or services. However, Gartner itself offers gift cards and does not prohibit vendors from doing so either. It is important to note that the value of gift cards should not exceed USD 25.

Each of the reviews submitted by users is verified in a process composed of several steps, including the definition of the user and organization profile, in addition to their role and responsibilities. This verification, which usually takes a few days, is done based on the inspection of the verified corporate email and LinkedIn profile. Additionally, the user cannot be an employee, consultant, reseller, or competitor of the vendor and product to be evaluated.

After submission, user reviews are assessed to determine whether they meet Gartner Peer Insights requirements related to context, quality, and relevance.

Some characteristics expected by Gartner are:

• Comments consistent with the respective scores.
• Variance of scores in the review, considering it unlikely that a user will have the same score for all aspects of a product or service.
• Scores are logically consistent, taking into account general and specific scores.
• Demonstration of experience in relation to the product or service being reviewed.

The reviews must also be authored by the user, with generic comments, and must not contain data that allow the user to be identified. Comparisons with competitors and financial data are not allowed either.

It is important to emphasize that, after the review is published, personal data of users, such as the name of the user or organization, are not displayed, only the industry in which the company operates and its respective size, geographic region, and revenue data.

Gartner recognizes the importance of user insights, so much so that it included them in the methodologies for evaluating the Magic Quadrant processes in order to assist customers in their effective decisions in a specific market. For vendors, Gartner Peer Insights allows them to use feedback from their consumers to reinforce their strengths, display quotes from customers, and highlight their position in the market.

For this, Gartner offers resources through the Technology Provider Tools portal that can be used to encourage customers to send their reviews, including best practices, customer communication templates, and tools. These resources allow providers to generate their links for requesting reviews and obtain indicators for measuring the success in using the tool, for example.

By using a platform like Gartner Peer Insights and its resources, it is possible to offer the user a free environment to evaluate their impressions and, thus, help others to choose IT products and services. As for vendors and providers, the platform allows them to check the general satisfaction towards what they offer to the market, in addition to being able to offer upselling, acquisition of other products and services of the company, and even refer them to others. The practical result of this is, in addition to more satisfied customers, a better perception of these products and services on the market, which leads to an increase in revenues and customers. In short: this is one of the secrets to the success of any organization.