Skip to content

More modern monitoring: how telemetry and machine learning revolutionize system monitoring

It’s time, take your things and let’s move on to more modern monitoring. Relax, I know how difficult the changes are for you, but if you were able to accept the arrival of DTT and the euro, you sure got this! 

But first let us do a little review:

Traditional system monitoring solutions rely on polling different meters, such as the Simple Network Management Protocol (SNMP), to retrieve data and react to it.

When an issue requiring attention is detected, an event is triggered, which can be notified through email to the administrator or by launching an alert.

Consequently, the administrator responds according to the nature of the problem.

However, this centralized approach to monitoring requires a considerable amount of resources.

You knew it?

Due to the “pull” nature of the requests, gaps are generated in the data and these could lack sufficient granularity.

In response to this limitation, the adoption of a telemetry-based monitoring solution has emerged as a promising alternative.

The day has come: discover more modern monitoring

By making the switch to a modern approach to monitoring, you gain access to smarter and richer solutions in terms of anomaly detection.

This transition represents a great advantage in the field of system monitoring.

In addition, another compelling reason to implement modern monitoring is the growing number of systems that rely on accurate monitoring to enable automated infrastructure operations, such as scaling nodes up or down.

If monitoring fails or is not accurate enough, disruptions can arise in the expected scalability of an application.

Therefore, reliable and accurate monitoring is essential to ensure the proper functioning of the systems.

To improve the efficiency and accuracy of surveillance systems, organizations are exploring smarter, more advanced solutions.

Telemetry vs. Poll: Differences and benefits in modern system monitoring

When it comes to implementing telemetry in surveillance systems, it is important to understand the differences between the streaming and polling approaches.

While streaming telemetry can be more complex, its design offers greater scalability, evidenced by public cloud providers such as Amazon, Microsoft, and Google.

These tech giants manage millions of hosts and endpoints that require constant monitoring.

As a result, they have developed telemetry and monitoring channels with no single points of failure, enabling them to gain the level of intelligence and automation needed to operate at a great scale in their data centers.

Learning from these experiences can be invaluable when building your own monitoring solutions.

In contrast, survey-based monitoring solutions may face scalability challenges.

Increasing the polling interval for a specific performance counter increases the load on the system being monitored.

Some meters are lightweight and can be probed frequently, but other heavier meters generate significant overhead.

Consistent data transmission may appear, at first glance, to involve greater overhead compared to a polling solution.

However, thanks to technological advances, lightweight solutions have been developed.

In many cases, data flows through a flow query engine that enables outlier detection while storing all data to support trend analysis and machine learning.

This architecture is known as lambda architecture and is widely used in applications that go beyond monitoring, such as in the Internet of Things (IoT) devices and sensors.

It provides real-time alerts for values outside normal limits, while enabling cost-effective storage of recorded data, providing deeper analysis in a low-cost data warehouse.

The ability to have a large amount of recorded data allows for comprehensive analyses of transmitted values.

System monitoring: Smart approaches and machine learning for accurate alerts

In the system monitoring area, it is crucial to ensure data quality to obtain accurate and relevant alerts.

Most monitoring tools offer the ability to customize alert ranges.

*For example, you may want to receive an alert when CPU usage exceeds 80% on certain systems, while on other systems a high level of CPU usage may be part of its normal operation.

However, finding the right balance can be tricky:

  • On the one hand, you don’t want alerts to overwhelm administrators with irrelevant information.
  • On the other hand, you also don’t want to set too lax thresholds that hide critical issues in your data center.

To address this dichotomy, it is advisable to use intelligent or dynamic monitoring approaches.

These approaches capture a baseline for each system and only trigger alerts when values are outside normal limits for both the specific server and the corresponding time frame.

As more data is collected, many monitoring tools are deploying machine learning systems to perform deeper analysis of the data.

This advanced processing makes it possible to generate smarter alerts based on the specific workload of each system.

Machine learning is used to detect subtle patterns and anomalies that might go unnoticed by traditional alert rules.

However, it is important to note that it is essential to verify that these smart alerts work correctly and provide the expected alerts.

Extensive testing and result validation is necessary to ensure that alerts are generated accurately and in a timely manner.

*That way, a more efficient and reliable surveillance system will be achieved.

Monitoring continuity: Key strategies and approaches for detecting problems in systems

As your organization seeks to implement smarter monitoring, the crucial question arises:

How do we detect problems or outages in our monitoring systems?

As automation connected to these systems becomes increasingly reliant, monitoring becomes an even greater challenge.

There are several measures that can be taken to ensure monitoring continuity:

  • First, it is critical to create redundancy in the infrastructure, either by deploying virtual machines or leveraging platform-as-a-service (PaaS) services across different data centers or cloud regions. This ensures that, in the event of failures at a point, alternative systems are in place to support monitoring.
  • Another option is to establish a custom or secondary alert mechanism that verifies the status of the primary monitoring system and acts as an additional security layer.
  • It is also possible to implement an alert process, which generates alerts at regular intervals, and have a scaled mechanism that issues an additional alert if the process is not activated as expected.

In addition to these approaches, it is important to ensure that the alert mechanism covers all application layers and it is not limited to just one.

*For example, it is necessary to perform tests and monitoring in the web layer, the cache storage layer and the database, to detect any failure or anomaly in any of them and receive relevant alerts.

Keeping online supervision requires a proactive and solid approach in terms of architecture and strategy.

By implementing these security and verification measures, it is ensured that any problems or interruptions in monitoring systems are quickly detected and addressed, allowing a timely response to maintain the proper functioning of critical systems.

Conclusions

Taking the leap to more modern monitoring is a smart and necessary decision to ensure proper system functioning.

Although the changes may seem intimidating, remember that you survived the Ibook and egg-free mayonnaise, so this should be a piece of cake!

Telemetry is presented as a promising alternative, offering smarter solutions and more accurate anomaly detection.

In addition, the implementation of redundancy measures, custom alert mechanisms and extensive testing at all layers of the application will ensure reliable and timely monitoring.

So get ready to embrace modern monitoring and leave outdated methods behind!

Remember, in the world of monitoring, to be modern is to be more modern than the average human.

And you’re ready to be the “cool kid” of monitoring!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Addressing the Limitations of Multi-Factor Authentication (MFA)

As organizations strive to safeguard their sensitive data and critical assets, multi-factor authentication (MFA) has emerged as a popular choice for enhancing security. However, as recent high-profile attacks have shown, relying solely on MFA for authentication can leave organizations vulnerable to cyber threats. In this article, we will delve into the various weaknesses of MFA, highlight notable incidents that exploited these weaknesses, and explore how pairing MFA with digital certificates can provide a more secure authentication solution. 

The Rise and Limitations of Multi-Factor Authentication

Multi-factor authentication, as the name suggests, combines multiple forms of verification to grant access to systems and data. It typically involves something you know (like a password), something you have (like a smartphone or token), and something you are (like a fingerprint or facial recognition). This layered approach adds an extra layer of security beyond traditional username-password combinations, making it significantly harder for unauthorized individuals to gain access.

However, MFA is not without its vulnerabilities:

  • Phishing Attacks: Phishing remains a prevalent attack vector, and even MFA cannot fully protect against it. In a phishing attack, cybercriminals trick users into revealing their credentials or MFA codes by masquerading as a legitimate entity. Once the attacker has both the password and the MFA code, they can gain access just as easily as the legitimate user.
  • SIM Swapping: In SIM swapping attacks, hackers fraudulently transfer a victim’s phone number to a new SIM card, allowing them to intercept MFA codes sent via SMS. This technique has been used successfully to compromise high-profile social media and cryptocurrency accounts.
  • Biometric Vulnerabilities: While biometric factors like fingerprints and facial recognition provide an added layer of security, they are not foolproof. Sophisticated attackers have demonstrated the ability to bypass these mechanisms using techniques such as fingerprint replication or deepfake technology.
  • MFA Code Interception: Even if MFA codes are generated by authenticator apps or hardware tokens, they can still be intercepted if the user’s device is compromised by malware or if the token is stolen. This highlights the importance of securing the device itself.


High-Profile MFA Exploits

Over the past few years, several high-profile incidents have demonstrated the limitations of MFA:

  • Twitter Hack (2020): In a widely publicized attack, hackers compromised several high-profile Twitter accounts, including those of Barack Obama, Elon Musk, and Bill Gates. While MFA was enabled on these accounts, the attackers used social engineering techniques to manipulate Twitter employees into granting them access to internal tools, effectively bypassing MFA.
  • SolarWinds Attack (2020): The SolarWinds supply chain attack, one of the most significant cyber incidents in recent memory, highlighted the vulnerability of MFA. Attackers compromised SolarWinds’ software updates and used them to distribute malware to thousands of organizations. Once inside these networks, the attackers could bypass MFA using stolen credentials.

Beyond MFA: Going Passwordless with Digital Certificates

To address the limitations of MFA, organizations are turning to digital certificates as a complementary, passwordless authentication method. Digital certificates provide a secure means of identifying both users and devices, reducing the risk of unauthorized access. Here’s an overview of how digital certificates enhance authentication:

  • Strong Authentication Digital: Digital certificates use asymmetric cryptography, making them extremely secure. Users and devices are issued a unique certificate that includes a public and private key pair. When they attempt to access a system, the private key is used to sign a challenge from the server. This challenge-response process ensures that only the legitimate certificate holder can gain access.
  • Device Authentication: Certificates can also be used to authenticate devices, not just users. This is particularly valuable in the context of IoT (Internet of Things) devices, where traditional username-password authentication is often impractical.
  • Secure Key Management: Certificates are stored securely, typically in hardware security modules (HSMs), making it difficult for attackers to compromise them. This level of protection is often superior to the security of user-generated passwords and MFA tokens.
  • Reduced Phishing Risk: Since digital certificates are based on cryptographic keys rather than static credentials like passwords or codes, they are not susceptible to phishing attacks. Even if an attacker gains access to a user’s certificate, they would still need the private key to authenticate.
  • Regulatory Compliance: Many industries, such as healthcare and finance, are subject to strict regulatory requirements for data protection. Digital certificates help organizations meet these compliance standards by providing a robust authentication mechanism.

Employing a Multi-Layered Approach to Cybersecurity

While multi-factor authentication (MFA) is a valuable component of a cybersecurity strategy, it is not a silver bullet. Recent high-profile attacks have demonstrated its limitations, particularly in the face of sophisticated threats. To bolster their defenses, organizations should consider adopting a multi-layered approach that combines MFA with digital certificates.

Digital certificates offer strong, cryptographic authentication that is less susceptible to common attack vectors like phishing. They provide a secure means of identifying both users and devices, reducing the risk of unauthorized access. By integrating digital certificates into their authentication systems, organizations can significantly enhance their cybersecurity posture and protect their critical IT assets from evolving threats.

In the ever-evolving landscape of cybersecurity, staying one step ahead of adversaries is crucial. By recognizing the limitations of MFA and embracing more robust authentication methods like digital certificates, organizations can better safeguard their valuable data and maintain the trust of their stakeholders in an increasingly interconnected world.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

How SafeDNS Provided a Secure Internet for a 30K-person event

Recently, amidst the thunderous roars and screeching tires of the races we supported, thousands gathered in Mexico City, Mexico on the 1st of July to experience the heart-pounding excitement of Notiauto Cup. In the midst of this motorsport extravaganza, SafeDNS stood as a silent sentinel, ensuring secure and seamless internet connectivity for the massive crowd.With 20-30 thousand attendees converging at Notiauto Cup and a significant portion of them relying on the event’s free WiFi, SafeDNS, a stalwart in online security, ensured their online journeys were devoid of cyber threats. Working in partnership with Joop Solutions, who provided the internet services, SafeDNS’s proven expertise maintained uninterrupted browsing while blocking all the online threats. With nearly half of the attendees accessing the event through the free WiFi, SafeDNS’s proven expertise maintained uninterrupted browsing while blocking all the online threats.   

 

As Carluc Racing continues to enthrall motorsport enthusiasts, SafeDNS remains committed to fortifying online experiences. In a world where connectivity is indispensable, SafeDNS not only ensures a safe digital journey but also paves the way for an uninterrupted and secure adventure for all attendees.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

Cyberview: WormGPT, FTC investigates OpenAI, 4-day deadline to report hacks

The latest Cyberview episode is out! Join cybersecurity experts Gerald Kasulis, Frida Kreitzer, and Carlos Salas as they explore the most talked-about news in the digital world, from WormGPT, ChatGPT’s evil twin, to OpenAI’s FTC investigation and the controversial 4-day breach disclosure rule. Dive into their discussion bellow to discover what’s new in tech and cybersecurity world.

In this episode, we dive into: 

  • ChatGPT’s evil twin WormGPT

  • The Federal Trade Commission (FTC) investigation into OpenAI data leak and ChatGPT’s inaccuracy

  • A new 4-day rule for disclosing cyberattacks set by the US Securities and Exchange Commission (SEC)

Watch Cyberview here 

ChatGPT’s evil twin WormGPT

The new tool, WormGPT, is advertised on underground forums as a blackhat alternative to ChatGPT for launching phishing and business email compromise (BEC) attacks. Although, ChatGPT’s natural language abilities can already help hackers write convincing emails, resulting in the obvious signs of malicious emails disappearing.

Tools like ChatGPT and Google’s Bard have some safeguards in place that try to ensure that AI-generated content does not cause harm. However, WormGPT is specifically designed to be fully unrestricted and facilitate criminal activities, so it raises even more questions about the ethical limits of AI.

FTC investigates OpenAI over data leak and ChatGPT’s inaccuracy

Has ChatGPT broken consumer protection laws by risking personal reputations and data? The FTC has opened an investigation into OpenAI, requiring details on how OpenAI gathers and protects data and vets information.

The FTC wants to know how information was used to train its model and how it prevents false claims from being shown to users. Additionally, they are interested in how APIs connect to OpenAI’s systems and how user data is protected, all while the FTC issued multiple warnings that existing consumer protection laws apply to AI.

The 4-day deadline for public companies to report breaches

US companies hit by cyberattacks will face a 4-day deadline for publicly disclosing hacks, under new rules approved by the US Securities and Exchange Commission (SEC). There are mixed feelings about this new requirement. On the one hand, it is praised for encouraging transparency about cybersecurity breaches, as they are considered as important to investors as any other significant operational disruption.

On the other hand, the new rule is being labeled as a controversially short deadline that may not allow companies enough time to put an action plan in place or fix vulnerabilities. Although regulations state that if the SEC is informed in writing of a national security or public safety risk, a delay in breach disclosure of up to 60 days is allowed.

Stay tuned for the next episode of Cyberview.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×