Skip to content

Support remote workers: a comprehensive guide to seamless IT assistance

Remote work isn’t just a cool perk offered by a few forward-thinking companies anymore—it’s the new normal. With everyone craving flexibility and companies looking to save money and get the best talent, working from home has shifted from exception to expectation

IT support, always a big deal in the office, has become even more important now that many of us are logging in from our living rooms or kitchen tables. So, what should you know to keep tech hiccups from ruining your day? Stick around because we’re diving deep into the best IT practices to support remote workers.

5 biggest challenges remote workers face

Before we jump into the best IT support practices for a remote workforce, it’s vital to know what remote workers are up against. These aren’t just your typical office problems but different challenges.

Things like distance between team members, different time zones, and varying degrees of tech skills can turn simple tasks into complex puzzles while working remotely. Get ready because we’re about to unpack these unique challenges and give you the lowdown on dealing with them.

Ensuring devices are up-to-date

In a regular office, the IT team ensures everyone’s computer is updated. But when you’re working remotely, that’s usually on your remote workforce. Out-of-date software can slow remote workers down and make their systems less secure. Threat actors love finding old software because it’s easier to break into.

For companies, this is a big challenge. They need a solid plan to manage this so that remote employees update their devices without causing work delays or risking the person’s or company’s online security. The plan must be easy for everyone to follow, even if they are managers and not tech experts.

Resolving IT issues in a timely manner

When everyone is in the office, IT issues get sorted out fast. At home, it’s a different story. Remote employees might have to try fixing problems while chatting with an IT expert. This can take more time and doesn’t necessarily lead to a solution.

It gets even trickier when remote employees work in different time zones or have odd hours. Even if remote employee support is available all day, the ideal time to fix or manage a problem might be missed. Companies need a plan to make sure IT issues are addressed and resolved fast, no matter where their employees are.

Securing remote work environments

While your employees work remotely, their network becomes a part of your company’s network. This can be risky because many employees get remote access, and their devices may not be as secure. Bad passwords or insecure devices can offer hackers an easy way in.

Companies have difficulty ensuring their remote workforce follows good security practices outside the office across all their devices. The strategies for an office building might not work for someone’s living room. Businesses need to think creatively and always be on the lookout for risks that could affect everyone in the company.

Maintaining effective communication

Poor communication makes it harder to support remote workers, affecting productivity and morale. Clear communication in virtual meetings is essential for all remote work support teams. But technical problems can make this challenging. A glitchy video call can stop a meeting and lead to misunderstandings.

Poor communication is more than an annoyance—it hampers remote work. Unclear guidelines on file access or IT support can derail projects. Companies must improve communication methods to keep remote teams effective

Time management and work-life boundaries

When employees work from home, the line between work and personal life often blurs. This flexibility is a double-edged sword: while convenient, it can make it tough for employees to “switch off” and enjoy their time.

Companies should be proactive about this issue. One way to address it is by offering guidelines or formal training on managing time and setting healthy work-life boundaries. By doing this, a company can help employees get the most out of remote work, boosting productivity and overall job satisfaction.Remote employee onboarding checklist web

Best practices for remote workers’ IT support

When your team is remote, you need a game plan for tech support. Software should be up-to-date, and if tech issues pop up, you’ll need a way to tackle them quickly.

Best practices for remote workers- IT support 1400x579

In this section, we’ll share the key steps to ensure remote workers’ IT support is up to the challenge of supporting the whole remote workforce.

Embracing cloud technology for efficiency

When working remotely, accessing company resources via cloud technology like Google Drive or Dropbox is often essential. However, convenience isn’t the only factor; security is equally crucial. A Virtual Private Network (VPN) might be necessary for more sensitive internal resources for secure access.

Companies should consider using virtual private networks like NordLayer to ensure the organization’s data and cloud assets are more protected from threat actors. This can be done with the help of IP whitelisting (allowlisting).

This method gives remote workers access to the network by ignoring the firewall. And if the IP is not whitelisted, the user’s data doesn’t go through. IP allowlisting is excellent for Network Access Control (NAC), Software-as-a-Service (SaaS) user management, Internet of Things (IoT) security, and more.

24/7 availability of IT remote workers’ support

Technical problems can pop up anytime, and waiting until the next business day is often not an option. An IT team available 24/7 is essential for dealing with these unpredictable issues.

Implementing 24/7 IT support does not necessitate the overexertion of your current personnel. Through judicious scheduling and the strategic employment of remote support teams situated in diverse time zones, assistance can be made continuously available at a mere click of a button or a phone call.

Strengthening security measures

All devices that connect to your company’s network must be secure. You can’t afford weak links to secure access and protect important data. A good start is to set up identity access management solutions (IAM), two-factor authentication (2FA), or multi-factor authentication (MFA), where your remote workforce must provide more verification factors or methods of authentication before logging in.

Another effective measure is single sign-on (SSO), which lets users access many services with one login credential. This makes things easier for employees and lowers the chances of password-related security breaches.

Additionally, incorporating a Remote Access VPN solution like NordLayer can secure data transmission and safeguard sensitive information, offering an extra layer of security that’s crucial in a remote work setting.

Fostering communication and collaboration

Effective communication is the backbone of any remote work setup. Communication tools like Slack and Microsoft Teams are popular for remote workers because they do the job. But you’ll want to add an extra layer of security to these platforms.

Moreover, make sure you hold regular team meetings to keep everyone on the same page about the communication methods and how to use them.

Automated software updates

Ensuring that all software is updated with the latest security fixes is paramount for maintaining a secure remote work environment. While automating software updates is one straightforward approach, advanced features like NordLayer’s Device Posture Security offer an added layer of security. This feature checks if devices comply with multiple predefined rule sets and identifies unknown devices in the network.

Moreover, it ensures that the operating system and NordLayer application are up-to-date, thereby bolstering the security of your remote workforce. Importantly, IT teams are notified about non-compliant devices on the network, allowing for immediate corrective action.

Incorporating both automated software updates and device posture security measures will further fortify your network against potential vulnerabilities.

Best practices for remote team management

Managing a remote team has its own set of hurdles. From dealing with different time zones to ensuring everyone’s on the same page, the usual management playbook might not cut it.

Keep reading, and we’ll share essential tips to help you manage your remote team like a pro, ensuring you can handle the unique challenges that come with it.

Setting clear expectations

For a team working remotely, it’s crucial to know what’s expected. This isn’t just about which apps to use for talking or video meetings. There are other rules, too. For example, everyone might have to use a VPN all the time for better security. The remote workforce should contact IT support immediately if something looks off or doesn’t work right.

Also, there are usually other restrictions around what sites remote workers should not be able to access during work hours. Those include gambling sites, adult sites, or gaming during work. Features like DNS Filtering from NordLayer can help block these sites to ensure everyone is focused on work.

By laying down these rules clearly, DNS Filtering helps avoid misunderstandings and keeps the team on track.

Setting measurable objectives and deadlines

Goals help a team focus. Setting measurable objectives and giving honest feedback is even more critical in a remote setting. Deadlines help avoid slacking during the day, and measurable deadlines are about daily control to see if the worker’s productivity isn’t declining.

These objectives should be clear and achievable. They should also be reviewed periodically to make adjustments if necessary. This keeps the team engaged and ensures everyone contributes to the project’s success.

Fostering team engagement and well-being

Remote work can sometimes feel isolating. To counter this, managers should actively engage with team members to check their well-being. This can be done through regular one-on-one meetings or team activities designed to build rapport with remote staff.

In addition to work, focus on your team’s emotional and mental well-being. Provide resources, training, or activities that can help reduce stress and increase overall job satisfaction.

Streamlining project management

Managing projects remotely can be challenging. Use project management software that enables everyone to keep track of tasks and deadlines. This ensures that all team members can update their progress and stay accountable.

Consistency is key. Stick to one project management tool for all projects and ensure everyone knows how to use it. Regular updates and check-ins can also help track the project’s status and make necessary adjustments promptly.

Ease remote working issues with NordLayer

We’ve gone over a lot in this guide, from the daily challenges of remote work to how to make IT remote support problems less of a headache. Here is where a solution like NordLayer can help. It doesn’t just help keep your data safe, it makes your workday smoother by improving control access to company resources.

If you’re serious about making your remote work environment as secure and efficient as possible, NordLayer is a tool you should try. Having great remote work support is great, but protecting your network is the key—get in touch with NordLayer.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

runZero 4.0: Introducing the runZero Platform and our new Community Edition

What’s new with runZero 4.0? 

New runZero Platform and Community Edition

The new and improved runZero Platform represents the culmination of four years of innovation, so it’s only fitting this is version 4.0 of our technology! Over the last few years, runZero has evolved and matured from an innovative asset inventory and network discovery product to a world-class CAASM (cyber asset attack surface management) solution. We couldn’t have reached this major milestone without our community and our awesome customers, and we thank you for supporting us on this journey.

The new Platform introduces passive discovery functionality, making runZero the only CAASM solution to combine proprietary active scanning, native passive discovery, and API integrations. Unifying all of these approaches makes runZero unique in its ability to deliver comprehensive coverage across managed and unmanaged devices, including the full spectrum of IT, OT, IoT, cloud, mobile, and remote assets.

With the introduction of the runZero Platform, we also have a new Community Edition that will replace Starter Edition effective immediately. Community Edition is a completely free version of the runZero Platform that is perfect for small businesses, individuals, and security researchers who have 100 or fewer assets.

You might be asking, is this just a name change for the free version? It’s not. It’s much better than that! We want all runZero users to benefit from the full power of the runZero Platform and our new Community Edition makes that possible. See the details below.

We hope the new Platform will help you better manage risk and exposure by giving you the most complete visibility possible across all your environments. Let’s dive into the details.

runZero Platform, Community Edition: CAASM for everyone #

The Community Edition is an improved version of the free Starter Edition. It now includes three important discovery approaches: unauthenticated active scanning, API integrations, and passive discovery.

Here’s why this is a significant leap forward:

Complete coverage: With three different discovery methods available, you can achieve a complete view of all your assets across IT, OT, IoT, cloud, mobile, and remote environments. runZero helps you uncover your unknowns and provides visibility across your internal network and external attack surface, consolidating everything into a single view.

Cost-efficiency: The Community Edition remains completely free, ensuring that advanced CAASM capabilities are accessible to organizations of all sizes and budgets.

runZero Platform: Unleash the full power of CAASM #

Our new runZero Platform brings together all of the features you know and love from our legacy Enterprise Edition with new functionality like passive discovery that is designed to provide the most complete security visibility possible. It includes:

Complete feature set: The Platform provides you with every tool in the runZero arsenal, ensuring you can tackle all the CAASM use cases like building a comprehensive asset inventory, eliminating security controls gaps, understanding vulnerabilities and identifying insecure configurations in your attack surfaces.

Unparalleled flexibility: API integrations, active scanning, and passive discovery are seamlessly integrated, offering you unparalleled flexibility to manage exposures of your ever-evolving attack surfaces.

Priority support: Platform customers can unlock premium support, also known as runZero Care, which enjoys priority access to our support team, ensuring you have expert guidance whenever you need it.

Scale to fit your needs: The Platform is perfect for organizations that manage a large number of assets. Whether you have thousands, hundreds of thousands, or even millions of assets to manage, runZero Platform can handle the load.

Current customers will receive further information about migrations.

Build your inventory through passive discovery #

Unlike other CAASM solutions, runZero offers visibility into OT environments, through both safe active scanning and now a passive discovery capability called traffic sampling. Traditional passive network monitoring tools require significant effort to deploy and compute resources to collect and analyze all network traffic. runZero’s passive traffic sampling only examines a small fraction of network traffic for asset discovery and fingerprinting, which customers can leverage with existing Explorers. This feature allows companies who have a policy against active scanning to build an asset inventory by analyzing traffic observed through SPAN ports, TAP interfaces, and broadcast. Passive traffic sampling is also helpful for organizations with scan windows that are too short to enable active discovery of the entire environment. Both active and passive approaches use the same fingerprinting database that was developed using data collected across tens of thousands of environments and OT devices.

We are very excited to introduce this novel approach to passive discovery as a complement to our reinvention of active scanning. We love a good challenge and like to rethink how we can improve on what’s already out there. Unlike traditional passive discovery solutions, runZero’s passive traffic sampling is faster, easier, and more cost-effective to deploy — and doesn’t require expensive dedicated hardware appliances. Our innovative approach to traffic sampling enables runZero Explorers to process existing network traffic as a software deployment on existing hardware or virtual machines.

runZero Passive Traffic Sampling

Learn more about passive traffic sampling

Discover assets the way you want to #

Updates to the runZero interface make it easier than ever to leverage all the flexible discovery capabilities available to you. runZero is the only CAASM solution that provides comprehensive asset inventory coverage for managed and unmanaged devices, including IT, OT, IoT, cloud, mobile, and remote assets. This is only possible by combining three specific data sources: proprietary active scanning, native passive discovery, and API integrations. These combined capabilities give customers ultimate flexibility in a single, unified solution, eliminating the need for multiple siloed tools.

Three discovery approaches.

Check out the new start pages for API Integrations, active scanning, and passive discovery.

Integrate with Tenable Security Center

With 4.0, you can now enrich your inventory with an authenticated API connection to Tenable Security Center, similar to existing integrations with Tenable.io and Nessus. This allows you to search for Tenable attributes, and vulnerabilities in runZero, as well as find assets not monitored by Tenable Security Center. runZero automatically correlates Tenable assets to runZero assets based on unique fields. Vulnerability data can be viewed in the asset details, as well as a dedicated inventory tab. Vulnerability attributes include CVSS score, relevant CVEs, vulnerability description, and any recommended remediation actions.

runZero Passive Traffic Sampling

Learn more about the integration or set up an API connection to Tenable Security Center today!

Understand correlations quickly

You asked and we delivered. Now you can quickly see the matching field that runZero used to merge data into existing records. Consolidating asset and exposure information from disparate sources into a single normalized view makes it easier for you to manage your ever-changing environment. As networks grow in complexity, sometimes it is not obvious how the correlation engine merges data from a new source and this important quality-of-life improvement shows what field and value was used, as well as the specific task, and time of the merge.

runZero Passive Traffic Sampling

Take a look at any recently-updated asset with multiple sources to check it out!

Improved new user workflow

New to runZero? You’ll be greeted by an updated onboarding flow that introduces all of runZero’s discovery capabilities and makes it easier than ever to get started.

runZero Passive Traffic Sampling

New users will automatically see the new flow. Existing users can check it out too.

Rapid Responses #

Protocol and fingerprint improvements

We continue to add new methods of discovery and to improve fingerprinting. Here’s what’s new in this latest version:

  • Support for EtherNet/IP probing and the MODBUS/TCP protocol, improving discovery and fingerprinting for OT networks.
  • Support for MQTT, improving discovery and fingerprinting for IoT devices constrained by resources or bandwidth
  • Improved fingerprinting of devices using the Mopria Alliance eSCL protocol, such as paper scanners and multifunction printers
  • Improved discovery for VoIP endpoints using the Voice Services Discovery Protocol (VSDP)
  • Improved fingerprinting for SMBv1 endpoints, assets based on AzureAD, Microsoft Intune, Microsoft 365 Defender, and NFS data, BACnet devices, devices that provide UPnP information, and devices that use Spotify Connect

See runZero 4.0 in action

Release notes

The runZero 4.0 release includes a rollup of all the 3.10.x updates, which includes all of the following features, improvements, and updates.

  • Moved to a new versioning scheme for the Console and Explorers, <major>.<minor>.<yymmdd>.<revision>.

New features

  • Build your inventory through passive discovery
  • Discover assets the way you want to
  • Integrate with Tenable Security Center
  • Understand correlations quickly
  • Improved new user workflow

Integration improvements

  • A bug that could cause some long-running connection tasks to restart repeatedly has been resolved.
  • A bug that could prevent Intune assets from merging with other sources has been resolved.
  • A bug that could prevent Tenable Security Center syncs from completing has been resolved.
  • A bug that could result in an incorrect ts attribute for Azure AD, Google Workspace, and Microsoft Intune has been resolved.
  • A bug that could result in invalid Shodan credentials still validating has been resolved.
  • A bug that prevented some queries from correctly matching Intune assets has been resolved.
  • A bug where existing assets were incorrectly fingerprinted after importing data from Microsoft 365 Defender has been resolved.
  • A performance regression when processing third-party assets has been resolved.
  • A rotation date for stored credentials is now available through both console and API via a new secret_updated_at field.
  • CrowdStrike and Azure AD assets will no longer be merged if they have a different globally unique ID. This may lead to more offline assets being generated if devices are frequently reimaged and given new GUIDs.
  • Custom Integrations now support the exclude unknown option.
  • Error logging for the Shodan integration has been improved.
  • Improved handling of API request retries for the Microsoft Intune integration.
  • The Tenable integration has been updated to reduce the possibility of asset and vulnerability export timeouts.
  • The Tenable integration has been updated to reduce the possibility of vulnerability export timeouts.
  • The request timeout has been increased for the Microsoft Intune and Azure AD integrations.

Inventory management improvements

  • A bug causing inconsistent navigation for Explorer configuration editing has been resolved.
  • A bug causing incorrect assertion of Microsoft Defender for Endpoint in edr.name has been resolved.
  • A bug causing pending new tasks to be seen as editable has been resolved, so that only new tasks scheduled to start in the future can be modified.
  • A bug causing project expiration to be miscalculated has been resolved.
  • A bug causing tasks in the process of stopping to be seen as dismissible has been resolved, so that only failed and completely stopped tasks can be dismissed.
  • A bug that could cause foreign service attributes to be attributed to the wrong source has been resolved.
  • A bug that could cause tasks to be copied with an incorrect discovery scope has been resolved.
  • A bug that could lead to improper stale service removal on rescan has been resolved.
  • A bug that could lead to orphaned tasks when an Explorer is removed has been resolved.
  • A bug that could prevent import of wireless networks has been resolved.
  • A bug that could prevent in-scope, unscanned addresses from being cleared on runZero assets has been resolved.
  • A bug that could prevent queries containing mixed-case search terms from returning results has been resolved.
  • A bug that could result in an unnecessary screenshot warning for connector tasks has been resolved.
  • A bug that could result in duplicate service warnings has been resolved.
  • A bug that could result in duplicate software entries for some sources has been resolved.
  • A bug that could result in orphaned tasks when removing an explorer has been resolved.
  • A bug that enabled SNMP credentials when modifying or copying existing scan tasks has been resolved.
  • A bug that prevented SNMPv3 credentials from being saved has been resolved.
  • A bug that prevented the scan.explorer_id value from being populated in alert templates has been resolved.
  • A bug that prevented the Find assets in this site icon from working properly in some cases has been resolved.
  • A bug that resulted in the Nmap XML Export having a zero start time has been resolved.
  • An issue that caused the asset details page to load very slowly has been resolved.
  • An issue that could result in an empty dashboard until a metrics recalculation was triggered has been resolved.
  • An issue that could result in an empty dashboard when selecting a single site has been resolved.
  • An update for improved asset matching for tasks importing both scan and third-party data sources has been added.
  • An update to the runZero Explorer now logs when the host operating system receives an interrupt or terminate signal, such as when the OS reboots.
  • Event rules now support conditions for Explorer and task type, where relevant.
  • Exports of task data now include timestamps which differentiate time spent acquiring data from time spent processing data.
  • Improved merging of assets with NetBIOS or SMB services.
  • Improved performance when deleting large organizations, projects, or sites.
  • License-based size limits are now applied to file imports.
  • Recurring tasks now stop with an error if they use a task template that has been deleted.
  • Task name and description can now be modified for tasks created via file imports.
  • Task processing times are improved.
  • Tasks in the stopping state are now included in the Processing section of the Tasks overview.
  • The maximum number of ownership types has been increased from 10 to 25.
  • The tasks CSV export now includes the template_name column.
  • The tasks JSON export and API responses now include the site_name, agent_name, and template_name columns.

New vulnerability queries

  • Hardware: MegaRAC BMC
  • Hardware: Citrix NetScaler

Scan and monitor engine improvements

  • A bug that could cause a memory leak in the Explorer between stopped tasks has been resolved.
  • A bug that could lead to bogus assets appearing in scans through Fortigate proxies has been resolved.
  • A bug that could prevent bogus services from certain firewalls from being completely filtered has been resolved.
  • A bug that could prevent some Windows-based Explorers from connecting with the same ID has been resolved.
  • A bug that could prevent the Explorer from reading the .env configuration file has been resolved.
  • A number of small parsing bugs in the protocol parsing engine have been resolved.
  • A bug which could leave SYN and LAYER2 probes in a perpetual error condition loop has been resolved.
  • A warning is now recorded for scan tasks if a host is ignored for responding on too many ports.
  • An issue that could result in stalled scans has been resolved.
  • Improved automatic asset filtering for certain web proxy assets.
  • Improved detection of spurious services when scanning certain firewalls.
  • Passive traffic sampling tasks now set source:sample instead of source:passive for assets.
  • The Explorer now uses the “runZero” brand by default (and matching filesystem/registry locations).
  • The TCP SYN scanner is now friendlier to stateful firewalls in the network path.
  • The scanner now supports a new syn-reset-sessions option that can be used to reduce session usage in middle boxes.

Self-hosted platform improvements

  • The self-hosted console now defaults to PostgreSQL 15 and provides an install option to select a version.
  • The self-hosted console now uses the “runZero” brand (and runzeroctl command) by default.

Security and user management improvements #

  • A bug causing the user details page to display permissions incorrectly has been resolved.
  • A bug in the user permissions display interface has been resolved.
  • A bug preventing some users from being able to manage their user’s group membership has been resolved.
  • A bug that could cause scan templates to be hidden when configured with invalid permissions has been resolved.
  • A bug that could prevent new SSO users from authenticating has been resolved.
  • A bug that could result in the wrong hostname being used in password reset links has been resolved.
  • A bug where users logging in for the first time with SSO would not have access to any organizations from the SSO group mappings has been resolved.
  • A security improvement has been added to clear password reset tokens after a password change or when link-based authentication is requested.
  • An issue that could result in login errors for invited users using Single Sign-On has been resolved.

API improvements

  • The api/v1.0/org/sites/{site_id}/import route now returns the proper 400 http status code error when the request body is empty instead of a status code 500.

UI/UX improvements

  • A bug causing app banners to not be visible has been resolved.
  • A bug causing the datepicker to close when navigating by year has been resolved.
  • A bug preventing columns from retaining their custom ordering has been resolved.
  • A bug that prevented display of the user permissions table in the User Details screen has been resolved.
  • A bug that prevented download commands from being displayed on the redesigned scanner page has been resolved.
  • On-screen text explaining the interaction between a user’s default organization role and the granted per-org role is clearer.
  • The Explorer and scanner download pages have been redesigned for improved UX and performance.
  • The Integrate page now shows active and suggested integrations for the current organization.
  • The asset details screen now has pagination when viewing an asset with more than 30 services.Join our team

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Crime-as-a-Service (CaaS): Unveiling the Cyber Black Market

The rise of Crime-as-a-Service (CaaS) mirrors the expansion of digital services across industries. With businesses using various “as-a-Service” models to grow and adapt, cybercriminals have found their version in CaaS, making sophisticated cybercrime tools accessible to a broader audience. This marks a trend that has greatly contributed to the rise in cyberattacks the world over.

The Rise & Expansion of CaaS

Cybercrime has always been a lucrative industry, but CaaS has supercharged it. Cybersecurity Ventures predicts the cost of cybercrime to reach $8 trillion this year. CaaS has contributed significantly to this figure by democratizing access to an array of high-level cyber-attack services such as:

Ransomware-as-a-Service: Arguably one of the most notorious, this services offers platforms providing customizable ransomware strains, allowing attackers to specify ransomware amounts, payment methods, and even the ransom note’s content.

Phishing-as-a-Service: Equipped with templates and tools, these platforms simplify the deployment of phishing campaigns. From fake bank login pages to scam eCommerce sites, the goal is to deceive users into providing sensitive data or installing malicious software.

DDoS-as-a-Service: Denial-of-service attacks flood website or online services with excessive traffic, causing shutdowns. With DDoS-as-a-Service, cybercriminals can rent botnets – large collections of compromised endpoints – to inundate targets with requests, leading to service outages.

Hacking-as-a-Service: Why learn to hack when you can outsource it? This service does just that. It provides a platform where individuals can hire seasoned hackers for specific tasks – be it infiltrating a system, acquiring data, or planting malware.

Data-as-a-Service: This is the digital black market’s storefront. Here, cybercriminals can purchase everything from stolen credit card information to breached databases. With the rising value of data, these marketplaces have become bustling hubs of illegal trade.

Botnets-as-a-Service: Essentially, it’s a rent-a-crowd for malicious activities. Users can hire networks of compromised endpoints (which can even include IoT) to carry out tasks like sending spam emails or mining cryptocurrency. Given the scale, these networks can wreak havoc.

The Ever-Evolving Landscape of CaaS

While the above paints a broad picture of CaaS, it’s essential to realize this landscape is in constant flux. With technological advancements, we’re seeing more niche CaaS offerings. For instance, specialized offerings targeting mobile devices or Internet-of-Things (IoT) platforms are gaining momentum. CaaS platforms are becoming more refined, user-friendly, and diversified, reinforcing the importance of vigilance in the cybersecurity realm.

Empowering Your Defense: The Merits of NAC & Certificate-Based Authentication

Tackling the advanced techniques that CaaS brings to the table demands robust coutnermeasures. Network Access Control (NAC) and certificate-based authentication stand as frontrunners in this fight.

Network Access Control: Envision NAC as the vigilant sentry of your digital domain. Beyond just restricting network access, it assess the credibility of users and devices, determining their permissions and logging their activity. It seamlessly integrates authentication, authorization, and accounting functions, ensuring that every device meets specific security benchmarks before granting access.

Certificate-Based Authentication: Bypassing the pitfalls of traditional password systems, certficate-based authentication offers a fortified barrier against unauthorized access. By assigning unique digital certificates, it validates the identity of users and devices without them having to memorize or input complex passwords. It’s an efficient way to enhance security, all while streamlining the user experience.

Closing Thoughts: Charting a Safer Path in the CaaS Age

The evolution of CaaS mirrors technological progression, always adapting, always expanding. Consequently, taking proactive security measures becomes more than just a recommendation; it’s an imperative. Leveraging multifaceted tools like NAC, and embracing the future with certificate-based authentication positions us several steps ahead of potential threats. Knowledge, paired with these advanced techniques, acts as our compass in this ever-evolving cybersecurity terrain.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

What is a passkey and how to store it in NordPass?

As the digital world continues to expand and evolve, the need for secure authentication has become more critical than ever. Enter passkeys – a modern solution for secure authentication that provides a safer and more convenient way to access apps and websites.

Today we will delve into the world of passkeys, explaining what they are, how they work, and why they’re the future of online security.

Passkeys explained
Essentially, passkeys are a new, more secure and convenient way to sign up for and access apps and websites. Cybersecurity experts tout passkeys as an authentication technology set to replace passwords.

Tech giants such as Apple, Microsoft, and Google are working on passkeys and aiming to make their platforms and accounts password-free. The decision is also expected to be taken up by other members of the FIDO Alliance, which is the driver behind passkey technology, and other companies around the globe.

When passkeys become the dominant authentication method, you will be able to sign up and access online services the same way you unlock your phone — via biometrics. No longer will you need to create, remember, and type out passwords.

Sounds awesome? Well, because passkeys are seriously awesome. Let’s have a peek at how to use passkeys in the real world.

Sign-up experience
Say you need to sign-up for a new online service that supports passkeys. All you need to do is add your email or username and confirm the prompt to create a passkey. Here’s how the sign-up process works with passkeys:

Login experience
Now that you’re signed-up for an online service with a passkey, logging in is quick, easy and secure. All you need to do is tap the suggested passkey for that account and you are logged in.

How do passkeys work? 
Understanding passkeys and how this technology works can be somewhat tricky, mostly because passwords have been an integral part of our digital lives for so long. So first let’s recap the old and familiar before getting into passkeys. By the end we should understand the whole passkeys vs. passwords deal and why passkeys are the way of the future.

Password technology explained
Passwords — we know them all too well, and most of us have some idea of how they work. But let’s quickly recap.

Password-based authentication is relatively simple and straightforward. Say you create a password for a new online account. That password is then stored in an encrypted format on a server. When you use the password to access that account, the system compares the password you enter with the one in its database. If the two match — you’re good to go.

Simple, right? Well the catch is that this kind of user authentication presents quite a few serious security concerns. People tend to reuse simple and easy-to-crack passwords for multiple accounts, which is a hacker’s dream — crack a single account and you have access to a person’s entire digital life. Databases that store passwords can be breached. In fact, Verizon’s Data Breach Report notes that up to 80% of successful breaches are attributed to weak or stolen passwords.

Passkey technology explained
You can think of passkeys as a new and improved type of password. Both are used to verify a user’s identity upon sign up and login. However, the technology behind passkeys operates in a different way.

Whenever you sign up for an online service which supports passkey authentication, two keys are generated — public and private, both of which are used to authenticate the user when logging in.

The public key is stored in the website’s server, while the private key is stored on your device, whether it’s a phone, tablet, desktop, or laptop. Without each other the two keys are useless.

Upon logging in, the server sends a request to your device, and that request is then answered by a related passkey. The user’s identity is also verified on the device level via biometrics. Finally if the pair of keys match you’re granted access to your account.

Passkeys are widely considered to be a more secure and convenient form of authentication compared to passwords, as they reduce the risk of forgetting or reusing passwords. Passkeys are also resistant to phishing attacks as they can’t be stolen from your device by a third-party.

Store passkeys with NordPass 
All NordPass users now have the ability to store and manage passkeys in NordPass and use them to access apps and websites. NordPass syncs your passkeys across all of your devices as well as operating systems and enables you to safely share passkeys whenever needed. It is important to note that sharing passkeys is not as easy with alternative systems as it is with NordPass.

We’re excited to let you know that with the release of iOS 17, passkey storage is now available on NordPass app for iOS devices. This is a monumental step for us, ensuring that you, our users, enjoy a seamless experience across all platforms and devices.

In addition to mobile access, you can also reach your passkeys on NordPass via the desktop app, web vault, Firefox, and Chrome-based browser extensions. We’re also thrilled to share that support for the Safari extension is on the priority list and will be launched later this year.

Password managers are highly reliant on platform vendors when it comes to passkey technology. Therefore, we welcome the latest move from Apple because it serves as a huge milestone in replacing passwords with more advanced online authentication solutions. With tech giants allowing third-party integrations, internet users will get more user-friendly services and, as a result, will be more keen to stick to using passkeys

– Sorin Manole,

Product Strategist @ NordPass

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Taking down Turla: Balancing act between visibility & usability with ESET

 

 

ESET technology blocked 10 out of 13 Protection tests, and detected 111 out of 143 substeps 

Once again, the MITRE Engenuity team has put together an incredible round of the MITRE Engenuity ATT&CK® Evaluations: Enterprise, this time using techniques inspired by the Turla threat actor. The substeps selected by MITRE Engenuity tested the visibility and protection provided by ESET security technology across the cyberattack chain, from initial access through system discovery and lateral movement to data exfiltration.

In the Protection tests, our technology detected and blocked most threats – ultimately foiling the two attacks conducted on Day 1 and Day 2.

On the Detection days, ESET Inspect demonstrated good overall visibility into the attacks, recording most substeps and thus equipping defenders with the capability of reconstructing the attacks despite the use of multiple techniques to obfuscate the chains of execution.

Protection tests

The Protection scenario divided 143 substeps into 13 tests; the first substep of each test was allowed to run, disregarding any blocking of a previous substep that would have prevented the attack from reaching this stage. Blocking a substep typically means detecting a file as malware or as a potentially unwanted/unsafe application, but it could also mean blocking a domain or IP address, or killing a process.

If all the substeps in a test are allowed to execute, the test is classified as None. If a security vendor’s technology blocks any substep within a test, it is classified as Blocked. ESET technology blocked 10 tests, in most cases at the first or second substep of the test.

Because the Protection tests give the attackers free rein to execute substeps at a later stage of the attack, blocking multiple tests demonstrates our capability of stopping an attack at multiple points, which is due to our multilayered approach to protection.

Notably, our technology protected against the following threats:

  • malicious executables,
  • a vulnerable, signed driver, and
  • a password-spraying attack.

Figure 1 shows ESET endpoint security software detecting and deleting the executables delivered during the initial access stage of both attacks, thus stopping the attacks right from the start.

Figure 1. ESET endpoint protection detected the malicious executables delivered during initial access
Figure 1. ESET endpoint protection detected the malicious executables delivered during initial access
Figure 1. ESET endpoint protection detected the malicious executables delivered during initial access

Because we had enabled the detection of potentially unsafe applications in ESET endpoint security software, we also blocked the attempt to install a vulnerable, signed driver. The attackers attempted to use the bring your own vulnerable driver (BYOVD) technique by installing a legitimate, signed driver with a known vulnerability to exploit it and gain kernel-level privileges. ESET Inspect also detected this driver as a known-vulnerable driver; see Figure 2.

Figure 3 shows ESET endpoint protection blocking the use of NTLM for authentication – the mechanism used by the password-spraying attack from the internal network.

In addition to ESET Firewall blocking these authentication attempts during the evaluation, our Brute-force attack protection directly blocks password-spraying attacks by denying connections from IP addresses detected in attempts to brute force credentials via the Server Message Block (SMB) protocol or Remote Desktop Protocol (RDP).

Detection days

In the Detection scenario, the ATT&CK Evaluation conducted two attacks comprised of 19 steps over two days. The evaluation not only recorded the detections generated for substeps, but also the level of visibility into substeps that may not have had accompanying detections. ESET Inspect detected or recorded 111 out of 143 substeps.

Plenty of useful and actionable data was available for the analyst sitting at the ESET Inspect console to uncover the attackers’ activity. Even when the adversaries pulled off many techniques to obfuscate the full chain of attack by using code injection, named pipes, service persistence, lateral movement to Windows and Linux machines, and installation of a Microsoft Exchange transport agent, ESET Inspect provided enough of the pieces for the analyst to put them back together.

We were especially pleased with detections of the following:

  • Mimikatz pass-the-hash attack,
  • TCP filter installation on a Linux machine, and
  • Microsoft Exchange transport agent installation.

The Mimikatz implementation of the pass-the-hash technique opens a process using a specific access mask. By monitoring this mask, ESET Inspect detected the use of Mimikatz to move laterally; see Figure 4.

When the attackers created and attached a TCP socket filter on a Linux machine, ESET Inspect detected these events too, signaling to defenders the presence of network sniffing; see Figure 5.

Figure 5. ESET Inspect detects the creation and attachment of a socket filter to sniff network traffic on a Linux machine
Figure 5. ESET Inspect detects the creation and attachment of a socket filter to sniff network traffic on a Linux machineFigure 5. ESET Inspect detects the creation and attachment of a socket filter to sniff network traffic on a Linux machine

These Linux detections demonstrate some of the improvements brought to ESET Inspect since the previous round of the ATT&CK Evaluations: Enterprise, which tested version 1.6 whereas this year’s tested version 1.10.

Finally, to commandeer a Microsoft Exchange server, the attackers attempted to install an Exchange transport agent via PowerShell. However, ESET Inspect monitors the installation and enabling of transport agents, and can kill the PowerShell process and thus block the installation attempt; see Figure 6.

Custom detections

One of the benefits of the MITRE Engenuity ATT&CK Evaluations is to help refine the balance between usability and visibility that we strive to achieve in detections by ESET Inspect. When a substep was visible in ESET Inspect but not pointed out by a detection, we created a new detection that, during a rerun, allowed the substep to be detected as well. MITRE Engenuity marked such enhancements in the detection results with the configuration change tag. These new detections are certainly noteworthy, but ultimately they will have to prove their value against real-world data before we decide to include them in a future version of ESET Inspect.

Even if these detections do not make the cut, customers may be interested in the capability to create custom detections in ESET Inspect. An open detection engine allows customers to adapt ESET Inspect to their specific detection needs – a feature not available in all XDR solutions.

Missed substeps

We classify the missed substeps on the Detection days into two groups. First, substeps that we assess provide the analyst with little to no value and almost no loss of information for reconstructing the attack. Second, substeps that add value for the analyst, which will be further assessed for possible inclusion in ESET Inspect.

Most missed substeps belong to the first group. For example, many substeps tested the product’s visibility into the very common actions of compressing, encoding, or encrypting data. Detecting such actions is generally only useful if what was compressed, encoded, or encrypted is also tracked, but this significantly increases data storage needs and imposes a huge hit on performance – both undesirable consequences for the security analyst to handle.

In the second group, an example substep that provides high value is writing executables to and reading executables from named pipes. Adding detections to ESET Inspect for these events could help the analyst reconstruct obfuscated process trees more easily and they are events expected to have low false positive rates on real-world data.

Putting the ATT&CK Evaluations in context

The MITRE Engenuity ATT&CK Evaluations are undoubtedly a solid reference point for understanding an XDR solution’s detection and response capabilities. However, the best solution is not necessarily the one that detects every substep, but rather the one that balances visibility with usability, placing the needs of the security analyst at the forefront.

Thus, when assessing an XDR solution, remember to zoom out and consider broader criteria than just how many detections were triggered in any given test, as these factors are just as indispensable. A complete assessment should include at least the following:

  • false positives,
  • performance,
  • data storage,
  • cost of detecting frequently occurring events,
  • customization of detections and responses,
  • integration with external data sources and other security tools,
  • endpoint security detection capability,
  • multiplatform support,
  • security needs of your network, and
  • vendor support services.

Putting the ATT&CK Evaluations in this context helps you better understand the full array of benefits that an XDR solution offers. We hope that this summary of ESET’s results and perspectives on the Evaluations has sparked your curiosity to explore the evaluation of ESET Inspect further on the results page provided by MITRE Engenuity.

* The views and opinions expressed in this blog are those of ESET and do not necessarily reflect the views or positions of any entities they represent.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×