Skip to content

You Were the Victim of a Data Breach. Now What?

A data breach is something every individual and organization needs to avoid. Unfortunately, it has become all too common in today’s online world. One major way that personal information becomes compromised is through identity theft. It’s better not to imagine the extent of damage that goes along with that.

In this highly-connected world, cybersecurity is continuously increasing in scope and size.

For one, consumers want to conduct business with enterprises capable of keeping hackers away. As a result, it becomes necessary to put a response plan against data breaches. The question, therefore, is how do you prevent or respond to a data breach?

What is a Data Breach?

A data breach occurs when an organization suffers a security incident that affects the confidentiality, availability, or integrity of its data. Consequently, the rights and freedoms of individuals become compromised.

Data breaches strike every industry, sector, and individual. For individuals, the cost is often personal financial damage to investment funds, salaries, or savings. On the other hand, corporations often spend hundreds of thousands or millions in dollars to repair systems, improve defense, and more.

How Do Data Breaches Happen?

Compromised credentials are the most common method cyber attackers use to enter a database. The approach accounts for 20% of data breaches.

Most affected credentials include passwords and usernames obtained through a different security incident. Various attack methods come into play in these data breaches including brute-force attacks, megacart attacks, phishing and more. Also, a breach could result from an insider, negligence, and business email compromise (BEC).

For an inside threat, the attackers first conduct surveillance, then map out a network for the most valuable resources, before targeting a potential pathway to infiltrate the systems.

Financial motivations are the reason for most inside attacks. Some employees jump at it when they get tempting offers to make extra money. The outcome is your information changing hands.

Types of Data Breaches

A data breach is also great at ruining a brand and not just your revenue. For individual to remain safe, a knowledge of the common types of breaches is a must. You also need to know how it affects you. So, here is a list.

  • Malware or Virus: The goal of this threat is to wipe information from a computer. For companies that heavily rely on data, this is always a heavy blow.
  • Password Guessing: Stolen passwords all to often result in extreme damage. Passwords are typically hacked due to their simplicity and being easily guessable. Prime examples of this include Passwords derived from people’s names, pet names, or birthdays.
  • Ransomware: As the name suggests, this occurs when you pay a ransom to regain access to your phone or computer.
  • Phishing: Phishing involves the mirroring of a website with a fake duplicate that can highly resemble the original. When you unknowingly log into the site, the attackers steal your password to conduct their criminal activities.

How to Detect a Data Breach

As data breaches become inevitable, detection is becoming an increasingly important initiative. At this rate, cybersecurity has become an essential investment for individuals and organizations. We all need to understand who is vulnerable to data breaches and how to detect and respond to them.

Data breach detection is not always easy. It often involves an intelligent Data Security Platform, especially in the case of large companies. Their tools help to provide speed and precision when mitigating damages.

Nevertheless, there are always warning signs that indicate when your system has experienced a data breach. Here are red flags you need to the investigate:

  • Sudden user account lockouts or password changes.
  • Strange user activity such as logging in at irregular times from unknown locations.
  • Unusual pop-ups, redirections, or changes to browser configuration.
  • Unusual activity on network ports
  • Strange messages from you by email or social media
  • Strange configuration changes without an approval

Effects of Data Breaches

Irrespective of the size, a data breach can destroy a business. For example, 60% of small businesses often shut down within six months after an attack. These occurrences can stem from multiple factors including:

  • Poisoned Corporate Brand: Data breaches have a way of tainting a business reputation –the effects of which can linger long after the incident.
  • Loss of Sales: Reputational damage can lead to a loss of customers and sharp drops in revenue due to drops in customer trust.
  • Loss of Intellectual Property: Intellectual property constitutes over 80 percent of a company’s value today. Losing intellectual property can threaten the future of the company and also leaves it vulnerable. In some instances, some competing businesses will even take advantage of stolen information for their own gain.

How to Develop a Data Breach Response Plan

Have an Incident Response Checklist
Having an incident response checklist for data breaches can provide guidance for what to do during breach scenarios. It contains an outlined task to carry out so that everyone knows what exactly to do. However, the checklist should be flexible to allow adjustments for evolving threats.

Be Informed about Laws and Regulations
Regular government policy changes are often a headache for SME businesses. Because of the rise in cybercrime, governments and agencies constantly change regulations on data protection. Be sure to keep tabs on these changes and adapt to new laws.

Review New Cyber Threats
Never take the news of a data breach for granted. It’s important to consistently review new security risks as these provide highly valuable insights.

Identify Data Security Platforms
In case of a security breach, contacting a forensic service provider is safe. They are highly skilled at investigating the cause and impact of an attack. It is best to have the contact for one beforehand rather than waiting for a crisis to find one.

Steps to Take After a Data Breach

1. Identify the Source and Extent of Damage
The first thing to do about any cyber attack is to identify the source. You also need to identify the type and the extent of the damage. It is a time-consuming process when operating without a prevention system.

2. Having an Intrusion Prevention System (IPS)
An IPS automatically logs the security event to you and tracks down the source and identify of the affected files when in use. You can also gain insight into the particular actions taken by the threat actor.

3. Inform your Forensic Service Provider
You need to have a structure in place for addressing security emergencies. If you have a team, have them to swing into action immediately. Remember your checklist and let them follow the procedure for resolving the issue. If it is an inside threat, revoke the account’s privileges and change the password. Should you not have an in-house team, inform your security service provider to tackle the problem.

4. Test your Security Fix
Once the issue gets resolved, implant a short-term security fix to prevent future occurrences. Don’t forget to also test any security fix to avoid attackers using the same method. Be sure to conduct the test on all computers and servers.

5. Inform Authorities and Affected Customers
Customers need to be informed about a breach of their personal data so they take personal measures to protect their identities such as canceling credit cards and setting up two-factor authentication if available. Informing customers requires three critical factors — time, information, and thoroughness. Be sure to communicate honestly and openly where necessary and provide steps of guides for them to protect themselves. In addition, contact authorities about the breach. The government and security agencies provide post-breach regulatory standards for every industry.

6. Prepare a Clean Up and Damage Control
The loss of customer confidence is another devastating effect of data breaches. They tend to be more cautious with any organization after a breach. When you fix all breach-related issues, quickly pivot and work on restoring public trust.

Final Thoughts on Data Breaches

There is no single method for responding to a data breach . Data breaches often require a case-by-case approach along with a thorough risk assessment to determine the best course of action. The extent of damage and nature of the breach will determine the precise steps needed. The response team may work with additional staff or external experts such as IT specialists/data forensics experts. While data breaches can undoubtedly be a nerve-wracking event, the first rule is always prevention, and having a sound response plan can help put the mind at ease.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Monitoring as a service: the alternative to talent shortages

There is quite a wide range of solutions offered by monitoring as a service to any company, from performing any analysis to detect the root cause of the issue to determining the path of the failure.

Here goes…

Our opinion on monitoring as a service

One of the most important and obvious benefits it brings to the table is that it solves training problems of workers involved or just solves the shortage of talent of these workers right away. 

It may sound a bit harsh… but it is what it is. 

The increase in the amount of information available in companies, and the obligation to be able to manage this IT structure well means that workers must constantly be better qualified.

In addition, the increasing importance of IT means that infrastructure managers have a certain amount of work overload. 

Something that with a monitoring system does not happen! 

Rather the other way around, monitoring as a service establishes a theoretical bridge between technology and business, drawing a scheme where you can easily detect where the source of the problem is, saving time and actions to the operating team.

Monitoring reduces the importance of the traditional involvement of people from different areas of the organization and the work overload that managers in this process may have. 

To sum up, monitoring systems control all data and allow access to information from the same platform, avoiding that those in charge of this area have to stay aware of several fronts without fully concentrating on a single one. 

Also inactivity cost is reduced!

Let’s get to the point!

“You must take into account that the transformation of a given company implies that there is more software. 

And, therefore, more business areas that depend on technology. A series of changes that imply the need to hire more competent profiles. 

Everything with the aim for all pieces to fit perfectly, both the computer and its software as well as the network and the technician who handles it “. 

Explains Sancho Lerena, CEO of Pandora FMS, as you surelyl know, an international reference in monitoring.

An example of this need is that the growth of hybrid infrastructures is 25% per year according to IDC data. 

For that reason, many companies are taking their chances on taking out their IT monitoring infrastructure to save money and especially time.

This process of getting the entire IT organization under the umbrella of the same system also helps the infrastructure manager, as they have higher capacity to manage its records. 

On the one hand, it collects all the data despite the fact that it is a large volume. 

And, secondly, it concentrates access to all that information on a single centralized console.

In conclusion, we get over the lack of time for the worker to be aware of fundamental tasks such as security or data management. 

It also gets rid of the possible lack of capacity to adapt to the different operating systems that may exist in the same company. 

And, lastly, the workload involved in facing a constant data flow where any minimal error must be detected is minimized. 

Systems such as Splunk, Datadog or Pandora FMS itself help in the process.

Conclusions

Through monitoring, it is possible to use information in a reactive way, anticipating problems and alerts received; preventive, since analyses are obtained that help to be prepared for any worst-case scenario; and retrospective, since the emerged crises are also studied to find out the extent of their impact and know how to take measures properly in the future.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Primer on SQL Injection

Intro

Our goal here is to explain what SQL Injection means, how it works, and what types of SQLi exist. With so many applications talking on the internet, while also having some sort of database on the backend, SQL Injection is something you should always think of.

There’s too many production systems that are internet-facing, and if they have a database on their backend (which they usually do), you would probably want to mitigate this risk in any way possible.

 

What is SQL Injection?

SQLi, or short for SQL Injection is an attack on a database of a webapp. SQL Injection means that the malicious query gets executed – injected. This happens when we don’t validate properly, not sanitizing our user inputs, or not using stored procedures, for example. When we don’t do this, we allow the user input to be sent from their browser – or our webapp’s frontend – to the backend of the app, where the database lives, which then gets executed. The idea here is to have some sort of control, so that our app will evaluate the given input to see if it’s valid, before letting the query be executed. Ideally, if the input is not valid, it would just not let the user execute. If we don’t do this, we will be vulnerable to the SQL injection.

When this attack is successful, there’s a risk of stuff within the webapp database being deleted, altered, stolen, or used to further attack other areas of the application. SQL injection, even though its one of the oldest vulnerabilities, as you can infer, can be particularly devastating for us.

Let’s try and briefly illustrate how an SQL injection would look like, using one of the simplest types of SQL injection – in-band SQLi.

For example, imagine the query below should return personal data of the current user – call him user1, and display it:

SELECT * FROM users WHERE user_id LIKE ‘user1’

If we allow this query to be executed in our app, our attacker could simply say %’– which would in turn send the following query to our database:

SELECT * FROM users WHERE user_id LIKE ‘%’--’

Since in SQL the two dashes are used to comment out the rest of the line that follows, our app would actually execute the following query:

SELECT * FROM users WHERE user_id ‘%’

The percent sign in SQL is a wildcard, and the query above, when executed, would in turn display all the contents in the users table.

This is quite scary as you can see, and not at all complex to do. The example above is something that’s known as in-band SQLi.

Types of SQLi

There are three main categories of SQLi: in-band SQLi, blind SQLi, and out-of-band SQLi. Our example above used the in-band SQLi, but let’s try and explain these three types of SQLi a bit more.

In-band SQLi

This is the simplest of the three SQLi types; in-band means that our attacker, who is able to change the query to their liking, will get direct results of this changed query. Direct results implies they also get their results in the same way they performed the attack – if they did that with their browser, their browser would also display the results of the query.

Subcategories include error-based SQLi and union-based SQLi.

Blind SQLi

Contrary to the in-band SQLi, with blind SQLi we get no feedback, or very little response as to the success of the injected query. One of the most well known examples of the blind SQLi is the ‘ OR 1=1;– (which is also a subcategory of blind SQLi called Boolean SQLi). 1=1 is always a true statement, and when combined with the OR operator, this query will also be true, which can end up being enough for the logic of our web application that would in turn believe that it found a valid username/password combination, thus allowing access.

This can be used to bypass authentication – letting us through the login screen; login forms that are connected to the user database are often made in such a way that the application doesn’t really care what username/password is given to it, rather that the two are matched successfully in the respective table.

You can think of it as our application asking the database if there is such a combination of the username/password (not what the contents are) and the response from the database is either true or false. If true, we are granted access, and can login successfully.

Blind SQLi query could look something like this:

SELECT * FROM users WHERE username=’ ‘ and password=’ ‘ OR 1=1;

Two subcategories include: Boolean-based SQLi and time-based SQLi

Out-of-band SQLi

Not that commonly used, out-of-band SQLi needs specific features to be enabled on the database server, or in the web application’s logic, that would make an external network call based on the results of the given query.

The server would need to have commands that could trigger DNS or HTTP requests, otherwise we can’t do the out-of-band SQLi.

Further, there are two communication channels in out-of-band SQLi – one that is used to do the attack, and the other that would collect the results.

If, however, these conditions are met, what would happen is that the attacker could make a request to the website, with their payload, then the website/app would make an SQL query on their behalf, which gets passed to the database (the payload is passed too), and finally, the payload has a request inside it that forces the database to send back an HTTP request to the attacker’s machine – containing the results.

 

Preventing SQLi

Some of the best ways to prevent SQLi is to use, prepared statements (parametrized queries), input validation, and escaping user input.

Prepared statements (parameterized queries) – the only fully effective way to prevent all types of SQLi in web apps. (If your language doesn’t support parameterized queries but your database does, you can use stored procedures instead).

We must note that even though input validation and escaping user input can help you against SQLi, these methods are not completely bulletproof and the attacker might still find a way around them.

Conclusion

We hope that this short primer on SQLi has brought the topic closer to you. The main takeaway here (we feel) is the fact that avoiding this specific vulnerability should mostly depend on your developers, specifically, crafting the appropriate prepared statements/parameterized queries as this is the best approach – since it eliminates the vulnerability alltogether. Without it, your filters, blacklisting, or other controls, are just bigger obstacles, but not the full solution.

#SQLi #blind #in-band #out-of-band

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

Shared responsibility: Why your Microsoft 365 is not backed up, and how to fix it

While most cloud service providers, including Microsoft 365, offer some degree of data backup, you might be surprised how minimal it actually is. This brings us to the discussion of shared responsibility and why it can’t be ignored if you want complete data protection and backup.    Because Microsoft 365 is so commonplace in business, it’s easy to assume that so long as you stick we them, you have the basics covered. That, unfortunately, is not correct when it comes to cloud backup and recovery. Here are two hard truths you need to take into consideration when you plan your SaaS data protection:
  1. Your cloud service providers are not responsible for the safe keeping of your data. 
  2. You are responsible for keeping your data and metadata safe.
  In this blog post, you will learn: 
  • What shared responsibility means.  
  • What cloud services like Microsoft 365 currently offer to retrieve lost data. 
  • How to make sure your cloud data is actually secure. 

What You Risk by Not Backing Up Your Cloud Data

Let’s start by looking at the exposure a company faces that does not participate in shared responsibility.    Depending on the nature of one’s business, several risk scenarios could arise if you rely solely on cloud service vendors for backup (and the vendors themselves recommend that you do not rely solely on their services):  
  • You lose access to critical intellectual property documentation such as patents. 
  • You may no longer be in compliance by losing access to certain required information. 
  • The entire company loses access to emails and other collaboration tools such as  SharePoint and other apps, thereby preventing employees from doing anything. 
  • Critical systems such as Salesforce, which are based on multiple automations that have been painstakingly built up over time, will need to be rebuilt. 
  When data loss happens to a large business it can result in thousands of unhappy employees and customers. For small to medium-sized businesses the consequences can be even more severe if they lack the IT resources and know-how to immediately address the problem.     The eventual outcomes range from customer inconvenience and disgruntled employees to severe legal problems and potential business catastrophe.  In other words, your business continuity is at stake.

Common Data Loss Threats  

Data loss threats don’t always originate from outside the organization, as demonstrated by a study conducted by the Enterprise Strategy Group (ESG) which showed that human error from within the organization is one of the single biggest contributors to data loss.    A breakdown of data loss causes is illustrated in the following graphic: If you lose data for any of these reasons, cloud vendors like Microsoft will not provide data backup because they adhere to the “shared responsibility” model that states it’s not their responsibility. More on that later. 

The “Backup Features” Currently Available in Microsoft 365 

In essence, cloud service customers have three functionalities that many think serve as backup of their data.  

Litigation Hold 

The purpose of litigation holds is to help if you are involved in a legal process and need to preserve information exactly as it is at a specific point in time. It is clearly not designed as a backup or recovery tool, because:  
  • Retrieving just a single email requires going through 8-10 demanding steps. 
  • Based on your licensing plan, your cost of storage may be significantly higher. 

Versioning 

Microsoft automatically saves versions of your documents at regular intervals, so you can just go back and open a previous version, right?     Technically yes, but:  
  • You only get the random actual documents. What you don’t get is structure—nothing is where you left it, and there are no folders. So, at scale, this quickly becomes unmanageable. 
  • If there is a ransomware attack, all versions may be encrypted. 
  • There is zero protection against dangerous and potentially crippling ransomware. 
  Speaking of ransomware attacks, check out our popular Disaster Recovery Guide for a seven-step guide on how to keep your business running in a disaster situation. 

Recycle Bin 

Just like the bins around your office, the Microsoft recycle bins are emptied regularly. How frequently depends on the application. For example:    
  • In Exchange: mail items disappear after 30 days, and calendar items after 20 days. 
  • In Teams: channels, teams, and group items go away after 30 days. 
  • In OneDrive and SharePoint, they’re removed every 93 days. 
  • In SharePoint backup, items disappear after 14 days.  
  As useful and convenient as they are for users, these features can lull employees into a false sense of security because if the worst happens, they are not reliable.     Now that you know what’s at stake, let’s dive into the issue of shared responsibility. 

A Crash Course in Shared Responsibility

What is Shared Responsibility?

Although no official dictionary definition exists, in a nutshell, shared responsibility means you and each cloud vendor take shared ownership for accessing your data in the cloud.     Don’t be surprised to learn that Microsoft is not responsible for protecting your data. They are very clear on this issue. You can read a summary of their shared responsibility policy for Microsoft 365 in this short article, and here’s the bottom line (in Microsoft’s own words):    ‘You own your data and identities. You are responsible for protecting the security of your data and identities, on-premises resources, and the cloud components you control (which varies by service type)’.   Regardless of the type of deployment, the following responsibilities are always retained by you: 
  • Data 
  • Endpoints 
  • Account 
  • Access management 
  As you can see in the table below, the division of responsibility between you and Microsoft, depends on your hosting. (For the purpose of this blog post, pay attention to the SaaS column.)  Source: Microsoft 
  As you can see, Microsoft assumes some responsibility for its piece of the cloud service, but it’s up to the customer to protect the critical data that represents the lifeblood of its business.     Microsoft 365 does have some built-in features to retrieve deleted data such as versioning, litigation hold, and recycle bins, however, these also have limitations and are nowhere near viable alternatives to genuine backup. 

Who Uses the Shared Responsibility Model? 

Originally, AWS developed the concept, and today it’s used more or less identically by all cloud services. So, shared responsibility doesn’t just apply to specific vendors or types of services but to cloud computing in general.     If you want to dig deeper and explore how some of the main cloud service providers refer to shared responsibility, follow the links below to learn what each says on their respective websites.   

What Microsoft Recommends Instead: The 3-2-1 Backup Principle 

So, if Microsoft is not responsible for your cloud data, what steps do they recommend?    Simply put, they recommend keeping your eggs in different baskets. The most effective way to safeguard your data is to use the 3-2-1 backup principle, which goes like this:  Store your data separately from your day-to-day operations.     You must keep one copy of your data off site. Years ago, offsite storage was mainly to protect against fire and theft. Today, it’s more complicated than simply separating data geographically. And you can’t fully rely on cloud access, which could be taken offline to protect the providers’ own business interests.    If you want to learn more about what Microsoft recommends what to do if you experience a ransomware attack, you can find a good summary here.      Let’s move on to some actionable advice on what you can do next to bridge the huge security gap left by shared responsibility. 

How to Find a Backup Solution That Works 

If you decide to heed the advice of Microsoft, Google, and the other cloud service providers, and find a reliable third-party backup solution, here are some important considerations: 
  1. Find out who is actually responsible for data loss in applications such as OneDrive, Groups and Teams, SharePoint, and Exchange within your organization. Is there a dedicated person or team, or is the responsibility spread across the organization? 
  2. Make sure backup copies are stored outside of Microsoft 365’s domain. Always have offsite, immutable, backup copies that are stored separately from your primary data. Never store in the same logical infrastructure as your primary data. 
  3. Look for comprehensive coverage for your SaaS data, in order to include as much data and metadata as possible in your backup. 
  4. Look for fast and granular recovery so you can recover from a single item, all the way up to the tenant level to achieve precision recovery at scale.  
  5. Look for a third-party tool that is compliant and offers long-term retention and a variety of security controls. 

How to Find the Right Microsoft 365 Backup Vendor

There are great solutions available, and like everything else, you need to find the one that best meets your needs. To help you in that regard, here are the most important considerations:    Microsoft 365 coverage 
  • Does it support all of Microsoft 365, with all associated data types, such as Teams private chat, channel chat, versioning, and public folders, etc.? 
Data recovery 
  • Can you restore all business-critical data in place? 
  • Is all data restored in its original format? 
  • Is all data restored — from a single item up to tenant level? 
Role-based access control and compliance 
  • Can you configure backup admin permissions? 
  • Is the audit log tamper-proof? 
  • Can you limit access rights across specific data connectors? 
Data storage 
  • Are data centers independent from the SaaS provider? 
  • Are there options for data residency? 
  • Are redundancies built in? 
  • Can you store copies of your data in two separate data centers? 
Pricing 
  • Is the license model clear and transparent? 
  • Is data consumption included? 
  • Are there any hidden costs (for example, for departed users)? 
Search capabilities 
  • Can you search universally across all snapshots in a single view? 
  • Can you preview documents live? 
  • Can you control search and restore delegation? 
  • Can you perform point-in-time navigation or restore? 
Simplicity 
  • Can you easily manage and unify backup sets of cloud apps? 
  • Can you share public links to end users, and download all the data types and levels? 
  • Is the interface intuitive? 
Backup configuration 
  • Is the backup deployment simple and configurable? 
  • Can you scale across any size organization? 
  • Are the retention policies flexible across the instance? 
  • Can you segment Microsoft 365 data to meet business requirements? 
Security 
  • Is the storage engine tamper-proof? 
  • Are there SSO and MFA options? 
  • Are the data centers ISO27001 certified? And what about the software development and operations organization?
Backup management  
  • Is the solution 100% cloud-based with no maintenance required? 
  • Are new users automatically added to the backup? 
  • Can you automate notifications and backups? 
  • Is there an open API allowing for third-party integration? 
 

In summary: 

We’ve covered the concept of shared responsibility, touched on what the cloud service providers cover, and where your responsibility lies. We’ve also shared some advice on what you should look for in a backup and recovery solution. I hope you come away from reading this blog post feeling better equipped to perform your cloud data risk assessments. If you have any questions, you are of course welcome to reach out.  

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

Network Security Perimeter: Why Is This Concept Obsolete?

For a long time, companies had data centers as their IT infrastructures, which needed to be protected from external agents. 

Business-critical data was embedded in these allocations, including internal networks, client devices, Internet gateways, applications, and servers. 

To protect these assets, firewalls, antivirus programs, intrusion systems, and demilitarized zones were used, separating those who had access authorization from those who did not.

In this type of structure, anyone could access most of the network, regardless of their need and the tasks they performed in the company.

On the other hand, accessing it remotely was a major challenge due to the Network Security Perimeter. 

The digital transformation process, along with the migration of infrastructures to the cloud and the adoption of remote work models, has led companies to decentralize their infrastructures. 

One of the direct consequences of this movement was the development and adoption of Zero Trust-based models and micro-segmentation, since the Network Security Perimeter has become inefficient. In this article, we will explore this subject. To facilitate your reading, we divided our text into topics:

  • What Is a Network Security Perimeter
  • Why Many Experts Believe the Network Security Perimeter has Become Outdated
  • Three Changes that Contributed to Making the Network Security Perimeter Obsolete
  • New Ways to Handle Network Security Today
  • Internet of Things and the Network Security Perimeter
  • About senhasegura
  • Conclusion

Read our content to the end and understand more about it!

What Is a Network Security Perimeter

The Network Security Perimeter refers to the model used in traditional networks to protect resources and data and prevent them from being accessed by external invaders.

For this, intrusion detection and prevention systems and firewalls are used, among other security measures. There are three best practices when it comes to Network Security Perimeter, which are:

  • Passive Monitoring

Some features can be used to promote passive monitoring by detecting vulnerabilities and identifying different devices connected to the network.

Passive monitoring allows one to locate desktops, remote servers, and routers, among others, and assess their configuration and operating system in order to find weaknesses that can be exploited by malicious agents. To do this, one must activate these features or schedule them manually. 

  • Active Monitoring

Active monitoring makes it possible to map an organization’s private network and check it continuously, identifying irregular traffic, unknown IP, and data transmission, among other patterns.

With active monitoring tools, one can keep employees in compliance with the organization’s guidelines, without exposing the system to security failures due to malicious actions or misuse. They allow you to create logs and reports to audit network security in real-time.

  • Network Zoning

Network zoning divides the areas of a network into secure, restricted, controlled, and uncontrolled zones. Its great benefit is to limit security breaches to the areas where they occurred, without affecting the others.

Each zone has different security policies and traffic can be restricted through firewalls, which leave the identity of the trusted network hidden from untrusted ones that are connected to the Internet.

With the evolution of cloud computing, the Network Security Perimeter has become insufficient to provide cybersecurity to organizations. In the next topic, we explain why.

Why Many Experts Believe the Network Security Perimeter has Become Outdated

The digital transformation has brought the possibility of accessing corporate resources from any environment, maintaining the productivity of employees who are in remote work or on a business trip. 

This can be very positive, as it ensures availability for customers, whose demands are constantly evolving. 

Adapting to digital transformation involves understanding that the security perimeter does not cover just the local network. Today, it is necessary to protect corporate resources accessed from external networks, such as hotels, cafes, or homes of employees and business partners.

For this reason, experts believe the Network Security Perimeter consists of a concept that has become insufficient and obsolete. 

This is because the traditional firewall used to consider the activities developed within a strong perimeter to be secure, and the services managed by public cloud providers extrapolate this delimitation and rely on mechanisms that require other security measures.

Digitally transforming a company requires modifying its security model, applying automated controls, detecting violations using the available signals, and applying the principle of least privilege. In addition, the actions performed by users must be constantly verified, regardless of where these users are located. We call this Zero Trust. 

Three Changes that Contributed to Making the Network Security Perimeter Obsolete

Some changes have contributed to making the Network Security Perimeter an obsolete solution. Among them, we can highlight:

  • Covid-19

The Covid-19 pandemic has caused many organizations to adopt remote work and, as it seems, this type of work may remain.

This changed the way people work: those who settled in an office today access the resources they need from any device, anywhere. 

But even before the spread of the coronavirus, the work had already changed for many: although people worked not only at home, they also worked at home.

  • VPNs

With the growth of remote work, VPNs were used by companies so that their employees could securely perform their tasks, even far from the office.

Today, they are still useful for enabling secure remote connections, but violations have already shown us that their security model is perimeter-based. That’s why organizations are looking for easier and more secure resources. 

  • Cloud Computing

Cloud computing is part of the reality of most companies today. As a result, data and resources are no longer stored in network locations and are stored in an external cloud.

In this way, your employees can access information available in the cloud environment from anywhere in the world, which provides much more dynamism to their activities.

However, it is no longer possible to talk about Network Security Perimeter, or delimiting a certain area, since it dissolves in this context. 

New Ways to Handle Network Security Today

After noting that the Network Security Perimeter has become insufficient, it is necessary to adhere to other ways of handling network security, and some of them are:

  • Zero Trust-based Models

One of the alternatives to the Network Security Perimeter is to migrate to a model based on zero trust, which assumes that one should never trust, but always verify.

Therefore, users and devices must be authenticated and constantly verified each time they access a program or resource through solutions such as SSO or multifactor authentication (MFA).

Thus, users will have access only to the data and tools they need to perform their functions.

This mechanism promotes security because it not only protects the network against external invaders but also against insider threats. At the same time, it favors flexible access to organizational systems, which can be done from any environment. 

  • Micro-segmentation

Micro-segmentation enables the creation of secure areas for companies to segment workloads that must be protected in isolation. 

This feature is useful in environments with many assets, such as cloud deployments and data centers, but it is very complex to deploy it securely in large companies with numerous networks, cloud platforms, and firewalls. 

To be efficient, micro-segmentation needs to have visibility, something that many networks do not have. This is because engineers must know which devices are on the network to target them. 

  • Software-defined Perimeter

Created by the Cloud Security Alliance (CSA), the software-defined perimeter (SDP) is a structure that controls access to resources based on user identity. Its function is to allow connection to applications, network systems, and services securely, hiding details of the infrastructure such as IP addresses and port numbers.

In this model, a network device refuses connections from any other device or application that is unnecessary to perform a certain activity, preventing attackers from exploiting the network. 

Internet of Things and the Network Security Perimeter

The Internet of Things (IoT) is characterized by making it possible to live in a hyper-connected world, in which everyday objects are connected to the Internet, working together with the minimum of human intervention.

Its evolution generates new vulnerabilities when it comes to information security, since not all people are used to adopting appropriate protection measures.

Preventing technological evolution is impossible, however, it is necessary to reflect that having everything connected anywhere makes the goal of the Network Security Perimeterunfeasible, requiring the adoption of layers of security that do not compromise the business. 

About senhasegura

We, from senhasegura, are part of the MT4 Tecnologia group, created in 2001, to promote cybersecurity.

We are present in 54 countries, providing our clients with control over privileged actions and data. In this way, we avoid the action of malicious users and data leaks. 

We understand that digital sovereignty is a right of all and this goal can only be achieved with applied technology. 

Therefore, we follow the life cycle of privileged access management, before, during, and after access, by using machine automation. Among our commitments, the following stand out:

  • Ensure more efficiency and productivity for businesses, as we avoid interruptions due to expiration;
  • Perform automatic audits on the use of privileges;
  • Automatically audit privileged changes to detect abuses;
  • Ensure customer satisfaction;
  • Perform successful deployments;
  • Provide advanced PAM capabilities;
  • Reduce risks;
  • Bring companies into compliance with audit criteria and standards such as PCI DSS, Sarbanes-Oxley, ISO 27001, and HIPAA.

Conclusion

By reading this article, you saw that:

  • Network Security Perimeter consists of a model used in traditional networks to prevent data and resources from being accessed by external invaders;
  • There are three best practices when it comes to Network Security Perimeters, which are: passive monitoring, active monitoring, and network zoning. 
  • This capability is not enough to protect corporate resources accessed from external environments by people linked to organizations;
  • It is a system that has become obsolete, due to the reduction in the use of VPNs, the Covid-19 pandemic and the wide adherence to remote work that it caused;
  • Therefore, companies have adapted themselves through solutions such as Zero Trust-based models, micro-segmentation, and software-defined perimeter;
  • The Internet of Things also represents a challenge for the Network Security Perimeter, as it makes it possible to have everything connected anywhere.

Did you like our article on Network Security Perimeters? Share it with someone who may also be interested in the topic.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Need help? Our team is just a message away