Skip to content

What are the actions performed during a privileged access

Nowadays, cyber-attacks have become increasingly common and hit more and more companies, of all verticals and sizes. According to the SonicWall 2022 Cyber Threat report, the number of cyberattacks involving data encryption increased by 167% in 2021, reaching 10.4 million attacks. And they weren’t the only ones: Intrusion attempts increased by 11% and IoT malware was up 6% in 2021 compared to 2020.

And the cost of these attacks also follows this trend: according to IBM in its Cost of a Data Breach 2021 report, the average cost of a data breach was USD 4.24 million, up almost 10% compared to 2020. It’s worth remembering that privileged users are a major attack vector used by cybercriminals: according to Verizon Data Breach Investigation Report 2022, more than 40% of data breaches involved exploiting stolen high-privilege credentials.

And it’s no wonder that privileged credentials are also called keys to the kingdom. After all, these credentials allow access to critical information and to modify settings in the environment. If compromised, they can cause significant damage to the organization, including affecting business continuity. For this, it is important for security leaders to implement processes, train people, and acquire tools to properly manage privileged access. This is called Privileged Access Management, or PAM. According to Gartner, by 2022, 70% of organizations will implement PAM practices for all their use cases, a 40% increase from 2020.

Implementing PAM allows organizations to effectively monitor their environment, as well as pinpoint who had access to which assets connected to the infrastructure. In this way, it is possible to protect the organization against threats – both internal and external – in addition to preventing malicious actors from gaining access to sensitive data through high-privilege accounts and enabling compliance with the latest cybersecurity regulations, including security protection laws. data such as LGPD, GDPR and CCPA. However, according to Gartner, mitigating risks associated with privileged access is virtually impossible without PAM solutions. These risks include, for example, the lack of visibility of assets, as well as the traceability of actions performed through privileged credentials. It is worth remembering that Gartner elected PAM as the number 1 project in security for two years in a row.

To ensure maximum protection, we at senhasegura have developed an approach that covers the entire life cycle of privileged access, including the actions carried out before, during, and after the realization of privileged access. These actions range from discovering privileged credentials in the environment and provisioning them to verifying actions performed in the environment. In this article, however, we will focus on the “during” step, and explain in more depth the actions performed during privileged access.

Download eBook (PDF)

These actions are primarily related to what the user performs while performing privileged access, after provisioning and granting access to the user. A PAM solution in this case allows administrators to define which users (or group of users) will be allowed to access a credential to perform access to a device, system or application. During this access, it must be possible to record all activities carried out through privileged credentials. This means that administrators must be able to see what actions are being performed on the systems and devices managed by the PAM solution, in addition to video recording and logging all remote sessions performed on these devices. This ensures that all actions taken can be tracked and audited later, thus allowing you to detect the causes of a cyber incident, or meet audit requirements.

In this case, the PAM solution must also be able to detect, respond and send alerts about any suspicious activity carried out through privileged credentials, based on their usage profiles. In this way it is possible for the security team to discover and prevent an ongoing cyber attack.

In addition to privileged credentials, a PAM solution also allows for the management and protection of SSH keys, digital certificates and secrets in DevOps environments, enabling the implementation of DevSecOps. According to Gartner, by 2021, DevSecOps practices (i.e., the adoption of Security practices in Development and Operations processes) will be adopted by 60% of agile development teams, against 20% in 2019.

We have seen that the implementation of proper Privileged Access Management is impossible without specialized PAM tools. The tool chosen by the organization must consider all aspects of the privileged access lifecycle: from provisioning access to verifying all actions performed in the environment. In this way, it is possible for Information Security teams to adequately protect the “keys to the kingdom” against the actions of malicious agents, including internal threats. In times of data protection legislation such as GDPR, LGPD and CCPA, ensuring compliance with these regulations is more than reducing cyber risks, it is ensuring business continuity.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Industroyer：一種摧毀供電系統的網路武器

國際資安大廠ESET於5年前(2017) 6月12日發現一個惡意程式Industroyer，其鎖定公共基礎建設而來，這也是第一個專門針對供電系統所開發的已知惡意軟體，而它在被發現的幾個月前就已經襲擊烏克蘭變電所並導致基輔部份地區的數千戶家庭在2016年12月17日斷電約一個小時。

Industroyer對基礎建設威脅很大，因為它能直接控制電廠的配電變電所開關及輸電網路的斷路器，研究人員分析，Industroyer可以輕易關閉供電、引發系統失靈或其他更嚴重危害；另外Industroyer使用的是全球電廠、運輸控制系統及自來水、瓦斯等其他基礎設施使用的工業通訊協定，影響範圍甚廣。

時間來到2022年，Industroyer捲土重來，4月12日ESET研究人員與烏克蘭電腦緊急應變小組（CERT-UA）一起宣布，他們發現了針對烏克蘭一家能源供應商的Industroyer新變種。Industroyer2原定於4月8日對烏克蘭的一個地區進行斷電，所幸最後成功阻止了針對該國電廠所展開的攻擊行動。

近年來，影響烏克蘭及世界其他地區關鍵基礎設施的一連串事件，已使許多公眾意識到網路攻擊所引起的停電、供水中斷、燃料分配中斷、醫療數據遺失等的風險以及許多其他後果，這些不僅會干擾一般日常生活，它們還可能危及生命，基礎建設威脅警鐘已然響起，是值得深思的重要議題，相關單位及負責人員應即早完善安全措施，防患於未然。


原文出處：www.welivesecurity.com/2022/06/13/industroyer-cyber-weapon-brought-down-power-grid/

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於ESET
ESET成立於1992年，是一家面向企業與個人用戶的全球性的電腦安全軟件提供商，其獲獎產品 — NOD32防病毒軟件系統，能夠針對各種已知或未知病毒、間諜軟件 （spyware）、rootkits和其他惡意軟件為電腦系統提供實時保護。ESET NOD32佔用 系統資源最少，偵測速度最快，可以提供最有效的保護，並且比其他任何防病毒產品獲得了更多的Virus Bulletin 100獎項。ESET連續五年被評為“德勤高科技快速成長500 強”（Deloitte’s Technology Fast 500）公司，擁有廣泛的合作夥伴網絡，包括佳能、戴爾、微軟等國際知名公司，在布拉迪斯拉發（斯洛伐克）、布裏斯托爾（英國 ）、布宜諾斯艾利斯（阿根廷）、布拉格（捷克）、聖地亞哥（美國）等地均設有辦事處，代理機構覆蓋全球超過100個國家。

Fast and Simple eDiscovery with Backup and Recovery

What is eDiscovery?

Electronic discovery (sometimes known as eDiscovery, e-discovery) is one of those terms that means slightly different things in different contexts. 

For example, in legal spheres, eDiscovery involves identifying, preserving, collecting, processing, reviewing, and analyzing electronically stored information (ESI). The term also shows up in digital forensics, which focuses on identifying, preserving, collecting, analyzing, and reporting on digital information—clearly very similar, but not quite equivalent. 

In general, eDiscovery is the electronic aspect of identifying, collecting, and producing electronically stored information, such as emails, documents, databases, audio, and video files, and also includes metadata such as time-date stamps, file properties, and author and recipient information. In other words—regardless of the specific driving need—eDiscovery refers to finding and retrieving electronically stored ‘stuff’. 

Sounds easy enough, right? But as anyone who’s performed eDiscovery knows, today’s information-enabled organizations produce an awful lot of that stuff. In fact, the tendency for every single action we take to produce a digital trail led public-interest technologist Bruce Schneier to observe that “data is the exhaust of the information age” [Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World, pg. 4].

Consequently, the sheer volume of electronically stored information makes eDiscovery a logistical challenge. Now, add in the time-specific nature of many requests—as in, needing to retrieve a file or record as it existed at a certain time on a certain date, a certain number of years ago—and the challenge becomes even greater. 

Beyond backup: enabling quick and simple eDiscovery

While the retention utilities included with software-as-a-service (SaaS) applications and cloud services may be adequate for retrieving something that’s a few weeks old, they certainly aren’t intended to provide—nor are they capable of providing—a substitute for long-term backup and the use cases it enables, including disaster recovery and eDiscovery.

To be resilient in the face of outages, compromises, and misconfigurations (or simply to find a crucial piece of information), your organization needs to be able to search and access SaaS and cloud data quickly and easily. Imagine the difference between a recovery mission aided by coordinates and a map versus a vague notion that someone is somewhere. 

Fortunately, with the right backup solution in place, eDiscovery really can be a breeze. Let’s look at a real-world example. 

ALPLA’s experience

With around 22,000 employees across 45 countries, ALPLA is one of the world’s leading manufacturers of high-quality plastic packaging.

The company’s rapid global expansion and cloud migration required an agile Microsoft 365 backup and recovery solution that could meet ALPLA’s need for 10-year data retention, and Keepit is proud to fulfill this need.

With other solutions, finding the right data to restore can be a tedious task, especially when very little information is provided by users—but Keepit’s unique and intelligent search features make it easy. In the words of Stefan Toefferl, Senior Data Center Engineer at ALPLA: “Keepit provides search filters that make eDiscovery simple, allowing us to quickly find and restore an exact file.”

One of the features most valued by ALPLA is the option to share a secure link to download a file, quickly getting the data back to the users. It’s features like this Public Links (40-second demo video) that makes Keepit more than just an ordinary backup and that helps our customers to become more efficient in their daily IT operations. Read more about the ALPLA customer case here.

Risk management in the digital age

The nature of backup and restoration is that you often don’t know when something might be needed: unexpected audits, legal discovery, cybersecurity incidents, or even an employee needing to recover something that they deleted years ago—these can all happen at any time.

That’s why truly managing risk requires a third-party backup solution that: 

  • Protects users and groups by providing snapshot-based restoration and timeline-based comparative analysis 
  • Preserves roles and permissions, with change tracking and straightforward comparisons 
  • Enables compliance and eDiscovery, for instance by capturing audit and sign-in logs, supporting log analysis, ensuring long-term retention, and enabling restoration to another site 
  • Accommodates growth into policies and devices by preserving device information and conditional access policies 

To help enterprises avoid disruption due to lost or inaccessible SaaS data, Keepit has architected a dedicated, vendor-neutral SaaS data backup solution that is resilient, secure, and easy to use.

You can see Keepit in action on our YouTube channel, or head to our services page to learn more about what we offer.  

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

The Cybersecurity Skills Gap Is Widening: The Reasons Why May Surprise You

We live in a world where cybercriminals can penetrate an alarming 93% of company networks. In fact, this trend looks set to continue as we move further into 2022 and beyond. 

Simply put, the cyber threat landscape is becoming increasingly dangerous for organizations and individuals today. For example, cybercriminals are becoming more sophisticated in their methods, shadow IT is widening the corporate attack surface, and network administration errors and misconfigurations are common. At the same time, Crime-as-a-Service (CaaS), where experienced cybercriminals sell access to tools and knowledge needed to execute an attack, is skyrocketing in popularity. The result? More hackers and more successful cyber-attacks. 

We need to strengthen our cybersecurity arsenal if we want to turn this situation around and effectively safeguard corporate systems. And that starts with people – the cybersecurity professionals who find unique solutions to keeping bad actors out. But unfortunately, the widening cybersecurity skills gap is making this extremely difficult. With this in mind, let’s look at the current state of the cybersecurity skills gap and what’s driving it. 

The Current State of the Cybersecurity Skills Gap

According to Fortinet’s 2022 Cybersecurity Skills Gap Report, the cybersecurity skills gap contributed to a whopping 80% of data breaches last year. And these breaches had dire consequences, with 64% of organizations saying they lost revenue or faced fines and 38% reporting that breaches cost them more than a million dollars. 

Companies need skilled cybersecurity professionals now more than ever, but finding and keeping this talent is becoming increasingly difficult. For example, the same report found that 60% of organizations struggle to recruit cybersecurity talent and 52% struggle to retain qualified people, despite 76% of organizations indicating their board of directors now recommends increasing cybersecurity headcount. 

In simple words, organizations urgently need to close the cybersecurity skills gap to tighten their network security and keep pace with nefarious actors, but the gap continues to widen. For example, according to another report, the global cybersecurity workforce will need to grow by 65% to defend organizations’ critical assets effectively. 

At the same time, we continue to make immense strides in technological innovation across industries. Technologies that once seemed like science fiction, such as artificial intelligence (AI), machine learning, and Internet of Things (IoT) devices, are now becoming commonplace. But while these technologies undoubtedly add enormous value, we’re not hiring and training the talent to ensure their security.

Perhaps the most puzzling aspect of this situation is why precisely the cybersecurity industry is struggling to attract and retain talent. On paper, cybersecurity appears to be an attractive job prospect for fledgling tech enthusiasts or even IT workers who might want to transition roles into areas like network engineering, cyber intelligence, or security analysis. 

The appeal for people entering the field should be strong job security, a wide variety of opportunities, the ability to make a real impact, and decent pay (the average salary for a cybersecurity engineer in the US is $101,5481). And IT workers looking to transition into the role get much the same benefits but with a lower barrier to entry. For example, a coder is unlikely to struggle to wrap their heads around firewall types, network access control, and authentication security protocols like 802.1X. 

And yet people aren’t jumping at the chance to work in cybersecurity. Moreover, nearly one-third of the cybersecurity workforce plans to leave the field in the near future. But why? 

Factors Driving the Cybersecurity Skills Gap

Various factors are at play in why the cybersecurity industry faces talent shortages and a widening skills gap. So, let’s get into them. 

An Increasingly Demanding Skill Set and Entry Requirements

Due to the severity of today’s cyber threat landscape, cybersecurity professionals need a massive range of skills, and the list is growing yearly. Organizations increasingly want workers to have strong computer science, network engineering, and other technical skills in addition to computer forensics skills, problem-solving skills, and more. 

And more often than not, one of the key prerequisites to enter the field is a formal degree and an advanced professional certification like CISSP (Certified Information Systems Security Professional).

But despite these requirements, getting cybersecurity skills while still in education is often challenging. For example, only 43% of the US’s top 50 computer science programs include security courses for undergraduates. In other words, we might be failing to attract budding IT professionals into cybersecurity before they choose their career paths. And when this next generation of IT workers opts for a different discipline, they find themselves without the needed certifications to transition into cybersecurity. 

Cybersecurity is Too Stressful

Sadly, stress is an industry epidemic in cybersecurity. Defending against advanced threats daily or even hourly can take a toll on mental health, which is reflected in the statistics. For example, according to Deep Instinct’s Voice of SecOps Report, 45% of C-suite and senior cybersecurity professionals have considered quitting the industry due to stress. And another study from the UK found that 42% of security leaders say they would be unlikely to recommend a job in cybersecurity due to the stress of the job.

A Thankless Job

Cybersecurity teams typically attract the most attention when something goes wrong (a successful breach). But, when they successfully defend the network, there’s silence. As a result, morale is often low in cybersecurity teams. If you’re going to be stressed, you should at least have your successes championed, right? Unfortunately, too many companies are failing to do this right now. 

Attitudes Toward Cybersecurity

Most companies recognize that network security and cybersecurity are essential in the modern world, but that doesn’t mean they have positive feelings toward them. Many high-ranking employees believe that cybersecurity stifles innovation or that cybersecurity teams are too heavy-handed regarding network access control. They don’t see all the attacks that cybersecurity teams prevent, so they assume the team is needlessly restricting their access to files and apps to exert power. 

Choosing a career in cybersecurity can seem unappealing if you’re anticipating being undervalued by your employer. 

Where Do We Go From Here?

Unfortunately, it’s never been easier to become a black hat hacker. Advanced hacking tools are easy to come by, and knowledge sharing for things like phishing attacks, whaling attacks, and corporate account takeovers is rife. But the barrier to entry for the other side – the good guys who want to protect corporate networks is far higher. So companies that want to strengthen their network security need to take steps to overcome the cybersecurity skills gap and deploy advanced tools to help bridge the gap. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

SAVIA enables its customers’ secure digital transformation with Awingu

Savia (Soluciones Avanzadas en Informática Aplicada) is a Spanish specialist provider of payroll and personnel management solutions for the public administration. More than 500 public organizations digitize and automate human resources administrative processes with their technology, gaining in efficiency and focusing on boosting talent and public performance. Their projects go beyond the technological aspect and put people at the center by accompanying them in the process of change to achieve the digital and cultural transformation of organizations.

Currently, Savia uses Awingu to facilitate their clients’ access to their cloud platform. They achieve this with a simpler, faster login and all framed in a single point accessible through a browser. In the past, they used RemoteApp or a remote desktop connection, which fell far short of Awingu, as Javier Prieto, Head of Marketing at Savia, explains. The key role played by our technology partner Claranet, working together with the Spanish distributor MCR, helped them to identify how Awingu could support them.

Digital transformation in public services
Public services have been digitizing at a rapid speed.
With Awingu, fast also means secure and scalable.

The digitization of public administration

One of the biggest problems for personnel departments is the excess of low-value tasks and the need for strategic focus. Technology and specialized services digitize all these administrative processes in their department, resulting in a change that is transferred to the entire organization.

The public sector has been accelerating its digitization exponentially, and employees play an essential role in that transition. HR teams are a driving force behind cultural and digital transformations and must be the first to internalize those changes and the new ways of working.

Therefore, Savia’s technological accompaniment, advice and support, in combination with Awingu, is contributing to the efficiency, digitization and improvement of the Public Administration, ultimately impacting on public service.

In search of a secure and easy solution

To facilitate this, Savia was looking for another solution to provide access to their users. This solution had to meet several requirements related to security, simplicity, and scalability:

  • Bringing greater security to their cloud services: isolating their solutions with an additional layer of security between the applications and the user.
  • Provide a less vulnerable form of access: Such as a remote desktop, which is more susceptible to certain threats.
  • Accessibility for your users: Allowing your solutions to be accessible regardless of architecture, OS, or device.
  • Scalability: Being able to scale resources based on demand.

They looked for a browser-based HTML5 solution and found Awingu among different alternatives. After testing, SAVIA quickly confirmed that Awingu matched its aforementioned needs:

“We saw that Awingu offered intuitive, fast and secure access. We chose it because it covered everything we needed. Awingu was the only solution that offered file management within a web environment in a very intuitive way”.

Javier Prieto
CMO, Savia

Today, Awingu is in a production environment providing access to solutions for more than 200 customers. They have received good feedback from their customers about the look & feel and the user experience. According to them, they have not only gained in accessibility and user experience, but also in speed and elimination of steps to access the solutions. In addition, they have found the scalability and redundancy possibilities useful without any problems for their users.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Parallels 
Parallels® is a global leader in cross-platform solutions, enabling businesses and individuals to access and use the applications and files they need on any device or operating system. Parallels helps customers leverage the best technology available, whether it’s Windows, Linux, macOS, iOS, Android or the cloud.

Need help? Our team is just a message away