2024 彙整 - Page 129 of 182

Enhancing your network security: the role of access control lists (ACLs)

Does your business rely on access control lists (ACLs) to manage user access? If not, you’re not alone. Many organizations shy away from using them due to the challenges of maintaining numerous lists across different network areas. However, an access control list can provide an extra layer of security for your network in specific scenarios and can be effectively integrated with role-based groups when needed.

This article will explore how an access control list can streamline your access management processes. We’ll also dive into the benefits of ACLs, including improved security measures and their adaptivity to various environments. Finally, we’ll offer practical insights into how access control lists are used to manage access and protect sensitive information.

Read on if you want to untangle the complexities of ACLs and enhance your network’s security.

What is an access control list (ACL)?

An access control list (ACL), sometimes called just an access list, filters network traffic based on source and destination. It’s a set of rules that determines which users can access particular network objects or devices. Users not included on the list are denied access to these resources.

Moreover, an access list can enhance role-based access control (RBAC). For example, they can be configured to allow only members of a development team to access a specific codebase while blocking access to all other users with DevOps roles who aren’t involved in the project.

Additionally, implementing network access control best practices involves using ACLs to manage user access and enhance security across the network.

What are ACLs used for?

An access control list (ACL) is a vital tool for managing permissions in computer systems and networks. It is mainly used for essential network security tasks, like controlling user access, protecting data, and preventing intrusions.

ACLs are also key for meeting cybersecurity standards and certifications, such as those related to network access control and network segmentation. Implementing ACLs is often a necessary step on the path to compliance, ensuring an organization fulfills required regulations.

ACLs help regulate the flow of data in and out of network components that users directly access, such as gateways and endpoints. For instance, a network administrator might have the permissions to read, write, and edit sensitive files, while a guest user may only view these files. An access control list ensures such selective control access based on specific criteria like IP addresses, protocols, or ports. This enhances network security by allowing precise control of who can access what.

Additionally, ACLs can be set up on various network devices, including routers, switches, VPNs, or databases. This provides a clear and effective way to manage access, improving traffic flow for better efficiency and security. By blocking malicious traffic and giving IT admins granular control, ACLs play a key role in keeping network systems safe and running smoothly.

How ACLs work

Access control lists manage access and monitor traffic within networks and systems, ensuring that only authorized interactions are permitted. Primarily installed in routers and switches, ACLs play a critical role in traffic control by guiding the flow of data throughout the network.

Each ACL contains access control entries (ACEs), which list user or group names along with their granted access rights. These rights are organized in a string of bits known as an access mask. Whether used for packet filtering or file access, ACLs provide a structured, rule-based security approach that helps administrators maintain control over network and system resources.

Rule creation and ordering

ACLs function by using predefined rules to allow or deny packets, with the order of these rules being critical in determining how traffic is managed. The process starts with rule creation and ordering, where admins set up ACL rules in a specific sequence that prioritizes certain traffic over others based on security policies.

Packet evaluation

This is another key function of ACLs, where the data within each packet is checked against the ACL rules to decide if it should be allowed through or blocked. This evaluation is based on criteria like IP addresses, port numbers, and packet content, aligning with established security measures.

Default actions

For file systems, ACLs detail specific user access privileges to system objects such as files and directories, dictating actions like reading, writing, or executing based on the user’s role (e.g., administrator or guest).

This granularity extends to default actions, where ACLs enforce predetermined responses when a packet or access request does not meet any of the specified rules. Typically, this results in a denial of access to protect the network’s integrity.

An access control list: various types

Access control lists come in various types, each serving a unique purpose based on functionality and scope.. There are two basic ones:

File system ACLs manage access to files and directories within an operating system. They dictate user access permissions and privileges once the system is accessed.
Networking ACLs regulate network access by providing instructions to network switches and routers. They specify the types of traffic allowed to interface with the network and define user permissions within the network. Networking ACLs function similarly to firewalls in controlling network traffic.

Additionally, ACLs can be categorized according to their traffic filtering capabilities:

A standard ACL does not differentiate between IP traffic. Instead, it allows or blocks traffic based on the source IP address.
An extended ACL offers a more granular level of control. It uses both the source and the destination IP addresses, such as a source IP address, destination IP addresses, port numbers, and protocol types (ICMP, TCP, IP, UDP). It can differentiate IP traffic to dictate what is allowed or denied access.

The advantages of using an access control list

An access control list isn’t a one-size-fits-all solution for network security. However, using roles for access management offers several benefits:

Enhanced security. Users access only resources aligned with their roles, minimizing the risk of credential theft or phishing attacks. ACL implements separation of duties, reducing the threat posed by privileged users.
Improved efficiency. ACLs streamline access control maintenance. Admins can assign new hires to role groups, granting them associated permissions without creating individual profiles.
Optimized network performance. With ACLs, admins can define criteria such as source and destination IP addresses, ports, and protocols to regulate traffic flow. By restricting access to certain resources based on these criteria, ACLs help prevent unnecessary network congestion and improve overall network performance.
Scalability & flexibility. ACLs allow for flexible role adjustments as organizations evolve. Changes can be applied globally, reducing the chance of security vulnerabilities.
Compliance & auditing. ACLs help meet regulatory requirements like HIPAA. Healthcare entities, for example, can limit access to patient records through role-based restrictions. Additionally, ACLs simplify auditing access, making it easier to track access requests and user activity.

Enhancing device security with ACLs

While ACLs offer significant advantages in network security, it’s essential to extend this protection to device-level security. By adopting Device Posture Security (DPS), your organization can evaluate the security of devices connecting to the network.

Through DPS, you can evaluate and monitor devices according to your predefined rules. But that’s not all. You can also automatically restrict network access for accounts using non-compliant devices. This integrated approach enhances overall network security by addressing vulnerabilities at both the network and device levels.

IT administrators can easily implement ACLs for Device Posture Security using our web-based Control Panel. To enable DPS checks, create various rules such as existing file check, OS version, jailbreaking or rooting status, and device location. Setting up ACLs in the panel is simple. Just create a profile and specify the desired rules. Once configured, it’s important to test the ACL to ensure that it is functioning as expected. Finally, activate the ACL to start enforcing the specified access control rules on your network.

ACLs for internal network segmentation

Protecting your data from leaks and insider threats is more crucial now than ever. It’s not just about safeguarding information; it’s about maintaining the credibility of your business. That’s where access control lists (ACLs) come in. They act as gatekeepers, deciding who gets access to what within your network. By setting up ACLs, you can stop unauthorized users from moving laterally through your network, helping to prevent data breaches.

Additionally, when you combine ACLs with role-based access control (RBAC), you gain even more control over who can access different parts of your network. With our Cloud Firewall feature, you can optimize your network by implementing granular segmentation using ACLs. These lists act as virtual bouncers, controlling who can access which parts of your network.

Our intuitive Control Panel facilitates the creation and management of ACLs, providing a streamlined and centralized approach to network security management.

ACLs in external access control

Managing network access isn’t just about your team. You also have to consider third-party vendors, contractors, and other external partners who might need access to your systems. With access control lists, you can ensure that these third parties only have access to the specific resources they need, minimizing the risk of unauthorized access and potential security breaches.

By setting up granular segmentation and ACL rules, you can protect your network against potential threats while enabling collaboration with external partners. Our Cloud Firewall feature makes managing external access easy, ensuring your network is protected from all angles.

Boost your network security with NordLayer’s ACLs

Access control lists (ACLs) make role-based access control more precise, ensuring only the right people have access to your data and resources, and improving network performance. They’re the frontline defense against unauthorized access and potential breaches.

But the benefits of ACLs don’t stop there. By combining ACLs with our Cloud Firewall feature, you’re not just building walls—you’re creating an impenetrable fortress around your devices and network. With NordLayer, setting up and managing ACLs is a breeze, giving you peace of mind knowing your network is fortified against any threats that come its way.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

CRN Recognizes Scale Computing’s Marlena Fernandez, Rachael Galey on the 2024 Women of the Channel List

INDIANAPOLIS – May 13, 2024 — Scale Computing, a market leader in edge computing, virtualization, and hyperconverged solutions, today announced that CRN®, a brand of The Channel Company, has named Marlena Fernandez, vice president, marketing, to the 2024 Women of the Channel Power 100, an elite subset of prominent leaders selected from the CRN® 2024 Women of the Channel list. CRN also named Rachael Galey, regional channel manager, to its coveted Women of the Channel list.

Every year, CRN highlights women from vendor, distributor, and solution provider organizations whose vision and leadership have a beneficial influence on the technology industry. The CRN 2024 Women of the Channel honorees are creative, strategic leaders who show ongoing commitment to using their skills to innovate and drive success for their partners and customers.

From within this impressive group, the annual Power 100 recognizes some of the most influential women leaders from technology vendors and distributors who consistently contribute their advocacy and expertise to advancing the channel. Every woman on the Power 100 is an inspiration to industry peers and shows deep dedication to improving outcomes and opportunities for their own organizations and the full IT channel ecosystem.

Fernandez has been named to the Women of the Channel list for five consecutive years and to the Women of the Channel Power 100 for the past three years for her leadership within the Scale Computing Partner Community. She joined Scale Computing in 2019 and was the first executive to be named to both lists. This past year, Fernandez significantly contributed to Scale Computing achieving record revenue growth and expanding the company’s partner community. She was instrumental in the success of last month’s Platform//2024, Scale Computing’s annual partner and customer event.

“We are tremendously proud of what Marlena and Rachael have accomplished this past year, not just for Scale Computing, but for the overall channel partner ecosystem. Marlena is a pivotal member of our executive team, bringing expertise from her 20+ years of results-oriented global marketing, and Rachael is extremely dedicated to partner success, making Scale Computing the consistent choice for channel partners,” said Dave Hallmen, chief revenue officer, Scale Computing. “They’re continued commitment to growing our business through our award-winning Scale Computing Partner Community and strong leadership make both very deserving of this recognition. As more and more partners seek VMware alternative solutions, we look forward to growing our partner program through the rest of 2024 and beyond.”

Galey joined Scale Computing in 2023 as a regional channel manager and focuses on Scale Computing solution sales and account management. She has played a crucial role in expanding the Scale Computing partner community, as the increased demand for new virtualization and edge computing solutions drove the company’s record growth this year. Passionate about mentorship, collaboration, and customer satisfaction, Galey’s drive to develop and support colleagues while exceeding client expectations has made her an asset to both Scale Computing and its partners.

“It is a great privilege to honor the remarkable achievements of these women leaders in the IT channel,” said Jennifer Follett, VP, U.S. Content and Executive Editor, CRN at The Channel Company. “Each woman on the list has demonstrated a deep commitment to innovation and leadership that advances their organizations and drives transformation and success across the IT channel.”

Earlier this year, Scale Computing launched an exclusive promotion for VMware partners looking for new virtualization solutions. Current and new partners looking to switch customers to Scale Computing can participate in the VMware Rip & Replace promotion and receive a 25% discount on Scale Computing software and services for each new customer implementation. Additionally, Scale Computing launched Scale Computing Showcase, offering partners and their customers open access to trial the Scale Computing Platform solutions suite.

The 2024 Women of the Channel list will be featured in the June issue of CRN Magazine, with online coverage starting May 13 at CRN.com/WOTC.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Scale Computing
Scale Computing is a leader in edge computing, virtualization, and hyperconverged solutions. Scale Computing HC3 software eliminates the need for traditional virtualization software, disaster recovery software, servers, and shared storage, replacing these with a fully integrated, highly available system for running applications. Using patented HyperCore™ technology, the HC3 self-healing platform automatically identifies, mitigates, and corrects infrastructure problems in real-time, enabling applications to achieve maximum uptime. When ease-of-use, high availability, and TCO matter, Scale Computing HC3 is the ideal infrastructure platform. Read what our customers have to say on Gartner Peer Insights, Spiceworks, TechValidate and TrustRadius.

Scale Computing Scale Computing News 2024

DNS Threats: Vulnerabilities, Attacks, and Prevention Strategies

The Domain Name System (DNS) is crucial for internet functionality, acting as an address book that maps web addresses to their numerical IP addresses. However, DNS is also a vector for various cyber threats due to its foundational role in network communications. Malware, ransomware, phishing, and more sophisticated forms of cyberattacks like Domain Generation Algorithms (DGA) and DNS tunneling exploit DNS to infiltrate and damage systems.

142.250.189.206 – google.com

DNS security is an underrated risk. The technology is structured in a way that allows DNS packets to flow through the network without prior scrutiny. Moreover, DNS activity within networks is rarely monitored, creating a blind spot in cybersecurity. This oversight is significant, as 88% of companies suffer from DNS attacks every year, according to a 2023 report by EfficientIP. Despite the high risk, one-third of these attacks could be prevented at the DNS level, as highlighted by a 2023 study by Cisco.

What is inside DNS traffic

DNS traffic can carry a variety of parameters that play an important role in the exchange of information between clients and DNS servers. These parameters may include the type of request, the server’s response code, TTL (time to live of the record in the cache), transaction identifier, query options, etc. DNS queries are essential components of DNS traffic, involving requests made by clients to DNS servers to resolve domain names into IP addresses.

Moreover, DNS traffic can carry data about the IP addresses of DNS servers, information about network traffic, the location and configuration of domains, as well as much more that helps ensure the efficient operation of the Internet and its security. The DNS resolver plays a crucial role in processing these DNS queries, facilitating the exchange of information between clients and DNS servers. Here is a list of the main parameters:

Threats at the DNS level

Malware

Malicious software, or malware, includes various cyber threats such as viruses, trojans, spyware, adware, and techniques like DNS cache poisoning, where malware redirects users to malicious sites by exploiting DNS vulnerabilities. It can cause significant issues, from minor annoyances to major financial losses, by altering browser settings, using up computing resources, and collecting sensitive user data like passwords and credit card numbers.

DNS protection is crucial in combating malware by:

Blocking access to malicious domains to prevent malware communication and data breaches.
Monitoring for abnormal behavior to detect malware presence.
Providing network activity logs to enhance incident response and mitigate security breaches quickly.

Ransomware

Ransomware is malicious software that encrypts a computer’s files, rendering them inaccessible, and may lead to data breaches. The malware demands ransom for decryption, impacting both individuals and business operations.

DNS protection aids against ransomware by:

Blocking access to ransomware’s command and control servers to disrupt its communication.
Preventing devices from connecting to malicious websites and email attachments that could initiate an attack.
Enabling rapid, automated threat detection and alerts, facilitating a swift response to potential ransomware activity.

Phishing and Typosquatting

Phishing and Typosquatting are forms of cyber deception aimed at stealing sensitive information through fake websites and misspelled domain names. DNS spoofing is another method where attackers manipulate DNS records to redirect users to fraudulent sites, often for malicious purposes such as phishing, malware distribution, or denial-of-service attacks. These practices can compromise personal and corporate security, leading to financial losses and reputational damage.

DNS protection helps combat these threats by:

Preventing access to fake websites designed to mimic legitimate ones, safeguarding user credentials.
Utilizing algorithms to identify and block deceitful domains that resemble legitimate sites, protecting users from fraud.

Botnet, Cryptojacking, and C2C

Botnets, composed of internet-connected devices infected with malware, can perform various malicious activities, including DDoS attacks, data theft, and illegal cryptocurrency mining, leading to energy and productivity loss and potential financial and reputational damages. Botnets and C&C servers often utilize DNS requests to communicate and control compromised devices, highlighting the need for robust DNS protection strategies.

DNS protection helps by:

Blocking access to known command and control (C&C) servers to disrupt botnet communications.
Detecting and preventing connections to suspicious domains associated with botnets or C&C servers.
Identifying unusual patterns that may indicate botnet presence to prevent system infections.

Parked Domains

These are domain registrations on DNS servers offering parking services, not actively used but may host illegitimate content at a remote server at any time. SafeDNS implements a verification pipeline using real-time data from various sources to monitor new domains and their content, identifying and filtering out illegitimate resources at an early stage. The system establishes domain-IP-autonomous system (AS) relationships, which helps in the early detection of malicious domains.

DGA and DNS Tunneling Attacks

DGAs create numerous domain lists to maintain botnet communication and evade security measures. They don’t directly harm networks but enable the infiltration of malicious software and impede its removal, potentially resulting in corporate network damage.

DNS protection contributes by:

Detecting and blocking DGA-generated domains using machine learning and traffic analysis, ensuring queries are directed to the correct IP address by verifying information with the authoritative DNS server.
Monitoring and obstructing abnormal DNS activity that could signify DNS tunneling.
Maintaining a database of known DNS tunnels to block unauthorized connections and data transmission.

An authoritative DNS server plays a crucial role in this process by holding the official and up-to-date information about a domain name’s IP address, ensuring that DNS queries are resolved with the correct IP address, which is essential for preventing DNS tunneling and DGA threats.

Threats at the DNS level are a major concern because they can disrupt operations, compromise sensitive data, and damage reputations. However, with the right solutions in place, many of these threats are preventable. SafeDNS is at the forefront of this defense, leveraging the latest advances in AI and machine learning to effectively detect and mitigate threats.

By processing billions of queries every day, SafeDNS provides real-time monitoring and proactive measures to secure networks. The power of SafeDNS lies in its extensive categorization database of over 2 billion URL records, providing unparalleled protection. This comprehensive approach ensures that SafeDNS not only identifies existing threats, but also anticipates emerging ones, providing a robust shield against DNS-level threats. With SafeDNS, organizations can secure their online presence and ensure the continuity and integrity of their digital assets.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

safedns 2024

Preparing for UEFI bootkits. ESET discovery shows the importance of cyber intelligence

Roman Cuprik08 May 2024

Some threats bypass standard security tools. In such cases, security operators capable of deep analysis are needed.

Last year, ESET Research confirmed rumors concerning BlackLotus, the first publicly known UEFI bootkit capable of bypassing a UEFI Secure Boot, being sold on underground forums. This means that malware preying upon fundamental weaknesses in the UEFI security model is in-the-wild and experts are expecting more bootkits like BlackLotus in the near future.

“Bootkits are no longer just a threat to legacy systems, but a real threat to the majority of modern UEFI firmware systems,” said ESET Researcher Martin Smolár, who discovered this previously undocumented real-world UEFI bootkit and presented his finding at the 2024 RSA conference.

This threat creates a challenge for businesses: How to take a prevention-first approach and secure their devices against attacks that cannot be fully prevented simply by following the standard recommendations and using default system settings because there are known vulnerabilities that still haven’t been fixed and might never be fixed?

Despite businesses holding the short end of the stick right now, they are not without hope. In fact, these are the situations where cyber intelligence platforms such as ESET Threat Intelligence shine.

Confirmed myth

In a nutshell, UEFI bootkits are serious threats targeting Windows that gain full control over the operating system (OS) boot process. With this level of capability, they can disable various OS security mechanisms and are able to operate very stealthily and with high privileges.

The initial attack vector is unknown, but UEFI bootkit starts with the execution of an installer deploying the bootkit’s files to the EFI System Partition. This abbreviation stands for Extensible Firmware Interface System Partition, which stores files needed for booting operating systems.

Using this installer, attackers can disable the first two layers of defense: Hypervisor-protected Code Integrity (HVCI) and BitLocker encryption. Then they reboot the host.

After the first reboot, the malware abuses the known vulnerability CVE-2022-21894, allowing attackers to enroll their own Machine Owner Key (MOK). An MOK allows owners of devices running non-Windows OSes to generate keys that sign non-Microsoft components during the boot process, thus allowing only approved OS components and drivers to run. By abusing this boot security feature, attackers achieve persistence.

The computer now thinks that the system is booted using trusted software, which means that attackers have bypassed another layer of protection, UEFI Secure Boot, and the machine is then again rebooted.

In the next stages, the self-signed UEFI bootkit is executed and deploys the kernel driver, having access to the Kernel, a computer program at the core of a computer’s operating system, which generally has complete control over everything in the system. It also deploys a user-mode HTTP downloader responsible for communication with the C&C. The abused device can now receive and execute commands from C&C and download additional user-mode or kernel-mode payloads.

Businesses are not powerless

Looking at this cascade for the hijacking of a compromised computer, and knowing that there is no effective fix for older devices due to their outdated security mechanisms, one may feel as if their hands are tied.

But businesses can protect themselves and apply a prevention-first approach even in these cases.

First of all, businesses need to keep their system and security products up to date, decreasing options for attackers.
IT staff should learn possible risks and procedures concerning how to decrease them. Microsoft released a threat description and a guidance for investigating UEFI attacks.
If needed, set up a custom secure boot policy. This, however, requires an experienced admin and is manageable only with a handful of devices due to its complexity.
Deploy reliable monitoring solutions and configure their integrity-scanning tools to monitor the composition of the EFI boot partition.
Block any attempts of modifying all or specific files on EFI System partition by untrusted processes to prevent bootkits installation.
Track developments with UEFI malware across Threat Intelligence platforms and resources.

ESET solutions such as ESET Enterprise Inspector and ESET UEFI Scanner, which is part of the ESET Host-based Intrusion Prevention System (HIPS), can detect signs that something suspicious is happening with a device and alert IT admins. While ESET UEFI Scanner checks and enforces the security of the pre-boot environment, HIPS combines advanced behavioral analysis with the detection capabilities of network filtering to monitor running processes, files, and registry keys.

For more information, check the RSA presentation by ESET Researcher Martin Smolár, via the ESET research podcast, and the NSA BlackLotus Mitigation Guide.

Be one step ahead of threat actors

Since the discovery of the in-the-wild UEFI bootkit, Microsoft has released several patches, and experts across the world provided some guidance. But how to protect a business from the start, before all of this can happen?

To identify such new threats and customize their solutions to deal with them, global leaders in cybersecurity such as ESET invest a lot in research. ESET Threat Intelligence turns this effort into a service, providing businesses with curated global knowledge about threat actors’ activities, gathered by ESET analysts and experts.

Thanks to ESET Threat Intelligence, security engineers, analysts, or incident responders can learn about new threats ASAP, anticipating them and making better, faster decisions. This allows them to deploy a proactive defense, customize their security, and fight increasingly sophisticated cyberattacks.

Moreover, ESET APT Reports give businesses access to private, in-depth technical analysis together with threat mitigation tips. Every user with the APT Reports PREMIUM package will also have access to an ESET analyst for up to four hours each month. This provides the opportunity to discuss topics in greater detail and help resolve any outstanding issues.

Facing a challenge

UEFI Bootkits represent a challenge that is hard to tackle, however that is why it is so important for businesses and enterprises to have reliable cyber intelligence.

With a globally distributed network of security centers, ESET research labs never sleep and have immediate access to threat intelligence like no one else, thanks to the number and distribution of devices protected around the world. Combined with more than three decades of experience in cybersecurity research and product development, ESET can provide businesses with vital intel and use this knowledge to continuously innovate threat-defense techniques.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

2024 ESET

How ROCKEN fortified its growing network against cyber-attacks for better data protection

ROCKEN, based in Zurich, Switzerland, operates in the recruiting sector, offering a unique blend of consulting and recruiting services. Their office boasts a dynamic team of recruiters, consultants, and business account managers dedicated to bridging the gap between companies and candidates.

The company’s edge is its extensive database, housing detailed candidate profiles enriched with personal interviews, experiences, and expectations. This database, coupled with their custom CRM crafted by their dedicated outstaff development team, stands as their cornerstone, offering a nuanced understanding of each candidate’s profile.

The extensive database, containing candidates and employer information, is the apple of the eye that needs to be protected sufficiently. Julia Zaliznytska, Product Manager and a bridge between business and development, shares why using security services like NordLayer in ROCKEN’s line of work was critical.

The challenge

On a lookout for stronger protection measures

With business expansion plans and team growth, safeguarding ROCKEN’s expanding database became paramount as the company faced a dual challenge.

“We are working for the Swiss market at the moment, and we are extending to Germany this year, and we will have even more data that needs to be protected.”

Click to tweet

First, they had to protect vast amounts of sensitive data, including candidates’ personal information and client companies’ corporate data, against increasingly sophisticated cyber threats such as DDoS attacks.

“With DDoS attacks as a threat and users leaving loads of personal data on the platform, we wanted to provide better protection than just relying on passwords.”

Click to tweet

The team also has gated content on their website, including market overviews and research that is not for free and, thus, must be secured from unverified access.

Second, ROCKEN had to accommodate its hybrid work model with employees and developers working remotely across Switzerland, Germany, Ukraine, and Estonia. For a company with all infrastructure in the cloud, it’s essential to have secure remote access to the internal systems from any location.

Some employees are fully remote, while locals must visit the office three time a week. For this reason, the company needed a unified approach connecting to the company network that is robust against cyber threats.

The solution

Sustainable scalability and protection against threats

After the launch, the company was small and didn’t have much data to protect—securing IP addresses on their own CRM was sufficient initially.

As ROCKEN grew rapidly from 30 to 91 employees, they sought a reliable solution that scales together without compromising security. The solution had to seamlessly integrate for remote and office-based employees alike, ensuring data protection across all touchpoints.

Besides exponential growth, the main triggering factor for enhanced security was a reminder of constant online threats. An identified DDoS attack didn’t do any tangible damage to the company but sent a message that the risk is always there.

“Once, we have experienced a DDoS attack. Whether it was an attacker or rivals testing our protection levels, the attack didn’t result in a data breach but reminded us that we are hunted.”

Click to tweet

A more complex and robust solution than passwords and authentication apps was needed to protect the company network. After a thorough market comparison, ROCKEN chose NordLayer for its comprehensive corporate VPN solutions.

Why choose NordLayer

Several factors influenced ROCKEN’s decision to partner with NordLayer. Primarily, it was necessary to ensure more complex and layered security solutions in place. Then, it had to be ensured that all connections are encrypted and authenticated.

“The access is secured only for those who already have access inside our organization once on-site and through the VPN once remote. Developers use VPN to connect to the production and staging systems.”

Click to tweet

Notably, team members’ personal positive experiences with NordVPN influenced the decision. Moreover, the responsive and accommodating nature of NordLayer’s customer support and the platform’s cost-effectiveness, especially with the provided growth-supportive discount, have been significant factors in choosing the tool.

“We compared many services, but the majority lacked corporate solutions that are centralized in management and payments. NordLayer offered an all-in-one platform with bulk organization control and setup.”

Click to tweet

NordLayer’s reputation for reliability and its ability to offer a scalable, secure solution for a growing company like ROCKEN were decisive.

How NordLayer prevents threats and secures company network

The outcome

Easy implementation of a reliable tool

The implementation of NordLayer was smooth and swift, taking just a week to onboard the entire organization, thanks to the clear instructions and support provided.

Despite initial hiccups with corporate laptop setups, the transition to NordLayer was well-received across the organization.

“There were absolutely no issues with NordLayer. Because we have corporate laptops that a third-party organization manages, devices weren’t prepped in advance for all users; thus, whole organization onboarding took up to a week.”

Click to tweet

The VPN’s no-logs policy and the ability to manage teams and users through a simple portal were particularly appreciated, ensuring ROCKEN’s operations remained secure without sacrificing efficiency.

Pro cybersecurity tips

It’s a good idea to use post-it notes for everyday cybersecurity tips as a reminder, but not passwords. This and many other tips come from our case study heroes. This time, we asked Julia Zaliznytska, a Product Manager at ROCKEN, to share her favorite habits for practicing cybersecurity hygiene.

Rocken’s partnership with NordLayer underscores the critical importance of robust cybersecurity measures in today’s digital landscape, especially for companies dealing with sensitive data.

Through strategic planning, careful vendor selection, and a focus on scalability and security, ROCKEN has successfully fortified its defenses, ensuring the confidentiality and integrity of its data as it continues to grow and expand into new markets.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

NordPass 2024 Nord Security