Skip to content

Launching the first-ever NordVPN 360° marketing campaign in Germany

In August, we started our first-ever 360° marketing campaign in Germany for one of our cybersecurity solutions – NordVPN. The campaign was designed to raise personal cybersecurity awareness among the German population and involved all channels in spreading the key message that nothing is more important than the privacy of your personal data.

In this interview, we speak to Joanna Rusin-Rohrig, Germany country manager, and Ieva Račienė, brand manager – the two NordVPN insiders who made this campaign happen. Read their interviews and find out the full behind-the-scenes story of this 360° NordVPN branding campaign in Germany: from idea creation, planning, and development to the final results and lessons learned.

Blog image Joanna 2

Blog image Ieva 2

From campaign idea to execution

Could you briefly introduce the campaign you just launched?

Ieva: Yes, we call it the “Safely be you” campaign. It was a huge milestone for our organization because it was the first 360° branding campaign ever done at NordVPN when all channels were aligned and focused on one message:

Switch on privacy. Switch off trackers and viruses. Go Nord. Safely be you.

(Privatsphäre ein, Trackern und Viren aus. NordVPN. Ganz sicher du selbst.)

With this key message, we wanted to stress the importance of privacy and make a connection with the usage of our product. Unlike the general approach that focuses on risks and dangers by showing hoodie-wearing hackers in dark rooms trying to steal personal data, we concentrated on more modern and positive messaging emphasizing the emotional benefit of safety. NordVPN protects you and your daily actions online: private messages, social interactions, and transactions. Nothing can be more important than that.

This “Safely be you” campaign aimed to show that everyone’s digital life has the same or even more threats than their “real” lives.

Is it any different from the usual NordVPN campaigns? If yes, how?

Joanna: In fact, it was very different from the usual marketing activities, which are strictly driven by performance indicators. This was the first time NordVPN launched an awareness campaign and the first time we implemented one in Germany.

What did the development of the whole branding campaign look like? Could you give us a sense of the development and implementation stages?

Ieva: It took us eight months to get from idea approval to campaign launch. To tailor the campaign to the German market, we first started looking for external partners.

From day one, our media team, in cooperation with our long-term partner, The Specialist Works, started analyzing media opportunities and best practices in the country and working on an appropriate media plan to promote our creative approach. Meanwhile, our other partner – the team at Influence.vision – helped us find the best influencers. For designing our video ad, we chose a local creative agency, Jung Von Matt. Together, we developed a creative concept called “Safely be you.”

To sum up, not everything was done by our external partners – a large part of the visual design and creative copywriting was done in-house.

Joanna: To give you a feeling of how big the project was: we developed nine separate media plans, from out-of-home advertising to mobile influencer activation. It was a huge team effort to create and execute them on time. More than 100 people worked together internally and in external teams on the execution of the whole campaign.

And speaking of branding campaign promotion tools, what kind of marketing channels were used to launch this campaign? How did you select them?

Ieva: As it was a 360° campaign, it covered all possible marketing channels: TVC, radio, OOH, PR coverage, dedicated celebrity campaign, influencer integrations, social media, PPC, various mobile app ads with full digital scope, and more. We also leveraged high-reach and visibility placements, and our SEO team covered various content clusters.

Joanna: Our main KPI for the campaign is the improvement of the upper funnel metrics – awareness and consideration levels in the market. Therefore, we chose channels and platforms that index highly on reach and reliability in our target group for us to achieve maximum penetration in the market with the given budget.

How are you measuring the success of each marketing channel that was used?

Joanna: Apart from the overall awareness level increase, we defined separate KPIs, like a specific CPA for TV or a level of positive sentiment for influencer integrations. These are our pillars of measurement that allow us to establish whether or not we can regard a certain action as a success or failure.

Blog image Joanna 3

Cybersecurity awareness in Germany

Your main goal is to raise awareness about personal cybersecurity among the German population. How aware are they of the threats they face online, and are they ready to embrace new technology for their cyber protection?

Joanna: According to our research data, Germans spend almost 25 years of their lives online. However, only 21% of them can say they are well aware of the different ways to secure their devices. Even though secure Wi-Fi is relevant to 69% of Germans, only 23% use a VPN to keep their connection safe at all times. This means that although people would like to browse the internet securely and privately, the burden of achieving this goal seems too big. With the campaign, we want to inform our relevant audiences how easy it is to be safe online.

Blog image for the diagram 1

Source: nordvpn.com

With the company in full swing now, how would you rate the first results in trying to achieve your main goal and increase NordVPN product usage in Germany?

Joanna: We definitely see a big interest in the topic, and search queries both for the VPN category and NordVPN are increasing significantly. With it, we see increased traffic numbers for our German website and prolonged time spent on the pages. We are waiting for comprehensive post-campaign research results to analyze more in-depth what influence the campaign had on all customer journey stages.

For you as a country manager, what was the most challenging part of running this campaign, and why?

Joanna: My role in this big project was to consult all teams to help them to achieve the best-localized approach. Another important part was to create a link between our headquarters and agencies operating for us in Germany.

Most people working on this campaign do not speak German, so my local team supported them on all language, copy, and influencer content-related tasks. With literally thousands of various marketing campaign design pieces and copy, keeping tabs on everything was challenging, but we managed to spot all mistakes on time.

Tips for a successful branding campaign

What is the most important thing to consider when launching such branding campaigns? Do you have any advice?

Ieva:

  1. Form a team you can trust. This is the most crucial part of all projects. Whether it is your colleagues or external partners, I strongly suggest gathering a team you can trust 100%. And if the team consists of professional and dedicated people ready to go the extra mile, they’re destined to succeed.

  2. Know your users or the people you are talking to. Understanding their needs and how we can help to solve their problems is the key success factor to being relevant.

  3. Have the courage to do things that were never done before. In our case, having the first branding campaign focused on an emotional message might have been seen as a challenge at first, but we took the risk because the challenge might pay off massively.

Joanna:

  1. Have your KPIs and measurement methods established before you start planning, and make sure that all the team members are on the same page.

  2. Think of having regular check-ins with all the team members involved so no information gets lost on the way.

  3. When you are done with all the project planning, go ahead and add an extra month to it. 🙂 Life happens, and this buffer will allow you to find solutions for challenges that arise on the go.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

NORDTECH – OUR FIRST TECH MEETUP IN BERLIN

Last week, we launched our first-ever tech meetup in Berlin – NordTech, where we invited locals to meet our experts live and get some insights into PHP, cybersecurity, and software development practices at Nord Security. As we value innovation and shaping future tech, we’re always keen on sharing our ideas and findings with others. Learn more about what our experts and the Berlin tech community discussed during the event:

 
Blog image 2022 10 06

 

Tests are not useless!

With Pavlo Mikhailidi

Fuelled by a recent encounter with an anti-tester, our Senior PHP Developer, Pavlo, set out to prove that testing is a necessary practice for all developers—not just QA. He explained that good testing saves time and headaches and can even double as documentation. Increasingly complex codebase requires proper care, and modifying one part can break several others. In these cases, testing is your go-to remedy.

He went on to cover the attributes of good testing, shared below, and to debate the trade-offs between bad testing and no testing. Finally, Pavlo passed along some recommended resources for upping your testing game: Unit Testing Principles, Practices, and Patterns, Test-driven Development by Example, and The Art of Unit Testing.

Here are the attributes of a good test that he shared:

  • It protects against regression

  • It’s resistant to refactoring

  • You get fast feedback

  • The test is maintainable

Watch the full recording of Pavlo’s presentation here.

Scrum sucks

With Oleksii Ustenko

Our Senior Android Developer, Oleksii, explored how Scrum is often misunderstood and misused. All-in-all, he actually likes Scrum but understands why people might grumble about the rigidness of the structure. What’s important to remember is that Scrum should be people-centric at its core: humans working together to create value for other humans. And each ceremony exists to drive that goal forward. Like many things in life, Scrum works best when motivated individuals have the trust, support, and understanding they need to get the job done. And Scrum, understandably, goes wrong when management or bureaucratic processes steal ownership away from teams.

He concludes that Scrum is not the silver bullet some of us want it to be. If something isn’t working, each person involved is responsible for speaking up and proactively suggesting improvements—respectfully. Scrum worked well for the use it was invented for, but every team is different. Take the time to understand the context behind why certain ceremonies exist, learn from past mistakes, and find the process that fits your team best.

Watch the full recording of Oleksii’s presentation here.

Securing your API using Cryptography

With Dovydas Bespalovas

In this security deep-dive, Dovydas, our Guild Tech Lead, laid out the basics with different types of cryptography algorithms and functions: Hashing, Encryption, Digital signatures, Key derivation function, and Key exchange. He then explained the evolution of Secure Sockets Layer (SSL) to Transport Layer Security (TLS) and how it’s used and certified. Going one step further, Dovydas got into the differences between ‘Authorization’ and ‘Authentication’ and shared a step-by-step example of how both information security processes can be put into practice. After that, he concluded that such necessary security measures come with extra work and extra complexity.

Watch the full recording of Dovydas’ presentation here.

PHP meetup

 

Future tech events in Berlin

If you’re interested in learning more, join our future NordTech events live in Berlin or watch them online. Follow us on meetup.com to stay up to date with upcoming knowledge sharing, networking, and other future events at Nord Security.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

TAKING CONTROL OF TEST EXECUTION: CUSTOMIZING THE EXECUTOR

Test execution is the process of running tests to verify a specific functionality in a system. It’s a great way for us to find bugs in our applications, but over time we realized that we needed to improve the speed and efficiency of our test execution method. Here’s how we did it.

The story so far
After four years of automated test development, we now have a significant collection of tests we can run. These tests can be organized and executed on demand and provide us with valuable data about the current state of our system.

Most popular automated test development platforms offer us some level of control over test execution: parallel suites, for example, to reduce execution times. Some platforms even allow us to dynamically inject test cases during runtime, depending on the current system state.

But what if it’s not enough? What if we need even more control over execution? What if we want to use mixed-type pipelines and dynamically change test data or execution pool thread capabilities?

The problem
We execute tests from several different IPs because some of the functionality can be tested only while using a specific tunnel connection. This brings us to Cloudflare accessibility problems, request limit issues, and, occasionally, authentication errors.

Some more complex scenarios require the alteration of test data. This can only be done via microservice-based endpoints. Some of those endpoints are only accessible from an internal network. After a tunnel connection is established with an external server, a test execution bot can no longer reach the internal resources required for this test run.

Another problem is the number of requests being generated during test runs. For security purposes, all environments have strict request limits, but our test activity can easily reach those limits. Dynamic IPs prevent us from whitelisting IP addresses, and it becomes impossible to execute all test collections from one IP address.

The solution
After several solutions failed, we finally came up with a test strategy that involved modifying test data upfront.

If access cannot be gained from specific IP, we get access tokens before making the connection. If the alteration of test data via internal endpoints is needed, we execute this before the test run. We also bypassed request limits by switching IPs during the test run.

All of this would be impossible if we did not design a more sophisticated test executor.

The executor
We had to design a system that allowed full control of dynamic test execution. The project goal was to have control over the parallel and serial execution of tasks, bound with one executor.

First, data gathering and alteration happen via internal endpoints. A tunnel connection is established, and then parallel test execution takes place to minimize execution time.

Some test suites generate more requests than others, so we must be aware of how many requests are being made and how many suites are in parallel segments. At some point, the IP address has to change, and a new set of test suites are executed again in parallel. This pipeline continues until all tests have been executed.

The result
Thanks to this solution, we can take full control of the test execution pool and execution sequence. In practice, that means we are able to adapt to ever-changing security measures and still provide valuable test execution reports. Our tests allow us to identify bugs faster than ever, enhancing the security and efficiency of all our applications.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

UNDERSTANDING OBSERVABILITY VS. MONITORING. PART 1

The development of clouds, the DevOps movement, and distributed microservice-based architecture have come together to make observability vital for modern architecture. We’re going to dive into what observability is and how to approach the metrics we need to track. Observability is a way of spotting and troubleshooting the root causes of problems involving software systems whose internals we might not understand. It extends the concept of monitoring, applying it to complex systems with unpredictable and/or complex failure scenarios. I’ll start with some of the basic principles of observability that I’ve been helping to implement across a growing number of products and teams at Nord Security.

Monitoring vs. Observability

“Monitoring” and “observability” are often used interchangeably, but these concepts have a few fundamental differences.

Monitoring is the process of using telemetry data to understand the health and performance of your application. Monitoring telemetry data is preconfigured, implying that the user has detailed information on their system’s possible failure scenarios and wants to detect them as soon as they happen.

In the classical approach to monitoring, we define a set of metrics, collect them from our software system, and react to any changes in the values of these metrics that are of interest to us.

For example:

Excessive CPU usage can indicate that we need to scale it up to compensate for increasing system loads;

A drop in successfully served requests after a fresh release can indicate that the newly released version of the API is malfunctioning;

Health checks process binary metrics that represent whether the system is alive at all or not.

Observability extends this approach. Observability is the ability to understand the state of the system by performing continuous real time analysis of the data it outputs.

Instead of just collecting and watching predefined metrics, we continuously collect different output signals. The most common types of signals – the three pillars of observability – are:

  • Metrics: Numeric data aggregates representing software system performance;
  • Logs: Time-stamped messages gathered by the software system and its components while working;
  • Traces: Maps of the paths taken by requests as they move through the software system.

The development of complex distributed microservice architectures has led to complex failure scenarios that can be hard or even impossible to predict. Simple monitoring is not enough to catch them. Observability helps by improving our understanding of the internal state of the system.

Metrics

Choosing the right metrics to collect is key to establishing an observability layer for our software system. Here are a few different popular approaches that define a unified framework of must-have metrics in any software system.

USE

Originally described by Brendan Gregg, this approach focuses more on white-box monitoring – monitoring of the infrastructure itself. Here’s the framework:

  • Utilization – resource utilization.
    • % of CPU / RAM / Network I/O being utilized.
  • Saturation – how much remaining work hasn’t been processed yet.
    • CPU run queue length;
    • Storage wait queue length;
  • Errors – errors per second
    • CPU cache miss;
    • Storage system fail events;

Note: Defining “saturation” in this approach can be a tricky task and may not be possible in specific cases.

Four Golden signals

Originally described in the Google SRE Handbook, the Four Golden signals framework is defined as follows:

  • Latency – time to process requests;
  • Traffic – requests per second;
  • Errors – errors per second;
  • Saturation – resource utilization.

RED

Originally described by Tom Wilkie, this approach focuses on black-box monitoring – monitoring the microservices themselves. This simplified subset of the Four Golden Signals uses the following framework:

  • Rate – requests per second;
  • Errors – errors per second;
  • Duration – time to process requests.

Choosing and following one of these approaches allows you to unify your monitoring concept throughout the whole system and make it easier to understand what is happening. They complement one another, and your choice may depend on which part of a system we want to monitor. These approaches also don´t exclude additional business-related metrics that vary from one component of the software system to another.

Logs

System logs are a useful source of additional context when investigating what is going on inside a system. They are immutable, time-stamped text records that provide context to your metrics.

Logs should be kept in a unified structured format like JSON. Use additional log storage/visualization tools to simplify interaction with the massive amount of text data the software system provides. One very well-known and popular solution for log storage is ElasticSearch.

Traces

Traces help us better understand the request flow in our system by representing the full path any given request takes through a distributed software system. This is very helpful in identifying failing nodes and bottlenecks.

Traces themselves are hierarchical structures of spans, where each span is a structure representing the request and its context in every node in its path. Most common tracing visualization tools like Jaeger or Grafana display traces as waterfall diagrams showing the parent and child spans caused by the request.

Conclusion

Building an observable software system lets you identify failure scenarios and possible risks during the whole system life cycle. A combination of metrics, extensive log collection, and traces helps us understand what’s happening inside our system at any moment and speeds up investigations of abnormal behavior.

This article was just the first step. We’ve covered the standard approaches to metrics and briefly discussed traces and logs. But to implement an observable software system, we need to set up its components correctly to supply us with the signals we need. In part 2, we’ll discuss instrumentation approaches and modern standards in this field.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

CYBER DEFENSE FOR BUSINESS: MAPPING PAIN AREAS AND SECURING THEM

Sometimes cyberattacks just seem to happen. Even in those instances, when you have: some cybersecurity measures in place and your employees know of good cybersecurity hygiene.

The Defensive Strategist at Nord Security, Adrianus Warmenhowen, points out that having systems in place often is not enough. They may protect your company at an 80% or 90% rate, but good hackers will target your weak points. Therefore, in this interview, he explains how organizations can identify their vulnerabilities and what are the best ways to secure those pain areas.

Tech person by nature

First, could you tell us a bit about your role here at Nord Security?

At Nord Security, I am a Defensive Strategist, meaning I advise on areas that need a strategic focus on the protection of customers.

Could you give us a brief overview of your career path?

I started my journey with the internet and cybersecurity in the middle of the 1980s. And since then, I’ve had many adventures along the way. I’ve helped in the pioneering years of the internet, where cybersecurity kind of crept into my daily responsibilities, and soon after, hacking became another area of interest for me.

Earlier in my career, I worked with the aviation industry, electric companies on high voltage equipment, satellites, and more.

The growing cyber threat to companies

2021 was a record-breaking year with a 50% increase in corporate cyberattacks. What do you think are the major reasons behind it?

The pandemic in the first place. People had less mental ‘back-up’ from colleagues while working from home.

In general, the past years felt for me like a watershed moment for criminals in how to conduct cyberattacks with a return on investment: cybercrime got professional.

What are the most common types of cyberattacks that companies are exposed to, and what disruptions can they cause?

In general, companies are most likely to experience either ransomware or (d)DOS attacks. Ransomware because it pays the criminal well, and denial-of-service attacks because people want to be actionable instead of just doing more talking.

However, those cyberattacks that cause no direct disruptions are actually the ones you should worry about. By this, I mean information stealing. It can range from intellectual property to bid books, from vendor assessments to information on where you buy your hardware. That last one is important for supply-chain poisoning.

How do cybercriminals identify which companies or employees will be their next targets? Where and how are they looking for pain points they could exploit?

Well, when a vulnerability comes out that is remotely exploitable, then search engines like Shodan or BinaryEdge can be used to identify potential victims quickly. A good example of such a case is the Kaseya or Solar Winds debacle.

As for ransomware, an organization’s digital footprint is one of the ways attackers can target their victims and plan their attacks. For instance, monitoring a company’s LinkedIn page can give an insight into the churn and the rate at which people get hired/leave the company. If a company has a high churn rate, there will be many inexperienced and/or disgruntled people. That is the perfect phishing spot or moment to try a CEO fraud.

Sites like Glassdoor are also good for gathering this kind of information. Another valuable source of information can also be announcements of new partnerships or acquisitions.

Identifying pain points and securing them

How can companies best identify their pain points? How should they look for them?

One of the most effective ways is to get someone from the outside looking in. And by that, I mean someone who will be searching not for the solutions to the problems but for vulnerabilities and unprotected areas that your company has.

The truth is that we all rather run through our “happy paths” to do our work and are just glad we can avoid the day-to-day pitfalls of what we are doing. But for the sake of security, we really should take the pain and enumerate as much as possible what could go wrong and why. For that, an outsider can usually help. Just don’t get me wrong. I don’t mean “hire a pentester and be done with it.” The pentester will probably find something, but not all the things that make “you being at risk.”

A really good starting point could be to leverage your audits if you have certifications. An auditor is quite meticulous (if you have a good one), and an audit process is pretty transparent to all involved because all shortcomings are discussed during this procedure.

After an audit and the subsequent resolution of any issues found, various specialists can be used to target specific areas. That could be a pentester, pickpocket, or lockpicker (depending on your business type). Finally, if your company discusses a lot of sensitive information, then you might want to set up a spying operation on yourself.

Also, set up a permanent bug bounty program so that well-willing people can report to you if they find anything out of the ordinary.

But above all, start with a “cleaning out the crud” session.

What measures or actions should businesses take to protect themselves from potential cyber threats?

  1. Organize and systemize everything you have.

    For your tech, have a form of CMDB (Configuration management database) with ownership (for risk acceptance). For your personnel, have proper onboarding/offboarding procedures. And make transfers like offboarding->onboarding so you can avoid accrual rights. Make sure you spot unhappy employees and unhappy customers – document this (but keep their privacy decent). Even if you are a small business, know your battlefield.

  2. Do regular updates and patches.

    For instance, have every odd-week Tuesday be your patch day. Always reserve that time. If nothing is to be patched, use that time to review vendors and check if anything approaches end-of-life and such.

  3. Use encryption everywhere.

    A VPN will help make your infrastructure less visible to attackers and protect you during client meetings, lunch discussions, or work-from-anywhere.

  4. Use an antivirus.

    Even if it is unused 99.9%, you will be happy for that one single time it blocks ransomware.

  5. Use offline rotating backups for your most important data.

    A couple of SSDs should be able to hold a backup of most of your documents and probably even export your database. At the very least, keep a copy of all the contact information of your customers and employees with an offline backup.

  6. Use a password manager.

    Secure that password manager with a passphrase (a sentence, maybe from a book you liked, a song, or a poem). The reason for using a password manager is simple, SSO is not available everywhere, and using OAuth gives away a lot of information to your identity provider. And some websites simply need a separate account/log-in.

  7. Have regular security meetups with employees to check what is new, what is wrong, and what to do about it.

  8. Keep in mind that there is always something to protect. Make a policy that explicitly states: that if there is no budget for securing something, it is automatically a risk accepted by the board.

On what things should organizations focus on when mapping their cyber battlefield and building up their cyber defenses?

  1. Knowledge.

    Know what you have, what connects to what and why (do you really need plugins in Slack or Jira, or are they “just” quality of life improvements), who has access to what and why (and, very important – from when to when). What software runs on what, and does it really need to be accessible from the outside world.

     

    Really, take the pain and map out what you have now and then adjust your processes so that this knowledge is updated all the time. Do a two-yearly check if everything is as it is documented.

     

    Don’t fall into the “productivity fallacy” trap – all arguments there are comparable to removing the safety measures of your car so that you can drive faster. It might seem the right thing when you blast across the highway doing 200, but the crash when you did not turn out to be Max Verstappen will be much more devastating. This goes for cybersecurity all the same: you might feel like the proper business king when you outdo your competition in time-to-market, but when it goes wrong, it is not just you. It is your clients’ lives as well that get mangled in the “incident.”

  2. On processes and audit trails.

    The audit trails are an essential part of the knowledge because they document what is changing in our current state of knowledge.

     

    Processes make things predictable and reliable. A process does not have to be an oppressive set of micromanagement instructions but can be as simple as “for each system in our CMDB, do a security check and document it.” In fact, the most crucial part of a process is not the steps within it but the interfaces with other processes, input, and output. Whenever there is a handover, it pays to check the CIA triad (Confidentiality, Integrity, Availability) and what the handover means to each of these.

     

    Also, to dispel a myth: you can have an open culture and still be very good at keeping things a secret. It should be normalized that you can tell your co-workers, “I can not tell because of confidentiality,” because it simply means those co-workers are not instrumental in that specific case. If they were, access would be granted when needed.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×