Skip to content

強化您的防禦：健全弱點管理計劃的價值

現代安全風險管理策略中不可或缺的支柱。

在過去，居家安全意味著在晚上四處走動，親手檢查每一扇窗戶和門都已上鎖。這是一個手動、謹慎的過程，基於一個簡單的真理：任何一個未上鎖的入口，都等同於向竊賊敞開大門。

今天，企業組織在數碼規模上面臨著類似的挑戰。網絡犯罪分子不斷地探測未上鎖的數碼門窗——也就是存在於流程和技術中的安全弱點。這種威脅不僅是理論上的：《2025年資料外洩調查報告》顯示，在20%的資料外洩事件中，弱點利用是其中一個因素，年增率高達驚人的34%。

隨著攻擊者越來越專注於這些弱點，一個健全的弱點管理計劃不再僅僅是最佳實踐；它已成為任何現代安全風險管理策略中不可或缺的支柱。

什麼是弱點管理計劃？

弱點管理計劃建立了一個標準化、主動的框架，用於識別、分類、修復和緩解整個組織數碼環境中的弱點——包括其系統、網絡、應用程式和設備。雖然它通常從弱點掃描開始，但一個成熟的計劃是一個全面性的持續循環，旨在系統性地降低風險。

一個成功的計劃其核心要素包括：

  • 弱點識別 (Vulnerability Identification)：利用先進的工具和威脅情資來發現潛在的弱點。
  • 弱點評估 (Vulnerability Assessment)：評估每個弱點的嚴重性和潛在影響，以排定處理的優先順序。
  • 修復與緩解 (Remediation and Mitigation)：實施措施以修復弱點或降低其潛在影響。
  • 持續監控與報告 (Continuous Monitoring and Reporting)：確保進行中的評估，並對組織的安全態勢保持清晰的可見度。

弱點管理的生命週期：一個持續的防禦循環

有效的弱點管理不是一次性的專案，而是一個永續的生命週期，包含多個獨特且相互關聯的階段：

  1. 探索 (Discovery)：主動掃描所有系統，建立數碼基礎設施中現有弱點的完整清單。
  2. 資產優先級排序 (Asset Prioritization)：集中力量處理影響最關鍵資產的弱點——那些對維持業務營運至關重要的資產。
  3. 評估 (Assessment)：根據弱點對組織可能產生的潛在影響進行分類和排序，以智慧地指導修復工作。
  4. 修復 (Remediation)：透過應用安全修補程式來緩解風險，或者在製造商未提供安全更新時，實施補償性控制。
  5. 驗證與監控 (Verification and Monitoring)：確認修復工作成功，且保護措施如預期般運作。
  6. 報告 (Reporting)：隨著時間的推移，溝通趨勢和進展，以驗證計劃的有效性並找出需要改進的領域。

關鍵術語：弱點 vs. 威脅 vs. 風險

弱點 (Vulnerability)：系統、安全程序或內部控制中的一個弱點或缺陷，可能被威脅所利用。

威脅 (Threat)：可能對營運或資產產生不利影響的潛在事件或情況，例如攻擊者試圖入侵系統。

風險 (Risk)：當威脅利用弱點時可能造成的損失或損害。它通常是事件發生的可能性及其所帶來影響的函數。

簡而言之，當威脅行為者可以利用弱點來達成其目的（如部署勒索軟體或竊取資料）時，該弱點便構成了風險。

弱點管理 vs. 弱點評估

弱點評估是弱點管理的一個關鍵組成部分，但兩者並不相同：

  • 目的：弱點評估是針對當前弱點的單一時間點快照。弱點管理則是一個持續性的長期策略計劃。
  • 範圍：評估是一次性的審查。管理則涵蓋從探索到報告的整個生命週期。
  • 頻率：評估是定期執行的。管理則是一個持續不斷的過程。

有效弱點管理的常見障礙

  • 獲得高層支持 (Gaining Executive Buy-In)：由於這是一種主動性控制，弱點管理的價值很難量化。從可能將其視為成本中心的高層主管那裡，獲得必要的預算、政策和領導支持是一大主要障礙。
  • 準確評估風險 (Accurately Assessing Risk)：像CVSS這樣的標準評分系統很有用，但通常缺乏業務情境。真正的風險評估需要理解資產對組織的關鍵性，而這是一般評分無法提供的。
  • 實現完整的資產可見度 (Achieving Full Asset Visibility)：組織無法保護他們看不到的東西。未受管理的設備（如員工自有的智慧型手機）的擴散造成了盲點，使攻擊面的很大一部分未被監控。
  • 缺乏正式的政策與流程 (Lacking Formal Policies and Processes)：如果沒有一個可重複的優先級排序和修復框架，相關工作就會變得手動、不一致且容易出錯。
  • 優先級排序的挑戰 (Struggling with Prioritization)：資產可見度差、風險評分籠統以及流程不一致的組合，使得幾乎不可能知道首先要修復哪些弱點，導致團隊感到不知所措。
  • 孤立的團隊協作 (Siloed Team Collaboration)：弱點管理是一項團隊運動，需要安全、DevOps和IT營運團隊之間的協調。如果沒有一個集中的溝通和追蹤平台，流程就會中斷，修復速度也會變慢。

Graylog：具備情境感知能力的風險評分與資產優先級排序

Graylog Security 透過提供推動智慧弱點管理所需的情境，直接應對這些挑戰。我們的平台允許您對每台機器和使用者資產的重要性進行分類，將它們分組為低、中、高和關鍵等級別的優先順序。

這種分類為我們的 資產風險評分 (Asset Risk Scores) 提供了動力，該評分將事件層級的風險與關鍵情境（包括日誌資料來源、資產優先級和相關弱點）相結合。這使您的安全團隊能夠專注於真正重要的安全事件——那些影響您最關鍵和最脆弱資產的事件。

建立在強大的 Graylog 平台之上，Graylog Security 提供了 SIEM 的全部功能，卻沒有其複雜性和高昂成本。我們易於使用的解決方案將集中式日誌管理、資料豐富化、威脅偵測、事件調查和報告整合到單一平台中。

借助 Graylog Illuminate 內容包，我們能為您自動化最重要日誌資料的視覺化和關聯分析，讓您能專注於安全，而非設定。

About Graylog  
At Graylog, our vision is a secure digital world where organizations of all sizes can effectively guard against cyber threats. We’re committed to turning this vision into reality by providing Threat Detection & Response that sets the standard for excellence. Our cloud-native architecture delivers SIEM, API Security, and Enterprise Log Management solutions that are not just efficient and effective—whether hosted by us, on-premises, or in your cloud—but also deliver a fantastic Analyst Experience at the lowest total cost of ownership. We aim to equip security analysts with the best tools for the job, empowering every organization to stand resilient in the ever-evolving cybersecurity landscape.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Dope.security Debuts DOPAMINE DLP to Modernize Data Loss Prevention with AI

An LLM-Powered Solution for Higher Accuracy and Reduced Alert Fatigue

Cybersecurity startup dope.security Inc. has launched DOPAMINE DLP, an endpoint Data Loss Prevention (DLP) solution that harnesses Large Language Models (LLMs) to dramatically improve the accuracy of monitoring and blocking sensitive file uploads.

The Problem with Legacy DLP

Traditional DLP tools rely on outdated methodologies like watermarks, regular expressions (regex), and pattern matching to identify sensitive files. This approach severely limits their effectiveness and results in an unmanageably high rate of false positives.

Because legacy systems fail to reliably identify truly sensitive data, security teams are often left with two unhelpful options: either turn the system off entirely or set it to ‘monitor mode,’ which eliminates its utility. This inability to understand **content context** is the central failing of old-school solutions.

How DOPAMINE DLP Changes the Game

DOPAMINE DLP replaces rigid, regex-based systems with the advanced comprehension capabilities of a Large Language Model . This allows the solution to classify and block data-in-motion during file uploads with a significantly higher degree of accuracy.

According to Kunal Agarwal, CEO of dope.security: “Old tools do not comprehend text and instead operate pattern matches… This results in both endless alerts and no true positives at the same time. DOPAMINE DLP uses LLMs which are incredibly reliable in identifying sensitive information, empowering our Fly Direct SWG to curb risky data exfiltration… No more mind-boggling policy tuning.”

Key Benefits and Features

The solution is built directly into dope.security’s existing agent and is designed to reduce the operational overhead and “alert fatigue” common with legacy DLP solutions.

  • Zero Configuration Required: Security teams can instantly identify, monitor, and block uploads containing sensitive data without extensive policy tuning.

  • Comprehensive Data Protection: It monitors for Personally Identifiable Information (PII), Payment Card Information (PCI), Personal Health Information (PHI), and Intellectual Property (IP).

  • Enhanced Security Posture: By accurately identifying and curbing risky behavior, security admins can significantly improve their overall data protection posture.

DOPAMINE DLP is currently available in early access. The venture capital-backed startup, dope.security, has raised $23.9 million from investors including Google Ventures (GV Management Co.), Boldstart Ventures, and Preface Ventures.

Request a demo or trial

About Dope Security

A comprehensive security solution designed to protect individuals and organizations from various cyber threats and vulnerabilities. With a focus on proactive defense and advanced technologies, Dope Security offers a range of features and services to safeguard sensitive data, systems, and networks.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

ESET Research discovers new spyware posing as messaging apps targeting users in the UAE

  • ESET Research has uncovered two previously undocumented Android spyware families, which ESET has named Android/Spy.ProSpy and Android/Spy.ToSpy.
  • ProSpy impersonates both Signal and ToTok, while ToSpy targets ToTok users exclusively.
  • Both malware families aim to exfiltrate user data, including documents, media, files, contacts, and chat backups.
  • Confirmed detections in the UAE and the use of both phishing and fake app stores suggest regionally focused operations with strategic delivery mechanisms.

MONTREAL, BRATISLAVA — October 2, 2025 — ESET researchers have uncovered two Android spyware campaigns targeting individuals interested in secure communication apps, namely Signal and ToTok. These campaigns distribute malware through deceptive websites and social engineering and appear to target residents of the United Arab Emirates (UAE). ESET’s investigation led to the discovery of two previously undocumented spyware families: Android/Spy.ProSpy impersonates upgrades or plugins for the Signal app and the controversial and discontinued ToTok app, and Android/Spy.ToSpy impersonates the ToTok app. The ToSpy campaigns are ongoing, as suggested by C&C servers that remain active.

“Neither app containing the spyware was available in official app stores; both required manual installation from third-party websites posing as legitimate services,” explains ESET researcher Lukáš Štefanko, who made the discovery. “Notably, one of the websites distributing the ToSpy malware family mimicked the Samsung Galaxy Store, luring users into manually downloading and installing a malicious version of the ToTok app. Once installed, both spyware families maintain persistence and continually exfiltrate sensitive data and files from compromised Android devices. Confirmed detections in the UAE and the use of phishing and fake app stores suggest regionally focused operations with strategic delivery mechanisms.”

ESET Research discovered the ProSpy campaign in June 2025, and it has likely been ongoing since 2024. ProSpy is being distributed through three deceptive websites designed to impersonate communication platforms Signal and ToTok. These sites offer malicious APKs posing as improvements, disguised as a Signal Encryption Plugin and ToTok Pro. The use of a domain name ending in the substring ae.net may suggest that the campaign targets individuals residing in the United Arab Emirates, as AE is the two-letter country code for the UAE.

During the investigation, ESET discovered five more malicious APKs using the same spyware codebase, posing as an enhanced version of the ToTok messaging app under the name ToTok Pro. ToTok, a controversial free messaging and calling app developed in the United Arab Emirates, was removed from Google Play and Apple’s App Store in December 2019 due to surveillance concerns. Given that its user base is primarily located in the UAE, it is likely that ToTok Pro may be targeting users in this region, who may be more liable to download the app from unofficial sources in their own region.

Upon execution, both malicious apps request permissions to access contacts, SMS messages, and files stored on the device. If these permissions are granted, ProSpy starts exfiltrating data in the background. The Signal Encryption Plugin extracts device information, stored SMS messages, and the contact list, and it exfiltrates other files – such as chat backups, audio, video, and images.

In June 2025, ESET telemetry systems flagged another previously undocumented Android spyware family actively distributed in the wild, originating from a device located in the UAE. ESET labeled the malware Android/Spy.ToSpy. Later investigation revealed four deceptive distribution websites impersonating the ToTok app. Given the app’s regional popularity and the impersonation tactics used by the threat actors, it is reasonable to speculate that the primary targets of this spyware campaign are users in the UAE or surrounding regions. In the background, the spyware can collect and exfiltrate the following data: user contacts, device information files such as chat backups, images, documents, audio, and video, among others. ESET findings suggest that the ToSpy campaign likely began in mid-2022.

“Users should remain vigilant when downloading apps from unofficial sources and avoid enabling installation from unknown origins, as well as when installing apps or add-ons outside of official app stores, especially those claiming to enhance trusted services,” advises Štefanko.

For a more detailed analysis and technical breakdown of Android/Spy.ProSpy and Android/Spy.ToSpy,
check out the latest ESET Research blog post, “New spyware campaigns target privacy-conscious Android users in the UAE” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

ProSpy execution flow

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Offline Mode, policy to block jailbroken and rooted devices, and other improvements: catch up with NordPass in Q3 of 2025

Media and awards

We’re super happy to share three acknowledgments we’ve received this quarter for our work creating advanced yet intuitive password management solutions. 

Listed as #1 by Password Manager

We are honored to be named the Best Password Manager of 2025 by Gunnar Kallstrom, a Cyber Team Lead at a DOD contracting company. Kallstrom highlighted NordPass as a well-balanced solution with strong security and a smooth user experience for both personal and business use. As this is ingrained in our brand’s DNA, it’s great to be recognized for it. 

Geekflare picks us as #2 best enterprise password manager 

Geekflare recognized us for our ability to combine simplicity with robust security, adding to our growing list of accolades. Their team helps businesses find the best software for their needs, so it was a great pleasure to be named by them as the second-best enterprise password manager for 2025. According to Geekflare, NordPass makes a standout choice for those who seek straightforward password management with strong encryption.

PCMag’s pick for the best password manager

We’re thrilled to share that PCMag has honored us with its Editor’s Choice award for the second year in a row, naming NordPass the Best Premium Password Manager for 2025. We’re especially proud of their praise, calling NordPass “just about everything you’d want from a password manager.” Rest assured, we’re committed to keeping it that way!

What’s new with NordPass

We stay true to that promise by improving our password manager every quarter—whether it’s refining existing features or introducing new ones. Let’s take a look at what we’ve been working on over the past few months.

Offline Mode 

First up, we’re excited to introduce Offline Mode for our Business users. It’s a new feature that ensures you can access your vault even without an internet connection. Whether you’re traveling, dealing with an internet outage, or working in a network-restricted area, you’ll still have secure, read-only access to all your credentials when you need them most. This feature is currently available only on mobile devices, but we’re excited to roll it out to the desktop app and browser extensions soon.

This eliminates the need for risky workarounds like exporting your vault to an unsecure file, keeping your sensitive data protected within the encrypted NordPass environment at all times.

1-inner-asset-Offline Mode

Block jailbroken and rooted devices

NordPass now has a new default policy option that blocks access to the NordPass app on rooted Android and jailbroken iOS devices. Such devices pose a higher risk of data leakage, app tampering, and other security breaches. So, with this feature, you’ll enforce security and maintain the integrity of the application. However, if there’s a need, your organization’s Owners and Admins can allow usage on those devices.

2-inner-asset-Block jailbroken

Business Account session management

With the next phase of Business Account session management, we’re giving you even more control over your organization’s security. This feature provides Admins with a complete overview of all active user sessions across the organization, including details about those sessions, like device, platform, IP address, and the last login. This enhanced visibility empowers you to take immediate action—if you spot any suspicious activity, you can instantly revoke members’ sessions, either all at once or in separate sessions, to protect your company’s data.

3-inner-asset-session management

Enhancing the autofill experience for Android users 

We upgraded the URL linking to the items on the Android NordPass app. Now, if the website is not linked to the item on the app, NordPass autofill will suggest that the user add the URL to the NordPass item.

Similarly, you can now use autofill to copy NordPass’ built-in TOTP code to the clipboard once it is generated to streamline the logging process without interruption.

Making the B2B onboarding process more intuitive 

We continuously strive to improve and make our product more intuitive. Onboarding is a crucial part of this equation—if you can’t get through the onboarding without hiccups, will the product actually be intuitive? With that in mind, we revised our B2B onboarding process, tweaking the necessary parts to make the flow as seamless as possible.

Other minor improvements

But that’s not all! We also did some other minor product touch-ups to make your experience better:

  • We’ve rolled out performance improvements to the Sharing Hub, ensuring a faster and more reliable experience.

  • Finding what you need is now easier with our smarter search. It now understands non-exact titles, so you can find an item like “Bayern München” even if you just type “Munchen.”

  • Lastly, we’ve introduced new in-app privacy settings, giving you clear and direct control over your data tracking preferences.

Bottom line

Well, that’s a wrap! This quarter was busy mainly with feature updates and experience enhancements—we hope you have already made the best use of them!

Just before you go, a quick note. Recently, our team has noticed an increased number of scams offering help through fake NordPass phone numbers. We want to remind you that we only provide customer support through chats and emails. That’s all—see you next quarter!

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Detecting Ransomware Across the Entire Attack Lifecycle

The threat of ransomware is constantly evolving, and traditional security tools are struggling to keep up. This is largely because ransomware has become a sophisticated business model, fueled by the availability of “Ransomware-as-a-Service.” This model allows individuals with very little technical skill to launch professional-grade attacks. Traditional defenses like firewalls and endpoint protection platforms (EPPs) are no longer sufficient because they leave significant blind spots, especially with unmanaged devices such as printers, scanners, and IoT devices that cannot run an endpoint agent.

The Importance of Network Visibility

The core principle for effective ransomware detection is comprehensive network visibility. Every stage of a ransomware attack, from the initial compromise to data exfiltration, leaves a detectable trace in network traffic. By mapping the stages of an attack to the MITRE ATT&CK framework, we can see how network monitoring can reveal malicious activity:

  • Initial Access: Unauthorized user logins or connections to external systems.
  • Execution: The start of a new process or suspicious PowerShell command.
  • Persistence: The creation of new user accounts or scheduled tasks.
  • Privilege Escalation: Network access to administrator accounts or servers.
  • Lateral Movement: Communication between endpoints that normally don’t interact.
  • Command and Control: Connections to suspicious IP addresses or domains.
  • Exfiltration: Large data transfers to external, unknown servers.

How Network-Based Detection Works

A solution like GREYCORTEX Mendel is designed to provide this essential network visibility. Mendel monitors the behavior of the entire network infrastructure, using machine learning and behavioral analysis to detect malicious activity. This is effective even on devices where endpoint protection cannot be deployed.

Beyond active detection, a network-based approach also aids in post-attack compromise assessment. By continuously monitoring for hidden backdoors and “keep alive” connections, it helps ensure the network is truly clean after remediation, preventing attackers from returning later.

Strengthening Your Cybersecurity Ecosystem

A solution like Mendel is a crucial component of a modern cybersecurity ecosystem. By providing deep network visibility, it not only helps stop active attacks but also strengthens long-term network resilience. This holistic approach ensures that your defenses are prepared for a ransomware attack at every stage of its lifecycle.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×