2021 彙整 - Page 42 of 67

Do you already know what Active Directory is and how to use it with Pandora FMS?

What is Active Directory and how to use it with Pandora FMS?

As you may already know, in this blog, we’re so into answering the big questions. After answering in previous episodes what the meaning of our existence is or explaining everything you need to know about Office 365 Monitoring, in today’s episode we are going to discuss what Active Directory is. I hope you are very comfortable sitting in your respective gamer chairs or in your two-seater sofas, because here we go!

What is Active Directory?

Active Directory is a tool that provides directory services, which entails many benefits in the business sector. Many companies have a large number of employees, they need a connected device to do their work, and there we have Active Directory, with it we can build a network of devices for users or employees.

How to collect information on user and service monitoring with Active Directory?

We already know that obtaining information is a very important section of monitoring. All these data can be very useful for us to see the status of something, find a possible problem or simply improve a certain system. Active Discovery is a process by which information can be collected while managing everything in a very simple way. We will be able to see what we need from a single computer, which will make the task much easier, since we will not have to act on each of the devices. In this article, we are going to give you the guidelines to configure Active Discovery and be able to use it.

What are the benefits of using Active Directory?

It is focused on professional and business use. It allows you to manage everything easily and without having to intervene in the computers of each user, which saves a lot of time.
Store data in real time. With data related to users and their authentication.
User authentication. If everything’s ok, the user’s information will reach the computer. This means that if one computer breaks down, you will be able to access it from another with authentication.
Easily manage all servers and applications, ensuring that everything runs at peak performance.
Prevention of replication errors. To verify that all replications are being performed optimally. Active Directory monitoring is essential, since you will obtain accurate information from them.
Obtaining information from remote sites and much more…

And here Pandora FMS comes into play

It is our standard: One of the principles of Pandora FMS is its flexibility. It is highly configurable and by using plugins you will be able to do almost anything in terms of monitoring. Making use of Active Directory in Pandora FMS is quite simple. You can use a specific plugin with which to collect different types of data. Like, for example, the number of users connected or inactive to be able to see them from the console. The data you may obtain is easily configurable from a simple txt, which will be the configuration file. The plugin can be found at the following link: https://pandorafms.com/library/active-directory/ Once downloaded, install it on the console. This short and simple process that will offer you great advantages will be explained below.

What is needed for the plugin to work?

Powershell v3.0 or higher.
Active Directory Powershell Module.
Repadmin. The plugin needs a configuration file that will be divided into the following blocks and will be called “adparams.txt” :
In user, you can choose whether to see the full list of all users or one in particular. In unused, a list of users that have not been used for at least two months. 1 to enable it and 0 to disable it.
Spn allows you to see spn suffixes. 1 to enable and 0 to disable, as in the previous point.
Upn allows you to see spn suffixes. 1 to enable and 0 to disable.
You may also add the test block, which retrieves the information from the AD diagnostic tests that the dcdiag tool returns. 1 to enable and 0 to disable. Example: #tests Tests = 0
We can run the plugin manually, calling executable.exe, writing the following output through the powershell terminal: [path_plugin]\active_directory.exe [path_conf]\adparams.txt
It is recommended to save the file in pandora_agent/util.
In the remote configuration of the agent that we have installed, add the following:
When the interval goes by, modules collected by the users of Active Discovery, the connectivity, the status of the service or the suffixes spn and upn will be obtained.

Execution from the web console

To be able to run it from the console, the plugin will be distributed through collections. In configuration -> collections, create a collection, it will be named “Active Directory plugin” and short name “Ad_plugin”, in the following image you can see the process.

Go to files after creating the collection :

Click on “Upload Files”:

And upload the executable of the plugin and the configuration file that we created previously, then return to the previous menu and click “Create a file again” and later “Update”. In the agent where you want to use the plugin, go to the collections section and add it:

Next, go to “Agent plugins” and add the route with the plugin execution. In this case, as it is by means of collections, they will be created in the software agent installation path.

The path by default would be the view in the image (2).

Modules generated by the plugin

These will be the modules returned by a standard run.

Monitoring:

AD Users
Unused AD User
AD Schema Master
AD Root Domain
AD Forest Domains
AD Computer DNS Host Name
AD Global Catalogs
AD SPN suffixes
AD UPN suffixes
Connectivity
Replication admin
Service DNS status
Service DFS Replication status
Service Kerberos Key Distribution Center status
Service Active Directory Domain Services status
Test Advertising status
Test FrsEvent status
Test SysVolCheck status
Test KccEvent status
Test KnowsOfRoleHolders status
Test MachineAccount status
Test NCSecDesc status
Test Netlogons status
Test ObjectsReplicated status
Test Replication status
Test RidManager status
Test Services status
Test SystemLog status
Test VerifyReferences status

Service NetLogon status

Service Intersite Messaging status

And this is how they would look like in the created agent:

And, up to here that would be everything required to be able to make the plugin work. It was easy, huh? I hope many things in this life, but above all I hope this article was useful, especially to help you understand better Active Directory and how to use it in such a simple way in Pandora FMS. I will not take anymore of your time, indeed, I say goodbye, not before, of course, encouraging you to read other articles on the blog that may be to your liking and taste.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

2021 Pandorafms

ESET Threat Report T1 2021 highlights rapid abuse of trending vulnerabilities and configuration flaws by cybercrooks

BRATISLAVA – ESET, a global leader in cybersecurity, has released its T1 2021 Threat Report, summarizing key statistics from ESET detection systems and highlighting notable examples of ESET’s cybersecurity research, including exclusive, previously unpublished updates on current threats. The featured story recounts ESET Research’s discovery of multiple advanced persistent threat (APT) groups exploiting a vulnerability chain affecting Microsoft Exchange Server. The exclusive updates include new findings about the Lazarus and Turla APT groups and an analysis of a malicious iOS tweak that steals files from jailbroken iOS devices.

Starting with this issue of the ESET Threat Report, ESET Research aims to have a triannual publication, meaning that each report will cover a four-month period. For easier orientation, the T1 abbreviation will be used to describe the period from January to April, T2 from May to August, and T3 from September to December.

During the first four months of this year, the COVID-19 pandemic was still the number one news topic globally; however, it became notably less prominent in the threat landscape. “One could say ‘fortunately,’ yet as you’ll see in our report, we are continuing to see worrying examples of cybercrooks rapidly abusing trending vulnerabilities and configuration flaws with a focus on achieving high returns on investment,” comments Roman Kováč, Chief Research Officer at ESET. These abuses include continued abuse of the remote desktop protocol (RDP), which remains the number one target of brute-force attacks, increased numbers of cryptocurrency threats, and a steep increase of Android banking malware detections.

The featured story of the report recounts ESET Research’s analysis of a vulnerability chain that allows an attacker to take over any reachable Exchange server. The attack has become a global crisis and ESET researchers identified more than 10 different threat actors or groups that likely leveraged this vulnerability chain.

The exclusive research presented in the T1 2021 Threat Report brings several updates and new findings about the APT groups Turla and Lazarus. It also includes information about a malicious iOS tweak, which is an application that leverages runtime patching in order to change program behavior, to execute shell commands on jailbroken and compromised iOS devices.

The ESET T1 2021 Threat Report also reviews the most important findings and achievements by ESET researchers. Among many other findings, including an ongoing series investigating Latin American banking trojans, ESET researchers uncovered the Kobalos malware, which attacks high performance computer clusters and other high-profile targets; Operation Spalax, which targets Colombian government organizations and private entities; a highly targeted supply‑chain attack that focused on online gaming in Asia; and a new Lazarus backdoor that was used to attack a freight logistics company in South Africa.

Besides these findings, the report also recapitulates the many virtual talks held by ESET research specialists in T1, introduces talks planned for the upcoming months, and provides an overview of ESET’s participation in the MITRE ATT&CK® Evaluations that emulated the Carbanak and FIN7 adversary groups.

For more information, check out our ESET Threat Report T1 2021 on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2021

Visual communication tools hand in hand when supporting special education

LetaAnn Miller is a special education teacher in the largest school district in the state of Georgia. Prior to teaching, LetaAnn spent eight years working with individuals with autism and other developmental differences in schools, homes, virtual, and community settings. Having such an opportunity afforded LetaAnn the ability to develop various perspectives of learning, teaching, and supporting students prior to the pandemic and strengthened the desire to find solutions to teaching digitally.

Despite being faced with multiple challenges during the pandemic, both the V4K and iDocCam software have allowed LetaAnn to transition to online teaching with ease while still retaining the engaging element of her teaching.

“When teachers were introduced to IPEVO, it allowed teachers to manipulate the camera’s view, split screens between instructional material, teacher view, and more. Also, it allowed teachers more flexibility in movement while teaching. For instance, once I had the IPEVO software, I could bend my document camera to where it was standing up so my students could see me standing and teaching and not sitting behind a screen without using multiple devices and trying to juggle platforms. Also, it allowed me to manage students and behavior more effectively and provide students with more reinforcement while teaching. Such a simple “tech hack” with the addition of software and materials already provided in the classroom allowed for better teaching without an added financial burden on individuals.”

Before integrating IPEVO products into her teaching, LetaAnn explains:

“Despite having many plans to boost student engagement and learning during digital instruction, doing such a task initially involved multiple components of technology and many pieces of equipment. Expanding the steps to provide quality instruction also expanded the room for error and for technological blips. Witnessing struggles in classrooms I supported and within my own lessons, I easily recognized the need for a more streamlined process of technology.”

LetaAnn saw both efficiency and engagement rise considerably, resulting in a much better experience all around. She explains:

“With the addition of the IPEVO products, I was able to eliminate multiple steps of meeting with students online, providing instruction and sharing materials. This afforded opportunities for varied instruction and building stronger connections with all students.”

As an passionate and dedicated educator, LetaAnn was successful in utilizing IPEVO products for not only herself but also for the whole county. She summarizes:

“When considering life over the past year, returning to big pictures, struggles, and deficits is easy. Conversely, when moments of success or improvements are broken apart and considered for every piece, the magnitude of its impact is amplified. I am beyond grateful for the addition of IPEVO to our county, school, and classroom. Not only did their customer service team go above and beyond to troubleshoot issues and develop a meaningful connection when interactions with others are vastly different, they provided educators, students, and families with meaningful change and lasting impact.“

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About IPEVO
IPEVO makes versatile teaching tools instead of specialized “classroom equipment”.
We go beyond the usual conventions of classroom technology—large, expensive, specialized and complex—to rethink simple and flexible solutions for interactive teaching in today’s classrooms.
IPEVO’s interactive teaching tools empower educators and teachers with radically affordable and compact technology that is simple, intuitive and flexible, so that precious time and resources can be wholly dedicated to teaching. We intend to make educational technology accessible and available to all.

IPEVO 2021

How Does Privileged Access Management Prevent Cyberattacks?

In the digital age we are in, it is essential to protect all the data we have, whether it is our own data or from the users who provided it. No user without permission should have a chance to access sensitive information.

According to Trend Micro’s annual cybersecurity report – A Constant State of Flux -, in 2020, more than 1453 vulnerabilities were identified – that’s just the number of warnings published ⎼, 173 of which consisting of critical severity and 983 of high severity.

Vulnerabilities like these are an open door for cyberattacks to happen. But let’s better understand what they are and how privileged access management prevents cyberattacks.

What are cyberattacks?

Cyberattacks are basically attacks by hackers on a specific computer, system, or computer network.

The goals of an attack like this can vary widely: they range from stealing user data, making modifications to systems, or even bringing down an entire network.

This type of crime can be associated with the category of extortion, considering that it is quite common for hackers to charge an amount of money for the attack to stop, so that important information is not leaked or any other aspect that may be extremely important for the victim.

Perhaps it may seem like something that does not happen very often, given the apparent difficulty of invasion, but Brazil alone has suffered more than 8.4 billion cyberattack attempts in 2020. This shows us that it is essential to always be aware of our system’s flaws and gives us an idea of the size of the risk we are facing.

How do hackers manage to break into systems?

There are several ways to break into a system, and with each passing day, criminals invent new ways to do this. Among them, we can mention:

Ransomware

The term ransomware is a fusion of the terms ransom, which is exactly what it means, and malware, a term referring to malicious software.

It is basically malware that blocks a series of files or an entire system, from which a ransom is charged for their release. It is literally a virtual kidnapping.

Ransomware can gain access to the system in different ways: via email links, social media links, websites, or by installing apps. Once inside, the virus encrypts the data, preventing the user from gaining access.

Generally, the ransom is charged in cryptocurrencies such as bitcoin. This is due to the virtually zero chance of tracking it, making it almost impossible to identify the criminal.

Spyware

This is used as spy malware. It is quite difficult to detect as it works in the background.

It is widely used for stealing confidential information such as passwords, banking, credit card, or any other information that is useful for criminals.

They usually have access by downloading free files or programs from the Internet.

Keylogger

Malware like this has the function of recording everything that is being typed on a keyboard. It is a type of spyware, that is, they are occasionally used in so-called phishing attacks, those designed for identity theft.

A Keylogger can also be hardware, such as a USB cable or a flash drive.

DDoS Attack

Also known as distributed network attacks or distributed denial-of-service attacks. DDoS attacks work by making a large number of requests to an online service to exceed the system’s capacity, preventing it from functioning properly.

They usually do this intending to request an amount to stop the attack. For this to happen, the hacker uses a series of infected computers; the network that these computers are part of is called a zombie network.

What characterizes privileged access?

As its name suggests, users who have this type of access have privileged accounts to access sensitive administrative information. They can change passwords, view user data, modify settings, and perform other related actions.

In general, users like this have accounts with very complex passwords and, in many cases, these accounts are shared among several administrators. But that alone is not enough. It is necessary to closely monitor each credential, especially those that are common among several people.

How does privileged access management prevent cyberattacks?

Privileged Access Management (PAM) is here precisely to help organizations to implement control of privileged actions efficiently.

Users who have this type of access are constantly accessing critical organization resources. Monitoring who joins the system, when that person logs in, and also if they are performing the activities assigned to them is of utmost importance.

A PAM solution is used for this very purpose. Thus, one can guarantee the user is really the one with the authorization, not a hacker who got someone’s credential information.

The solution does this by forcing the person to request a just-in-time authorization, limiting the space they have to work with and also setting a sufficient time limit to perform the required task.

This way, there is no unnecessary exposure of information, ensuring greater security and exponentially reducing the loopholes for hackers to work.

A PAM system can go further and block the user if they are performing unauthorized tasks, which is great for reducing the chances of falling victim to a cyberattack.

It is important to mention that no solution is 100% effective, but the more barriers there are between people and data, the lower the risks.

As we have seen, hackers have a variety of ways to perform their activities. When we talk about users with privileged access, we are dealing with a huge risk for the organization. A hacker can simply steal someone’s authorized credential and use it to break into the administrative system.

A PAM system is essential to put another virtual barrier, reducing the number of loopholes and considerably reducing the vulnerability of a system.

senhasegura is a PAM solution that allows and helps you to secure and protect your data. You can request a demo and learn more about the quality of the service provided. Do not waste time and do not be one more person in the victim statistics!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Segura 2021

訊連科技攜手GIS業成打造具備口罩偵測、體溫量測及活體辨識功能之3D人臉辨識機

【2021年06月03日，台北訊】 世界級AI臉部辨識技術開發商訊連科技(5203.TW)宣佈旗下FaceMe® AI人臉辨識獲GIS業成(6456.TW)採用，整合至「YouMe 800T 3D人臉辨識機」，打造整合了人臉辨識、口罩偵測、體溫量測及3D活體辨識等多樣化功能一體式門禁機，可適用於辦公大樓、廠房、倉庫、住宅等多種應用場景。

人臉辨識是近年來最熱門的人工智慧應用之一，可整合在門禁管理、差勤打卡等應用中。於COVID-19疫情期間，口罩偵測、體溫量測等功能，更是打造非接觸性門禁系統不可或缺的功能。此外，人臉辨識面對的挑戰之一，是如何進行活體辨識，避免透過臉部相片或影片來進行身分冒用。而於強光、逆光的室外，或是弱光的室內等於環境光源不佳之地點，如何有效進行辨識，也是一大難題。

GIS業成開發的「YouMe 800T 3D人臉辨識機」採用了訊連科技的FaceMe® AI人臉辨識引擎，可進行即時人臉偵測及辨識，因應COVID-19防疫需求，並支援配戴口罩人士進行身份識別及體溫量測，供作門禁、考勤打卡管理使用，為疫情時代功能最齊全的人臉辨識機。「YouMe 800T 3D人臉辨識機」亦內建補光燈，可大幅改進逆光、強光、弱光等極端光源環境下的辨識率。此外，「YouMe 800T 3D人臉辨識機」搭載先進的3D相機，透過景深資訊進行3D活體辨識，100%辨別是否為3D活體、或是以人臉相片、影片等方式冒用身分。

「FaceMe®具有建置彈性、跨作業系統支援等特性，適合建置於各式IoT解決方案中。其中刷臉門禁就是FaceMe®最普遍的應用之一。」訊連科技執行長黃肇雄表示：「很榮幸FaceMe®獲GIS業成採用，於其3D人臉辨識機中，可進一步透過3D景深相機，達到活體辨識功能，打造出更加安全、可靠的智慧門禁及差勤系統。」

FaceMe®可支援各式CPU、SoC及GPU等處理器，亦支援10種以上的作業系統。以「YouMe 800D 3D人臉辨識機」為例，可支援其搭載的的Rockchip RK3399 SoC及Ubuntu作業系統，可提供快速、即時的人臉偵測及辨識。此外，FaceMe®人臉辨識引擎更提供了口罩辨識、配戴口罩的人臉辨識及3D景深資訊的支援，可協助GIS業成加速3D人臉辨識機之開發。

訊連科技FaceMe® AI人臉辨識引擎，在全球知名NIST人臉辨識競賽中，名列全球最精準的刷臉技術之一，在1:1和1:N測試項目中均位居全球前6強、並是排除中、俄廠商後的全球第一。FaceMe®可廣泛支援Windows、Linux（Ubuntu、RedHat、CentOS）、JetPack（Jetson）、iOS和Android等作業系統，並對CPU，GPU，SoC，APU和VPU等各式硬體優化。FaceMe®提供最全面且彈性部屬的解決方案，能將人臉辨識技術應用在各種IoT和 AIoT設備上。

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於CyberLink
訊連科技創立於1996年，擁有頂尖視訊與音訊技術的影音軟體公司，專精於數位影音軟體及多媒體串流應用解決方案產品研發，並以「抓準技術板塊，擴大全球行銷布局」的策略，深根台灣、佈局全球，展現亮麗的成績。訊連科技以先進的技術提供完美的高解析影音播放效果、以尖端的科技提供完整的高解析度擷取、編輯、製片及燒錄功能且完整支援各種高解析度影片及音訊格式。產品包括：「威力導演」、「PowerDVD」、「威力製片」、「威力酷燒」等。

訊連科技 Cyberlink PowerDVD 2021