2023 彙整 - Page 77 of 128

SpaceCobra group goes after WhatsApp backups using Android spyware GravityRAT, ESET Research discovers

ESET Research discovered a new version of Android GravityRAT spyware being distributed as trojanized versions of the legitimate open-source OMEMO Instant Messenger Android app.
The trojanized BingeChat app is available for download from a website that presents it as a free messaging and file sharing service.
This version of GravityRAT is enhanced with two new capabilities: receiving commands to delete files and exfiltrating WhatsApp backup files.
The campaign is very likely highly targeted. Just as in previously documented SpaceCobra campaigns, the Chatico campaign targeted a user in India.

BRATISLAVA, KOŠICE — June 15, 2023 — ESET researchers have identified an updated version of the Android-based GravityRAT spyware being distributed as the messaging apps BingeChat and Chatico. GravityRAT is a remote access tool previously used in targeted attacks against users in India. Windows, Android, and macOS versions are available. The actor behind GravityRAT remains unknown; ESET Research tracks the group known as SpaceCobra. Most likely active since August 2022, the BingeChat campaign is still ongoing. In the newly discovered campaign, GravityRAT can exfiltrate WhatsApp backups and receive commands to delete files. The malicious apps also provide legitimate chat functionality based on the open-source OMEMO Instant Messenger app.

Just as in previously documented SpaceCobra campaigns, the Chatico campaign targeted a user in India. The BingeChat app is distributed through a website that requires registration, likely open only when the attackers expect specific victims to visit, possibly with a particular IP address, geolocation, custom URL, or within a specific timeframe. In any case, the campaign is very likely highly targeted.

“We found a website that should provide the malicious app after tapping the DOWNLOAD APP button; however, it requires visitors to log in. We didn’t have credentials, and registrations were closed. It is most probable that the operators only open registration when they expect a specific victim to visit, possibly with a particular IP address, geolocation, custom URL, or within a specific timeframe,” says ESET researcher Lukáš Štefanko, who investigated the malicious apps. “Although we couldn’t download the BingeChat app via the website, we were able to find a distribution URL on VirusTotal,” he adds. The malicious app has never been made available in the Google Play store.

ESET Research does not know how potential victims were lured to, or otherwise discovered, the malicious website. Considering that downloading the app is conditional on having an account and new account registration was not possible during the investigation, ESET believes that potential victims were specifically targeted.

The group behind the malware remains unknown, even though Facebook researchers attribute GravityRAT to a group based in Pakistan, as previously speculated by Cisco Talos. ESET tracks the group under the name SpaceCobra, and attributes both the BingeChat and Chatico campaigns to this group.

As part of the app’s legitimate functionality, it provides options to create an account and log in. Before the user signs into the app, GravityRAT starts to interact with its C&C server, exfiltrating the device user’s data and waiting for commands to execute. GravityRAT is capable of exfiltrating call logs, contact list, SMS messages, device location, basic device information, and files with specific extensions for pictures, photos, and documents. This version of GravityRAT has two small updates compared to previous, publicly known versions of GravityRAT: exfiltrating WhatsApp backups and receiving commands to delete files.

For more technical information about SpaceCobra and the latest campaign with Android GravityRAT, check out the blogpost “Android GravityRAT goes after WhatsApp backups” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

GravityRAT distribution mechanism

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2023

The risks of using spreadsheets for cyber asset management

An accurate and comprehensive asset inventory is vital for an effective cybersecurity program. Relying on basic spreadsheets for asset management could introduce severe risks to your entire organization.

Read on as we explore the downsides of using spreadsheets for cyber asset management and highlight the clear advantages of using a dedicated cyber asset management tool to empower your security program, rather than hinder it.

Spreadsheets are simply inefficient for cyber asset management

A recent study found that a staggering 73% of cybersecurity and IT professionals use spreadsheets to manage security hygiene and posture.

There are two primary reasons why one might use spreadsheets for asset management:

An asset inventory tool has never been used in your organization.
You need to work around your current asset inventory tools.

While spreadsheets can adapt to numerous use cases since they handle all sorts of data, this dexterity also makes them less than ideal for IT asset management. Furthermore, while Excel and Google Sheets can be an easy first step to track asset data for an IT environment, they fail entirely as an efficient cyber asset management solution.

7 disadvantages to spreadsheets asset management

Manual data collection
Spreadsheets require time-consuming manual updates. Without automation, they often become outdated. Reliance on tracking changes and identifying responsible parties manually introduces errors, hindering the detection and resolution of security incidents. This limitation makes it harder to monitor the integrity of the asset inventory and respond swiftly to cyber threats.
Inconsistent attributes
Different departments and individuals have discrepancies in what attributes they prioritize for data collection. Security teams may focus on listening ports, while IT may prioritize warranty expiration. This can lead to confusion and inconsistent data collection over time.
Outdated information
Asset records in spreadsheets can vary widely in age, ranging from a week to a year, depending on when someone bothered to update them. This significantly hampers effective incident response and security program management.
Lack of detail
Due to the aforementioned points, spreadsheets often lack sufficient detail. Humans dislike repetitive manual work, and the limitations of spreadsheets prevent them from containing comprehensive information.
Incomplete inventory / managed-only devicesThe Achilles’ heel of any asset inventory program is unmanaged devices. Spreadsheets cannot be updated with assets that are unknown.
According to a Deloitte research report, 32% of organizations believe that “Shadow IT” assets pose the greatest challenge for ITAM. Rogue devices installed by employees, third-party vendors, or through shadow IT lack standard security controls like EDR agents, making them easy targets for adversaries.
The same report states that 18% of organizations are considering non-active or repurposed IT assets. With manual data entry, unmanaged devices can go unnoticed or neglected for extended periods, leading to uncertainty within teams regarding their significance or reluctance to invest effort in investigating them.
Here are just some of the key problems unmanaged assets pose:
- Audit violations
- Cannot be patched
- Cannot be upgraded
- Cannot be automated
- Cannot be turned off
Hard to shareSharing is not built into Excel. Sharing Excel sheets linked to other dependencies also causes all sorts of problems. In the meantime, Google Sheets copies come with a touch of showmanship, flaunting a prepending “Copy of” like a magician demonstrating a trick. However, with it being so easy to duplicate documents, one sleight-of-hand from a nefarious user could go easily unnoticed.
No version controlVersion control becomes a challenge as spreadsheets lack proper mechanisms to track changes and maintain data consistency. It is difficult and time-consuming to trace back who updated which asset in whose copy of which version of the spreadsheet.
Multiple copies of the same spreadsheet create confusion and hinder the ability to have accurate and up-to-date information. This limitation affects data integrity and poses challenges in maintaining a reliable asset inventory. With Excel, sharing automatically creates a copy, and with Google Sheets, anyone with edit access can make a copy. These copies can take on a life of their own, resulting in various states of inaccuracy.

Spreadsheets are high-risk for sensitive information

As if the inefficiencies weren’t bad enough, spreadsheets lack sophisticated controls and are easily duplicated, increasing the risk of information exposure. In truth, using spreadsheets for any sensitive information is a liability. Storing asset details in a spreadsheet is perilous.

PeopleDAO, a group formed to buy a copy of the U.S. Constitution, lost 76.5 ETH ($120,000) after the accounting lead mistakenly shared a Google Sheet with edit access to a payout form on a public Discord channel.

Human error aside, hackers have a notorious history of exploiting enterprise products. In 2021, Microsoft fell victim to a malware attack spread through Excel spreadsheets, and in 2019, hackers bypassed Google filters to launch CSV malware via Google Sheets.

Both companies have continued to be victims of vulnerabilities and phishing campaigns over the years:

Access to just one spreadsheet could be the key to everything that a bad actor needs to compromise your entire network. The potential repercussions, including the costs associated with a data breach, loss of profits, expensive lawsuits, and customer and partner attrition, far exceed the investment required for a secure and comprehensive asset inventory solution.

Beyond spreadsheets – go CAASM

It is clear to see that there are significant downsides to using spreadsheets to manage cyber assets, yet organizations proceed to adopt this method with the support of other tools. However, EDRs, vulnerability scanners, CMDBs, NACs, and free asset management solutions all have asset management limitations. Not only do these tools lack comprehensive visibility into the asset landscape, but using spreadsheets to supplement or work around them only inherits the same limitations.

The manual process involved with spreadsheets introduces the risk of human error, especially as the number of assets and data sources increases. Managing access and enforcing the principle of least privilege, as well as restricting who can view, edit, or delete the inventory, becomes increasingly difficult. Without proper access controls, maintaining a secure environment and protecting sensitive information becomes a daunting task.

Correlating asset data from different sources poses challenges because each tool or data source uses its own format. It becomes arduous to accurately compare and analyze data when it is not normalized within the same time ranges. Without proper correlation and normalization, the ability to understand asset relationships, identify vulnerabilities or misconfigurations, and respond to security incidents in a timely manner is negatively impacted.

Although Google Sheets and Excel allow third-party plugins and extensions to enhance usability and functionality, granting this type of access is also high-risk. Third-parties gain access using an OAuth process. As part of this process applications can request specific scopes, gaining formidable privileges.

Example of an OAuth scope request from a third-party application for a Google product

The wrong plugin, developed with malicious intent, could wreak havoc by pilfering your sensitive information. Furthermore, once a third-party add-on has been granted access permissions, it will retain them until they are manually revoked. This means that forgotten add-ons, not used for several years, could still have access to your data. Managing this situation without a CASB or SSPM solution becomes a near-impossible task, adding yet another tool to your stack.

In contrast, a cyber asset attack surface management (CAASM) solution addresses all of these limitations, offering security, automation, integration, scalability, reporting, collaboration, and compliance support. One major benefit of CAASM is the ability to bring in data from multiple sources, allowing for automated data collection, correlation, and normalization. The best CAASM solutions also include active scan data. With a comprehensive view of all assets, organizations can prioritize security efforts, identify potential security gaps, and make informed decisions to protect their network. Correlation among different sources is not only a desirable feature but also a table stakes requirement for an effective cyber asset management solution. It enables organizations to have a holistic view of their assets, streamline workflows, and implement proactive security measures to effectively mitigate risks.

runZero is a cyber asset management solution that includes CAASM functionality, and can safely and securely integrate with other security tools and systems, such as vulnerability management platforms, Security Information and Event Management (SIEM) solutions, and Internet scanning services.

As a standalone solution, runZero performs unauthenticated active scans powered by high-fidelity fingerprinting to quickly and safely provide a complete and accurate asset inventory, even on fragile IoT and OT networks. As a whole, runZero is designed to effectively address the unique challenges and requirements of cybersecurity asset management, which a spreadsheet could never achieve.

Learn how Presidio eliminated spreadsheets for greater visibility across their internal and client networks with runZero

Read the case study

Spreadsheets vs runZero

As a whole, runZero is designed to address the unique challenges and requirements of cybersecurity asset management effectively, which a spreadsheet comparatively could never do. Below are the notable ways runZero far surpasses spreadsheets for cyber asset management:

Automation

Unlike spreadsheets, runZero automates the entire asset discovery, inventory and tracking process; offering real-time updates, accurate data synchronization, and a holistic view of an organization’s assets and network.

Scalability

Spreadsheets struggle to handle large-scale asset inventories, leading to performance issues and decreased efficiency. runZero is built to handle vast amounts of data, and millions of assets, providing a scalable solution to accommodate growing asset portfolios, from small business to large enterprise.

Advanced Security

Spreadsheets lack robust security features, making it easier for unauthorized individuals to access and manipulate them. runZero prioritizes security and provides robust features, offering advanced role-based access control (RBAC) and organizational hierarchies to ensure that only authorized individuals can access and modify the asset inventory. Our SSO and RBAC features are available in all editions. Our commitment to helping the world be more secure means we don’t gate security features in the higher tiers.

Reporting and Analytics

runZero has robust reporting and analytics capabilities, allowing organizations to generate detailed reports on asset inventory, services running on the network, current vulnerabilities, and more. This is essential when needing to provide insights and metrics that can assist in decision-making, resource allocation, and risk mitigation strategies.

Collaboration and Workflow

Spreadsheets make it difficult to collaborate and streamline workflows. runZero enables IT and security teams to work together more efficiently, share insights, and coordinate response efforts through asset ownership, alerts, third-party integrations, and canned queries for rapid zero-day response.

Compliance and Audit Support

It is near impossible to maintain an up-to-date asset inventory with spreadsheets. runZero helps organizations maintain exemplary cyber hygiene through automatic asset tracking, documenting information, changes, and security controls, making it easy to demonstrate compliance with industry regulations and standards.

Try runZero free

Upgrade your asset management.

Find out what’s connected to your network in less than 20 minutes with a 21-day trial, after which, downgrade to our free tier for personal use or for organizations with fewer than 256 devices.

Start trial

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

runZero 2023

When Time Stands Still: The Business & Operational Impacts of System Downtime

It happens to businesses worldwide every day: A routine day turns into chaos as systems crash, bringing operations to a grinding halt. This is system downtime – an IT nightmare that can have significant implications for any business. In our fast-paced, digitally interconnected world, even a few minutes of system unavailability can lead to substantial financial losses, operational disruptions, and reputational damage.

Despite being an issue that falls squarely in the IT domain, system downtime reverberates throughout the entire business. Yet, many firms fail to fully understand its actual cost and reach. Knowledge is power, and by better understanding the wide-ranging implications of system downtime, businesses can implement effective strategies to mitigate its impacts.

Top Causes of System Downtime

Before we dive into the cost of system downtime, let’s familiarize ourselves with why these events occur in the first place.

Hardware Failures: Hardware components can break down over time due to wear and tear or sudden malfunctions. This includes servers, hard drives, and network devices.
Software Malfunctions: Bugs, compatibility issues, or incorrect configuration can cause a software crash, leading to downtime.
Cyber Attacks: Hackers can cause system downtime through various methods such as Distributed Denial of Service (DDoS) attacks, viruses, ransomware, and other types of malicious software.
Network Failures: This includes server overload, connectivity problems, or problems with service providers.
Human Error: Mistakes made by staff, such as incorrect system configuration, accidental deletion of critical data, or the mishandling of hardware, can cause system downtime.
Power Outages: Unexpected loss of power can cause immediate system downtime. Even with UPS systems in place, prolonged power outages can lead to downtime.

Cyber attacks are an increasingly alarming cause of system downtime, posing a serious threat to businesses and critical sectors. When these attacks occur, not only do they cause immediate disruption, but they can also have long-lasting implications. This is especially dangerous for vital industries like healthcare, manufacturing, and the industrial sector.

In healthcare, system downtime can impede access to crucial patient information, delay treatments, and disrupt emergency services – literally becoming a matter of life and death. For manufacturing and industrial sectors, a cyber attack can halt production lines, disrupt supply chains, and cause severe financial losses that ripple through industries. In all cases, such attacks can damage a company’s reputation and erode customer trust.

Understanding IT Downtime Costs – Real Business Impacts

IT downtime can result in a significant financial hit, but calculating that cost may seem complex. Luckily, there’s a simple formula:

Hourly Cost of Downtime = Lost Revenue + Lost Productivity + Recovery Costs + Intangible Costs

Let’s break this down.

Lost Revenue

How much does your business earn per hour? Dividing your weekly revenue by 40 should give you that figure. The key factor here is your reliance on uptime. Uptime indicates how long your site or system is functional. If you’re a business like an online store that entirely depends on the internet for sales, your uptime dependency is 100%. So, the loss of revenue during downtime is directly tied to your uptime percentage.

Here’s how you can calculate Lost Revenue:

Hourly Revenue x Downtime (hours) x Uptime (%) = Lost Revenue

For example, if your hourly revenue is $5,000, your network was down for 3 hours, and your uptime percentage is 35%, your lost revenue would be $5,250.

Lost Productivity

When your servers crash, your employees can’t work. Still, their salaries are constant. So to calculate lost productivity, you need to figure out each employee’s hourly salary, then the percentage of their productivity that relies on uptime (Utilization Percentage).

Lost Productivity = Employee’s Hourly Salary x Utilization % x Number of employees (with the same Utilization %)

Recovery Costs

Recovery costs are the expenses incurred in rectifying the issue(s) that led to the downtime. These can include:

Repair Services: When a system goes down, the first step in recovery is identifying and fixing the issue. This might require the services of IT professionals, either from your in-house team or external consultants. The associated costs could include their hourly rate and any additional fees for emergency service or overtime work. For example, in a hardware failure scenario, an IT technician might need to be called in to diagnose and repair the faulty component.
Replacement Parts: In some cases, repair might not be an option. When a piece of hardware fails beyond repair, it needs to be replaced. This could range from a faulty network router to a server or an entire data center in the case of catastrophic events, like natural disasters.
Lost Data Recovery: Data is often the lifeblood of a business. If data is lost during a downtime event, it may need to be recovered. This could involve using special software or hiring a data recovery service. Costs can vary greatly depending on the complexity of the recovery, the amount of data, and the extent of what has been lost. For example, if a hospital’s patient records are lost due to a system crash, recovering this information would be critical, potentially requiring the services of a specialized data recovery firm.
Miscellaneous Costs Due to Data Loss: Lost data can have additional costs beyond the recovery efforts. There might be regulatory penalties if the lost data includes sensitive customer information. Businesses may also lose customer trust, resulting in lost sales. Moreover, employees might need to spend time recreating lost data, leading to lost productivity.

Although less straightforward than revenue and productivity costs, recovery costs are equally vital in determining the total cost of downtime.

Intangible Costs

Intangible costs might not be apparent immediately but can lead to lasting damage. For example, these costs arise when your reputation or brand image suffers due to downtime. For businesses highly reliant on uptime, these intangible costs can be significant. Incorporating intangible costs into your Total Down Cost Formula will help reveal the potential long-term consequences of downtime.

Final Thoughts

Here’s the bottom line. System downtime can cripple operations, reputation, and revenue streams. Understanding its cost isn’t just about dealing with a crisis, but about proactive planning and prevention. It equips businesses to invest wisely in robust IT infrastructure, practical training, and comprehensive recovery plans, enabling resilience in the face of unexpected outages.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Portnox 2023 Network

Evolving Cyber Threats Demand Refined BYOD Policies

As the world continues to adapt to the evolving landscape of hybrid work, IT security teams find themselves at the forefront of a relentless battle against increasingly sophisticated cyber threats. With the proliferation of Bring Your Own Device (BYOD) policies in organizations, the need to carefully define and enforce security protocols has never been more critical. As cyber attackers constantly refine their techniques, the effectiveness of BYOD policies becomes a vital component in safeguarding sensitive data and protecting corporate networks.

The past few years witnessed a significant surge in remote work, with organizations quickly pivoting to virtual operations amid the global pandemic. This shift, while essential for business continuity, also opened up new avenues for cybercriminals to exploit vulnerabilities. A multitude of ransomware attacks, data breaches, and phishing attempts have left organizations grappling with the dire consequences of inadequate security measures.

Blurred Lines Between Devices & Networks

Enterprises across sectors are now embracing hybrid work models, blurring the lines between personal and professional devices and networks. This integration necessitates a reevaluation of existing BYOD policies, as cyber threats become more insidious and sophisticated. It is imperative for IT security teams to establish clear guidelines and protocols that strike the delicate balance between convenience and protection.

While organizations have historically struggled to balance employee autonomy and data protection, the urgency to fortify BYOD policies has never been more pressing. With the potential for a single compromised device to become a gateway for cyber attackers to infiltrate corporate networks, IT security teams must adopt a proactive approach to safeguarding sensitive information.

A robust BYOD policy should encompass stringent device registration and authentication protocols, regular security updates, and mandatory encryption measures. Educating employees about the importance of strong passwords, identifying phishing attempts, and adhering to security best practices must also be a core component of any comprehensive BYOD strategy.

Enforcing BYOD Policies with NAC

Furthermore, organizations can enhance their BYOD policies by implementing Network Access Control (NAC) solutions, which play a vital role in enforcing security measures across the network. NAC enables IT security teams to authenticate and authorize devices before granting access to the corporate network, thereby reducing the risk of unauthorized devices compromising sensitive information.

NAC solutions offer a comprehensive set of features that aid in implementing and enforcing BYOD policies effectively. Firstly, they provide device profiling capabilities, allowing IT teams to identify and categorize devices based on their characteristics and security posture. This profiling enables organizations to enforce specific policies tailored to different device types, ensuring that each device meets the required security standards before connecting to the network.

Secondly, NAC solutions can conduct pre-connect and post-connect assessments to validate the security posture of devices. Pre-connect assessments verify whether devices have up-to-date operating systems, antivirus software, and security patches. Post-connect assessments continuously monitor devices to detect any malicious activities or changes that could pose a security risk. These assessments help ensure that devices remain compliant with security policies throughout their connection to the corporate network.

The Need for a BYOD Strategy is Now

The dynamic nature of cyber threats necessitates constant evaluation and refinement of BYOD policies. IT security teams must collaborate closely with stakeholders across the organization, including legal, human resources, and IT departments, to ensure policies align with evolving industry standards and compliance regulations. Regular audits and assessments of the BYOD infrastructure will provide valuable insights into potential vulnerabilities and areas for improvement.

Furthermore, leveraging cutting-edge technologies such as artificial intelligence and machine learning can bolster security measures by identifying anomalies, detecting suspicious activities, and responding swiftly to potential threats. As cyber attackers continually adapt their tactics, organizations must remain agile and embrace innovative solutions to safeguard their digital assets effectively.

In an era where the consequences of a security breach can be devastating, IT security teams must assume a proactive stance to mitigate risks. Clear and well-defined BYOD policies, in tandem with ongoing employee education, will form the backbone of a robust defense against the ever-evolving cyber threats. By doing so, organizations can confidently navigate the hybrid work landscape while ensuring the integrity and security of their sensitive data.

As organizations strive to thrive in the new normal, one thing remains clear: a comprehensive and refined BYOD policy is no longer a luxury but a necessity. The time to act is now, as cyber attackers grow more sophisticated and relentless. The resilience of our digital infrastructure depends on it.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Network Portnox 2023

Meet the Team: coffee break with the Managing Director at NordLayer

We had the opportunity to sit down with Donatas Tamelis, the Managing Director at NordLayer, the driving force behind the company’s strategy and vision. He mapped out what sets NordLayer apart in the competitive cybersecurity landscape and how the team plays a crucial role in bringing the company to the top.

Donatas, how many cups of coffee have you already had today?

Only five, and it’s not even the end of the day 🙂

You must be fueled with energy all the time! But, on a more serious note, could you share with us what it takes to be a part of one of the most promising cybersecurity companies in the country and navigate it through the industry challenges?

Well, it happens that I work with companies in their early stages, so NordLayer is no exception. Most early-stage companies share the same denominator – they start from something very small.

I joined the company about four years ago, and even back then, what set it apart was the well-developed product and market positioning. It helped eliminate the unknown factor if the product has any potential and gave the freedom to start strong.

Being there from the beginning has its own magic. Establishing strong foundations and building high-performing teams are key moments for a successful start and ongoing achievements. It’s no secret that jumpstarting a business that develops superior products is an exciting journey for a Managing Director and, I presume, for everyone else involved.

As a leader, how important is the team to you? What are you looking for when you are forming your squad?

I’m happy that now at NordLayer, we have a full leadership team and key people who run the processes and take care of our organization units. Personally, I invest a lot of thought into the hiring process. I carefully interview and select individuals to see if they fit the picture I have for the successful organization direction.

For me, as a manager, the previous experience or future focus fade away compared to what personality traits and attitude the prospect has. It has little to no importance if someone has graduated from Harvard five times. What matters most is our ability to work together and good chemistry.

In a leadership role, it is important to have resilience to stress. Running a business can sometimes lead to very uncertain situations when you don’t know how it’s supposed to be and don’t have an instant solution. And panicking isn’t the way to proceed. So people who manage should listen to others, observe, weather the storm and return to the problem the next day to make informed decisions. When the stakes get high, I choose to work with the team members who exhibit those qualities.

What is your strategy-building process?

My approach is always to have a bottom-up perspective. If you take a helicopter view of the problem, you get a scattered and disjointed overview of priorities. To avoid wasting time, energy and resources, I crystalize the main problems that are really important at the time instead of focusing on a million irrelevant issues that can be addressed later.

I believe that for a leader, it’s important to be present and get their hands deep into the problem. This level of involvement helps clearly understand the situation and manage the expectations for possible outcomes, scope, and the team’s role in it.

Could you name a few top highlights and achievements of NordLayer?

As an organization, we achieve quite a lot in those four years. One of the highlights was creating a fundamental leadership team as the base for organizational growth and progress. From a company evolution perspective, it puts NordLayer in a very good place. The help of balanced leadership enables me to have better insights into the life of every company unit and gauge the team dynamics.

Another achievement is a well-defined product roadmap. We have identified the crucial components, how we validate them, and how we treat external information. Our product management team has introduced a methodical approach to product development strategy.

Knowing that our product solves real customer problems is a huge achievement for our company and all contributors. Through various metrics, such as retention and growth, we can see that there is a demand for the product we create.

What is your idea of standing out as a product in a saturated cybersecurity market?

Mobility, flexibility, and security are the features that lead to current business needs. NordLayer sets itself apart from other cybersecurity solutions by enabling all ways of working in a digital world.

We aim to help businesses make this shift in the most accessible and organization-friendly way, catering to companies of all sizes and structures. With our flexible and easy-to-implement cybersecurity solutions, NordLayer ensures enhanced protection against cyber attacks, surpassing the capabilities of traditional VPNs.

Our driving force is to make complex things easy, so users can enjoy the benefits of the solved problem rather than struggling with it. NordLayer focuses on three key pillars – internet access security, network and resources access management and achieving compliance. This comprehensive approach ensures business network and device security against cyber attacks and potential risks.

I’ve recently had a nice and in-depth discussion with Security Detectives about NordLayer’s focus and unique offering. I’d really like to encourage you to check it out to gain further insights.

Could you reveal what to expect from NordLayer in the near future?

We recently released the NordLayer Browser Extension, an alternative agent to our application that our team worked tirelessly on. We are happy about the successful launch because the extension provides security on a browser level for users who need a lighter option to use NordLayer in various work scenarios.

Firewall as a Service (FWaaS) is the next thing brewing this year. It’s the most significant project in the product’s history to this date in terms of its complexity, resources and competencies. All our focus and development efforts are concentrated on finalizing and launching another element of the Security Service Edge (SSE) framework.

FWaaS will bring NordLayer to a more unified SSE provider, as we already offer Zero Trust Network Access (ZTNA) and Secure Web Gateway (SWG) functionalities. We constantly improve our product, its solutions, and user experience for our customers and partners. It allows us to maintain a clear direction in the ever-evolving cybersecurity landscape.

What would be your tips and recommendations for envisioning and building a business cybersecurity strategy?

When building a strategy, whether cybersecurity or business development, the most essential element is the team. It’s the foundation for a good starting point.

Then it’s crucial to assess the priorities for securing your business. If it’s unclear where to begin, a helpful practice is to break down the OSI levels and audit your organization’s security practices against them. This will give you a better understanding of what to improve and work on first.

Naturally, everything starts from an idea, but taking a constructive approach to a problem helps achieve the best results with minimum resource waste. Balance the team and start with a plan. We at NordLayer know how difficult it may be to grasp the complexity of effective cybersecurity, so we introduced the Decision Maker’s Kit, a guide that leads you through all the stages of creating a cybersecurity strategy.

Thank you.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

NordLayer Nord Security 2023