Skip to content

CrowdSec Security Engine 1.5 is officially here!

The biggest release since 1.0, CrowdSec Security Engine 1.5 brings you new features, major enhancements, and more control of your security management. Discover all that is new in 1.5 and how to get started in this article.

 

We launched a private preview of the CrowdSec Security Engine 1.5 to our community members in March to allow them to test it out and give us feedback. After a few months of testing, it was clear that the CrowdSec Security Engine 1.5 was ready for its debut by the end of May. So here it is, new features, major enhancements and more ways to manage your security. Check out all the updates and what’s new below. You can also read about the increased performance and faster response times when processing high volumes of logs that our community members experienced with the CrowdSec Security Engine 1.5. 

“We are delighted to announce the launch of CrowdSec Security Engine 1.5 today. Following our last release in February 2022, we have been busy listening to our users to deliver a new version with significant enhancements, including the ability to receive “orders” from the console. We have also developed several new features, including compliance and post-exploitation scenarios to the engine. We are also hugely grateful to the CrowdSec community that has been busy testing the release over the last few months to ensure a smooth and successful roll-out for all our users. ” – Thibault Koechlin, Chief Technology Officer, CrowdSec‍‍

Polling API Integration

With the polling API, the Console can now send orders to the CrowdSec instances. Allowing users to manage their decisions (banned IPs at a given time). Let’s dive into what that means. 

Real-time decisions management

The new Polling API gives you the ability to complete real-time decision management within the console. For users with many instances, you can now ban IPs on all of your instances at once, all from the comfort of a single page, rather than running an automation script to update all instances. A great timesaver for SecOps teams.

Teaser: Secure and custom configure the fleet of instances from the Console

In the future, the polling API feature will allow users to set up parsers and scenarios directly from the CrowdSec Console.

New Blocklist API and Premium Blocklists

We recently announced the external IP blocklists which allow all of our users to subscribe to at least 2 (new) additional blocklists created by the CrowdSec team, in addition to our community fuelled blocklist to better protect your instances.  

Viktoria Rei Bauer (@ToeiRei on Discord, Twitch, and Twitter), CrowdSec Ambassador, saw a 190% increase in blocked IP addresses after implementing CrowdSec’s new Blocklist API and subscribing to 2 new blocklists. 

“My average number of IP blocks was 2,000 per day. The day isn’t even over and I’ve already blocked 6,000 IPs.”

The chart below shows the impact the blocklist subscription made to Rei’s CrowdSec pfSense deployment. The red line shows the implementation of the blocklists that resulted in a 183% increase of malicious IPs blocked, peaking at a 400% increase.

‍

Kubernetes audit acquisition

The feature we presented at Kubehuddle UK 2022 is finally here:

Kubernetes Cluster Monitoring now gives our users the ability to monitor and protect their whole K8s cluster, and not just the services running on it.

S3 audit acquisition

CrowdSec now supports reading logs stored in S3 bucket, allowing you to process logs generated by AWS services (such as ALB access logs or Cloudfront logs).

Auditd support

Allows for the detection of “Post Exploitation Behaviors”, including:

  • base64 + interpreter (perl/bash/python)
  • curl/wget and exec
  • pkill execve bursts
  • rm execve bursts
  • exec from suspicious locations

CrowdSec CTI API helpers

You can now query CrowdSec’s Cyber Threat Intelligence (CTI) from your parsers and behavior scenario thanks to our new CTI API, allowing you to react to each threat differently according to each IPs reputation and classification.

This new CTI API allows CrowdSec and the CTI to be more interactive with each other, allowing users to query more information around a specific IP. For example, you can now query the machine’s usage, as well as the type of attack it relates to. CrowdSec is now able to query all this data in real-time, helping users to detect false positives, and also reducing alert fatigue. 

AWS Cloudtrail Scenarios

Thanks to 1.5’s new behavior detection capabilities, we were able to create an advanced AWS Cloudtrail scenario helping you to detect and better understand what’s happening on your cloud. Below you can see a list of activities you are now able to detect.

  • Detect AWS CloudTrail configuration change
  • Detect AWS Config configuration change
  • Detect AWS console authentication failure
  • Detect AWS IAM policy change
  • Detect AWS KMS key deletion
  • Detect login without MFA to the AWS console
  • Detect AWS NACL change
  • Detect AWS Network Gateway change
  • Detect AWS root account usage
  • Detect AWS route table change
  • Detect AWS S3 bucket policy change
  • Detect AWS Security Group change
  • Detect AWS API unauthorized calls
  • Detect AWS VPC change

Feature flag support

This new feature allows us to have some features within the Security Engine that are disabled by default but can be activated manually by the user.

This will facilitate the inclusion of beta features safely and give more chances to the community to preview what’s coming and help us test the features in a range of use cases. 

Detection Engine improvements

  • Conditional buckets: an improvement of our behavior detection system allows for more complex expression for the alert triggering mechanism
  • Event data stash: allows parsers to capture data for future enrichment. Adding the capability to detect advanced malicious behaviors

CAPI Allowlist

While the community blocklist is highly curated, and designed to avoid false positives, sometimes a shared IP used by both innocent and malicious actors will end up in it, so we’ve added the capability to create allowlists that can also be applied to the community-powered blocklist.

Conclusion

We would like to thank our community of users who have helped us reach this major milestone! Thanks to your feedback we have been able to create a release that truly caters to your needs and enhances your use of CrowdSec. 

Interested in using CrowdSec Security Engine 1.5? If you haven’t already, install the CrowdSec Security Engine and then, sign-up for the CrowdSec Console. We will also be hosting a live webinar to go over all the new features and enhancements! 

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About CrowdSec

Thibault & Philippe, two of CrowdSec’s founders, used to work in high security hosting, which was a relatively new field back in the 2010’s. They designed a protection stack which would also block IPs that made violations.

One day, one of their clients, a famous sports-oriented e-commerce shop was under attack. It was not a real problem since it was protected by a robust stack, but the hacker used more than 3,000 IP addresses to try to attack the website. This event caused the idea that would be the genesis of CrowdSec.

New IP External Blocklists

All users on the CrowdSec Console can now subscribe their instances to third-party blocklists cherry-picked by our expert team. With these 14 blocklists, including 3 premium ones, you can secure your systems against VoIP fraud, botnets, and more.

We are excited to announce that we just released the new Blocklists tab in the CrowdSec Console. All users can now subscribe to two of the 11 free third-party blocklists. And, if you are an Enterprise user, you have access to 3 premium blocklists with no limit to the number of blocklists you subscribe an instance to.

The Blocklists you can subscribe to

The blocklists contain IPs that come from various proxies, tor nodes, and known scanners. One of the blocklists you can find is the Firehol voipbl.org list which includes a distributed VoIP blacklist that is aimed at protecting against VoIP fraud and minimizing abuse for networks that have publicly accessible PBX’s. Another is the TOR Blocklist which contains tor exit nodes’ IP addresses. You can also stay protected against IPs belonging to botnets with CrowdSec’s very own aggregated list (part of the premium blocklists). 

Bots and attackers often try to hide their malicious activities using proxies and tor nodes. Therefore, once you have subscribed to one of the blocklists, you might want to apply remediation to those IPs, either by blocking them, validating they are genuine humans via CAPTCHA, or any custom remediation you might have implemented on your bouncer.

Dive a little deeper

Before subscribing to a blocklist, you can see the number of IPs the list currently has as well as how many have been added and removed in the last month and in the last 2 days. 

Information for the Firehol BotScout Blocklist

All of the third-party blocklists provided were cherry-picked by the expert team at CrowdSec from reliable websites.

How to subscribe to a blocklist 

Log into the Console, and click on the new ‘Blocklists’ tab under Instances. Click on the ‘Subscribe’ button next to the blocklist you want. You can then select the instances from your park that you’d like to subscribe to this blocklist and then, choose what type of remediation should be applied to this blocklist.

https://www.youtube.com/embed/GUOUGZHIGDM

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About CrowdSec

Thibault & Philippe, two of CrowdSec’s founders, used to work in high security hosting, which was a relatively new field back in the 2010’s. They designed a protection stack which would also block IPs that made violations.

One day, one of their clients, a famous sports-oriented e-commerce shop was under attack. It was not a real problem since it was protected by a robust stack, but the hacker used more than 3,000 IP addresses to try to attack the website. This event caused the idea that would be the genesis of CrowdSec.

Single Sign-On: What it is and how it works

Nowadays, single sign-on (SSO) authentication is required more than ever. Many websites offer users the option to sign up with Google, Apple, or any other service. Chances are you have logged in to something via single sign-on today or at least this week. But do you know what it is, how it works, and why it’s used? Take a deep dive into the world of single sign-on and all things related to it.

What is SSO?

Single sign-on is a session and user authentication service that allows the user to use a single set of login credentials – namely, a username and password – to access multiple websites or applications. Put plainly, SSO allows users to sign up and access a variety of online accounts with a single username and password, thus making things a lot easier for the everyday user. SSO’s primary use is as an identification system that permits websites and apps to use the data of other trusted sites to verify a user upon login or sign-up.

Essentially, SSO puts an end to the days of remembering and entering multiple passwords. An added bonus is that SSO gets users out of the vicious password reset loops.

Additionally, SSO can be great for business, as it improves productivity, security control, and management. With a single security token (a username and password), IT professionals can enable or disable a user’s access to multiple systems, which in some cases mitigates cybersecurity risks.

So, how does the magical service work?

How does SSO work?

Single sign-on is a component of a centralized electronic identity known as federated identity management (FIM). FIM, or Identity Federation, is a system that enables users to use the same verification method to access multiple applications and other resources on the web. FIM is responsible for a few essential processes:

  • Authentication

  • Authorization

  • User attributes exchange

  • User management

When we talk about SSO, it is important to understand that it is primarily related to the authentication part of the FIM system. It’s concerned with establishing the user’s identity and then sharing that information with each platform that requires that data.

Fancy jargon aside, here are the basic operational processes of single sign-on:

  • You enter a website.

  • You click “Sign In with Apple” or any other service.

  • The site opens Apple’s account login page.

  • If you’re already logged in, then it gives the site your data.

  • You are logged in to your Apple account.

  • Apple’s site verifies that you are authorized to access the site.

  • If you’re authorized, the site creates a session for you and logs you in.

In technical terms, when the user first signs in via an SSO service, the service creates an authentication cookie that remembers that the user is verified. An authentication cookie is a piece of code stored in the user’s browser or the SSO service’s servers. Next time the user logs in to that same app or website using SSO, the service then transfers the user’s authentication cookie to that platform, and the user is allowed to access it. It’s important to highlight that an SSO service doesn’t identify the exact user since it does not store user identities.

What is an SSO Token?

An SSO token is a digital unit that contains data about a particular user such as their email address. The token is used to transfer user information from one system to another during the single sign-on process. For the recipient to verify that the token comes from a trusted source, it has to be signed digitally.

The SSO service creates a token whenever a user signs in to it. The token works like a temporary ID card which helps identify an already verified user. This means that when the user tries to access a given app, the SSO service will need to pass the user’s authentication token to that app so they can be allowed in.

Password security for your business

Store, manage and share passwords.

Get NordPass Business

30-day money-back guarantee

Single-Sign-On Costs

Because many of the SSO solutions currently available on the market are cloud-based, most of them are offered in a monthly subscription model. The price of a cloud-driven SSO solution designed for small and mid-sized businesses can range from $1 to $10 per user per month.

However, those that want to get an SSO solution designed for a big enterprise will need to either pay more each month or make an entry fee. Enterprise-grade solutions are usually more wide-ranging and require vendors to customize them to each of their client’s needs and requirements. Hence, the price difference.

Is single sign-on secure?

Yes. An SSO protocol is secure when implemented and managed properly and used alongside other cybersecurity tools.

The main benefit introduced by single-sign on with regard to cybersecurity is that, because it allows using a single set of credentials for multiple services, there are fewer login details to be lost or stolen. As long as the server is secure and an organization’s access control policies are established, a malicious user or an attacker will have little to no chance to do any damage.

However, this benefit could also pose a certain kind of risk. Since SSO provides instant access to multiple accounts via a single endpoint, if a hacker gains access to an authenticated SSO account, they will also gain access to all the linked applications, websites, platforms, and other online environments.

This issue can be easily mitigated by implementing an additional layer of security known as Multi-Factor Authentication. Combining SSO with MFA allows service providers to verify users’ identity while giving them easy access to applications or online platforms.

The benefits of SSO

Reduced password fatigue

With SSO in place, users only have to remember one password, making life a lot easier. Password fatigue is real and dangerous. SSO encourages users to come up with a single strong password rather than using a simple one for each account separately. It also helps users escape the vicious cycle of password reset loops.

Increased employee and IT productivity

When deployed in a business setting, SSO can be a real time saver. According to a recent report, people waste 16.3 billion hours a year trying to remember, type, or reset passwords. In a business environment, every minute counts. Thanks to SSO, users don’t need to hop between multiple login URLs or reset passwords and can focus on the tasks at hand.

Enhanced user experience

One of the most valuable benefits of SSO is an improved user experience. Because repeated logins are not required, users can enjoy a digital experience with less hassle. This means that users will be less hesitant to use the service. For any commercial web-based service, SSO is an essential part of their user experience.

Centralized control of user access

SSO offers organizations centralized control over who has access to their systems. In a business setting, you can use SSO to grant new employees specific levels of access to different systems. You can also provide employees with a single set of credentials (username and passwords) to access all company systems.

Top single sign-on solutions

Microsoft Azure AD

Microsoft Azure AD includes Active Directory Federation Services (AD FS) as an option to support SSO. Azure AD also offers reporting, security analytics, and multi-factor authentication services. It’s perfectly suited for any company that uses the Microsoft Azure cloud platform, no matter its size.

Okta Identity Cloud

Okta is well-established in the world of SSO solutions. They are open-source SSO leaders because of their flexibility and ease of use. Okta offers customizable open identity management in real time according to business needs, as well as two-factor authentication and a password reset functionality. Okta can serve the needs of multiple industries, from education and nonprofits to financial services and the government.

OneLogin Unified Access Management Platform

OneLogin is an open-source SSO provider that is often used for employee access to the company’s cloud-based applications. OneLogin is suited for a variety of IT administrator needs since it is designed to enforce IT policy in real time. It can also be updated according to specific needs if any changes occur, such as an employee leaving.

Idaptive Application Services

Idaptive is primarily suited for small to medium-sized businesses. Idaptive is capable of providing support to many users at once, thanks to their new cloud architecture. The company also offers adaptive MFA, enterprise mobility management (EMM), and user behavior analytics (UBA) all in a single solution.

Ping Intelligent Identity Platform

Ping offers services to large enterprises. The solution can serve anywhere between a few hundred to a few million users. Ping provides both on-premises and cloud options for deploying their solution. Additionally, the service comes with multi-factor authentication.

Does NordPass provide SSO?

Yes, NordPass does provide a single sign-on authentication! It can be set up via NordPass Admin Panel for users who want to log in to the NordPass app with their Microsoft Azure, Google Workspace, or Okta credentials.

This means that if you turn on Microsoft Azure Active Directory (AD), Google Single Sign-On, or Okta Single Sign-On, and invite new members who use one of these SSOs, they will be allowed to login in using their Azure AD, Google, or Okta SSO credentials — it’s as simple as that.

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Storage Beyond Passwords: Securely Save Files in NordPass

Ever been in that awful situation where you’re going through old emails or disorganized folders trying to find that one crucial document? The insurance form, an e-copy of your ID, or even a video detailing how to get into your new office? Wouldn’t it be a game-changer if you had all your important files right next to your passwords, credit card information, or secure notes?

Good news! Today, we are excited to introduce File Attachments — a new and improved way to manage important files with NordPass.

Best for large file attachments

Here’s a quick rundown of how it works. As a NordPass Premium user, you now have the ability to attach files to your saved items in NordPass. It’s not just about enhancing organization. This feature also provides an unmatched level of security. Forget the hassle of disorganized unsafe file storage. Any attached files or documents will be as secure as your passwords thanks to our encrypted storage.

But we didn’t stop at mere functionality. NordPass Premium now provides a whopping 3GB of encrypted storage per account, a giant leap forward. That’s not just more — it’s three times more than any other password manager out there! We’re offering you unrivaled storage and advanced security — and that’s certainly what we call more bang for your buck!

NordPass — The best password manager for large file attachments.

– Attila Tomaschek

CNET

No strings attached (except your files)

With NordPass Premium’s File Attachments, you have the freedom to store documents of any type to one of your existing items. Whether it’s a simple JPEG, PDF, MP4, or DOC file — NordPass supports them all.

Supported file types

The new feature allows for files up to 50MB in size and up to 50 attachments per single item. The only limit is your 3GB storage per user — and that’s a whole lot of space for your files.

While we aim at maximizing convenience, your security is always our top priority. To ensure maximum protection, we currently do not support attaching files to shared items or sharing items with files attached.

You can learn more about how to attach files to your NordPass items in our handy help center article.

Streamline your digital life with NordPass

In the digital age, we often juggle tons of files, documents, and data, and that can lead to a disorganized and chaotic personal digital space. With our new File Attachments feature, we look to help you take back control and streamline your digital life by allowing you to save documents in a quick and efficient way

With NordPass Premium, you can now attach important files to all your saved items. Store any file in one secure place with 3GB encrypted storage.

Instant access

When you’re in a hurry, having quick access to your important documents can make all the difference. That’s where File Attachments shine. Need to view a copy of your ID or an important receipt? No problem! With File Attachments, all your vital images or documents are just a few clicks away.

Effortless downloads

It’s not just about attaching and storing your files along with your passwords. It’s also about being able to retrieve them whenever necessary. Suppose you’ve stored financial documents that you need to share with your spouse. With File Attachments, you can quickly and effortlessly download these files directly from NordPass.

Unprecedented control

The File Attachments feature isn’t just about adding another functionality to NordPass. It’s about giving you greater control over your digital life. You get to decide what files to attach, what items those files are attached to, and when to download or delete them. You can also organize your vault in a way that best suits your personal or professional needs.

A single secure place for files and passwords

Take your password manager experience to the next level with NordPass Premium. Don’t just manage your passwords, manage your life. No more scrambling for documents, no more disorganized files, and certainly no more compromised security.

Your life. Your files. One secure place. Start your NordPass Premium journey today and make the most of our File Attachments feature.

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

23.3.9 ‘Voyager’ released

Changes compared to 23.3.8

Bug Fixes

  • Fix an issue with macOS devices failing to log in with an ERR_UNKNOWN_DEVICE error
  • Fix an issue with the Recent Activity and Policies pages not loading correctly when hard-refreshed or loaded directly via URL
  • Fix an issue with Comet default branding not presenting correctly following a server upgrade

About Version 2
Version 2 is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×