Skip to content

Backup Appliance: How to Simplify Backup and Gain More Control

Complicated systems, dispersed data, information silos, and pressure to simplify. IT environments today balance the need for security with limitations of time, people, and budget. Storware Backup Appliance addresses these challenges—combining simplicity, automation, and a Zero Trust philosophy in one ready-to-use device.

Although there’s increasing talk about the need to simplify IT infrastructure, many server rooms still operate with isolated data repositories. Information is stored and managed in separate systems, which makes it difficult to share data between teams and departments within an organization. Such data dispersion limits monitoring capabilities and hinders the detection of unauthorized activities. It’s hard to protect what you can’t see and don’t have full control over. Each of these “silos” may require a separate approach to backup and Disaster Recovery, further complicating backup and data recovery processes.

Another challenge is the phenomenon of data gravity—the tendency of large data sets to attract applications, services, and additional resources. The more data accumulated in one place, the harder and more expensive it is to move. Migrating a large repository from an on-premise server room to the public cloud can take days or even weeks—or require physical transport of media. Meanwhile, new applications are being developed in the same environment that—instead of using distant services—opt for fast, local data access.

At first glance, data gravity and data dispersion seem to be opposing phenomena. In practice, however, they coexist and reinforce each other. Data remains in silos not because there’s no need for consolidation, but because its migration is often too expensive, time-consuming, or risky. In other words, it “gravitates” to a specific environment (local or cloud) and stays there.

Siloses stem from organizational, technological, and cultural divisions, while data gravity results from physical and economic processing limitations.

A real-world example: the sales and marketing department uses a CRM system in a SaaS model, with customer and campaign data located in the public cloud. In contrast, the finance department works on a local ERP system, whose data is stored on an SQL server within the company. As a result, each department operates in its own digital world, and collaboration—such as analyzing the impact of a marketing campaign on sales—becomes difficult. Migrating ERP data to the cloud involves process reengineering, significant costs, and risks.

Meanwhile, IT departments are fighting on many fronts. They handle routine, urgent tasks that—though essential—don’t add significant strategic value. They are also often responsible for the entire infrastructure: from hardware and software to configuration and user support.

Backup? It’ll Get Done After the Failure… Still Relevant Pitfalls in Data Security Thinking

A separate, but extremely important issue remains the attitude of clients themselves. Many companies still ask themselves: “Why do I need a backup if everything is working?” or “Why change systems if the current ones are functioning flawlessly?”

Costs are the most frequently cited barrier to investing in new solutions. Often, the only argument that convinces management to act is… a failure. Even in large organizations employing hundreds of people, it happens that management consciously limits IT and security spending, literally waiting for an incident to occur.

Meanwhile, regulatory pressure is growing—another regulation is set to come into force in June, expanding data protection obligations to all key companies. This will be a quick and, for many, surprising change. Despite this, the thinking that “it doesn’t concern us” still prevails. However, in today’s reality, attacks, ransomware, and incidents are not a matter of “if,” but “when.”

It’s also worth emphasizing that although the price of storage per terabyte is regularly decreasing, maintaining a consistent, secure data environment still requires investment—in people, procedures, and technologies.

Furthermore, a new, dangerous illusion has emerged: that migrating to the cloud—for example, to Microsoft 365 or Azure—relieves the organization of responsibility for backup. This is a myth. The responsibility for data protection and recovery still lies with the client. Cloud providers are responsible for the infrastructure, but not for user data.

Less Sometimes Means More

In an era of relentless cyberattacks, information security is of fundamental importance. What matters is not just the backup itself, but also the speed of reaction, reliability, readiness for change, and ease of management. Equally important are: intuitive device operation, universality, and seamless integration with both local infrastructure and the public cloud.

Our approach focuses on maximizing the simplification of IT systems. On one hand, we provide comprehensive data protection; on the other, we reduce the need to maintain separate backup systems, which are often expensive and complicated to operate. We operate on the principle that sometimes, less means more.

Storware Backup Appliance is a ready-to-use device that integrates hardware with software. Setup takes just a few minutes, and configuration and daily operation are almost maintenance-free.

The solution is based on the ZFS file system, which guarantees: data integrity, advanced compression, easy snapshot creation, and deduplication providing up to 5:1 space savings.

Backups are performed synthetically, and the appliance’s architecture allows for efficient operation even under heavy load—the only potential limitation is the client’s network infrastructure.

Storware Backup Appliance is available in three variants: SBA 1020 (maximum capacity 100 TB), SBA 2050 (up to 250 TB), and SBA 2100 (up to 500 TB). The solution not only secures data but also ensures its efficient storage. Thanks to ZFS deduplication, it’s possible to achieve up to 5:1 space savings. Backups are created synthetically, and the appliance’s architecture allows for efficient operation even under heavy load—the only potential bottleneck might be the client’s network infrastructure. Expected performance is approximately 0.5 TB per hour for a 64 KB block or 7 TB per hour for 512 KB.

Do It Yourself? Not Necessarily

An alternative to ready-made backup solutions are so-called DIY backup appliances—environments created and configured independently by IT teams, often based on existing infrastructure. This approach might seem cost-effective, but in practice, it involves greater complexity, risk, and a lack of unified technical support.

In the event of a failure, there’s no single point of contact—the responsibility for analyzing and solving the problem falls entirely on the internal team. This requires not only specialized knowledge but also the availability of people and resources 24/7.

DIY can be a good choice for organizations with large IT teams and very specific requirements. For most companies—especially those prioritizing simplicity, security, and reliable support—complete platforms provided by specialized vendors are a better solution.

Every Storware appliance is prepared individually—with a pre-installed and configured operating system, backup environment, and optimal settings. Once connected to the infrastructure, the device is ready to work—without time-consuming configurations and the risk of errors. The solution is based on enterprise-grade components: server processors, ECC memory, and disk systems optimized for intensive write operations and data deduplication. This is not just an ordinary server, but a specialized environment for data protection.

Of particular note is Paranoid Mode—a unique, proprietary RAID configuration that ensures continuous operation even in the event of a simultaneous failure of four disks. The automatic failover mechanism works automatically—without the need for administrator intervention.

Storware Backup Appliance supports a wide range of environments: virtualization (VMware, Hyper-V, KVM, Citrix, Nutanix, VergeOS), clouds (AWS, Azure, Google Cloud), container platforms (OpenShift, OpenStack), and physical infrastructure. One device provides consistent protection for all these environments—physical, virtual, and containerized—from a central point.

Security and Simplicity – Storware Backup Appliance in Practice

Modern IT environments demand solutions that are not only effective but also as user-friendly as possible and secured at multiple levels. Storware Backup Appliance demonstrates how these goals can be achieved in practice, based on the Zero Trust philosophy, intelligent automation, and a high level of component integration.

One of the key security elements in this solution is the use of the ZFS file system, which ensures not only data integrity but also effective protection. Data is stored by default on an encrypted ZFS pool, which is not automatically decrypted after a restart—physical password entry by the user is required.

The system also utilizes a TPM module, which enables automatic decryption of system partitions and those containing the library and database. This ensures the device remains fully operational, while simultaneously preventing an attacker from reading stored information if the disks are physically seized. Data access is secured in multiple layers. The end-user receives a 20-character encryption key, and for technical support, access to deeper system layers requires additional login credentials—complex passwords and 2FA authentication, available only to selected individuals within support and sales structures. The entire procedure is centrally documented, and access to the most critical components is secured with additional passwords and physical keys. This approach—though it may seem overly cautious—effectively prevents unauthorized access, even in the event of physical seizure of the device.

Storware Backup Appliance proves that a high level of security doesn’t have to mean complexity. On the contrary—properly designed mechanisms integrating encryption, access control, and automation create a system that is simultaneously easy to use, resistant to physical attacks, and compliant with best security practices.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Storware
Storware is a backup software producer with over 10 years of experience in the backup world. Storware Backup and Recovery is an enterprise-grade, agent-less solution that caters to various data environments. It supports virtual machines, containers, storage providers, Microsoft 365, and applications running on-premises or in the cloud. Thanks to its small footprint, seamless integration into your existing IT infrastructure, storage, or enterprise backup providers is effortless.

Secure Remote Desktop for MSPs: Scale Revenue & Security with Thinfinity® Workspace

 

Introduction

Managed service providers (MSPs) are staring at a perfect storm of opportunity: the remote‑desktop software market will more than double from $2.75 billion in 2024 to $6.13 billion by 2029 (18.3 % CAGR). Clients need friction‑free access for hybrid workforces, but they also demand airtight protection against the surge in RDP and VNC attacks. Delivering a secure remote desktop service has become the fastest path to new monthly recurring revenue—if you have the right platform. Thinfinity Workspace gives MSPs that edge with built‑in Zero Trust, clientless HTML5 delivery, and multitenant management.

MSPs Opportunity in Secure Remote Desktop: Market Growth, Client Needs, Security, Thinfinity Workspace.

Why “Secure Remote Desktop” Is Mission‑Critical for MSPs

  • Exploding demand: Hybrid work makes secure, always‑on access a priority budget line for SMBs.
  • Attack surface chaos: VNC generated 98 % of traffic on remote‑desktop ports in 2023, with RDP exploits close behind—legacy VPN tunnels can’t keep pace.
  • High‑margin services: Clients will pay for managed security; MSPs that solve the problem first earn stickier contracts and higher ARPU.

Challenges in Secure Remote Desktop for MSPs: Market Demand, Attack Surface, Legacy VPNs, Service Opportunities.

Thinfinity Workspace: The Purpose‑Built Secure Remote Desktop Platform

1. Zero Trust Network Access (ZTNA) from Day One

Thinfinity Workspace enforces “never trust, always verify” for every session—no external add‑ons required. Granular policies authenticate and authorize each user, device, and context before a connection is allowed.

2. Reverse Gateway + Clientless HTML5 Access

RDP, VNC, and SSH sessions travel through a reverse gateway in an SSL/TLS tunnel, so you never open inbound ports on customer firewalls. End users launch desktops or RemoteApps from any modern browser—no client installs, no version drift, fewer tickets.

Thinfinity Workspace features →

3. Hybrid & Multicloud Console for MSP Efficiency

Manage on‑prem clusters and any major public cloud—Azure, AWS, OCI, or GCP—from one secure dashboard. Spin up, brand, update, and monitor unlimited customer tenants while built‑in load balancing and autoscaling keep performance steady and costs predictable.

4. Native Cloud Integrations & Automated Provisioning

Thinfinity Workspace ships with out‑of‑the‑box APIs and Terraform modules that hook directly into your clients’ cloud accounts. Automate VM creation, gateway deployment, scaling policies, and identity bindings so new secure‑remote‑desktop environments come online in minutes—not days.

5. Seamless Identity Integration

Plug into Active Directory, Azure AD, Okta, or any SAML/OAuth provider to deliver single sign‑on and MFA that satisfy even the strictest audit teams. 

6. Cost‑Efficient Citrix & VPN Alternative

Thinfinity Workspace packages remote application delivery, VDI, and secure gateway functions in one license—no complex editions or third‑party brokers—making it an easy upsell against Citrix or legacy VPN solutions.

Learn more →

Enhancing Remote Desktop Security: Zero Trust, Identity, Secure Gateway, Automation, Hybrid Cloud.

Implementation Blueprint for MSPs

PhaseWhat You DoOutcome
1. Select Your Deployment ModelChoose Fully‑Hosted Cloud (Azure, AWS, OCI) for zero infrastructure, or On‑Prem/Hybrid if clients need local data residency. Thinfinity brokers and gateways are containerized, so switching models later is drag‑and‑drop simple.Right‑sized costs, compliance alignment, and faster time‑to‑value for every client.
2. Trial & SandboxActivate your 15‑day MSP trial, spin up a dedicated tenant, and import a pilot client (10–25 users). Leverage Thinfinity’s “one‑click” reverse gateway to avoid opening inbound ports.Hardware‑free proof‑of‑concept that showcases secure remote desktop performance and Zero Trust workflow.
3. Policy Templating & AutomationCreate global templates for MFA, ZTNA zones, and micro‑segmentation. Tag them to security profiles (e.g., Finance, Dev, Guest) and set them to auto‑inherit when you add new tenants.Consistent, audit‑ready security with near‑zero manual effort—every client starts compliant.
4. Partner Program OnboardingEnroll in the Thinfinity MSP Partner Program (Silver, Gold, Platinum). Gain co‑branding assets, deal‑registration protection, and tier‑based margin boosts.Marketing muscle and higher ARPU, plus priority roadmap input as you climb tiers.
5. Go‑Live & UpsellPublish branded HTML5 portals, enable real‑time usage analytics in the multitenant console, and bundle add‑ons—backup, DRaaS, SOC monitoring—into premium plans.New high‑margin recurring revenue and a “single pane” view that slashes support tickets by up to 40 %.
6. Continuous Co‑Sell & SupportTap Thinfinity’s technical SE team for pre‑sales demos, architecture reviews, and POC guidance; lean on the channel desk for joint campaigns and MDF funds.Faster deal cycles, expert coverage on every opportunity, and happier, stickier customers.

Quick Tip: Whether you deploy fully hosted or on‑prem, every tenant lives in its own micro‑segmented enclave—so scaling from one SMB to a hundred never compromises security or performance.

Thinfinity Workspace Features: Security, Fast Onboarding, Identity, Multi-Cloud, MSP Trial.

 

About Cybele Software Inc.
We help organizations extend the life and value of their software. Whether they are looking to improve and empower remote work or turn their business-critical legacy apps into modern SaaS, our software enables customers to focus on what’s most important: expanding and evolving their business.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

How to manage passkeys on Android

Wait… what are passkeys, again?

For those who don’t know, passkeys are a new authentication method designed specifically to allow users to log in to their online accounts securely—but without the need for passwords. The goal is to leverage technological innovation to improve both cybersecurity and user convenience. How does it work?

Each passkey uses a pair of cryptographic keys: one public key stored on the app or website’s server, and one private key that stays on your device. When you log in, the server sends a request with the public key to your device, which then responds with the private key. If both keys match, you’re granted access.

Since the private key is safely stored on your device and never leaves it, the risk of unauthorized access is much lower. That’s also because passkeys, unlike passwords, can’t be cracked, guessed, or easily stolen. And the cherry on top is that, with passkeys, you don’t have to remember or type in anything—you can just quickly and safely access your accounts.

Passkey requirements for Android

At this point, it’s worth noting that not all Android versions or devices fully support passkeys. So, if you’re thinking about going passwordless, you should keep that in mind, especially if you plan to use a third-party passkey provider like NordPass. Here’s a quick breakdown of which Android versions support passkeys—and how far that support goes.

Android versionPasskey support
Android 9 (Pie)Basic passkey support—works only with external security keys (e.g., YubiKey).
Passkeys are stored locally (no cross-device synchronization).
Android 10/11/12Improved integration with browsers and apps via WebAuthn.
Android 13Full native passkey support.
Integrated with Google Password Manager for syncing across devices.
Biometric or screen lock authentication.
Android 14Support for third-party passkey providers (e.g., NordPass).
Enhanced multi-device syncing and usability.
Android 15More seamless cross-platform passkey usage.
Improved user experience in apps and websites.

As for the other software and hardware requirements for running passkeys on Android, the good news is that most modern Android devices already meet them. This means that if you purchased your device in late 2023 (when Android 14 was launched) or later, it most likely has full support for third-party passkeys.

Still want more details? Here are the key technical requirements your Android device must meet to use passkeys:

  • Your device must have a trusted execution environment (TEE) or secure element (SE) component for storing cryptographic keys.

  • Biometric authentication or a screen lock must be enabled.

  • The Google Play Services app needs to be up to date.

  • You must have an internet connection to sync passkeys across devices.

How to create and save a passkey on your Android device

The process of setting up, creating, and storing passkeys on your Android device can be a bit different depending on a few factors—like which version of Android you have, the passkey provider you’re using (such as Google’s native option or a third-party service like NordPass), and the websites or services you want to use passkeys for. That said, creating passkeys usually involves the following steps:

  1. Enable the lock screen on your Android device (if you haven’t already).

  2. Go to a website or app that supports passkey logins.

  3. Choose to sign up with a passkey option. (If you already have an account, go to the account settings and find the passkey login option.)

  4. Follow the on-screen instructions to create a passkey.

  5. Confirm and save the passkey using your device’s built-in biometrics.

Once confirmed, your new passkey will be stored in your default passkey provider—if you have Android 14 or later, you can choose that to be either Google Password Manager or a third-party solution like NordPass.

How to log in with a passkey on Android

Logging in with a passkey to a website or app is super easy—way easier than using a password. Here’s how it goes:

  1. Go to the website or open the app where you’ve saved your passkey.

  2. Select the option to log in with a passkey (it’ll usually say something like “Use passkey” or “Sign in with passkey”).

  3. Authenticate by following the on-screen prompts (like using your device’s fingerprint scanner or Face ID).

That’s it! If the two cryptographic keys match, you’ll get instant access to your online account or app.

Using passkeys on Android with NordPass

While NordPass is best known as a password manager, it’s also fully equipped to support passkey technology across all major platforms and browsers—and it was one of the first to do so! This is because we believe passwordless authentication is the way forward, and we want you to experience it with top-tier security and ease.

Getting started with passkeys in NordPass is really simple. Just install the NordPass app on your device and set it as your primary passkey manager in your device’s “Passwords and Accounts” settings. Once that’s done, NordPass will prompt you every time you want to create or log in with a passkey, guiding you through the process.

Managing your passkeys in NordPass is also a breeze—they’re stored securely in your vault under a dedicated item category. There, you can easily see when each passkey was created, share them with trusted people without compromising your security, and even add secure notes to help you keep track of important details for any service or account.

For a step-by-step guide on using passkeys with NordPass, check out our Help Center article, where we cover everything from passkey setup to login.

 

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Inside the World’s Largest Cyber Defense Exercise: Lessons from Locked Shields 2025 with Joseph Carson, Advisory CISO for Segura®

How do you prepare for the kind of cyberattack that could shut down a country?

This isn’t a theoretical scenario. NATO’s Locked Shields is the world’s most advanced live-fire cyber defense exercise. In 2025, nearly 4,000 cybersecurity experts from 41 nations came together to defend against more than 9,000 simulated attacks. These weren’t simple technical challenges. Participants were tasked with defending critical infrastructure – energy grids, financial systems, military communications – while simultaneously managing legal decisions, strategic communications, and crisis leadership.

Among this year’s participants was Joseph Carson, Segura®’s new Advisory CISO and Chief Evangelist, backed by Evandro Gonçalves, our Principal Solutions Architect & Presales Technical Lead, and Yago Lissone, our Security Analyst. Joseph’s experience on the front lines of Locked Shields 2025 offers critical insights into the future of cybersecurity defense and what organizations must do today to strengthen their resilience.

Before we share his first-hand account, here’s why Locked Shields remains one of the most important exercises for global cyber defense and why leaders like Joseph play a vital role in shaping modern security strategies.

‍

About NATO’s Locked Shields: Where Cyber Defense Meets Reality

Organized annually by NATO’s Cooperative Cyber Defence Centre of Excellence (CCDCOE), Locked Shields is the largest and most sophisticated real-time cyber defense exercise in the world.

Each year, participants face a series of highly realistic cyberattacks designed to simulate the technical, operational, and strategic complexity of a full-scale cyber crisis. In 2025, the scenario focused on defending the fictional nation of Berylia, whose government, critical infrastructure, and military networks came under sustained attack.

Over two days, Blue Teams worked around the clock to prevent catastrophic failures in essential services while navigating political pressure, disinformation campaigns, and legal response challenges. The objective: test not only their technical defenses but their ability to lead through crisis under extreme pressure.

As Mart Noorma, Director of the CCDCOE, noted:

“In a world where cyber threats cross every border, Locked Shields proves that resilience in cyberspace is built together.”

‍

Meet Joseph Carson: A Global Leader in Cybersecurity Resilience

Joseph Carson is an award-winning cybersecurity professional with over 30 years of experience in enterprise security and critical infrastructure protection. As Segura®’s Chief Security Evangelist and Advisory CISO, he focuses on identity security and helping organizations build resilient cybersecurity strategies capable of withstanding today’s most advanced threats.

Joseph holds CISSP and OSCP certifications and actively advises governments, critical infrastructure sectors, and global enterprises on strengthening security postures against evolving cyber risks.

He is the author of the widely recognized Cybersecurity for Dummies, read by more than 50,000 professionals worldwide, and regularly contributes expert insights to leading publications including The Wall Street Journal, Dark Reading, and CSO Magazine.

With a passion for advancing cybersecurity as a people-first mission, Joseph helps organizations integrate technology, processes, and leadership strategies to drive long-term resilience. Now, at Segura®, he brings this field-tested expertise directly to organizations working to secure privileged access, protect identities, and stay ahead of the next critical threat.

‍

‍

Inside the Action: An Interview with Joseph Carson

We spoke with Joseph shortly after his return from Locked Shields 2025 to discuss his experience and the critical lessons every organization can apply from this global exercise.

Q: Could you describe your role and responsibilities during Locked Shields 2025?

Joseph Carson:
“In Locked Shields 2025, I served as a Blue Team Defender with a specific focus as a subject matter expert on credential protection. My responsibilities included securing authentication systems, monitoring for potential credential abuse, and responding rapidly to any threats targeting user accounts. I was also on standby to provide urgent support to teammates across different domains, ensuring we could respond to critical incidents without delay.”

‍

Q: What were some of the key challenges your team faced during the exercise?

Joseph Carson:
“One of the biggest challenges was maintaining situational awareness across multiple systems while under continuous and sophisticated attack from the Red Team. Coordinating responses in real time, especially during credential-based attacks or privilege escalation attempts, tested both our technical skills and our ability to communicate under pressure. The pace was relentless, and ensuring that team members had the right support exactly when needed was critical.”

‍

Q: How does participating in Locked Shields influence your approach to real-world cybersecurity strategies?

Joseph Carson:
“Locked Shields reinforces the importance of preparation, collaboration, and agility in real-world cybersecurity. It highlights the need to build resilient systems that don’t just prevent attacks, but can recover and adapt quickly under pressure. The exercise has influenced my emphasis on incident readiness, credential hygiene, and fostering cross-team communication channels in professional environments.”

‍

Q: In your opinion, how does Locked Shields contribute to international collaboration in cybersecurity?

Joseph Carson:
“Locked Shields is one of the most effective platforms for fostering international cybersecurity cooperation. It brings together experts from around the world to tackle realistic, high-pressure scenarios, forcing participants to rely on shared knowledge, trust, and rapid information exchange. It breaks down silos and encourages a collaborative mindset that’s essential for defending against modern, transnational cyber threats.”

‍

Q: What were your main takeaways or lessons learned from participating in Locked Shields 2025?

Joseph Carson:
“My key takeaways from this year’s exercise include the power of coordinated teamwork, the need for clearly defined roles in incident response, and the critical importance of staying calm and focused during high-stress events. Holding back the Red Team was a testament to our preparation and collaboration. Each round of Locked Shields deepens my appreciation for collective defense and the importance of continuous learning in the field.”

‍

‍

Why This Matters for Today’s Cybersecurity Leaders

Locked Shields may be a simulation, but the risks it highlights are real. Privileged access remains the most common target for attackers in the modern threat landscape. The speed at which your organization can detect, respond to, and recover from incidents will determine whether a breach becomes a headline or a footnote.

One immediate action to prioritize? Tighten control over privileged credentials.

Review privileged accounts, eliminate unused credentials, and enforce strong authentication and rotation policies. As Locked Shields 2025 shows, even the most advanced defenses can falter if credential management is overlooked.

At Segura®, we are proud to have Joseph Carson helping shape our vision for a more secure future. His field-tested expertise directly informs how we help organizations strengthen privileged access controls, improve credential hygiene, and reduce the time it takes to detect and respond to advanced threats.

With the right controls in place, your team can move beyond constant firefighting and focus on bigger strategic initiatives, knowing your most critical accounts are protected.

Our mission is to help organizations take these critical first steps while building toward long-term resilience. Because in the next crisis, every second will count.

Ready to take control of your credentials before attackers do? → Talk to Our Team Today

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

DNS Tunneling Exposed: Why It’s Dangerous and Shockingly Easy to Exploit

While the first part of this series introduced the concept of DNS Tunneling, explaining how attackers exploit the DNS protocol to create covert channels, bypass security controls, and exfiltrate data, this follow-up delves into the underlying risks and practical realities that make DNS Tunneling a persistent and underestimated threat. Despite its technical complexity, executing a DNS Tunnel often requires minimal resources, leveraging widely available tools and overlooked gaps in network monitoring. In this article, we’ll explore why DNS Tunneling remains dangerous, how it contributes to data breaches and unauthorized access, and why many organizations fail to detect it until it’s too late.

Why is DNS Tunneling Dangerous?

DNS tunneling poses a significant security threat to organizations because it provides attackers with a stealthy channel for data and commands that often goes unnoticed. Since DNS traffic is critical for normal operations, network defenders and monitoring tools may not scrutinize it as closely as web or email traffic. This lack of scrutiny allows malicious DNS tunnels to blend in with legitimate DNS queries. The result is a covert avenue to bypass security controls: DNS tunnels can easily slip past firewalls, proxies, and intrusion detection systems by masquerading as routine DNS lookups.

The potential impacts of a successful DNS tunneling attack on a company are severe. Once a tunnel is established, attackers can perform data exfiltration, siphoning off sensitive information (customer data, intellectual property, credentials, etc.) in small encoded chunks via DNS without immediate detection. They can also maintain persistent command-and-control (C2) over compromised systems. Through the DNS tunnel, an attacker can issue commands to malware inside the network, instructing it to propagate, encrypt files for ransomware, and so on, and receive status updates or stolen data in response. Essentially, DNS tunneling can give an adversary a continuous foothold to remotely control infected machines. Furthermore, it can be used to deliver malicious payloads or malware into the network, for example, sending pieces of a malicious code that reassemble on the target, all hidden in DNS responses. According to security analyses, the risks of DNS tunneling include data breaches, unauthorized access to sensitive information, loss of intellectual property, and malware delivery, as well as enabling attackers to move laterally or further exploit the environment.

Another reason DNS tunneling is dangerous is the difficulty of tracing and attribution. The DNS queries used in tunneling often look like queries to obscure domains or subdomains, which might not immediately raise flags. They could be misinterpreted as legitimate, if somewhat unusual, DNS traffic. Detecting a DNS tunnel is non-trivial, it often requires specialized analysis of DNS query patterns, payload sizes, and frequencies that are outside the capability of standard network monitoring tools. BlueCat Networks notes that DNS tunneling “bypasses most filters, firewalls, and packet capture software,” making it especially hard to detect and trace its origin. An attacker using DNS tunneling can therefore quietly operate under the radar for an extended period, increasing the potential damage. In summary, DNS tunneling is dangerous because it turns a trusted protocol into a vehicle for covert malicious activity, often leading to serious breaches that are hard to discover until the damage is done.

Why DNS Tunneling is Relatively Easy to Execute

Ironically, one of the reasons DNS tunneling is so prevalent is that it’s relatively easy for attackers to pull off, especially compared to other covert channels. There are a few factors that contribute to this:

  • Pervasive DNS Access: DNS is required for almost all internet communications, so networks tend to permit DNS queries out to the internet by default. Port 53 (DNS) is “nearly always open on systems, firewalls, and clients” . Many organizations do not strictly limit what DNS servers can be queried or don’t inspect the contents of DNS packets. This means an attacker has a high chance that DNS traffic will be allowed egress from a target environment without being blocked. Even when an organization uses an internal DNS server, that server usually forwards queries it cannot resolve (like external domains) to upstream resolvers on the internet. Attackers can abuse this by querying their malicious domain – the query will traverse the internal DNS and go out to the attacker’s server. Unless specific egress rules or DNS filtering are in place, firewalls often treat DNS as an exception and let it pass uninspected, effectively punching a hole that attackers exploit.
  • Lack of DNS Monitoring: DNS traffic is often considered benign infrastructure traffic and may not be monitored by intrusion detection systems or endpoint security agents. Security teams focus heavily on web, email, and lateral movement traffic, while DNS may get overlooked. Adversaries favor DNS because it is an “always-open, overlooked and underestimated protocol” for communications . This common oversight in network defense makes DNS an attractive avenue, attackers know their DNS-based communications have a lower chance of triggering alerts.
  • Readily Available Tools: Perhaps most importantly, there is an abundance of open-source tools and frameworks that make setting up a DNS tunnel trivial. One doesn’t need to write custom code to leverage DNS tunneling; many publicly available projects can encapsulate traffic or messages into DNS queries. In fact, using these tools has become a common tactic for penetration testers and attackers alike. Unit 42 researchers point out that numerous tools available on GitHub allow attackers to create covert DNS channels “for the purposes of hiding communication or bypassing policies,” and these tools are not only freely available but also easy to use . In other words, an attacker with basic knowledge can download a DNS tunneling toolkit and get a working tunnel running in a short time, without needing to invent their own method. We will discuss some of these tools in the next section.
  • Misconfigurations and Weak Policies: Many organizations inadvertently make DNS tunneling easier by not enforcing strict DNS usage policies. For example, if endpoint computers are allowed to query any external DNS server (like 8.8.8.8) instead of being forced through the company’s DNS resolver, an attacker’s malware can directly query the attacker’s DNS server, completely bypassing internal controls. Even if internal DNS is used, if it is not configured to filter out suspicious domains or very long query names, it will dutifully forward along the attacker’s queries. Common firewall configurations may allow DNS to any destination, or lack advanced DNS protocol inspection. Such misconfigurations (or rather, default configurations) create an environment where implementing a DNS tunnel is as easy as sending out DNS queries to a domain, and there is little to impede the malicious traffic.

In summary, DNS tunneling is facilitated by the necessity and ubiquity of DNS itself. Attackers are basically piggybacking on a service that must be open and functional. Combine that with the wealth of easy-to-use tunneling tools available and often insufficient DNS oversight, and you have a recipe for a simple but effective attack technique. Even junior attackers can find tutorials and tools online to exfiltrate data via DNS.

Understanding the dangers and simplicity of DNS Tunneling is the first step in recognizing just how vulnerable many networks remain. The protocol’s trust-based nature, combined with its ubiquity and poor visibility in traditional security stacks, creates an ideal vector for covert communication and data exfiltration. As we’ve seen, even basic tunneling tools can bypass firewalls and proxies if DNS traffic isn’t properly inspected.

This is where SafeDNS provides a critical layer of defense. Our Protective DNS solution is equipped with advanced detection capabilities to identify and block DNS tunneling attempts in real time. By leveraging behavior-based analytics, anomaly detection, and continuously updated threat intelligence, SafeDNS helps organizations detect covert channels, stop data exfiltration, and enforce security policies at the DNS layer—long before threats reach endpoints. With full support for DNS encryption (DoH/DoT), SIEM integration, and policy-based filtering, SafeDNS enables secure DNS resolution while maintaining full visibility and control over DNS traffic.

In the next article, we’ll take a closer look at the performance characteristics of DNS Tunneling, how attackers balance speed, stealth, and reliability to maintain persistent access, and what that means for defenders monitoring DNS traffic.

Start your free trial of SafeDNS today and see how Protective DNS can help you close one of the most overlooked gaps in your cybersecurity stack.

 

 

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.