Skip to content

SCADAfence Discovers First CVEs Detected In Alerton PLCs

Alerton, a subsidiary of Honeywell, is a major manufacturer of building management systems for heating, ventilation, and air conditioning (HVAC). SCADAfence’s research team discovered vulnerabilities that lead to NIST issuing the first CVEs ever assigned to Alerton products. Left without proper security measures, these vulnerabilities could lead to major disruptions in any facility where they are deployed.

This is a technical report on how our research team discovered these vulnerabilities. 

Alerton Ascent Suite

Alerton Ascent is a suite of controllers, devices, and software used for building management specifically in regard to HVAC. The Ascent product suite is deployed in buildings, server rooms, chemical labs, hospitals and more, with the purpose of maintaining the appropriate air flow and safe temperature required for a room’s or space’s specific need. 

The Alerton Suite is made up of many different components. For example, in the research we conducted the Alerton Ascent network comprised:

  1. Alerton Ascent Control Module (ACM) – Main controller
  2. VLC-853 – Field controller
  3. Alerton Compass – Management and Control Tool
  4. Visual Logic – Programming ToolAlerton Ascent Suite Topology Map

As seen in the topology map, an ACM is connected to a VLC-853 device over a serial port. The Compass software and Visual Logic software have access to the ACM over ethernet via a network switch. 

Any user, innocent or malicious, can access the various Alerton devices and software either locally or remotely via the network switch, assuming that there are no extra security tools providing network protection (such as an FW or switch port security).

The resulting effect of a malicious user gaining access to the Ascent Suite can result in a degradation of credibility, integrity, and availability of the BMS as a whole. 

Configuration Change for Alerton ACM

The Compass software provides the ability to configure the ACM. This configuration includes setting IP values, enabling or disabling specific ports, defining which networking protocols are active and more. In general, the configuration is set when the system is installed and is rarely changed thereafter. 

Alerton Config Interface

The Attack – CVE-2022-30242 and CVE-2022-30245

Two of the CVEs that were disclosed, CVE-2022-30242 (cvss 3.x score of 6.8) and CVE-2022-30245 (cvss 3.x score of 6.5), are vulnerabilities discovered which allow for configuration changes to be made outside of the Compass Software without any authorization or authentication. In addition, the configuration changes that were performed are relayed to the Compass Software, leaving the system operator unaware that a change to the configuration occurred. 

The following is a Wireshark partial capture showing how the configuration data is sent over the network from the Compass Software to the ACM: 

Wireshark capture showing config data sent over the network

As seen in the traffic snippet above from Wireshark, the configuration is sent to the ACM in ASCII characters and in cleartext with no obfuscation and minor difficulty in understanding or changing the configuration data. 

By extracting the whole configuration from the network traffic, and setting the MSTP0 ENABLE field to N, we can simply disable the COM0 port from any computer with access to the ACM. 

Change sent over the network 

As a result of sending a specially crafted packet with the above change, the configuration of the ACM changed, and COM0 was set to disabled, disconnecting the VLC-853 controller from the ACM: 

  

While successful changes in the configuration occurred, the Device Configuration window still indicates to the operator that COM0 is enabled: 


While successful changes in the configuration occurred, the Device Configuration window still indicates to the operator that COM0 is enabled:

In a real life scenario, this can have significant and/or tragic effects. 

Having this vulnerability leveraged in a real life setting can cause connectivity issues or undefined behavior of the entire network. In the example above, COM0 was disabled, which resulted in the VLC-853 to be cut out of the network. 

If the VLC-853 was responsible for ensuring that a cloud storage server room was properly cooled, operators who notice that VLC-853 is not communicating with the ACM and also are unaware that a configuration change occurred, may be compelled to shutdown the server farm out of fear of the servers overheating causing major disruptions for numerous services worldwide. 

This is obviously a single example for a single change in configuration. Any number of other changes can have similar, troubling effects. 

Programming Changes for Alerton Controllers

Programming management for Alerton Controllers is done using an Alerton proprietary plug-in for Microsoft Visio called Visual Logic. Programs written in using Visual Logic use diagrams to display the program in a visual manner as seen below:Visual Logic Program sent to Alerton Controller

Programs are written, pushed to controllers and run by engineers whose task it is to define the programmatic logic of the controller necessary for it to perform its specific role in the network.

Programs are written and edited on an as-needed basis and are not accessed frequently so long as the target device is fulfilling its intended purpose. 

The Attack – CVE-2022-30243 and CVE-2022-30244

In our research, we successfully wrote a program to an Alerton ACM device without authorization or authentication. In addition, the Visual Logic software did not provide an indication that a programming change occurred or that there is a difference in the program saved in the engineering software to that actually running on the ACM. This leaves an operator clueless as to why a controller has malfunctioned, changed its activity or stopped processing altogether.

This resulted in the disclosure of two CVEs, CVE-2022-30243 (cvss 3.x score of 8.8) and CVE-2022-30244 (cvss 3.x score of 8.0)

The packet sequence for writing a program to the ACM is a set sequence of Bacnet commands and is listed, in order as follows: 

With the exclusion of ADD_CODE_BLOCK_PACKET, all of the commands above are static, constant BACnet packets with a dynamic parameter of invoke ID. Being a BACnet system, there are no authorization checks to ensure that the commands being sent are from a reliable and authorized source. 

An attacker who has network access to any of the Alerton controllers can send a maliciously crafted program, using the above sequence of commands, to change a program on the target controller. This is done without the knowledge of an operator, as there is no indication of a program change in the Compass software or the Visual Logic Programming Visio plug-in. 

The following image is a diagram of the program that we pushed to the controller in the previous section; however, an additional component was added and pushed to the controller from a third-party computer with no access to the Visual Logic software:  

VIsual Logic Image of Program Pushed to Alerton Controler

The only indication that a programming change occurred is by clicking the Read from Device button as seen in the image below, and comparing the downloaded program to that which is stored on the engineering station:


Program Stored On Engineering Station
Program Stored On Engineering Station

As with the configuration change vulnerabilities, if these vulnerabilities are leveraged on an Alerton controller in a real-life, production network the effects can be catastrophic. 

If a controller is managing the air flow in a chemical lab, and a program is written to the controller that essentially renders it useless for its current purpose (either by sending a stub program, or sending a program that does not fulfill the air flow requirement), anyone in the lab could potentially be in life threatening situation. 

The potential scenarios that can occur by taking advantage of these vulnerabilities are endless, and can be very serious and even lethal. 

Full details on the CVEs can be found on the official NIST website:
https://nvd.nist.gov/vuln/detail/CVE-2022-30242

https://nvd.nist.gov/vuln/detail/CVE-2022-30243

https://nvd.nist.gov/vuln/detail/CVE-2022-30244

https://nvd.nist.gov/vuln/detail/CVE-2022-30245

In response to SCADAfence’s findings, Honeywell issued a Product Security Bulletin informing Alerton ACM Controller users of the vulnerabilities. 

To learn more about how the SCADAfence Platform can protect your OT network, visit our website or request a demo.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

How to Appropriately Protect Remote Access from Cyberattacks

The Covid-19 pandemic has brought the need for many companies to join remote work with it. The mass adoption of this modality resulted in a significant increase in cyberattacks on IT business structures through breaches in the security of remote accesses.

The malicious action of these attacks impacts businesses of all industries and sizes, whether interfering with the operation of companies, damaging their image, stealing or leaking sensitive data.

With this in mind, we will show you 5 important security measures you can take to protect remote access:

 

Use VPNs

Using a Virtual Private Network (VPN) is a great way to increase security in remote access, especially if you are using public networks or unsecured connections. 

The VPN’s role is to encrypt all your Internet traffic, creating a secure end-to-end tunnel between your device and the company’s, preventing Internet providers, government agencies, or cyber criminals from tracking your activities. 

However, its use can significantly impact the speed of the Internet, mainly affecting tasks that consume greater bandwidth, such as video calls. Look for reliable VPN services that offer good speed and stability.

Implement Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) is a feature that allows you to add a layer of security by combining different mechanisms for user authentication, ensuring data protection that could otherwise be accessed by malicious agents or inexperienced users, which avoids financial and image disruptions and losses for the company.

Apply the Principle of Least Privilege

The Principle of Least Privilege is a way to keep a company’s confidential data secure. The application of this principle grants the user access only to the environments necessary for the performance of their job, without unnecessary permissions, thus avoiding insider threats, data theft, and unauthorized access of malicious agents to the sensitive data of a company. 

Implement Zero Trust-based Policies

The Zero Trust model is a security framework that works, as its name implies, based on the idea of “never trust, always verify”, removing implicit trust and continuously requiring authentication of the user and their device on the network. 

The continuous Zero Trust verification is an essential security factor to protect remote cloud-based access. 

Install the Latest Updates on Devices and Network Assets 

Thinking about the frequent and annoying notifications that come up requesting system updates seems silly, right? Wrong.

Software and applications you use on your devices may be vulnerable right now. Messengers, browsers and the operating system itself may expose you to cyber risks. This is because regular updates work to fix possible security flaws and instabilities. And the best part is that now it is possible to schedule most updates to take place outside the time when the device is being used, or even in the background, automatically, causing little or no interruption in your tasks.

 

Share our content!

In this article, you found out what security measures to take to keep remote access secure from cyberattacks. If you liked our content, share it with someone who might be interested in the topic. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Monitoring as a service: the alternative to talent shortages

There is quite a wide range of solutions offered by monitoring as a service to any company, from performing any analysis to detect the root cause of the issue to determining the path of the failure.

Here goes…

Our opinion on monitoring as a service

One of the most important and obvious benefits it brings to the table is that it solves training problems of workers involved or just solves the shortage of talent of these workers right away. 

It may sound a bit harsh… but it is what it is. 

The increase in the amount of information available in companies, and the obligation to be able to manage this IT structure well means that workers must constantly be better qualified.

In addition, the increasing importance of IT means that infrastructure managers have a certain amount of work overload. 

Something that with a monitoring system does not happen! 

Rather the other way around, monitoring as a service establishes a theoretical bridge between technology and business, drawing a scheme where you can easily detect where the source of the problem is, saving time and actions to the operating team.

Monitoring reduces the importance of the traditional involvement of people from different areas of the organization and the work overload that managers in this process may have. 

To sum up, monitoring systems control all data and allow access to information from the same platform, avoiding that those in charge of this area have to stay aware of several fronts without fully concentrating on a single one. 

Also inactivity cost is reduced!

Let’s get to the point!

“You must take into account that the transformation of a given company implies that there is more software. 

And, therefore, more business areas that depend on technology. A series of changes that imply the need to hire more competent profiles. 

Everything with the aim for all pieces to fit perfectly, both the computer and its software as well as the network and the technician who handles it “

Explains Sancho Lerena, CEO of Pandora FMS, as you surelyl know, an international reference in monitoring.

An example of this need is that the growth of hybrid infrastructures is 25% per year according to IDC data. 

For that reason, many companies are taking their chances on taking out their IT monitoring infrastructure to save money and especially time.

This process of getting the entire IT organization under the umbrella of the same system also helps the infrastructure manager, as they have higher capacity to manage its records. 

On the one hand, it collects all the data despite the fact that it is a large volume. 

And, secondly, it concentrates access to all that information on a single centralized console.

In conclusion, we get over the lack of time for the worker to be aware of fundamental tasks such as security or data management. 

It also gets rid of the possible lack of capacity to adapt to the different operating systems that may exist in the same company. 

And, lastly, the workload involved in facing a constant data flow where any minimal error must be detected is minimized. 

Systems such as Splunk, Datadog or Pandora FMS itself help in the process.

Conclusions

Through monitoring, it is possible to use information in a reactive way, anticipating problems and alerts received; preventive, since analyses are obtained that help to be prepared for any worst-case scenario; and retrospective, since the emerged crises are also studied to find out the extent of their impact and know how to take measures properly in the future.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

New Day, New Ideas

This morning, like many before it, I woke up and thought, “Today is the day I come up with some  magical blog post idea that changes someone’s world!” I showered, threw on my Global Panini attire and a pair of Uggs slippers, cooked up an omelet, and made a pourover (my new obsession).

I plodded downstairs to the office and fired up the computer. I opened a new document, raised my hands to the keyboard and — nothing. Complete brain freeze. 

It’s hard to be amazing week after week. I know you feel this too. You have IT projects that are stacked up. Your boss is on you week after week to make their world more secure without adding friction for the users. Or your MSP is feeling stagnant and you need to come up with some new services to offer — or figure out how to offer your current services in a different way.

The week over week of having to be “on” all the time…it diminishes your ability to be creative after a while. Problem-solving becomes what keeps you from getting out of bed each morning instead of driving you to be 1% better every day. I get that. I hear you loud and clear.

The Block is Real

This creativity block thing is real. Very real. And if you were just doing IT for the fun of it — creating a playspace for yourself — you wouldn’t have to worry. But, folks, this IT thing is what you get paid to do. You can’t just say, “too bad, so sad” and head off to the zoo, y’know? 

Over here in the MacAdmins community, we have a great Slack instance where people are doing amazing things and being really creative. You go there, looking for something – a solution, some inspiration, a new job – but you’re still left uninspired. And you wonder why. Could be burnout. Could be general tiredness. Could be something else – let’s explore.

Brainstorming

At a recent standup (yes I now speak the language Agiletongue) I asked for a lift from my brilliant and creative teammates. Ideas, people, I needed ideas! It didn’t matter how outrageous they were. In fact, the more outrageous, the better. Anything is a springboard. As we’ve talked about previously, brainstorming requires a plethora of input and little to no judgment. 

And as a response to my request I got….nuthin. No ideas. Not a one. I wonder if it’s just the heat of this unbelievably hot summer cooking our brains or if people are just plumb wore out from current events. No clue, but nobody had any ideas for me. 

The next day, though, someone pinged me with an idea. “What about recipes?” they  said. “It’ll be fun,” they said.

I work for a tech company. Our product does (amongst other incredible things) device and identity management. IT stack centralization. MDM and security management. Automation. With my IT background, I hear the word “recipe” my brain goes to GitHub and shell scripts and munki and other IT management types of things. But, alas, that is not what they meant.

They meant real recipes. Food recipes. Don’t get me wrong, I like food. It’s an important part of my day to day life. But, hmmm…was this a weird ploy to turn this into a happy homemaker column? I was both confused and a little offended but I stuck with the discussion knowing that I’d find out if I just let them talk. 

How Does That Fit Into Tech?

Little by little the discussion started to make sense. 

Us admins are under a lot of pressure to be perfect all the time. For many (if not all) of us, one mistake can cost our companies their reputation (not to mention financial and productivity loss). In some cases, if a mistake is big enough, it could cost our jobs or our client. So if you weren’t feeling stressed before you started reading this, you probably are now. Sorry!

One way to get past the stress is to get up from your chair, step away from your desk, and get active doing something that is not related to tech (if stepping away won’t get you in trouble, that is).

Thinking about other things is a great way to open channels that allow you to come up with solutions. We’ve all experienced this — our best ideas come in the middle of the night; or the middle of a shower

Points to anyone who, by now, has accurately predicted where this is going.

A Story and a Treat

picture of baked food on a table
Mom baked every item on this table.

Growing up in my house meant that there was a plethora of home-baked goods. I don’t mean, a few store-bought cookies. I mean my mother baked. Daily. And there were always people over who didn’t live in this house.

The counter always had a few different kinds of cookies, a cake, maybe brownies, and on special occasions there were eclairs in the fridge. There were always bowls and beaters waiting to be licked clean and getting to the frosting bowl first meant you had to hide behind a locked door, lest someone steal it right out of your hands.

But one particular tradition we had was that on our birthday we got to choose our favorite dinner and our favorite cake. Mom wasn’t the best cook (I won’t say food was overcooked and dry and we’re probably lucky we didn’t all get food poisoning regularly, but…oh, I guess I will say it), but she could definitely bake.

So my choice was always spaghetti with meatballs (safe and really hard to mess up) and mom’s chocolate banana layer cake. I used to call it my migraine cake because every time I’d eat it I would end up with a migraine. Also, it was worth it every single time. I don’t do that anymore because now I know that my post-cake morbidity was due to celiac — but I can still taste it in my memory.

Here It Is

And, so, it is with a full heart and a now-hungry tummy that I gift you this recipe. Posting it here serves two purposes: 

  • Getting up and doing something completely different from your work frees up your brain and refreshes your spirit.
  • Eating something delicious can reduce your stress level. Even if it’s not a healthy option, a treat is good for the soul.

The recipe card (mom retyped every one of her recipes onto an index card with our Selectric typewriter that only had an all-caps ball) is well-worn. It has food stains all over it. It may have even gotten a bit too close to the heat. But it’s still here and someday it will be passed down to someone in the family. 

Chocolate Banana Cake 

recipe card from the 1960's

Serves: 16 

Baking time: 30-35 minutes

Notes: This cake is best when frosted between layers and on the outside with a buttercream frosting.

Ingredients:

  • 2 ¼ cups sifted flour
  • 1 tsp baking powder
  • ¾ tsp baking soda
  • 1 tsp salt
  • 1 tsp vanilla extract
  • ½ cup sour milk
  • ⅔ cup shortening (may substitute butter or margarine)
  • 1 ½ cup sugar
  • 2 eggs
  • 2 ounce Bakers chocolate
  • 1 cup mashed ripe bananas

Directions:

  1. Preheat oven to 350º Fahrenheit.
  2. Sift together flour, baking powder, baking soda, and salt.
  3. Cream shortening together with the sugar until fluffy. 
  4. Add eggs, one at a time, beating after each addition to shortening mixture.
  5. Mix chocolate in with egg and shortening. Stir in vanilla extract.
  6. Add the dry ingredients, alternating with the banana and milk in small amounts.
  7. Turn into two 9-inch greased pans.
  8. Bake for 30–35 minutes or until a toothpick inserted into cakes comes out clean.
  9. Let the cake cool completely before removing from pans and frosting.

Nutrition Information*: 1 slice (1/16th of the cake) contains 241 Calories, 11.1g Total Fat, 4g Saturated Fat, 21mg Cholesterol, 220mg Sodium, 355.5g Total Carbohydrates, 1.4g Dietary Fiber, 20.3g Total Sugars, 3.2g Protein

*Note that this does not include the nutrition facts of the buttercream frosting

Let us know if this helped reduce your stress by baking it or by eating it. Or both! Join us in the community and tell us your favorite recipe for freeing up your IT brain.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About JumpCloud
At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.

JumpCloud’s Cloud RADIUS & Azure AD Authentication

As businesses continue returning to the office, more and more MSPs are being pressed to ensure that employees are able to return with minimal pain. Wi-Fi connectivity is often the very first issue that users will run into in a new office setting, so MSPs are finding that they must revisit how they handle the security of the wireless networks that they manage. 

Common Wi-Fi Security Vulnerabilities

It’s very likely that your customers have their Wi-Fi set up with a guest network for visitors to use and a pre-shared key that employees are given on the first day of their employment. However, this authentication method is only marginally better than having no password at all and is very dangerous if the Wi-Fi provides access to domain-associated resources. 

Addressing Connection Concerns

Being that your customers’ Wi-Fi keys are likely older than COVID-19, there has never been a better time to switch to a tried and tested solution: RADIUS. With RADIUS configured, network authentication takes place against a directory that has been configured to allow a user’s existing login credentials (username and password) to grant and revoke access to network resources. 

RADIUS adds a much needed layer of security between users and a Wi-Fi network, while also bringing added convenience to your customers’ wireless networks. While RADIUS comes with a plethora of benefits, implementation can feel intimidating — but, it doesn’t have to be!

Using JumpCloud’s Cloud RADIUS Feature

In order to set up RADIUS for a client, you will need a directory to use as the source of truth for user authentication, and JumpCloud has the perfect solution for you. Here at JumpCloud, we leverage our powerful open directory platform to offer a high-quality, easy-to-use Cloud RADIUS solution that our customers love, giving them cloud-directory-fueled authentication and MFA to keep their networks secure and efficient. 

  1. Utilizing the Full Functionality of JumpCloud Alone

In addition to its Cloud RADIUS feature, implementing JumpCloud’sopen directory platform opens the door to a variety of other important features such as SSO, MDM, software deployment, and policies to help manage your users and endpoints. 

In effect, with JumpCloud, you will not only be able to address your clients’ immediate network security and user experience needs, but you’ll also be able to position your services in a new way. You’ll be able to offer current and potential customers a more forward-facing and expansive service using all of JumpCloud’s capabilities — including helping clients consolidate their technology stack or adding much needed features into their IT infrastructure.

Now, I know what you’re thinking: “That’s great, but I am not in a position to migrate directory services. I simply want to deploy RADIUS to improve Wi-Fi and VPN authentication, and I already have customers using Azure Active Directory (AAD).”

Well, I have some good news for you: you can leverage your existing Azure AD environments in harmony with JumpCloud thanks to our new feature: RADIUS Authentication with Azure AD Credentials.

  1. Using JumpCloud’s RADIUS Feature With Azure AD

Surprisingly (or maybe ironically?) enough, the implementation of RADIUS with Azure AD is reliant upon on-prem resources, with physical servers needing to be allocated to perform the required tasks. JumpCloud is a strong proponent of equipping MSPs and IT professionals with world-class tools to get their jobs done effectively, which means we focus on creating solutions for problems like this.

This means that we’ve made it so you can leverage JumpCloud’s Cloud RADIUS feature while maintaining Azure AD as the source of truth for your directory needs, effectively giving you the best of both worlds, with no on-prem setup necessary. This means that your customers can enjoy secure networks while improving ease of access to networks among their credentialed employees. On that same note, what this means for you, is that you now have a cloud-based RADIUS solution that can be implemented for any of your customers without gutting their existing directories.

Getting Started With Cloud RADIUS

Here are some guides to help you begin launching Cloud RADIUS across your MSP business and your clients’ orgs.

 

Cloud RADIUS Benefits

Check out some of the benefits that JumpCloud’s RADIUS solution will give to your clients:

  • Improved user experience that only requires a single, unique password to connect to networks and resources to get work done both in the office and remotely via a VPN.
  • Streamlined user onboarding and offboarding due to the activation or deactivation of a single set of secure credentials compared to many different usernames and passwords.
  • Fewer help desk tickets related to the pain associated with changing a PSK (pre-shared key) for a Wi-Fi network.
  • Simplified compliance that’s easier to prove by getting rid of a shared network password that anyone can get ahold of.
  • Easier network access for your techs. They’ll no longer be scrambling to figure out Wi-Fi passwords when performing site visits (this will also drastically lower the chance of a tech needing to huddle to one corner of a closet to get the single bar of LTE signal available for their hotspot to connect to your documentation service to find the Wi-Fi password. Definitely not speaking from personal experience. Sidenote: Why did they stop putting a network port on laptops?).

Ultimately, the largest benefit of having Cloud RADIUS from JumpCloud implemented is that you now have a solution that can be easily replicated across your entire customer base. Whether you’re working with a company that has never touched a directory service before (which JumpCloud can easily help with), or a customer that has been holding onto that 12 year-old server for dear life, JumpCloud is here to help you modernize your customers’ infrastructure. 

With Cloud RADIUS, your service offerings around network management can fully revolve around a single authentication standard, your hardware vendor of choice, and a unified support approach that will delight your customers. 

JumpCloud for MSPs

At JumpCloud, we are serious about setting MSPs up for success when working with in-office, hybrid, and fully remote clients. To do this, we have developed a dedicated platform for MSPs, called JumpCloud for MSPs. 

JumpCloud for MSPs is an open directory platform that enables our partners to centralize identity, authentication, access, and device management capabilities under one umbrella without having to tear and replace any existing infrastructure. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About JumpCloud
At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×