2022 彙整 - 頁77，共121

Why Backup and Recovery for Salesforce – Do You Need It?

Introduction

Salesforce is the undisputed market leader when it comes to customer relationship management (CRM) platforms, with a 23.9% market share, as per IDC (figure below).

More than 150,000 companies across the globe trust Salesforce for managing their data ecosystems – doing everything from gathering and converting leads to opportunities, managing information to understand and engage customers, extracting insights from the data, to sharing information across the organization.

It’s clear that Salesforce is very much at the heart of your value chain, but how safe is the most important asset of your organization, your data? Let’s explore this question.

How Effective Is Native Salesforce Backup and Recovery Service?

According to industry analysts (and even a Salesforce best-practices blog), using the native backup and recovery capabilities can have the following drawbacks:

It takes 6 to 8 weeks for data backup recovery time objective (RTO)
Salesforce Data Recovery Service is very expensive, costing $10,000 per restore per organization
Backup does not cover vital Salesforce metadata. You’ll miss out on custom fields, page layouts, reports, dashboards, and custom code backup.
Salesforce ended its Data Recovery Service in July 2020, citing quality issues, but it was revived in March 2021 after customers demanded a native backup service.
Salesforce suggests using third-party backups as part of the data backup strategy.

Why Do You Need Third-Party Backup?

In addition to the drawbacks above, there are many reasons why Salesforce data should be backed up with a third-party backup and recovery solution. Let us explore some of the main reasons:

Salesforce recommends it:

“There are a number of data backup solutions offered by our partners on our AppExchange. Some of these are more comprehensive in that they allow you to automate backups of both your data AND your metadata and provide a mechanism by which to restore that data easily. You can search for these by visiting the AppExchange directly and searching for keyword backup. We recommend that customers vet multiple offerings and audit the reviews provided by other customers before selecting one of these offerings.”
Accidental deletion

Consider this statement directly from Salesforce best practices to back up data:

“Even with the best of intentions, users and administrators have been in situations where they have either deleted large amounts of data, or have modified records, only to later realize that a mistake was made. With tools like the Data Loader, it is very easy to mass delete or update records. And a simple mistake in your source file or field mapping could spell disaster for your data. It is recommended that you keep a regular backup of your data and to do a manual point-in-time backup before you proceed with any major data project within your organization.”

Accidental deletion remains the top cause of Salesforce data loss, leading to nearly 70% of the data loss incidents.
Cybersecurity attacks

Being at the heart of the value chain and hosting huge volumes of sensitive customer data, Salesforce is a prime target for cybersecurity attacks.

Unfortunately, in 2019, a cloud-based e-commerce platform and children’s clothing company, Hanna Andersson, had its data exposed due to a malware that infiltrated Salesforce. The breach compromised a considerable chunk of customer data, including credit card information and personal identifiers. The hackers gathered data from about 10,000 consumers nationwide and sold it to criminals on the dark web.

Bearing the sophistication of cyberattacks in mind, it is important to consider what the impact of a security breach is on your organization, and what your data protection plan is to mitigate these attacks.

A third-party cloud backup is a key component of data protection best practices. With reliable backups and quick recovery in case of a disaster, you will not only have peace of mind that you can recover data (and metadata) when you need it, but also that you maintain data compliance.
Unpredictable (and high) costs

Professional service costs are high, as high as $10,000 per restore, per organization. A third-party backup provider can offer superior services for a predictable, all-inclusive price per user, per month.
Limited data backup retention period

Is your customer data part of your long-term strategy? Salesforce backup is limited to a maximum retention period of 90 days. In contrast, a third-party backup provider can provide the flexibility to retain data, from one year and up to 99 years.
The infrequency of backups and lacking automation

Salesforce Data Export Service allows you to back up every seven days (or 29 days, depending on the Salesforce edition). Additionally, datasets greater than 512 MB are exported into multiple zip files.

When compared to this, a third-party backup provider offers you complete, automated daily backups with data and metadata in a time- and user-friendly fashion. Further, they provide tracking and monitoring of the latest backup and your backup history.
Lackluster user experience and poor recovery options

When you need to recover objects, dealing manually with multiple 512 MB zip files is resource intensive. A third-party backup can provide you with these additional features:

Drill down to specific objects
A search option to instantly search and recover deleted or modified data
Granular restore
Compare and restore metadata
Restore permanently deleted records
Navigate snapshots of previous data versions and recover

Ultimately, as an IT Leader, it comes down to data protection and data availability. Can your business afford to lose mission-critical data for 6 to 8 weeks? Can your budget handle unpredictable costs up to $10,000? Can you perform time consuming, manual reconfigurations due to loss of metadata with Salesforce backup?

Instead of worrying about when data loss will happen, by using a third-party backup provider, you can recover data and metadata in minutes – at a predictable price point – regardless of what happens.

Keepit Backup and Recovery for Salesforce

Keepit for Salesforce saves you time, is cost effective, scalable, provides ease-of-use through a simple user interface, and gives you peace of mind that your data is securely backed up, recoverable, and available whenever you need it. With Keepit, we ensure this through:

Automated daily backups every 12 hours
Easy user interface which is clutter-free, intuitive, and increases productivity
Set and forget operation – set up in a few clicks and the backup will be running in the background
Unlimited storage and archiving at no extra charge
Technology scalable to millions of users with long backup retention from 12 months to unlimited
Point-in-time restores
Blockchain-verified technology for protecting your data
World-class security with dual data centers and 4 copies of data in private data centers

Keepit for Salesforce saves you time, is cost effective, scalable, easy to use through a simple user interface, and gives you peace of mind that your data is securely backed up, recoverable, and available whenever you need it. With Keepit, we ensure this through:

Automated daily backups every 12 hours
Easy user interface which is clutter-free, intuitive, and increases productivity
Set and forget operation – set up in a few clicks and the backup will be running in the background
Unlimited storage and archiving at no extra charge
Technology scalable to millions of users with long backup retention from 12 months to unlimited
Point-in-time restores
Blockchain-verified technology for protecting your data
World-class security with dual data centers and 4 copies of data in private data centers

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

2022 Keepit

How Organizations Can Properly Secure Network Access for Remote Workforces

IT security policies have traditionally been perimeter-based, primarily concerned with the network activity within their own office and corporate network. While remote work certainly existed before, it has now become a standard – even an expectation among employees – no matter the industry or job function.

This rapid expansion of remote workforces has created significant operational and cultural changes for companies worldwide – particularly when it comes to IT and securing corporate digital eco-systems. Many organizations were not fully prepared for such an immense transition of expanding corporate edges and countless new endpoints.

With so many workers now scattered beyond the walls of their physical offices, this has created a considerable challenge for IT departments that find themselves struggling to monitor and gauge the real security posture of their networks, and the endpoints in use across them. The weakest link is no longer in the cubicle next to you – it can be halfway around the world in the home office of an employee using a VPN on a compromised laptop.

Secure Network Access for Remote Workers: Challenges Today

There are numerous potential risks for companies when it comes to enabling secure network access for remote workforces:

Limited Network & Endpoint Visibility: Remote work environments can make it considerably more difficult for an organization to maintain visibility and control over the data security of its employees. A lack of visibility inhibits IT and security teams from achieving operational and security objectives, while putting the business at increased risk.

Increased BYOD Use: An increasing number of employees these days use personal devices to access company networks. This is especially true as employees find themselves working from home with greater regularity. In many cases, these devices are often not fully compliant with their employer’s security policies. Unsecured personal devices can provide potential attack vectors for cybercriminals to target a corporate network.

Social Engineering Attacks: As organizations have bolstered their cybersecurity measures over time, tit has become more difficult for cybercriminals to exploit security posture vulnerabilities. In turn, many have favored more cost-effective tactics to breach networks like phishing emails that capitalize on human error and trust. Social engineering tactics need only an unwitting or distracted employee to succeed, and therefore typically require less technical knowledge to pull off.

What’s Needed to Secure Network Access for Remote Workers

Here are some critical considerations when it comes to enabling secure network access for remote workers:

Firewall: Serving as somewhat of an electric fence to your network, firewalls remain a basic but essential extra layer of protection for remote workers. One pitfall is that many employees may disable their firewall if they believe it to be slowing down their device, keeping it from blocking malicious traffic.

Antivirus: A just as essential, yet often forgone staple in your security stack is antivirus software. In addition to providing protection from all sorts of malware, the Next-Generation Antivirus (NGAV) of today utilizes predictive analytics driven by AI and machine learning for advanced threat detection. This includes determining root causes from endpoint data and responding to previously undetected emerging threats.

Managing Endpoint Visibility: Unmonitored remote devices can bring an abundance of potential threats to a network if they are not up-to-date and properly configured. Visibility is a key issue here. By implementing solutions like NAC, companies gain insight into every user and device on their network, allowing them to pinpoint any weaknesses within it. With this visibility they can then control, adjust, or deny access for any device as needed.

VPN: While it’s common for many companies to offer secured VPN connections for remote employees, VPN can’t serve as a comprehensive security solution. A VPN alone can leave you in the dark about the security posture and compliance level of the device connecting to it. You could unknowingly be giving safe passage for a compromised device directly to your network.

Device Risk Monitoring & Mitigation: With the help of an agent or MDM, NAC solutions like Portnox CLEAR can work alongside a VPN, offering two factor authentication based on user identity and endpoint risk score. Continuous monitoring is key here for keeping countless users and devices in compliance, no matter their location. By knowing the security posture of remote devices, IT teams can adjust their security policy and mitigate potential threats.

Employee Training & Awareness: Employees are more likely to be lax with their security habits outside the office, and cybercriminals are no stranger to this reality. Maintaining employee awareness of these potential threats is key for risk mitigation. Whether regarding proper password management, compliance policies, or how to spot phishing attempts, it’s highly beneficial to offer employee education and training in security best practices.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

OSINT Tools – Pt.3

Intro

Now that we’ve laid some theoretical foundation as to what OSINT consists of, let’s check out some tools and see how they can benefit us, as well as what are some of the most common uses. Before going any further, we would just like to quickly go over what types of information gathering there are, as well as some distinctions when it comes to these tools.

Active vs. Passive Recon

Within the context of an investigation, be it a penetration test or due diligence, we will use OSINT to gather some information.

The main distinction to be made here is active versus passive reconnaissance. Active reconnaissance means we are making some sort of a contact with a system we’re investigating. We interact with said systems. Some can be almost harmless, like ping, but some are much more intrusive, and can even mean brute forcing, and other such probing – which might be seen as hacking regardless of the fact that the resources are indeed in the open.

In general, in such a way we also might leave traces in the form of logs – which can further show the length of the connection, our IP address, etc.

When we are doing passive reconnaissance, we are not interacting with the systems. We might look up our target on Shodan, which would be considered passive, since we’re just using data that’s already out there, and are in no way interacting with any of the systems of interest.

There are merits to both sides, however, it’s crucial that we are aware of the distinction, so as to not hinder our investigation – we need to know what to use, and when.

Types of OSINT Tools

Based on what the tool does, we can say there are three main categories:

Aggregation Tools
Discovery Tools
Scraping Tools

Discovery Tools – tools that enable us to query and search the data that is already out there. The best example is Google search engine. Seemingly simple, but Google has a lot of websites indexed and crawled, which in turn gives us enormous potential when it comes to discovering new information. Another example would be Shodan.

Aggregation Tools – these tools help us connect the dots, so to speak, once we have gathered all of our relevant data and are in need of further relating it, and compiling it into a functional, easily digestible, format.

Scraping Tools – when we have successfully discovered the information we need, we would like to extract it in an easy and safe way. With these tools, we can avoid extracting anything that is of no use to us, as well as saving our precious resources e.g. time and bandwidth.

With all of that being said, there are a plethora of tools out there, but we have decided to give a brief overview of a few that we felt are the most essential ones. It’s up to you to establish your own methodology, and do research accordingly, as there is no exact path one would follow when conducting OSINT investigations.

Google Search Engine – Google Dorking

Beside your everyday uses of Google’s search engine, there’s a lot of options for you to refine your queries.

A simplest example is adding quotation marks to your search. By doing so, Google will interpret whatever we’ve put inside the quotation marks as an exact phrase, and will give us only the results where that exact phrase comes up.

Another common example is adding the term site to our search. If we wanted to search for let’s say imdb new movies we would get something like this… notice the number of results.

On the other hand, if we were to add site: to our search, we would get a result similar to this…

As we can see, there’s a drastic difference in the number of results obtained, just by leveraging one of the many Google dorks.

We can even look for specific filetypes, with the filetype keyword.

If we want to look for publicly available .pdf’s for example, we can add the keyword like this:

We can also say intitle – and Google will return results if the exact phrase appears in the title of the page; there’s cache too – which will give us Google’s cached version of the URL that we’ve specified.

There are many more dorks available, and this is a big topic which we will look to cover in an article dedicated just to Google dorking.

But for now, we’d like to mention that this is completely legal as we are querying against legal, publicly available information. Of course, be mindful that what you do with the information might not be legal.

Shodan.io

With Internet connected devices number being higher than ever, a search engine dedicated to IoT – Internet of Things – Shodan is an irreplaceable tool to have in your arsenal.

If, for example, publicly accessible CCTV cameras are something that you might be looking into, Shodan’s got you covered.

Heck, if you want to check if your smart fridge is publicly accessible, Shodan can help you!

To use Shodan fully, you’ll need a paid subscription, however you might start with the free tier – but you’ll only get a limited amount of searches.

Best free(mium) alternative to Shodan is Censys which also tries to discover, analyze, and monitor Internet accessible devices.

OSINT Framework

The OSINT Framework is one of the most popular OSINT tools out there, and rightly so. Structured like a web directory of tools, it has almost everything you might need for your investigation, which makes it an extremely attractive option for information gathering.

Also, most of the tools in this web directory are directly usable and accessible through a browser, which is a great thing to have, since almost all of the best OSINT tools are created for Linux. Thus, the OSINT Framework provides us with a very useful and accessible bundle of tools, regardless of the platform – which is extremely valuable.

It is worth noting that most of the tools found within are free, with only a minority being premium, subscription based tools.

Maltego

Maltego is a wonderful aggregator of interfaces to various OSINT databases – from the official Maltego website – https://www.maltego.com/.

With Maltego, we can investigate and find information on organizations, individuals, as well as investigate cryptocurrencies, and much, much, more.

Once registered (which can be done for free – as a part of community license) you are brought to a GUI from which you can start your investigation. Results of your queries (Maltego calls them transforms) are displayed in a beautiful bubble graph, which maps the relations between your nodes.

Maltego starting screen

In our example search, where we’ve chosen Domain as Maltego entity, for youtube.com, we’ve obtained the following:

As we can see from the image, on the bottom are the transforms that were run, and on our graph we see color-coded results of our query. We’ve got 148 entities, and some of those include MX and NS records, email addresses, people, phone numbers, emails, etc.

We just ran the all transforms search, of course, in reality we would maybe use only transforms that we need, or we would install specific modules (from Maltego starting page), so that we can query for information that’s relevant for our investigation. Some of the modules that we can install are paid, but there are also some good free ones.

Maltego definitely warrants an article of its own, but we wanted to briefly show what this awesome tool is all about. Oh, and one more thing – Maltego runs on Linux, Windows, and MacOS.

Recon-ng

Another great tool is Recon-ng. This is a completely free, open source, CLI tool made for web-based open source reconnaissance.

It is completely modular, it has its own default modules that are also open source, while also having a marketplace from which we can further enrich it with whatever we might need.

The information we collect with it is stored in a database, which means we can use it to generate custom reports, if that’s something we need.

Being an open source tool, it grows through its developer community, which is quite engaged.

It might be a bit daunting at first, due to it being a CLI-based tool, but it is actually extremely fun to navigate around, and once you’ve gotten the hang of it you will surely love it!

Conclusion

These are some our favorite tools, and we’ve given you a brief introduction on them; in the future, we hope to expand on them (ideally all the tools mentioned here, and more!) – if that doesn’t prove to be possible for us, we hope that we’ve at least managed to provide a ‘teaser’ of sorts, and that we’ve managed to pique your interest.

Lastly, honorable mentions go to TinEye – a reverse image search tool, and Phoneinfoga – Python-based phone number scanning tool.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022

Thanks to you, our LTS Release finally has a name!

A few days ago we gave you the opportunity in social media and through email to choose, by means of a simple survey, the upcoming names of our LTS Release (Long Term Support).

Participation has been a success! More than two hundred participants! Making it clear that you love both our releases and Star Trek of course.

* Let’s not forget that our repertoire of possible names, from which we gave you a choice and vote, was an extensive list of Star Trek spaceships.

Well…

We finally have a winning name for our LTS Release!

Are you ready?

And the winner is… AKIRA.

Our new LTS Release (Long Term Support) will be called Pandora FMS NG LTS Akira.

We already know that with “Akira” you can think of the famous and award-winning manga by Katsuhiro Otomo or his animated film with the same name. At Pandora FMS we love him too!

*Hence our little homage in the above illustration. Give it up for Tetsuo!

But it actually refers to the spaceship Class Akira. A Starfleet heavy cruiser in Star Trek that was specially designed for combat.

3,055,000 tons and a cruising speed of Warp 9.2

As much a boss and as much a geek as we are.

And that’s not all!

Our next LTS Releases will be named after the most voted ships that have followed Akira.

Hope
Renaissance
Andromeda
Defiant
Excelsior
Tachyon
Stellaris
Antares
Apollo
Chimera

It only remains to say that THANK YOU VERY MUCH for your participation and long life and prosperity to all of you!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Pandorafms 2022

Password Reset As An Essential Process for Privileged Access Management

With the emergence of cloud-based technologies, there is a growing demand and the consequent increase in services offered in this format. In this scenario, in which there were only two or three credentials to perform online tasks, today, the user is forced to deal with so many that they can barely remember them.

In addition to having to remember complex passwords, users also need to keep in mind that many systems have a reduced number of access attempts. Thus, if one enters the wrong password, they will eventually have little chance of entering the right one before the access is blocked. So, the best thing to do is to use words that are easily typed and memorized.

Recent research by the UK’s National Cyber Security Centre (NCSC) reported that for the fifth consecutive year, “123456” is the most commonly used number sequence by users for passwords. The word “password” is another recurring top choice in this list of commonly used passwords, also because it is easier to memorize and type, even if it does not guarantee security.

The question is: Considering these passwords as insecure and easy to guess, why do people continue to use them?

Users are expected to memorize their passwords and enter them correctly on the first try. However, the complexity required in password policies used by services and companies makes creating a strong and usable password difficult for both ordinary and advanced users.

We invite you to keep reading today’s article and discover how the password reset process is essential for Privileged Access Management and consequently for a better cybersecurity posture.

The Problem of Managing and Maintaining Strong Passwords

The combination of user and password has been used as a basic defense mechanism for computer systems since the beginning of their implementation, preventing unauthorized access to data stored on systems and devices. Despite the creation of authentication mechanisms without a password, such as biometrics or one-time passwords (OTP), the combination of user and password is still widely used to access systems and devices.

This is because such a combination is easy and inexpensive to implement. In a digital transformation scenario, the multiplication of systems, devices, and their respective credentials is a perfect scenario for malicious attackers to collect passwords and, thus, access data improperly.

After all, remembering a password is much easier than the dozens (or even hundreds) of services that require some kind of authentication. It is estimated that the number of passwords per user is between 70 and 100.

Email accounts (personal and professional), banking services, corporate systems, devices, and applications are some examples that require authentication through passwords. And with the increase in the number of data leaks, it is easy to find compromised credentials on forums on the dark web being sold for pennies.

And yes, we know that it is not easy to manage so many passwords. Even the most tech-savvy can struggle to manage and protect credentials in so many different environments.

In times of personal data protection legislation, such as LGPD and GDPR, ensuring the protection of such data has become more than a security requirement – it is a business must.

Despite all the risks associated with their use, many users and companies use passwords that are easy to guess, such as numbers or sequential letters (123456 or abcdef). SolarWinds itself, the victim of a serious attack on its supply chain, was using the password solarwinds123 in its infrastructure.

The Main Attacks Involving Access Passwords

It is essential to understand the types of attacks that passwords can suffer in order to be able to create a robust password policy. Some of these attacks and vulnerabilities involve:

Dictionary Attacks. A list (dictionary) made up of words and combinations is used to compare captured hashes with the list items and thus try to find the password. It is still possible to use the list to access accounts through brute force attacks.
Credential Stuffing: Leaked credentials used when attempting to access other accounts, succeeding when the user reuses the same credentials (username and password) on more than one account.
Replacement: Authentication by the attacker is successfully performed by replacing a password or username already known by the attacker through some leak.
Password Recovery: When the password recovery process has flaws, the attacker can impersonate the victim and gain access to the password or even change the current password to one of their own. This can happen, for example, when the user uses the easily guessable question-and-answer feature in the password recovery process.
Social Engineering: The use of social techniques to mislead the user and illegally obtain access to credentials or use the same techniques to install password-stealing software.
Keylogging: A malware that, when installed on the system, can copy all information that is being entered by the user, including their passwords.
Bad Hashes: Attacks that can be used to recover passwords, especially if the hashing algorithm has known flaws, such as MD5.

The password policies can be combined with software and tools to further protect systems and devices. Some of these tools include Password Managers; or for organizations that want to protect their assets, Privileged Access Management (PAM) solutions.

Password Managers and PAM Solutions

Password managers and PAM solutions are tools and software that can generate secure passwords and automatically authenticate the system, eliminating the users’ task of remembering and entering passwords for different accounts.

It is worth remembering, however, the importance of protecting and never losing access to these tools: once the access credential is compromised, all accounts connected to the user may be lost. And it is also worth keeping these passwords up to date because if a vulnerability is exploited, all stored passwords will be exposed.

If there is a suspicion that the password policy or passwords themselves are compromised, the recommendation is for the company to move quickly to mitigate the problem causing the compromise and require all users to change the password.

Finally, there must be a consensus to protect users from creating bad passwords and generating difficult password creation patterns. Raise awareness and allow people to recognize that their passwords are insecure so that they can choose strong and secure passwords for both work and personal access.

The senhasegura Solution

Passwords are one of the oldest security mechanisms in the computing world and are also one of the main attack vectors by cybercriminals. In this way, we can avoid cyberattacks that can cause considerable damage not only to people but also to companies.

A more secure approach to the use of passwords is one where they can only be used once. Single-use passwords protect users from theft of credentials. Unlike static ones, which are not changed, using passwords only once makes systems resilient to attacks.

Once inserted in senhasegura, the passwords are managed by the solution. This means that, at any time, the solution can make a change in the password. These changes can occur in the following ways:

Determined by the company’s password policies (automatic). Based on the company’s password policies, registered in the system, the solution automatically and periodically changes the keys, facilitating the work of its information security team.

Determined by password exposure (automatic). When a user is allowed to see a password held by the solution, they can use it for a specified period in the system. When this time is over, the system will immediately change the password, so that the credential custody returns to storage.

Requested by an admin user. A user with administrator rights in the system may at any time schedule a password change for some or all devices registered in the solution.

Request a demo now and discover the benefits of senhasegura for your business.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Segura 2022