At JumpCloud, we are constantly investing and developing our Linux infrastructure and capabilities for our customers. We want to enable admins with the flexibility to manage and control Linux devices on the same platform as any other OS (ie. Mac, Windows, iOS, and Android) so they can continue to utilize the speed, stability and security of Linux-based systems wherever they need them.
Since the beginning of 2022, we had planned to increase the velocity and focus of our Linux capabilities. Some of the key areas of focus for Linux included:
Enable Remote Security Management
Improve and Strengthen Security Posture
Provide Simple & Scalable Patch Policies
Introduce New Popular Linux Distros
Just take a look at what our customers have been leveraging this year.
Security Commands
JumpCloud Commands let you quickly and easily automate tasks across multiple servers, launch those tasks based on a number of different types of events, and get full auditing of all command results. To that end, we added more security commands that allow Linux devices to remotely execute management commands, such as:
Lock
Restart
Shutdown
Erase
Screensaver/ Inactivity Lock based on timeout period
New Linux Policies
We added new Linux policies to help organizations manage and secure their deployed Linux endpoints more efficiently while improving their overall security posture. They include:
Partition Options
File Ownership and Permissions
Network Parameters
Disable Unused Filesystems
Additional Process Hardening
Configure RSyslog
Forbidden Services
Secure Boot Settings
Service Clients
SSH Root Access
SSH Server Security
Patch Management
JumpCloud Patch Management was launched in Q1, 2022 with initial support for Windows and iOS. Our Linux (Ubuntu) support was a fast-follow in April. The Ubuntu default policies are preconfigured with conservative defaults for the following settings:
Defer Rollup/Patch Updates: The number of days to defer the availability of future minor OS updates. For Deferral Days, specify how many days to defer a minor OS update after it’s released.
Defer Major Updates to Ubuntu LTS versions only: Specify how many days to defer the availability of future major LTS OS updates. For Deferral Days, specify how many days to defer a major OS update after it’s released.
Expanded Linux Agent Support
JumpCloud continues to build out our support across Linux-based systems to enable IT administrators the flexibility to manage all of their deployed devices. Expanding to a variety of new distributions, the JumpCloud agent can be deployed to secure, manage, and view these systems in the admin portal. Our Linux distros include:
Amazon Linux and Amazon Linux 2
CentOS
Debian
Fedora
Mint
Rocky Linux
Ubuntu
RHEL and more
What’s Next?
Exciting new capabilities are already in the pipeline for Linux. Perhaps a sneak peek is allowed as we bring good cheers to the new year. Linux support is coming to JumpCloud Remote Assist! Admins will be able to remotely access (view and control) a Linux laptop or desktop to help troubleshoot and resolve issues.
If you have not tried any of our Linux capabilities, sign up for a free account for up to 10 users and 10 devices. Support is available 24×7 within the first 10 days of your account’s creation!
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
The information comes from a 2021 AdvisorSmith survey of 1,122 small business owners and managers. Yet, a whopping 61% of them aren’t concerned about falling victim to cyberattacks. They think they’re “too small to be a target.”
Bad actors target small businesses and small-to-medium-sized enterprises (SMEs) just as frequently (if not more so) than established organizations. Websites get hacked, email accounts get compromised, and sometimes, employees even steal sensitive information.
While it’s understandable for budget-conscious SMEs to put cybersecurity measures on the back burner, it just isn’t worth the risk. Especially when there are simple actions organizations of all sizes can take to improve their security tenfold.
Before we dive into our top five cybersecurity tips for SMEs, let’s take a moment to better understand what factors might make your organization an easy target.
Why SMEs Are Easy Targets for Cybercrime
As previously mentioned, many folks assume adversaries solely target enterprise companies because they provide larger opportunities for blackmail profits.
What they don’t realize is that SMEs are often targeted by chance, not by choice. Cybercriminals may impersonally wade through lists including hundreds of business names without doing much research into organizational holdings.
With that said, SMEs and enterprise-level companies alike are often chosen for the following reasons:
1. Money
Most cybercriminals carry out attacks for financial benefits. Naturally, receiving direct payments from victims is the most efficient way to profit from an attack. They usually lock down assets, before demanding a ransom to unlock them.
Intellectual property (IP) is a highly motivating asset to steal. Criminals know that an SME will pay big to get it back as a leaked IP can bring a small business down to its knees. Some hackers also sell breached assets, data, and information in the black market for profit.
2. Company Damage
Alternatively, some attacks are politically, competitively, or ideologically motivated. Though it may sound like the plot of a thriller movie, disgruntled former partners, business rivals, and unhappy employees have all been known to hijack organizational systems.
A successful cyberattack can cause major damage. They can wipe data, cause downtime, or even drive a total business shutdown. In addition to depleting bottom lines, they can ruin consumer trust. Breached SMEs also risk facing compliance ramifications, especially if the breach affected other consumers and other third parties.
3. Access to Resources
Cyberattacks can also be aimed at leveraging the company’s resources and relationships. For example, cybercriminals may target your business as part of a larger DDoS attack, to steal customers’ personally identifiable information (PII) for financial fraud, or just to hijack your computer resources for crypto mining.
4. Testing Tactics
Software engineers aren’t the only ones who run tests! Cybercriminals sometimes experiment with new tactics and attack vectors on smaller businesses before targeting the big fish in the pond.
SMEs are an easy target in such cases because the criminals expect their defenses to be weak. Don’t allow your organization to be someone’s stepping stone to a more high-impact target.
5. Becoming a Casualty in a Supply Chain Attack
Finally, SMEs are sometimes victims of circumstances. An attack may target a large vendor’s asset and infect the entire supply chain, spreading out to customers, other third parties, and even SMEs that interact with the compromised assets or parties.
These unintentional attacks may still end up crippling businesses. There are many other reasons why SMEs make easy targets for criminals. But the bottom line is that SMEs’ resource limitations can make them attractive and impactful targets to cybercriminals.
Whether you’re the target of an intentional attack or a victim of an unintentional attack, the implications of a security breach can be dire.
It’s better to take a proactive approach to cybersecurity than deal with potential financial, legal, and reputational challenges down the line. Below are five simple measures that can help you to improve your business’s cybersecurity even on a budget:
1. Implement Multi-Factor Authentication
Leveraged credentials such as passwords cause 61% of data breaches. Implementing multi-factor authentication can help in reducing these breaches.
Multi-factor authentication (MFA) is a security method for protecting access to online resources by utilizing multiple (often two) factors to verify a user’s identity. The MFA requires an additional form of identity besides a password. This can be a security key, biometric data, one-time passcode (OTP) via email or SMS, or a push notification from a supported smartphone or tablet app.
Implementing MFA has many benefits, including securing your resources even if your passwords have been compromised.
Antivirus software is great at stopping known malware threats. But admins must keep systems up to date in order for them to work properly. This is why it’s important to stay on top of patch management. Your computers, servers, and operating systems should always be patched.
System patch management is critical because patches often fix bugs and address security vulnerabilities in operating systems. For the modern business with distributed workforces and a variety of work devices and operating systems, manual patching can be a headache. Consider cloud patch management solutions within unified toolkits like the JumpCloud Directory Platform.
A firewall is a security system that filters network traffic and prevents unauthorized access to your network. Besides blocking unwanted traffic, firewalls also protect your systems from malicious software infections. It prevents unauthorized access to sensitive company data. They are an invaluable tool in web traffic management.
With a dependable firewall in place, only trusted sources and IP addresses can access your systems. Firewalls often differ based on their structure, functionality, and traffic filtering methods. Some of the most common firewalls include:
Firewalls are crucial components of any perimeter-based cybersecurity. For your network and devices to be protected, you need to properly set up and maintain your firewall. Always ensure your firewalls are up to date.
4. Enforce Strong Password Policies
All your cybersecurity efforts can go to waste if you have ineffective password policies. Besides emphasizing strong passwords that are difficult to crack, you should also encourage your employees to change their passwords regularly and not share them with other people. Implement multi-factor authentication as discussed above.
People within your organization can pose significant security risks too. Insider threats happen when people with access and privileges abuse them. This is why it’s crucial to carefully consider who needs access to what.
Implementing the principle of least privilege will protect your resources from insider threats. Additionally, it makes it easier to monitor compliance and makes it easier for your employees to access the resources they need instead of having to sift through everything.
For SMEs with lean budgets, cybersecurity can feel unattainable. But you can’t afford to completely skip on security.
The five simple, cost-effective actions outlined above can significantly improve cybersecurity without breaking the bank. There are also affordable tools such as JumpCloud, with a la carte options, that can help SMEs streamline security efforts in a centralized platform.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
“The house of every one is to him as his Castle and Fortress as well for defense against injury and violence…”— Sir Edward Coke, English judge and jurist.
Coke uttered the famous words across the pond more than 400 years ago. For centuries, the legal precedent has underpinned the right to freedom from intrusion.
One can only imagine what Coke would think about today’s ongoing privacy debate between consumers, big tech, and legal systems.
No longer are homes the only places we store personal information. Today’s companies have multiple options (and incentives) for collecting, storing, and sharing data.
As the IT admin of a small-to-medium-sized enterprise (SME), what do these developments mean for you? And what are the essential things you need to know about data privacy laws?
Keep reading to learn more about data security versus data protection, the history of data privacy laws, and the most relevant laws in the U.S. and Europe. In addition, we’ll share our best tips on how to strengthen your compliance efforts.
Data Privacy Laws and Why They Exist
The topic of data privacy entered the world stage in 2018. That’s when the Facebook-Cambridge Analytica scandal flashed across news headlines around the world.The New York Times reported that the company harvested the Facebook profiles of 50 million users, without their permission, for nefarious political purposes.
Shortly after, several high-profile data breaches further emphasized the need for enhanced data privacy and security regulations. Google+ developers discovered a breach that allowed 438 external apps to access 500,000 Google+ users’ data, including names, emails, addresses, occupations, genders, and ages. The result?
Lawmakers and regulators worldwide are now taking data privacy seriously. Several laws and regulations have popped up in recent years to protect people’s privacy. The most notable and expansive of these are the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States. We’ll dive into these regulations in a moment, but first, let’s define data privacy laws.
What Are Data Privacy Laws?
Data privacy laws are mandates that govern how organizations can collect, use, and share personal information. The laws exist to protect individuals from having their personal data mishandled or misused.
In addition, data privacy laws set standards for how organizations must handle and secure data and give data subjects rights over their information. This often includes the right to know and permit what information is collected, the right to have it erased, and the right to object to its use.
The specifics of data privacy laws vary from country to country. But they all aim to achieve the same goal: to protect people’s information from falling into the wrong hands.
Benefits of Data Privacy Laws
The benefits of data privacy laws for individual data subjects are self-evident. However, they may seem somewhat burdensome for corporations.
After all, complying with data privacy laws requires significant time, resources, and money investments. But make no mistake, adhering to data privacy laws is not only the right thing to do, but it’s also good for business.
1. Enhance Consumer Trust (and Credibility)
In a world where data breaches are becoming increasingly common, customers want to work with companies they can trust.
In fact, 71% of respondents in a 2020 McKinsey survey stated they would take their business elsewhere if a company released sensitive information without permission. Complying with data privacy regulations sends a strong signal to stakeholders that you take privacy seriously and do everything you can to protect their data.
2. Level the Playing Field
Submitting all companies to the same standards means the differentiating factor would be products and service quality, not who has the most lenient data privacy practices. This is particularly important for SMEs that lack the resources of larger corporations and would be at a competitive disadvantage if there were no data privacy regulations.
Understanding Data Sovereignty
As noted earlier, different countries have different nuances on data privacy laws, making the discussion on data sovereignty ever-important.
Data sovereignty is the concept that data should be stored and managed in compliance with the laws of its country of origin. This is especially critical for companies that operate in multiple countries, as they need to ensure that their data complies with the laws of each country.
It also extends to the idea that organizations should store data originating from a country in the same country to avoid subjecting individuals’ privacy to a foreign government’s jurisdiction.
Data sovereignty has immense relevance in cloud storage applications as companies sometimes host servers in different countries from where the data is collected. Data sovereignty will become even more critical as the internet grows and expands.
Data Security vs. Data Protection
People often use the terms data security and data protection interchangeably without realizing they are two completely different concepts.
Data Security
Data security is the practice of restricting access to data. This includes ensuring that only certain users can obtain data and that information is not modified or destroyed without authorization.
Data security is vital for both individuals and organizations, as it helps protect information from being misused or stolen. Examples of data security strategies include encryption, firewalls, and password protection.
Organizations can use an IT toolkit like the JumpCloud Directory Platform to streamline data security compliance, oversee device management in heterogeneous environments, provision/deprovision users, and enforce password controls.
Data Protection
Data protection involves safeguarding data from loss or damage. It includes measures such as backing up data and storing it in a secure location to ensure that important data is not lost in the event that security measures fail.
For example, suppose cyberattackers seize control of an organization’s server in a ransomware attack. In that case, data protection measures ensure that the organization can still access its data.
Though relevant as the last line of defense in a wider security strategy, data protection is also handy for other reasons besides malicious attacks. For example, it helps businesses recover from data loss due to technical failures or human error.
Also, if different locations house data (e.g., on premises and in the cloud), data protection helps ensure critical systems don’t grind to a halt if one storage location goes down.
The Four Basic Data Privacy Protections
Oftentimes, implementing data privacy policies is challenging for organizations because they don’t approach it as a baseline for operations.
Instead, they treat it as an afterthought and only focus on meeting regulatory compliance when required. At JumpsCloud, we’ve seen SMEs take a similar approach with IT security compliance measures to their own detriment.
Organizations seeking to take a proactive approach to data privacy should have the following protective measures in place as mandated by the General Data Protection Regulation and other similar laws:
Data Collection and Sharing Rights
Your privacy approach should include letting users know what types of data you collect, how you use it, who you’ll share it with, and what purpose you’ll use it for.
It should also inform and enable them to exercise their rights over their data, such as the right to access, delete, or correct their data.
They should also have the right to deny third-party access to some or all of their data.
Opt-In (Consent)
What’s better than letting your users know what data you handle? Asking their permission for how you intend to handle it.
It’s common for websites to have pre-ticked boxes that allow users to opt out of cookies or the collection of certain information. This is neither good practice nor in line with the laws, such as the GDPR’s cookie consent requirements.
Require your customers to take clear and proactive action to indicate that they agree to have their data collected.
Data Minimization and Storage Limitation
Only collect and store the data that is necessary for you to fulfill your business purpose. For example, suppose you’re a business that sells products. In that case, you’ll need to store data such as the customer’s name, shipping address, and payment information.
Don’t store data such as visitor browsing history on your site or the sites they visit after leaving yours. Furthermore, limit the amount of time you keep data. For instance, you can delete customer data once they haven’t interacted with your site for a certain period, such as 12 months.
Perhaps, the most shocking cautionary tale is the double-header case of AdultFriendFinder, where a dating website got hacked twice, and very private information of users was made available on the dark web. What was already a sticky situation became even worse. It turned out that the data of former users who had deleted their accounts were still being kept and were among those leaked.
Nondiscrimination and No Data-Use Discrimination
This protection requires you not to engage in discriminatory behavior against individuals who choose to exercise their data privacy rights.
For example, you cannot charge a higher price, refuse service, or give them a lower quality service because they exercised their right to access or delete their data. Also, you can’t use collected data to profile individuals along discriminatory lines.
For instance, using data to target ads or content to individuals based on their race, ethnicity, gender, religion, disability, or other discriminating factors could violate your data subjects’ rights.
Evolution of Data Privacy
As referenced in our introduction, the notion of privacy has been around long before the digital age. Here’s some additional fun facts for the history buffs out there:
In 1890, two Americans, Samuel Warren and Louis Brandeis wrote “The Right to Privacy.” The article advocated individuals “be left alone” and not have their lives turned into public spectacles. With time, the need to protect people’s information became more apparent as the technological landscape changed.
In 1967, an interesting development to the U.S. constitution’s fourth amendment arose in Katz v. The U.S., where investigators had recorded a gambler’s conversations on a public telephone. The court held that the right to privacy extended beyond a person’s house, papers, and effects to include areas where a person has a reasonable expectation of privacy, such as a telephone booth, as in this case.
Katz vs. The U.S. accelerated the movement toward data privacy, and in time, Sweden enacted the first national data privacy law in 1973.
The 1980s saw the Organisation for Economic Co-operation and Development (OECD) release data privacy guidelines which then and till today, form the basis for many data privacy laws around the world.
Then came the internet, which made it easier for organizations to store more information than ever. In response, the European Union (EU) passed the Data Protection Directive in 1995.
During the Wild West days of the internet, data privacy concerns took the backseat while data security rode shotgun. However, this soon changed with the rise of big data firms such as Google, Amazon, and Facebook in the 2000s.
The massive data these organizations collected, coupled with high-profile privacy scandals, made it inevitable that data privacy would come to the forefront again.
As previously mentioned, several countries have enacted data privacy laws reflecting its greater importance. Meanwhile, only time can tell what new technologies will develop and what concerns and responses to data privacy they might bring.
U.S. Data Privacy Laws
The United States does not have a single, all-encompassing data privacy law. Instead, it relies on a patchwork of federal and state laws and industry-specific regulations.
National Privacy Legislation
There are several pieces of U.S. federal legislation that deal with data privacy. Perhaps the most popular are the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), and the Children’s Online Privacy Protection Act (COPPA).
HIPAA establishes national standards to protect people’s medical information. It applies to healthcare providers, health plans, and other medical information organizations.
The GLBA requires financial organizations to safeguard sensitive information and explain their information-sharing procedures to customers. It also demands that they respect the customer’s right to opt out of any data sharing with unaffiliated parties.
COPPA protects the online privacy of children under 13 by prohibiting website operators from collecting personal information from children without parental consent.
State Privacy Legislation
Several states also have data privacy laws. For example, The Massachusetts Data Privacy Law is one of the most comprehensive state data privacy laws. It requires businesses to take reasonable security measures to protect personal information. It imposes harsh penalties for companies that suffer data breaches.
California has the California Consumer Privacy Act (CCPA), which came into effect in 2020. The act contains residents’ right to know what personal information is being collected about them, the right to delete that information, and the right to opt out of its sale. With few exceptions, the CCPA contains as many measures as the GDPR.
There is also the Nevada Internet Privacy Law, with similar provisions to the CCPA but limited to online and web services only.
EU Data Privacy Laws
The European Union has one of the world’s most comprehensive data privacy laws. The EU’s General Data Protection Regulation (GDPR) came into effect in 2018 and builds on the EU’s 1995 Data Protection Directive.
The GDPR requires businesses to get explicit consent from individuals before collecting, using, or sharing their personal data. It also gives individuals the right to know what private data organizations collect about them, the right to have that data erased, and the right to object to its use.
The GDPR applies to data processes irrespective of whether the data is collected online or offline; or whether or not the business is in the EU.
Companies that violate the GDPR can receive a fine of 4% of their annual global revenue or €20 million, whichever is greater.
Data Privacy Quick Tips for SMEs
So, what can SMEs do to comply with data privacy laws? Here are some quick tips:
Get rid of dark patterns: You know how easy it is to use those complicated menus to frustrate users and discourage them from using the opt-out button. Or how easy it is to place confusing words like “Don’t Not Sell My Personal Information” beside the “I agree” checkbox. Well, don’t use them. Dark patterns are not only annoying to your user; specific instances of them could also be illegal under relevant laws.
Implement privacy by design: This means building privacy into your products and services from the ground up. It starts with understanding what personal data you are collecting and why. Do you really need it? Can you get by with an email address? Once you’ve decided what data you need, figure out how to collect it to minimize the risk of exposure. For example, if you’re managing sensitive information like health data, consider using encryption to keep this information safe both during and after collection.
Communicate changes in policy: If you change your privacy policy, communicate these changes to your users. Also, ensure you provide an option for users to opt into the new policy. It goes without saying that you should also make it easy for users to find your privacy policy on your website or app.
Data privacy is more than the internet: Remember that privacy laws also apply to offline data collection. This includes data collected through paper forms, over the phone, or in person. So, if you collect this type of information, take steps to protect this information from exposure and use it only for the purpose it was collected.
Improve IT Security Hygiene with JumpCloud
Data privacy laws are constantly evolving, and businesses must keep up to date with the latest changes. By understanding the basics of data privacy, you can ensure your organization complies with relevant laws and protects your customers’ personal information.
Did you know that instituting and enforcing IT hygiene policies helps improve organizational data privacy, security, and protection posture?Learn how organizations can adopt data-hygienic practices, improve data privacy, and avoid breaches in The IT Manager’s Guide to Data Compliance Hygiene.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
Streamlined and unified authentication to all resources is a core feature of JumpCloud’s open directory platform. That capability extends to secure network access into Wi-Fi and VPNs. JumpCloud’s cloud RADIUS service now supports credential-based (password) and certificate-based (passwordless) authentication.
The combination of these authentication methods addresses the vast majority of risk levels an organization may face. Furthermore, the certificate-based authentication (CBA) approach is considered the most secure and frictionless method available today. JumpCloud’s CBA is consistent with the open directory principles, offering IT and network admins the flexibility to bring your own certificates (BYOC) as well as the future ability to manage certificates within JumpCloud.
What Is RADIUS Certificate-Based Authentication?
RADIUS Certificate-Based Authentication (CBA) is an authentication method that leverages the content of a X.509 compliant certificate to validate the identities of the device and the user requesting access to a network resource. RADIUS CBA obtains the certificate contents from the RADIUS client when a user requests access to an AP (access point) via client PC (RADIUS client). It then validates the standing of the certificate, as well as the certificate trust chain, with the corresponding certificate authority (CA). Finally, RADIUS CBA verifies the user status and access privileges against the JumpCloud Directory before allowing access to the RADIUS resource (typically Wi-Fi or VPN) when the certificate is validated.
The Benefits of RADIUS CBA
The benefits of CBA are predicated on two fundamental capabilities. First, the ability to positively identify the authenticating party by leveraging the digital private/public key pair technology recognized as the most secure technology in the industry; and second, the ability to authenticate the user bound to the certificate without any input from the user (frictionless). Small and medium-sized enterprises (SMEs) can use CBA to secure and streamline user authentication flows and eliminate the potential for identity silos or duplicate systems.
Key Features of RADIUS CBA
All current cloud RADIUS features are available with the RADIUS CBA release. The following new capabilities are part of this new release:
Bring your own certificates (BYOC) – The initial release of RADIUS CBA allows IT administrators to import their certificates into RADIUS for authentication. The certificate lifecycle management and delivery to target endpoints is achieved by tools external to JumpCloud.
Multilayer User Authentication – Before allowing user access, RADIUS CBA authenticates the good standing of a certificate (expiration, origin, and revoke status), compliance to one of three JumpCloud user certificates supported (Email user identifier in Subject Alternative Name field, Email user identifier in Distinguished Name field, or Username user identifier in Common Name field), the user status in JumpCloud directory, and finally the user certificate location (must be located on target client device).
Password as an alternative to certificates – RADIUS CBA allows administrators to use credentials as an initial alternative to certificate. This capability enables the gradual migration to certificate based authentication. Users can initially authenticate using their Username/Password then transition to certificates.
User groups – The traditional user group association capability and assignment to RADIUS AP is also available with certificates. Groups leverage JumpCloud’s attribute-based access control (ABAC) to automate identity lifecycle management.
Consolidated IT infrastructure –No additional servers, Windows Server roles, or on-premise infrastructure is required to set up and maintain cloud RADIUS CBA. This lowers IT’s administrative overhead and reduces potential cyberattack surface areas.
Certificate Status check during Authentication BYOC supports validating the good standing of a certificate on every authentication transaction via the Online Certificate Status Protocol (OCSP).
The Benefits of RADIUS CBA/BYOC
Certificates may originate from multiple CAs. Organizations that already use and manage certificates can import them into JumpCloud and use them for authentication to JumpCloud RADIUS to secure network access. For more on the JumpCloud CBA, see Certificate-Based Authentication to RADIUS for Admins.
Examples of BYO Certs in Action
When the SME wants its users to authenticate securely and without friction, the administrator:
Selects the “passwordless” authentication method
Imports the certificate chain, which allows the JumpCloud RADIUS server to challenge the RADIUS client with EAP-TLS mutual authentication.
The admin can also allow password authentication as a fallback method for those users who have not yet received a certificate.
Admin
When a user initially connects to a Wi-Fi device configured for JumpCloud RADIUS with certificate authentication (and password as a fallback), they can select “connect using a certificate.” Going forward, authentication to the Wi-Fi AP will happen automatically without any additional input from the user.
JumpCloud’s cloud RADIUS validates the certificate contents provided and checks if the certificate, and user, are in good standing before granting access to the Wi-Fi network.
Try JumpCloud Cloud RADIUS
JumpCloud offers its full open directory platform without any charges for up to 10 users and devices. Free chat support is provided for 10 days to help get you started. Pricing is workflow-based to help SMEs meet their unique requirements versus feature-based SKUs. Would you prefer tailored, white-glove implementation assistance? Schedule a free 30-minute technical consultation to learn about the service offerings available to you.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
Active Directory (AD) is a directory service introduced by Microsoft that runs on a Windows server to centrally manage user access to resources on the LAN. The server role in Active Directory is run by Active Directory Domain Services (AD DS), and the server running AD DS is called a domain controller. The domain controller performs two important functions:
Authenticates and authorizes all users and systems in a Windows-based network
Assigns and enforces all security policies for Windows systems
That is why Active Directory remains an important system of record for many small and medium-sized enterprises (SMEs), even though it can only reside on servers within a network. However, IT infrastructure and workplace trends have changed dramatically since its introduction over two decades ago. It’s common to have a heterogeneous mix of devices with employees working remotely at least some of the time (or even indefinitely). Microsoft has responded by extending AD to the WAN, but devices and users can now be managed without AD, or Microsoft.
Identity has become the new perimeter and IT teams must look beyond standalone AD to manage identities and all corresponding devices, wherever they exist. Devices are the gateway to your IT assets and shouldn’t go unmanaged because they’re not Windows. Cloud directories are filling the gap by providing the access control, device management, portability, and security that AD cannot. This has brought forward the option for a new paradigm: the domainless enterprise.
This article examines AD’s benefits, and when it’s necessary to look beyond it. That’s accomplished by integrating with cloud directory services to extend it, or even a domainless enterprise.
What Does Active Directory Do?
AD DC manages local network elements, such as systems and users, by organizing them into a structured hierarchy. The domain controller is then responsible for authorizing user authentication requests within the network. The next section outlines its core capabilities.
Manages Devices, Services, and Users
Active Directory Users and Computers manages local contacts, devices, and users in your fleet: from PCs to printers. Admins create and organize groups within organizational units (OUs) to logically separate resources. OUs reside within a “forest,” which is the highest level of organization in AD. It may include service accounts for network services, apps that run on your servers, and integrations with SaaS apps. Service accounts can run locally on machines or across the domain. This tool also configures permissions for objects within your directory.
Global Catalog of Domains
Global catalog is an AD feature that stores replicas of the attributes of an object within a forest (or domain tree), even if the object (such as a user) resides within a separate domain. This enables organizations to centralize IT even if they have multiple locations and data centers, but users and devices must either exist within the confines of those facilities or utilize a VPN.
Querying and Indexing Directory Objects
There are two built-in options to query AD attributes. The Active Directory schema snap-in enables admins to index attributes. PowerShell is another option to specify a query string to retrieve AD objects. Many organizations purchase third-party reporting tools for compliance purposes and to gain visibility into their AD environment, but it’s vital to trust all software that’s installed on a DC. Attackers may gain entry into networks through the supply chain, and DCs hold the “keys to the kingdom.”
High Availability
Every domain controller is a server object in AD DS. High availability is automatic whenever there’s more than one DC. This makes it possible to shut down a server for maintenance without impacting your end users. Objects are automatically replicated throughout the server cluster. Administration is more complex: e.g., add-on apps must be installed and updated on each DC. Adding servers may increase licensing, management, server infrastructure costs.
Schemas and Templates
Admins have deep control over how AD operates. Schemas can be customized to control (through rules) objects that can be stored within the directory and their related attributes. Templates can be configured to automate the creation of objections and associated policies. Admins use the Group Policy Editor to create and edit ADMX and ADML template files. Templates may also be imported into Microsoft’s Endpoint Manager, a new subscription cloud service.
Now, let’s explore what AD isn’t capable of doing.
What Doesn’t Active Directory Do?
The domain controller serves an important role, but the modern workplace has shifted to the cloud. Legacy management solutions like the domain controller struggle to manage the disparate, non-Windows-based identities that have become commonplace in the IT landscape. Managing identities also entails managing devices and access to SaaS apps external to the Microsoft ecosystem. The next section examines those constraints in further detail.
Single Sign-On (SSO) and Multi-factor Authentication (MFA)
The widespread shift toward web applications means that end users can no longer leverage single sign-on (SSO) through AD for all resources. Twenty years ago, when the IT landscape consisted entirely of Windows applications and desktops, AD connected every user to just about every resource they required. AD no longer grants that level of authorization, forcing admins to adopt additional tooling to manage authentication and authorization for all of their IT assets.
Microsoft introduced an Identity-as-a-Service (IDaaS) solution with Azure Active Directory (AAD), but AAD can make identity management complex, time-consuming, and costly for IT admins by forcing them to keep on-prem AD in conjunction with it. There’s a free tier of AAD that makes it possible to access apps such as Microsoft 365 (M365), but a Premium 1 (P1) or greater subscription to AAD is necessary to have SSO for domain-bound apps and the cloud.
Additionally, if IT professionals wanted to leverage SSO for their users without AAD, they would have to add Active Directory Federation Services (AD FS) to their on-prem AD. That would need to be housed on-prem. AD FS has high management overhead and can be difficult to implement. Microsoft requires the NPS server role to be installed, configured, and managed to access network devices. There are multiple options for SSO within the Microsoft portfolio, but extending AD for roles it wasn’t designed for dramatically increases complexity and overhead.
Multi-factor authentication (MFA) isn’t built into AD. SMEs must purchase solutions that integrate with it. Microsoft offers MFA to access Windows apps, but only through its AAD P1, P2 SKUs. Additionally, conditional access (CA) policies aren’t available without those integrations.
Securing and Managing External Identities
The domain controller struggles with providing access to IT resources outside of the on-prem Windows networks, so AWS and GCP infrastructures can be difficult to integrate, such as Google Workspace.
Third-party solutions, such as JumpCloud’s open directory, manage identities from other identity providers (IdPs) such as Google or Okta. Microsoft has introduced the capacity to manage external identities through Entra, for an additional monthly fee per user. It also charges for every single instance of an MFA authentication for those external IDs.
Strong Security Defaults
Substantial work is required to harden Active Directory through specialized configurations. It’s not secure by default, and attackers have cultivated a strong understanding of AD’s default settings. Hardening AD is mandatory to secure your infrastructure.
IT teams should always follow best practices to limit how they run as domain administrators. It’s advisable to use Microsoft’s ATA (Advanced Threat Analytics) or Defender for Identity to detect anomalous user behaviors. Security best practices for AD can take several full days of work to implement.
Automation of Identity Lifecycle and Entitlements
User identity lifecycle and entitlement management is a manual process in AD. Serious and costly breaches, including the Colonial Pipeline ransomware attack, have occurred when domain users were “forgotten.” Forgotten accounts are still able to access assets. It’s important to actively manage users and privileges to safeguard against insider and external threats.
Integrated Reporting
Third-party tools/services are necessary for reporting, especially when your users are accessing confidential and protected information or your industry is subject to compliance or regulatory requirements.
Cross-OS Device Management
Systems must be directly bound to the AD to deploy Group Policy Objects (GPOs) which are registry settings, configurations, or tasks that need to be executed. Mac and Linux systems’ commands and scripts (i.e., no GPOs) cannot be managed from the Windows domain controller, meaning that IT admins must manually configure each system if they choose not to implement add-ons. Even Windows systems must be connected to a VPN to receive policy updates from AD or PowerShell commands, complicating your capacity to effectively manage remote users.
Microsoft’s paid subscription Intune service fills this gap, but Microsoft services aren’t mandatory. An open directory platform, such as JumpCloud integrates with AD to perform this function, but could also manage devices without a domain controller being present.
Patching
There have been over 1,000 patches released from Microsoft to date this year alone. Patch Tuesday has now become “Zero Day Tuesday.” However, it’s possible to deploy software using AD Group Policy, but it doesn’t handle patching Windows systems throughout a domain (or even third-party applications) without a patching solution.
Patching services may be cloud-based, such as JumpCloud, or on-premise servers. Patching OSs and apps (such as browsers) is vital to prevent Zero Day attacks from being exploited.
AD DS runs on Windows Server, which must be maintained and supported. Domain controllers contain data that determine access to an established network, making it a primary target for cyberattackers looking to corrupt or steal confidential information. It’s even possible for attackers to elevate domain standard users accounts to become domain admins without using malware on unpatched systems. Security tools such as BloodHound and Mimikatz are all that’s required for the AD attack path.
Standard endpoint detection and response (EDR) won’t detect these intruders, and firewalls won’t stop them. Given these risks, cybersecurity should be a paramount priority for all SMEs. Industry experts routinely recommend a Zero Trust posture.
Active Directory isn’t Zero Trust.
Active Directory and Zero Trust Security
Microsoft has responded to these threats by updating AD’s capabilities for better security, but the requisite setups and changes can be resource intensive or require its premium cloud services. Active Directory works best with on-prem networks and Windows-based environments. AD natively operates by establishing a network of trusted assets, known as a domain, which are protected by an AD domain controller, VPN, firewalls, and other controls.
The objective is to create a strong perimeter to protect trusted resources from the open internet. As a result, external sources of network traffic (e.g., users) must first authenticate and ultimately be authorized to access internal domain resources such as systems and applications.
Zero Trust security, on the other hand, is a security model that effectively eliminates the separation between an internal domain that’s safe and the open internet that’s dangerous. Rather, all sources of network traffic are viewed as potential attack vectors that must generate trust before they are authorized for user access — and with good reason too. Bad actors are now attacking traditional networks from inside and out, often bypassing perimeter-based security by targeting trusted assets. Thus, Zero Trust security is effective because it basically eliminates the concept of trusted assets (i.e., the domain) altogether. Users must prove who they are.
The next-generation Active Directory alternative has been reimagined AD for the cloud era. Cloud directories connect users to their IT resources regardless of their platform, provider, protocol, and location. They’ll also manage all your devices. Additionally, as an identity and access management (IAM) platform, cloud directories forgo the concept of the traditional domain. This provides users with True Single Sign-On™ access to virtually all of their IT resources. SMEs can leverage JumpCloud’s open directory platform to manage identities wherever they reside with the assurance that it will help to deliver Zero Trust security.
Cloud Integration with IT Resources
The cloud directory integrates with the external identities and devices that AD doesn’t support in addition to AD itself. This is made possible through the combination of modern IAM and SSO protocols, automated entitlements management, using MFA to verify users, and CA for privileged user management. You can manage your entire device fleet through JumpCloud.
Centrally Control Identities and Systems
JumpCloud can extend AD and AAD identities and agent-based control (or MDM) to all systems in a fleet, whether they’re Apple, Android, Linux, or Windows devices. Unlike Microsoft, there’s no additional cost to manage your non-Windows devices or Windows without a DC. JumpCloud can also serve as a standalone cloud directory or import identities from Google and Okta.
End users access their machines with their identity provider’s credentials, and admins can enforce pre-built GPO-like policies on those machines, such as full disk encryption or managing patches. No complex templates are required. SUDO-level permissions and a PowerShell module enable administrators to perform commands on any device, from CRUD operations to benchmark policies. A commands queue offers admins an easy-to-use dashboard for admins to see what commands they have awaiting execution on all their assigned devices and their status.
Other key features include:
Automatic high availability and redundancy. There’s no need to license multiple servers or to create a service account that has access to a privileged AD group.
Telemetry aggregated from devices, events, users, and cloud services with pre-built reports and reporting tools. You’ll even know which users are accessing SSO apps.
Opt-in Remote Assist, without the complexity of RDP or need to license a solution from a third party. This feature works across multiple operating systems.
An optional decentralized password manager and vault for your users.
You don’t need AD to access your network. Admins can achieve Cloud RADIUS functionality without additional on-prem infrastructure, and they can ensure users log into Wi-Fi networks (with VLAN tagging) and VPN clients using the same core credentials they use to access their other resources. Delegated authentication includes AAD credentials. Admins can enable Push or TOTP MFA, which is especially useful to secure VPN access to internal network and on-prem resources from switches to servers.
SSO to Everything
The open directory platform builds the stack that you want. A web-based portal is used to access all the apps employees need to do their jobs with best-of-breed solutions. The portal serves as a security control to help eliminate phishing. Pre-built connectors are freely available for common apps. Supported protocols include:
LDAP
OIDC
SAML/SCIM
RADIUS
Long-standing workflows don’t have to be scrapped in favor of cloud apps. Even Windows file sharing is possible without a domain controller.
Like AD, groups are used to manage access to your apps and resources. The difference is that they are automated with HRIS provisioning included. Attribute-based access control (ABAC) reduces the risk of human error and eliminates the heavy administrative overhead that’s necessary to keep AD privileges and users up to date.
Boundaries matter less.
This setup also eliminates the need for complex server management and AD’s global catalog. For instance, specifying an office location could be as simple as creating a directory group assignment.
Integrated MFA and Conditional Access
AD is reliant upon a single factor. MFA is environment wide in the open directory platform. Optional conditional access policies can further restrict access to trusted devices, by geolocation, and more for privileged users. JumpCloud doesn’t charge for MFA for external identities; Microsoft’s AAD does. Microsoft limits CA to AAD P1, P2, and requires integrations for AD. AD doesn’t have these capabilities and must be morphed into something it’s not in order to satisfy modern requirements.
In contrast, there’s far less complexity, labor, and cost when the domain controller is left out of the equation. In addition, there’s a greater opportunity to protect identities. JumpCloud secures identities (and aligned devices) even further with extended detection and response (XDR) integrations from the security vendors of your choosing. Microsoft only makes its security services first-class citizens.
Utilizing an Open Directory Platform
Organizations have already been moving their operations to managed services in the cloud to save the cost and time of maintaining an on-prem domain controller and server rooms. The journey begins by integrating JumpCloud with AD. An open directory platform frees up time and money for IT admins looking to manage a variety of systems and applications from one built-in service. Budget can be allocated toward higher priorities, such as Zero Trust, especially during leaner economic times. JumpCloud is free for your first 10 users or devices with 10 days of chat support up front.
Sometimes self-service doesn’t get you everything you need. If that’s how you’re feeling, schedule a 30-minute consultation to discuss options for implementation assistance, migration services, custom scripting, and more.
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About JumpCloud At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.
