Press Release 彙整 - 頁425，共774

Discover Pandora FMS best features 2022-2023 (Part I)

Version 760

Starting with version 760, Pandora FMS significantly improved its installation process.

Instead of using ISOs, you now have online installation scripts that allow you to install Pandora FMS and all its components with a single run.

In addition, this same version is the one that started including support for Red Hat 8, Rocky Linux 8 and Alma Linux 8 operating systems.

Hard to believe, right?

On the other hand, in the Alerts menu, you will find a renewed tool to schedule alert notification.

You may set multiple schedules in a single day with the advanced mode, or choose only one with the simple mode.

In addition, it also has a new automatic graph for modules based on a histogram that will allow you to see the changes in the module status in the time range you want. Without a doubt, a very helpful tool for your day to day.

Version 761

Pandora FMS version 761 also comes with very interesting news.

For example, you now have two new Module Agent reports, with which you can see the name of the agent and the current value of the modules you select, in addition to the current status of the module, group and last contact.

But that’s not all, a new type of report called “Custom Graphical Representation” was also added, with which you may customize SQL executions or create graphs with your own macros and show any information you want from your environment.

As for views, a new one was added, called “heat map”, which will allow you to see the general status of your environment interactively, being able to filter by agent group, module group or label.

Version 763

Pandora FMS version 763 brought lot of other improvements. One of the main ones is the new method for displaying the service map.

Now, with “Sunburst”, you will be able to see your services in a circular way instead of the common tree shape.

There is also a new widget in the dashboards section, with which you may quickly see the number of agents that belong to each operating system and their current status.

And if that was not enough, event replication was deleted from the command center, which provides higher fluidity and scalability when working with these events.

Version 764

Pandora FMS version 764 is undoubtedly one of the most convenient ones.

Very interesting features related to the Satellite server have been added.

From now on, you can manage the whole configuration of your Satellite servers from Pandora FMS console itself, change any configuration or parameter in the configuration file of the Satellite server itself or even restart the service remotely from the console.

In addition, this version also includes improvements in event management, allowing greater flexibility in event creation and management and their associated actions.

Integration with ticketing systems, such as OTRS or RT, has also been improved, allowing more efficient incident management.

Another of the most notable novelties is the inclusion of a more advanced alert system, which allows you to define alert thresholds based on different metrics and actions to be taken when these thresholds are exceeded.

Conclusions

These new Pandora FMS features for 2022-2023 are like a superhero based in your city, ready to protect your environment from any danger and make your job much easier.

With easier installation, revamped alert tools, new custom reports, and improved event management, this new version is all you need to take your monitoring tasks to the next level.

So if you’re sick of dealing with complicated installations, unclear graphics, and useless alerts, Pandora FMS is the solution for you!

With its powerful combination of features and ease of use, there is no other monitoring software that can compete with it..

Version 760

Starting with version 760, Pandora FMS significantly improved its installation process.

Instead of using ISOs, you now have online installation scripts that allow you to install Pandora FMS and all its components with a single run.

In addition, this same version is the one that started including support for Red Hat 8, Rocky Linux 8 and Alma Linux 8 operating systems.

Hard to believe, right?

On the other hand, in the Alerts menu, you will find a renewed tool to schedule alert notification.

You may set multiple schedules in a single day with the advanced mode, or choose only one with the simple mode.

In addition, it also has a new automatic graph for modules based on a histogram that will allow you to see the changes in the module status in the time range you want. Without a doubt, a very helpful tool for your day to day.

Version 761

Pandora FMS version 761 also comes with very interesting news.

For example, you now have two new Module Agent reports, with which you can see the name of the agent and the current value of the modules you select, in addition to the current status of the module, group and last contact.

But that’s not all, a new type of report called “Custom Graphical Representation” was also added, with which you may customize SQL executions or create graphs with your own macros and show any information you want from your environment.

As for views, a new one was added, called “heat map”, which will allow you to see the general status of your environment interactively, being able to filter by agent group, module group or label.

Version 763

Pandora FMS version 763 brought lot of other improvements. One of the main ones is the new method for displaying the service map.

Now, with “Sunburst”, you will be able to see your services in a circular way instead of the common tree shape.

There is also a new widget in the dashboards section, with which you may quickly see the number of agents that belong to each operating system and their current status.

And if that was not enough, event replication was deleted from the command center, which provides higher fluidity and scalability when working with these events.

Version 764

Pandora FMS version 764 is undoubtedly one of the most convenient ones.

Very interesting features related to the Satellite server have been added.

From now on, you can manage the whole configuration of your Satellite servers from Pandora FMS console itself, change any configuration or parameter in the configuration file of the Satellite server itself or even restart the service remotely from the console.

In addition, this version also includes improvements in event management, allowing greater flexibility in event creation and management and their associated actions.

Integration with ticketing systems, such as OTRS or RT, has also been improved, allowing more efficient incident management.

Another of the most notable novelties is the inclusion of a more advanced alert system, which allows you to define alert thresholds based on different metrics and actions to be taken when these thresholds are exceeded.

Conclusions

These new Pandora FMS features for 2022-2023 are like a superhero based in your city, ready to protect your environment from any danger and make your job much easier.

With easier installation, revamped alert tools, new custom reports, and improved event management, this new version is all you need to take your monitoring tasks to the next level.

So if you’re sick of dealing with complicated installations, unclear graphics, and useless alerts, Pandora FMS is the solution for you!

With its powerful combination of features and ease of use, there is no other monitoring software that can compete with it..

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Pandorafms 2023

Most common types of cyberattacks in 2023

Cybercriminals constantly evolve their methods and develop sophisticated techniques to infiltrate our interconnected world. From elaborate nation-state campaigns to opportunistic ransomware attacks, hackers tirelessly explore new avenues in their pursuit. As a result, cyberattacks multiply every year, leaving individuals and organizations vulnerable.

To secure digital ecosystems, staying informed of the most common types of cyberattacks in 2023 is crucial. This blog will delve into the escalating battle against criminals, uncovering the key challenges and proactive measures necessary to fortify your defenses.

What is a cyberattack?

A cyberattack is a malicious and deliberate attempt by an individual or an organization to breach an information system. The attacker (often called a hacker) aims to disrupt, damage, steal, alter, or gain unauthorized access to a computer system or network, usually intending to extract or compromise data.

Some cyber attacks are financially motivated. They may target individuals, businesses, or financial institutions to steal sensitive information. Data like credit card details, login credentials, or personal information can be sold on the black market or used for fraud.

Other cyber attacks may be driven to disrupt rival nations or organizations as a form of modern warfare. These hackers often have political or strategic motivations to gain a competitive advantage or destabilize their targets.

Cyberattacks can take wildly different forms, from installing spyware on a device to conducting large-scale distributed denial of service (DDoS) on significant network infrastructure. Here are its main types:

Phishing

Phishing is a social engineering technique when attackers disguise themselves as trustworthy entities, usually via email, to trick recipients into disclosing sensitive information. Phishing cyber attacks look like genuine emails from colleagues or official institutions. The catch is that the provided links in these emails lead to malicious websites or initiate malware downloads.

In real-life, phishing is usually a gateway to initiate additional cyberattacks on top of it. Phishing may be used to obtain genuine user credentials to plant malware or access classified documents. As one of the most common cyberattack methods, it primarily targets individual users and SMBs (small and medium-sized businesses).

Ransomware

malware that locks down a victim’s files and demands a ransom

High data value enables hackers to get away with a hefty ransom, as sometimes it may seem cheaper and faster to pay the amount for a business. The lucrativeness of this cyber attack type was one of the main contributing factors to its popularity in 2023.

Spyware

Spyware is another type of malware that tracks data flowing through network assets and sends this information to controllers outside the targeted organization. Hackers use it as a monitoring tool to track their victim’s activities or extract other data. Spyware can include keystrokes, browsing habits, and even confidential business information.

This malware can be spread through infected websites, malicious emails, hacked USB flash drives, or even freeware applications. Some advertisers even use spyware legitimately to deliver targeted ads (as most users agree to terms and conditions without actually reading them).

Viruses

viruses are self-replicating malicious software

They work by attaching to an executable host file, which results in their viral codes executing when a file is opened, such as an Excel sheet or a .pdf document. It means that viruses generally spread through email attachments and file-sharing programs. In any case, businesses must be up to date to detect such attachments before they wreak havoc on their perimeter.

Malware

Malware is a broad category describing various types of malicious software, including ransomware, spyware, and viruses. The specific actions of malware will depend on its exact type, but its overall objective is consistently centered around disrupting a computer, server, client, or computer network. It may involve leaking confidential information, illicitly accessing systems, restricting access to data, or unintentionally compromising the user’s computer security and privacy.

Man-in-the-middle attacks

A man-in-the-middle (MITM) attack is a type of cyberattack where an attacker intercepts and potentially alters the communication between two parties without their knowledge. The attacker positions itself between the sender and the recipient, becoming a “middleman” in the process.

This type is different from phishing because the source is entirely genuine. It’s just that it’s been altered to serve the hacker’s goals. An obvious example would be attacking an organization’s financial department and changing the bank transfer code. As neither party notices anything unusual, this cyber attack type is tough to detect and is usually discovered after the attack.

SQL injection

SQL injection is an exploit technique when an attacker externally manipulates the input parameters of an SQL (Structured Query Language) query. As many applications and websites dynamically construct SQL queries by combining the user-supplied input and the query string, this provides a window of opportunity for hackers.

The attacker identifies a vulnerable input field in a web application that accepts user input, like a login form, search box, or any other input field. Then, a crafted input with SQL code needs to be submitted as part of the user input. If the application takes input as a SQL query without validation, it can be executed by the application’s database engine. It interprets the injected SQL query as part of the code infiltrating the database.

SQL injection allows hackers to perform many unauthorized actions like bypassing authentication, retrieving sensitive data, modifying or deleting database records, or executing arbitrary commands on the underlying system.

DDoS attacks

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal functioning of a computer network, service, or website by overwhelming it with a flood of illegitimate traffic. In a DDoS attack, multiple compromised devices or systems are used to generate a massive volume of requests or data packets toward a target, overwhelming its resources and making it unavailable to legitimate users.

These attacks can be launched from anywhere, making them highly challenging to mitigate. Furthermore, attackers often employ tactics like IP address spoofing or multiple attack vectors simultaneously, making it more challenging to identify and block malicious traffic.

Zero-day exploits

Zero-day exploits refer to unknown security vulnerabilities or weaknesses in software, operating systems, or applications. They have no official patches because developers had zero days to address them before they were exploited.

These exploits are highly sought after by both cybercriminals and security researchers because they provide a significant advantage to the attacker. Zero-day exploits are dangerous because there are no available defenses or countermeasures.

DNS tunneling

DNS tunneling is a technique to bypass security measures and exfiltrate data from a network. The attacker exploits the DNS protocol to establish a covert communications channel between a compromised machine within a network and an external server controlled by the attacker. It allows them to send and receive unauthorized data through DNS queries and responses.

DNS tunneling poses a significant security risk because it leverages a widely used and trusted protocol to bypass firewalls and other security measures that typically monitor and restrict data traffic. By hiding within DNS traffic, attackers can exfiltrate data without arousing suspicion.

XSS attacks

Cross-Site Scripting (XSS) attacks inject malicious scripts into websites that users trust, aiming to steal sensitive data. XSS attacks typically target web applications that allow user-generated content, such as online forums, comment sections, or input fields.

The attacker finds a vulnerable website and identifies the input field for submitting comments, search queries, or any other user input form. A malicious payload is then crafted using scripts or code, often written in JavaScript. Unaware of malicious intent, the website accepts and stores or displays the input. When users interact with the compromised web page, the website serves the malicious payload to their browser. It leads to malicious code execution in the victim’s browser.

Common cyberattacks on SMBs

Cybercriminals often target small businesses because they typically have less secure networks and less sophisticated cybersecurity measures than large corporations. At the same time, they still have enough sensitive information to be attractive targets.

Phishing — is the most popular attack against SMBs because it requires the least preparation time. All a hacker needs is a convincing email message, adjusting the formatting, and sometimes spoofing an email’s domain address while dodging spam filters. Then all that’s left to do is wait for the victim to click the link.

Malware — as this type involves all varieties of malicious software, there are countless ways and methods of how an SMB could come into contact with it. Malware can range from ransomware that encrypts files and demands a ransom to release them to spyware that collects and sends sensitive data to the attacker.

DoS and DDoS — due to their disruptive nature, organizations and businesses are often the targets of this attack. Business services can be completely shut down, making it impossible for legitimate users to access the system. Small businesses can become targets of such attacks as digital vandalism or as a distraction for another type of attack.

Be safe with NordLayer

While NordLayer doesn’t have a miracle cure for all cyberattacks, it can assist your organization in protecting its connections over the public internet. You can do it by encrypting the connection between the user’s device and the middleman server using advanced ciphers.

Additionally, NordLayer can block access to malicious websites and control entry to specific content categories. It lowers the risk that an employee will infect the network after clicking a malicious link, whether it came from an email or was encountered online.

Taking proactive measures to ensure your sensitive information remains secure from various threats is the only way to navigate the modern cyber landscape. Contact our team and find out how to improve your resistance against cyberattacks.

FAQ

How often do cyberattacks occur?

Cyberattacks happen daily (some sources claim one cyber attack occurs every 39 seconds). Their frequency and severity vary based on the target, the attacker’s skills, resources, and the defensive measures in place.

What is the most significant cybersecurity incident in 2023?

In April 2023, the Shields Health Care Group, a medical services provider in Massachusetts, experienced the most significant data breach of the month. Towards the end of the month, news surfaced indicating that a cybercriminal had illicitly infiltrated the organization’s systems and successfully obtained the personal information of 2.3 million individuals.

What are the top 3 most common cyberattacks in 2023?

As of 2023, the top three most common cyber attacks are phishing, ransomware, and DDoS attacks. These pose significant threats due to their high success rate and potential for causing substantial damage.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2023

Jira security best practices: keeping your data safe

Jira’s cloud-hosting solutions serve major corporate giants like the Coca-Cola Company, Delta Airlines, and CostCo. Every day, millions of people rely on Jira to access development apps and collaborate with colleagues. But Jira deployments require watertight security. Companies can easily fall victim to cloud data theft. This can inflict reputational damage or – in worst-case scenarios – lead to bankruptcy.

This article will explore how to secure your Jira assets. We will look at best practices for Jira security and learn how shared responsibility works. We will also explain some of the most urgent cloud security threats. The result will be a solid foundation in Jira cloud security.

Understanding the significance of Jira security

Cloud platforms are critical to the modern economy. The cloud hosts websites, customer databases, development environments, and collaboration tools. Lightweight cloud tools also dramatically lower networking costs. This makes it easier to create customized business architecture.

Operated by Atlassian, Jira is a cloud-hosting service known for supporting agile network deployments. Its development tools suit rapidly changing companies and scale smoothly. But as with all major cloud platforms, Jira is a tempting target for cyber attackers.

Jira security is shared between the cloud provider and customers. As we will see, Jira has many native security features that guard customer data. But customers retain responsibility for:

Access management
Endpoint security
Application installation and management
Protecting customer data

Jira security best practices

Jira security aims to protect sensitive data stored on the cloud platform. Users (or “tenants”) must minimize data breach risks while understanding security areas covered by Jira’s systems. This checklist covers actions required to secure Jira environments.

jira security best practices list Security best practices include:

Verifying your domains
Hardening your login security policies
Auditing activity logs intelligently
Managing accounts to minimize data breach risks
Training staff to use Jira securely
Making use of mobile security tools

1. Verify and claim Jira domains

The first step in improving your security setup is verifying the Jira domains you own. Domain verification allows administrators to take control of access management policies for Jira assets. Admins can claim domains via the Atlassian admin panel.

Domain verification also enables admins to use Atlassian Access. After verifying their domains, admins need to subscribe to Access. When that’s done, you can start applying security controls across your Jira-hosted assets.

2. Harden login security policies

Login portals are a critical security vulnerability. Jira tenants must exclude malicious actors while allowing legitimate requests. This is not always an easy balance to strike. Users should:

Implement two-factor authentication

2FA requires more than one authentication factor when logging on. Atlassian supports popular authentication providers like Google Authenticator and Authy. These tools integrate with Jira and deliver secure passcodes to smartphones. SMS verification is also possible, although it’s seen as a less secure option.

Enforce two-step verification

This tool supplements 2FA for Jira. Enforced verification makes it impossible to access Jira assets without supplying two authentication factors. Admins configure enforced verification via the centralized access management panel.

Create SSO portals

Single Sign On combines all Jira cloud assets via a single set of credentials. SSO integrates smoothly with identity providers. You can transfer existing directories and groups to Jira while adding authentication tools.

Prevent third-party access

Access requests from third-party cloud platforms presents a security risk. Restricting access requests from Slack, Google Cloud, or Apple platforms is a good idea. Enforce additional authentication procedures to prove user identities before granting access.

Use strong passwords

Admins must require solid passwords for all accounts. Strong passwords feature a mix of characters and numbers and are usually between 12 and 15 characters long. This makes them very difficult to guess or brute force. Admins should also set password expiry deadlines that force users to change passwords regularly.

Exclude non-human users from authentication policies

Bots and API service accounts may require access to Jira assets. But they do not require the same authentication processes. Admins should configure these users to remove SSO and two-step verification tools.

3. Audit activity logs intelligently

Product audit logs record activity across the Jira environment. This makes it possible to detect patterns of suspicious behavior and remediate network security vulnerabilities before threats emerge.

Atlassian operates separate audit processes for Confluence and Jira. In both cases, companies can track any changes made to their cloud setup. Tenants can determine which events to monitor. This includes group creation, data imports and exports, deletions, and changes to global settings.

By default, logs are kept for one year. Tenants can change this setting, reducing the audit period to as little as one month. However, retaining audit data for the maximum period is a security best practice. This will deliver more actionable insights to improve security settings.

4. Manage accounts to minimize data breach risks

Jira tenants should audit both activity and user accounts. Account audits look at the entire range of active user accounts. And they perform a couple of important security tasks:

De-escalation of administrative privileges when they are no longer needed.
Deletion of obsolete accounts. Without timely audits, user accounts may remain active after employees leave the organization. This creates a security risk and should be avoided if possible.

Carry out account audits regularly. Integrate external identity providers covered by Jira, such as SCIM or G Suite. This makes it easier to automate user provisioning and deletion tools. But do not assume that orphaned accounts have been deleted. Check thoroughly and make deletions as necessary.

5. Train staff to use Jira securely

Security teams are responsible for educating all Jira users. Solid training teaches employees to follow security best practices and should be critical to your cloud security policy. Training issues to focus on include:

The importance of strong, regularly-changed passwords.
Eliminating confidential data from Jira tickets or pages. This could include cardholder data or personal health information.
Creating access controls for any pages that contain sensitive information.
Using two step-verification to access Atlassian products.
Using API tokens to access Confluence Cloud or Jira resources.
Avoiding phishing attacks related to the Atlassian cloud environment.

Schedule regular training events and log the participation of all cloud users. Include additional security training for administrative-level account holders. Admins have extensive powers to change global settings that regular users lack. Enforce prohibitions against shared admin accounts and reinforce the need for strong password security.

6. Make use of mobile security tools

Employees may require access from home workstations, industry events, or during global travel. But mobile access carries security risks. In these situations, companies should leverage the mobile security features supplied with Jira software.

Atlassian Access allows tenants to create Mobile Application Management (MAM) policies. This is a good option if your organization relies on either work-from-home or bring-your-own-device (BYOD). MAM policies should:

Enforce multi-factor authentication for remote access to the Atlassian cloud.
Check that devices have anti-malware protection and that the operating system is up to date.
Allow only authorized BYOD devices and require registration for new devices.
Mandate encryption for all remote connections. This could include Virtual Private Network connectivity or the use of other forms of secure gateway.

If you are not an Atlassian Access member, you can integrate external MDM solutions with Jira deployments. Jira software supports Microsoft Intune, JAMF, and MobileIron. It should be possible to transfer existing MDM settings directly to the Atlassian cloud.

Understanding Jira security basics

It is important to apply the security best practices outlined above. But Jira tenants must also understand what their cloud provider secures before taking action. There is no need to duplicate security measures. Tenants should be aware of tools available within the Jira platform before sourcing external solutions.

jira security best practices glossary

Atlassian is vocal about its commitment to security, and the company builds both internal and client-side security features into its products. Let’s start with client-side features that tenants can control.

Client-side features:

Authentication

Authentication verifies the identity of every user accessing the cloud environment. These mechanisms compare user credentials to secure directories. If supplied credentials match the database, the network grants access. Jira authentication options include Basic Authentication via Atlassian Account. However, Jira also supports OAuth tokens, which offer more security. These secure tokens add an extra layer of protection against illegitimate access.

Authorization

Authorization determines what users can do within the Jira environment. Each user receives a set of permissions. These permissions grant access to resources according to the user’s role and work requirements. Admins can create temporary groups or assign precise powers to users. For instance, the user could possess create, view, and edit privileges. But they may not be able to delete records on Jira apps.

Logging

Jira logs key activities and presents the data via the central administration console. The audit log captures project changes, user permissions, workflow changes, custom fields, data deletion, and suspicious access requests. Admins can export audit data via CSV files and amalgamate the information with other cloud platforms. Retention periods vary from one month to a year.

Incident management

Jira’s incident response systems include collaboration tools, automated alerts, incident timelines, and incident response templates. Tenants can plan to neutralize threats and restore systems as quickly as possible.

Internal security features:

Atlassian products secure hosting infrastructure with internal security controls. In keeping with the shared responsibility model, the company undertakes to ensure the “security, availability, and performance of the applications we provide, the systems they run on, and the environments within which those systems are hosted.”

Encryption

Jira encrypts data at rest and in transit. Data on the Rest API is encrypted using 256-bit AES ciphers. Data in transit is secured by TLS 1.2+ with perfect forward secrecy. Passwords are also encrypted, along with API keys. Tenants don’t need to apply encryption to data hosted on the Jira platform. But it is necessary to encrypt data passing across the network edge, for example, via remote work connections.

Zero Trust architecture

Jira’s network is constructed in line with the Zero Trust principle “never trust, always verify”. Private cloud routing, firewalls, and software-defined networking create secure zones. A three-tier access policy ensures that only authorized employees can access network resources.

Data center security

Atlassian uses Amazon Web Services (AWS) to store data. Redundancy and failover are built into a global AWS architecture. Multiple physical security controls also guard Jira’s data centers against malicious intruders.

Common security threats to Jira

Jira’s cloud hosting services face many threats. Security controls should always be designed with threats in mind. Any of these threats could result in loss of data, system downtime, and regulatory penalties:

Insider threats

Malicious individuals exploit legitimate access rights to carry out illegal actions. But insiders can also be unaware of the risks they pose. For example, employees might accidentally introduce malware via flash drives. Insiders can sabotage assets or steal data for sale. But identifying them isn’t easy. Jira tenants can leverage activity monitoring logs to detect unusual access patterns, off-board orphaned accounts, and apply MFA to make access difficult.

Social engineering

Also known as phishing. Social engineering involves persuading legitimate users to carry out risky actions. This could include opening attachments, clicking links, or even providing payment data directly. Training is the best remedy for social engineering attacks. Data Loss Prevention tools and tight access policies also help to prevent illicit data removal.

External threats

Malware can spread throughout insecure cloud deployments. Worms and Trojans leak information to outsiders. Other agents damage performance by leaching network resources for other purposes. Robust threat detection systems, network segmentation, and regular software updates are essential.

Data breaches

Data breaches require a specific strategy because the risks of suffering data loss are critical. Tenants should secure confidential data with encryption at rest and in transit. Limit access with MFA and RBAC. And track critical data via audits and threat alerts.

FAQ

How to keep my organization secure?

Follow these basic steps to secure your organization on Atlassian’s Jira platform:

Understand your Jira landscape. Inventory all apps and classify data held on Jira according to risk categories.
Ensure all assets are visible via the Atlassian admin panel.
Integrate your identity provider with Atlassian’s SSO solution.
Test configurations to balance access and security.
Create role-based access controls. Limit access to high-risk data.
Schedule regular audits and monitor activity logs.
Manage user accounts and remove users when they leave the organization.
Train your staff on security best practices.
Create a mobile device management solution for secure remote work.

What are the security features of Jira?

Jira is equipped with many security features. Use relevant features to secure cloud assets under the shared responsibility model. Tenants can configure Jira to include:

256-bit at rest encryption of sensitive data and TLS encryption for data in transit.
Flexible access controls. SSO and MFA options that integrate with identity providers.
Regular network scanning and audits of Jira infrastructure. Constant monitoring for cloud security threats.
Compliance with major standards such as GDPR and ISO 27001.
The Bug Bounty program rewards developers who find security weaknesses.
Secure development under the Peer Review/Green Build system. Testing of all new app deployments before they go live.

Atlassian has covered the most crucial security themes. But this still leaves customers with the responsibility to extend access controls to users, encrypt data outside the Jira environment, and train staff to use the cloud safely.

Key takeaways

Jira provides a wide range of security features to assist cloud tenants. This includes authentication systems that integrate easily with identity providers.
Automated user provisioning offers users the right permissions to access essential resources.
Tenants benefit from data encryption and proactive threat monitoring. Jira tools include customized audit processes and security alerts.
Cloud users must always be aware of the shared responsibility model when designing security solutions.

How can NordLayer help?

The Atlassian suite enables businesses to manage projects of varying scope and complexity effectively, but its security leaves much room for improvement. This is where NordLayer can reach out a helping hand to companies that are struggling to find the right balance between ease of use and security.

Using Virtual Private Gateways, network administrators have much better control over user access. Only gateway-connected users are allowed to reach the Jira portal. The login to NordLayer itself can be further secured by enabling Single-sign on and multi-factor authentication, ensuring that the connecting user’s identity is genuine.

With IP allow-listing (whitelisting), companies can permit access to Atlassian suite only from trusted IPs, which also shrinks the attack surface. The connections from unrecognized IP addresses are immediately blocked.

NordLayer’s suite of ZTNA and SSE-focused features allows additional layers of security and combines built-in Jira security tools with NordLayer’s solutions. This combination is a sure way to improve SaaS access control.

Get in touch with us, and discover how to reap the benefits of Atlassian suite without putting your sensitive data at risk.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

2023 NordLayer Nord Security

ESET Research follows the comeback of the infamous botnet Emotet, targeting mainly Japan and South Europe

Emotet has launched multiple spam campaigns since it re-appeared after its takedown in 2021.
Since then, the Mealybug cybercrime group, which operates Emotet, has created multiple new modules and multiple times improved all existing modules.
Emotet’s operators subsequently have put a lot of effort to avoid monitoring and tracking of their botnet since they came back.
Currently, Emotet is silent and inactive, most probably due to identifying a new effective attack vector.
Since 2022, most attacks detected by ESET were aimed at Japan (almost half of all), Italy, Spain, Mexico, and South Africa.

Emotet has launched multiple spam campaigns since it re-appeared after its takedown in 2021.
Since then, the Mealybug cybercrime group, which operates Emotet, has created multiple new modules and multiple times improved all existing modules.
Emotet’s operators subsequently have put a lot of effort to avoid monitoring and tracking of their botnet since they came back.
Currently, Emotet is silent and inactive, most probably due to identifying a new effective attack vector.
Since 2022, most attacks detected by ESET were aimed at Japan (almost half of all), Italy, Spain, Mexico, and South Africa.

BRATISLAVA — July 6, 2023 — ESET Research has published a summary of what happened with the Emotet botnet since its comeback after a limited takedown. Emotet is a malware family active since 2014, operated by a cybercrime group known as Mealybug or TA542. Although it started as a banking trojan, it later evolved into a botnet that became one of the most prevalent threats worldwide. In January 2021, Emotet was the target of a limited takedown as a result of an international, collaborative effort of eight countries, coordinated by Eurojust and Europol. Emotet came back to life in November 2021 and launched multiple spam campaigns with an abrupt end in April 2023. In its latest 2022-2023 campaigns, most of the attacks detected by ESET were aimed at Japan (almost half of them), Italy, Spain, Mexico, and South Africa.

“Emotet spreads via spam emails. It can exfiltrate information from, and deliver third-party malware to, compromised computers. Emotet’s operators are not very picky about their targets, installing their malware on systems belonging to individuals, companies, and bigger organizations,” says ESET researcher Jakub Kaloč who worked on the analysis.

Throughout late 2021 and until mid-2022, Emotet spread mainly via malicious Microsoft Word and Microsoft Excel documents with embedded VBA macros. In July 2022, Microsoft changed the game for all the malware families like Emotet and Qbot – which had used phishing emails with malicious documents as their method of distribution – by disabling VBA macros in documents obtained from the internet.

“The disabling (by authorities) of Emotet’s main attack vector made its operators look for new ways to compromise their targets. Mealybug started experimenting with malicious LNK and XLL files. However, by the time 2022 was ending, Emotet’s operators struggled to find a new attack vector that would be as effective as VBA macros. In 2023, they ran three distinctive malspam campaigns, each testing a slightly different intrusion avenue and social engineering technique,” elaborates Kaloč. “However, the shrinking size of the attacks and constant changes in the approach may suggest dissatisfaction with the outcomes”.

Later Emotet embedded a lure into Microsoft OneNote, and despite warnings that this action might lead to malicious content, people tended to click on it.

After its reappearance, Emotet received multiple upgrades. The notable features were that the botnet switched its cryptographic scheme and implemented multiple new obfuscations to protect their modules. Emotet’s operators have put significant effort to avoid monitoring and tracking of their botnet since they returned. They also implemented multiple new modules and improved existing modules to remain profitable.

Emotet is spread via spam emails, and people often trust those emails because it successfully uses an email thread hijacking technique. Before the takedown, Emotet used modules we call Outlook Contact Stealer and Outlook Email Stealer, capable of stealing emails and contact information from Outlook. However, because not everyone uses Outlook, post-takedown Emotet also focused on a free alternative email application – Thunderbird. Additionally, it started to use the Google Chrome Credit Card Stealer module, which steals information about credit cards stored in the Google Chrome browser.

According to ESET research and telemetry, Emotet botnets have been quiet since the beginning of April 2023, most probably due to finding a new effective attack vector. Most of the attacks detected by ESET since January 2022 until today were aimed at Japan (43%), Italy (13%), Spain (5%), Mexico (5%), and South Africa (4%).

Emotet detections by ESET: Jan 2022 – Jun 2023

For more technical information about Emotet, check out the blogpost “What’s up with Emotet – A brief summary of what happened with Emotet since its comeback” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2023

23.6.4 ‘Voyager’ released

Changes compared to 23.6.3

New Features

Added an option to use temporary files instead of RAM during a restore
Added a partial data recovery option to zero over unreadable data chunks during a restore (Comet will not abandon the job when it finds an unreadable chunk)

Enhancements

Improved error logging for failures during MSSQL backups and restores

Bug Fixes

Fixed an issue with Office 365 clients where rate limiting may cause list requests to restart unnecessarily
Fixed an issue with Office 365 clients hanging in some situations
Fixed an issue with macOS notarization timing out when Apple takes longer than 10 minutes to process the request
Fixed an issue with error handling during a retention pass of a Storage Vault that has Object Lock enabled

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Comet
We are a team of dedicated professionals committed to developing reliable and secure backup solutions for MSP’s, Businesses and IT professionals. With over 10 years of experience in the industry, we understand the importance of having a reliable backup solution in place to protect your valuable data. That’s why we’ve developed a comprehensive suite of backup solutions that are easy to use, scalable and highly secure.

Comet 2023