Skip to content

Do you know what BYOD, BYOA, BYOT are? No? You lack experience!

We apologize in advance for this extremely freaky reference: If in the well-known science fiction saga Foundation there was a duty to collect all the information of the galaxy to save it, at Pandora FMS we have assigned ourselves the task of making a glossary worthy enough with all the “What are” and the “What is” of technology. And today, without further delay or freakiness, it’s time to define the acronyms: BYOD, BYOA, BYOT.

* Warning to (very) lost sailors: This “Byo-” has NOTHING to do with that other prefix element, “Bio”. Thank you. Get back to your beloved diet

Do you already know what BYOD is? And BYOA? Nor what is BYOT?

BYOT (Bring your own technology)

That means indeed: “Bring your own tech from home, kid”. This is what BYOT means. A policy that allows employees to bring their own electronic devices, personal ones, from home to work.

This has advantages even if you don’t imagine it. And the top companies each give their distinctive approach to implementing such a policy. Some offer employees remuneration to purchase such technology. Other companies think better of it and expect their employees to put up with half or all of the expenses. Some even spend the money but then they demand for employees to pay for some services separately, such as phone service or data…

In any case, no matter how you buy your new devices or whoever pays for the Internet that month, if the device is connected to a corporate network, a highly professional IT department must secure and manage the device.

BYOD (Bring your own device)

Correct. You have translated well: “Use your own device from home, kid”. This term refers again, although on a different scale, to the tendency of employees to use personal devices to work and connect to their company’s networks, access their systems or relevant data.  You know what we mean when we talk about “personal devices”… your smartphone, your laptop, your tablet or, I don’t know, your 4-gigabyte USB.

The truth is that this rings a bell, companies, and especially since this terrible pandemic, now support teleworking. BYOD is here, more and more, working from home, maintaining a flexible schedule, including trips and urgent departures, in the middle of the morning, to get a Coke or to pick up your kid from school.

As it could not be otherwise, for the directives of your company the security of your BYOD is a crucial issue. Because for you it can be a whole morale boost, even on productivity, the fact of working with your trustworthy device, but if the IT department does not take care of checking it before, the access of your personal devices to the company network can raise serious security concerns.

The best thing in this case is to establish a policy where it is decided whether the IT department is going to protect personal devices and, if so, how it is going to determine the access levels. Approving types of devices, defining security policies and data ownership, calculating the levels of IT support granted to BYOD…  Then informing and educating employees on how to use their devices without ultimately compromising company data or networks. Those would be the steps to follow.

Studies show that there is higher productivity for employees using BYOD. Nothing less than a 16% increase in productivity in a normal workweek, for those who work forty hours. It also increases job satisfaction and the fact that new hires decide to stay through a flexible work arrangement. Employee efficiency is higher due to the comfort and confidence they have in their own devices. Technologies are integrated without the need to spend on new hardware, software licenses or device maintenance…

Everything looks wonderful, although there are also certain disadvantages as usual. Data breaches are more likely due to theft or loss of personal devices, as well as employee dismissal or departure. Mismanagement of firewalls or antivirus on devices by employees. Increased IT costs, and possible Internet failures.

BYOA (Bring your own application)

And what’s that? BYOA is basically the tendency of employees to use third-party applications and Cloud services at work.

As we know, mobile devices, owned by employees, have personal-use applications installed. However, they access these applications and different services through the corporate network. Well, this is the aforementioned BYOA.

There are benefits, of course. All those who may be listening to Spotify or using your own Google Drive without paying directly for the Internet. However, the higher the BYOA, like the higher BYOD and BYOT, the bigger the security holes in your organization. No one suffers more than a company’s IT department when it comes to thinking about how vulnerable corporate data can be. Especially when they are stored in the Cloud.

Conclusions

BYOT, BYOD, BYOA solutions are very efficient in the way an employee works. High morals, high practicity, and high productivity. However, well, they do pose certain cracks in the corporate network. Sensitive data and unsupported/unsecured personal devices, sometimes are not the best combination.

“BYO” products have advantages but they need a seasoned, conscious, proactive IT department, always protected by management policies of BYOT, BYOD, BYOA.

If you have to monitor more than 100 devices, you may also enjoy a FREE 30-day Pandora FMS Enterprise TRIAL. Installation in Cloud or On-Premise, you choose !! Get it here.


Last but not least, remember that if you have a reduced number of devices to monitor, you can use the Pandora FMS OpenSource version. Find more information here.


Do not hesitate to send us your questions. Pandora FMS team will be happy to help you!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

ESET Research: Latin American banking trojans spread to Europe at the height of activity

  • Latin American banking trojans are an ongoing, evolving threat and ESET has recently seen some of their biggest campaigns to date.
  • They target mainly Brazil, Spain, and Mexico.
  • Mekotio and Grandoreiro expanded to Europe, mainly targeting Spain but also Italy, France and Belgium.
  • There are at least eight different malware families still active.
  • In June this year, Spanish law enforcement arrested 16 people related to Mekotio and Grandoreiro.
  • The vast majority (90%) are distributed via spam.

 

BRATISLAVA, PRAGUE — December 15, 2021 — ESET Research is concluding today its blogpost series dedicated to demystifying Latin American banking trojans started in August 2019. Since then, it has covered the most active ones, namely Amavaldo, Casbaneiro,Mispadu, Guildma, Grandoreiro, Mekotio, Vadokrist, Ousaban and Numando. Latin American banking trojans share a lot of common characteristics and behavior. Altogether, ESET has identified a dozen different malware families, most of which remain active to this day. The most significant discovery during the course of this investigation is the expansion of Mekotio and Grandoreiro to Europe, mainly Spain. ESET researchers have also observed occasional small campaigns targeting Italy, France and Belgium. Since Latin American banking trojans expanded to Europe, they have been getting more attention from both researchers and police forces. In the last few months, ESET has seen some of their biggest campaigns to date.

ESET telemetry shows a surprisingly large increase in the reach of Ousaban, Grandoreiro and Casbaneiro in recent months, leading to the conclusion that the threat actors behind these malware families are determined to continue their nefarious actions against users in targeted countries.

The campaigns we see always come in waves and more than 90% of them are distributed through spam, usually leading to a ZIP archive or an MSI installer. One campaign usually lasts for a week at most.

“Brazil is still the most targeted country, followed by Spain and Mexico. Since 2020, Grandoreiro and Mekotio expanded to Europe – mainly Spain. What started as several minor campaigns, likely to test the new territory, evolved into something much bigger. In fact, in August and September 2021, Grandoreiro launched its largest campaign so far and it targeted Spain,” says ESET researcher Jakub Souček, who leads the investigation into Latin American banking trojans.

In June this year, Spanish law enforcement arrested 16 people related to Mekotio and Grandoreiro. In the report, police state that almost €300,000 were stolen and they were able to block the transfer of a total of €3.5 million. Correlating this arrest with Latin American banking trojan activity in Spain, Mekotio seems to have taken a much larger hit than Grandoreiro, leading ESET to believe that the arrested people were more connected to Mekotio. Even though Mekotio went very quiet for almost two months after the arrest, ESET continues to see new campaigns distributing Mekotio.

Latin American banking trojans used to change rapidly. In the early days of ESET’s tracking, some of them were adding to or modifying their core features even several times a month. Nowadays they still change very often, but the core seems to remain mostly untouched. Due to the partially stabilized development, we believe the operators are now focusing on improving distribution.

“Latin American banking trojans require a lot of conditions to attack successfully,” explains Souček. “Potential victims need to follow steps required to install the malware on their machines; they need to visit a targeted website and log into their accounts. On the other side, operators need to react to this situation by manually commanding the malware to display the fake pop-up window and take control of the victim’s machine.”

During the course of this research series, several Latin American banking trojans became inactive, namely, Krachulka, Lokorrito and Zumanek. ESET researchers also discovered Janeleiro, a new Latin American banking trojan. In the future, ESET expects we may see some of these banking trojans expanding to the Android platform.

For more technical details about these Latin American banking trojans, read the blogpost “The dirty dozen of Latin America: From Amavaldo to Zumanek” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

 Top three countries most affected by Latin American banking trojans

Latin American banking trojan activity worldwide

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

What partners say about Safetica?

Our partners are in everyday contact with customers and provide us with crucial feedback from different industries, geographies, and use cases.

Secure & IT

Visibility, traceability and forensic analysis on the actions performed by users.

At Secure & IT, we work with Safetica DLP with UEBA (User and Entity Behavior Analytics). This tool allows the information to be classified automatically, assigning labels to each type of data. Thanks to this, it is possible to create reports on the type of information handled by each employee, controlling all the actions and documents with confidential information. This tool provides us visibility, traceability, and forensic analysis on the actions performed by users.

Francisco Valencia
Managing Director, Secure & IT 

Andorsoft

I have full confidence in Safetica as a tool for securing my customers’ critical information.

Protecting our customers from information leaks and insider threats is critical nowadays. With Safetica’s solutions, we can identify and classify information handled by employees, provide complete visibility into user activity, and block information leaks reliably and straightforwardly.
In our first project with Safetica Discovery at a major insurance company in Andorra, we have been able to monitor employee activity, having complete visibility from a security and productivity point of view. It allows us to establish analytical reports, and we ensure regulatory compliance at the audit and security level.

François Ruiz
CEO, Andorsoft

ICOS

Safetica is the optimal solution for companies of all sizes.

Easy to install and manage, it has fantastical features that allow you to prevent data loss by monitoring everything from printouts, USB accesses, to use behaviour and much more. What about Safetica’s support and people… simply spectacular! Professional and always ready to support us.

Katia Rovezzi
Product Account Manager, ICOS   

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Safetica
Safetica is to provide small and mid-sized companies with the same quality data protection that corporations have – affordably, and without any additional IT administration or disruptions in operation.

透過 STEAM 動手實作能力重新想像學習 —— Skyrock 科技俱樂部 STEAM 使用案例分享

Skyrock 是一個體驗式學習空間，經由實踐方式來教授 STEAM（科學、科技、工程、藝術和數學），及透過個人創造以激發天賦和想像力。

隨著整個社會快速數位化，學生掌握必要的知識和技能以獲得成功在這個數位化社會中變得越來越重要。

Zack Hwang 曾是電源工程師，現在為 Skyrock 的校長之一，他成功地將IPEVO 愛比科技產品融入線上和實體課程中。線上課程的概念已經存在多年，但直到最近才真正被大眾認可為有效的教育形式。借助 IPEVO 愛比科技產品，Zack 能夠順利的向全國各地的學生反複說明課程中精細而複雜的細節。

「當老師想要從臉部影像切換到手部動作錄影時，視訊教學攝影機對教授直播組裝課程提供很大幫助。」

在結合 IPEVO 產品之前，Skyrock 一直需要想辦法盡力維持影片品質：

「我們試著集合多位老師錄製多個組裝影片。最大的挑戰是讓影片的品質和畫面維持一致性。」

在此之前，Skyrock 是將智慧型手機放在手機支架上來錄製影片：

「使用愛比科技視訊教學攝影機錄製影片後，最明顯不同的是，畫面不會像使用手機錄影時會抖動或搖晃。」

在 STEAM 課程中使用愛比科技視訊教學攝影機獲得很好的成果後，Zack 分享了他對 IPEVO 愛比科技視訊教學攝影機在其他潛在領域應用的想法：

「我認為視訊教學攝影機很適合需要不同拍攝角度及錄影的現場直播課程。例如烹飪課程、藝術和手工藝等。」

Skyrock 的使命是推廣 STEAM 教育，Zack 分享了其背後的想法：

「我們都知道，教科書和考試是如何扼殺孩子的好奇心。只有認真工作沒有玩樂，一點也沒有樂趣。我們相信培養孩子們對技能和創造的信心，能讓孩子們再次愛上學習。因此，這個是讓孩子們能參與「認真玩」（SERIOUS PLAY） 和 「困難，但有趣」（HARD FUN） 創意計畫的最完美的工具！」

本文章圖片中使用VZ-X 無線教學攝影機 以及 VZ-R HDMI/USB 雙模教學攝影機。

關於Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴，Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區，客戶來自各行各業，包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於IPEVO
IPEVO源自於PChome Online硬體事業部門，2007年7月正式獨立。自2004年於台灣營運Skype網絡電信服務，使台灣成為Skype全球發展中最成功的市場。2005年起以IPEVO品牌推出一系列Skype專屬硬件產品，將Skype虛擬服務轉化為使用者實質經驗。IPEVO以簡單、實際且具有價值的經驗為產品目標，其簡潔俐落的產品風格呼應著IPEVO的核心思考與產品精神。目前已研發之產品包括：Skype有線USB話機、Skype無線話機、Skype會議系統、Skype視訊設備、Stand-alone免電腦Skype話機。

An Overview of Saudi Arabia’s Personal Data Protection Act (PDPL)

Saudi Arabia’s Personal Data Protection Law (PDPL) was implemented by Royal Decree M/19 of 9/2/1443H (September 16, 2021), which approved Resolution No. 98 of 7/2/1443 H (September 14, 2021). It was published in the Republic Journal on September 24, 2021.

The Saudi Data and Artificial Intelligence Authority (SDAIA) will oversee the implementation of the new legislation for the first two years, after which a transfer of oversight to the National Data Management Office (NDMO) will be considered. The NDMO is the regulatory arm of SDAIA and had already published interim data governance regulations in 2020, which have now been superseded by the PDPL with regard to the protection of personal data.

According to the SDAIA announcement, the PDPL is intended to ensure the privacy of personal data, regulate data sharing and prevent abuse of personal data in line with the goals of the Saudi Vision 2030 to develop digital infrastructure and support the innovation to grow a digital economy.

PDPL Enforcement Scope

The Personal Data Protection Law (PDPL), as well as other legislation on the subject, is designed to protect personal data, that is, any information, in any form, through which a person can be directly or indirectly identified. This expressly includes an individual’s name, identification number, addresses and contact numbers, pictures, and video recordings of the person.

The PDPL applies to any personal data processing by companies or public entities carried out in Saudi Arabia by any means, including the processing of personal data of Saudi residents by entities located outside the Kingdom.

The PDPL does not apply to the processing of personal data for personal and family use.

The PDPL Pillars

Many of the features of the Personal Data Protection Law (PDPL) are consistent with the concepts and principles contained in other international data protection laws, such as:

  • Data Subject Rights: Individuals (data subjects) shall, with some exceptions, have the right to be informed about the processing of personal data and the legal basis for such processing, the right to access their personal data (including to obtain a free copy thereof), the right to correct or update their personal data, and the right to request their destruction if they are no longer necessary. Data subjects can also file complaints related to the PDPL enforcement with the regulatory authority.
  • Registration of Controllers: Organizations that collect personal data and determine the purpose for which they are used and the method of processing (controllers) must register with an electronic portal that will form a national register of controllers. There will be an annual fee payable for registration, to be determined in executive regulations (which will be issued in due course).
  • Controller Obligations: Controllers will be obliged to ensure the accuracy, integrity, and relevance of personal data before processing them, to keep a record of the processing for a period that will be defined by the executive regulations, and to ensure their team is properly trained in the PDPL and data protection principles.
  • Consent: Data subjects may withdraw their consent to the processing of personal data at any time, and consent shall not be a prerequisite for the controller to offer a service or benefit (unless the service or benefit is specifically related to the processing activity for which consent is obtained).
  • Processing not Based on Consent: Notwithstanding the provisions on withdrawal of consent, the PDPL makes it clear that data processing does not always require consent from the data subject. Consent is not required if processing achieves a clear benefit and it is impossible or impractical to contact the data subject, if required by law or prior agreement to which the data subject is a party, or if the controller is an entity and processing is required for security or legal purposes.
  • Privacy Policy: Controllers must implement a privacy policy and make it available to data subjects before the collection of their personal data. The Personal Data Protection Law (PDPL) establishes the minimum information that must be included in the privacy policy, including when personal data is collected directly from the data subject.
  • Purpose Limitation and Data Minimization: Organizations must make clear the purpose for which personal data is collected and used. Personal data must also be relevant and controllers must limit collection to the minimum necessary to achieve the intended purpose.
  • Impact Assessments: Controllers must assess the impact of processing personal data and, if personal data is no longer needed to achieve the intended purpose, the controller must stop collecting such data.
  • Marketing: Personal data may not be used for marketing purposes without the recipient’s consent or the use of opt-out mechanisms.
  • Breach Notification: Data breaches, leaks, or unauthorized access to personal data must be notified to the supervisory authority, and incidents that cause material damage to the data subject must be notified to the data subjects.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.