Skip to content

The most complete comparison: Pandora FMS Open Source vs Pandora FMS Enterprise

What is Pandora FMS Open Source?

Pandora FMS Open Source is not a freemium software, it is not bloatware nor shareware (*Wink for those born before the 80s). Pandora FMS is licensed under GPL 2.0 and the first line of code was written in 2004 by Sancho Lerena, the company’s current CEO.

At that time, free software was in full swing and MySQL was still an independent company, as was SUN Microsystems. Today there are thousands of users of the Open Source version that regularly download updates through the system that we designed for that specific purpose.

We do not know more about the subject (neither their names, nor their companies…) because, above all, we respect privacy.

We consider Pandora FMS to be a real free software. The project has been active in Sourceforge since 2004 and we have all the awards granted by this entity that leads Open Source. All the code is available on Github in real time, but we do believe that there is something more important and that is the documentation we have available in five languages (Spanish, English, French, Japanese and Russian), with a level of depth that allows you to get the most out of it without having to pay for certifications, training or consulting.

Printed, the manual has more than 1,000 pages (per language) and is maintained by our professional development team, Q&A, translators and professional documentalists. We also have a public forum where we solve questions, with more than 15,000 messages.

We believe that freedom consists in offering users options, not just giving them part of the pieces of a puzzle without instructions.

Pandora FMS Enterprise

However, Pandora FMS has a version based on a commercial license that extends some of the features present in Pandora FMS OpenSource version. This license incorporates additional source code that is not publicly available or free of charge.

These features are oriented to demanding professional environments that require some automation and more specific tools already created to use them in operation and with professional support so that if something fails they can ask and get a patch if necessary. It is exactly for these types of environments that we designed Pandora FMS Enterprise.

If you want to use Pandora FMS Community and have doubts about whether it will be enough for your organization: Don’t hesitate!, it is not a question of size, we have users of the Open version with thousands of agents and who have been using it for years.

Obviously the main benefit of the Enterprise version is that you will have someone to support you at all times. Whether it is some problem with an update or throughout the installation of a plugin. But there are many small differences that can be key to optimizing your day-to-day management.

Next we will describe some of the Enterprise features. If you want to try them yourself, you can test the waters of a 30-day trial version, but let us show it to you at an online meeting and you’ll save yourself the trouble of messing with the software. Your time is valuable and while our documentation is extensive, PFMS has plenty of features.

Services

Services are the way to show in a simple and visual way what things are like in your organization, classified into different entities that in turn are made up of other services and / or metrics.

That way you may perform an automatic root cause analysis and find out when a service is affected, where the source is and even have it displayed in the form of a tree:

Services complement the existing display options in Pandora FMS and allow system managers to define weight rules that have their systems’ redundancy to alert only in case of need, not when something irrelevant fails.

↑ Go to index

Policies

The need arose from a client who managed many computers with different purposes and technologies. They found out that monitoring Windows 2000 computers was different from monitoring Windows 2003, and that of course the Redhat Linux had different needs from the Debian Linux. It also had differentiated database environments, such as DB2 or MySQL.

Base monitoring could be “compartmentalized” into different sets of checks that could be standardized, so that any Linux machine that had Oracle could be monitored the same. That way, we made sets of checks that could be easily deployed to machine groups.

Thanks to policies, it is possible to homogenize monitoring and to deploy standard monitoring by technologies.

Thus a system can have different policies applied (e.g. base operating system, database, application X, network performance, etc.) and for every time you modify the policy, it can get “synchronized” with those systems that are subscribed to said policy, in a totally automatic way.

Of course, exceptions can always be made to policies at individual level, and each system can have unlimited policies in addition to custom monitoring. Using policy monitoring can save system administrators a huge amount of time.

↑ Go to index

Customization and OEM

If you need to sell your own monitoring product, with your own brand and full customization not only of its look, but also of its installers, command path, running services, ISO installation images, Windows agents, logos, manufacturer and product names, Pandora FMS Enterprise has different customizing levels.

The most basic, and included as standard in any Enterprise license, allows you to customize the appearance of the console so that it does not look like Pandora FMS but your own product, with your own brand.

If what you need is to go further, and generate a software with another name and that from the installation process to the name of the database everything is alien to Pandora FMS, then OEM customization is what you need. We can even generate update packages specific to your OEM (or teach you how to do it so you can fend for yourself).

↑ Go to index

History DB

Pandora FMS Enterprise has a secondary storage system in an additional database. The system automatically transfers the data from more than N days to the history database and when it needs it to make reports or graphs, it uses both databases to gather information.

This allows you to have an almost unlimited data history (several years) without compromising the speed of access to day-to-day data.

↑ Go to index

Delegated authentication in Active Directory

Whether you need your installation to rely on an Active Directory to authenticate users, or to automatically create them at login, assigning them specific profiles or filtering them through a blacklist, this feature is designed specifically for professional environments like yours.

It has advanced options such as delegating to a secondary server, excluding administrators, complementing it with double authentication through Google Auth and many other options.

↑ Go to index

Remote control

Remotely control and access your systems, whether windows workstations, Linux or Windows servers, or Raspberry or similar embedded systems. Access the remote shell as if you were in front of it, the remote desktop, or copy files both ways. All this from the same Pandora FMS WEB console, fully integrated into your asset management.

In the Enterprise version you may have your own on-premise infrastructure of eHorus servers so that all communication among your systems can be managed and controlled, with total autonomy from third parties and with maximum security and confidentiality.

In the community version, however, you may use our Cloud servers, up to a maximum of five devices for free.

↑ Go to index

Satellite Servers

Satellite servers allow headless remote monitoring of entire networks of equipment in a distributed way. Install Satellite servers in the networks of your clients, they will obtain metrics of all kinds of devices around them, exploring what they have around them automatically and sending the information to the central server where you may manage it as if they were normal agents.

Satellite servers are perfect for making deployments in remote sites, customer offices or inaccessible environments. They can be installed on Raspberry, or any type of container.

↑ Go to index

User Experience (UX) Monitoring

Nothing like observing things pretending to be a real user, if possible from the same chair as the real user. This is what user monitoring consists of, replicating a transaction from beginning to end, step by step, calculating the time it takes in each step, and verifying that each step is completed correctly.

That way you will not only find out whether it fails, but you will also know where, and how long each step takes. You may even take a screenshot to know what the fault looked like. This can be done for web applications (even if they have Java, Flash, HTML5, etc.), and also for traditional desktop applications. It can be done centrally (WUX) or in a distributed way so that the probes perform the tests from different geographical locations.

↑ Go to index

Remote agent deployment

We know that deploying agents and configuring them is one of the most burdensome points of deploying monitoring. That is why we created a tool that allows, providing credentials, to connect to Windows or Linux systems to copy the agent and carry out its unattended installation.

It allows you to customize the installation, by different networks, environments or groups of machines. From dozens to thousands of systems can be installed or upgraded from the agent deployment console.

↑ Go to index

Omnishell

Omnishell is a Pandora FMS Enterprise feature that is used for orchestration (IT automation). It is a fully native tool integrated into the console that uses PFMS agents to execute command blocks on selected targets.

A use example would be to configure the auto-start of the HTTPD service on CentOS 7 systems massively. Another example could be to install a manual patch on those Windows machines that you select from a list. It can be one or several hundred machines.

The system is designed to be executed on hundreds of systems simultaneously and wait for the order to be executed, showing on the screen the progress, machine by machine:

↑ Go to index

Auto Provisioning and automatic agent configuration

It implements an automatic mechanism by which it can apply policies and changes to newly provisioned agents, so that after deployment, monitoring configuration is automated, assigning it group(s), monitoring policies, alerts, etc.

This customization is done based on rules. For example, having a certain IP range, a specific brand or custom field, or a hostname with a certain pattern. In addition, after you make the configuration change, you may generate a custom action.

↑ Go to index

Collections

Deploying advanced monitoring requires bringing scripts and small applications (ours, yours or from third parties) to the monitored systems, to be executed by the agent in the form of plugins.

Collections allow you to gather this set of files and send them them to agents in an integrated way in the policies. That way, using plugins is something simple and transparent for the final operation.

↑ Go to index

Log collection

Pandora FMS can collect logs from any source that supports syslog or through software agents (Windows and Linux). Such logs can be plain text files, or Windows system events.

They will be collected by Pandora FMS monitoring agent and sent to the server along with the monitoring data. So if you already have agents installed, you may collect logs from those systems conveniently and quickly, and without additional software or licenses.

Unlike monitoring data that is stored in a conventional SQL database, logs are stored in a separate Elastic system. You will be able to store gigabytes worth of logs and keep them for a long time (you will only need more disk space). You may set up alerts or search through your data sources. It is the ideal complement to comprehensive monitoring, and fully integrated into the console.

↑ Go to index

Inventory Alerts

PFMS inventory allows you to obtain data of many types: installed software packages, users with access to the equipment, installed patches, hardware devices, firmware and version of the base system, license or serial number, etc.

Alerts allow you to generate actions in case of finding or not finding certain data on a computer with inventory information (whitelist / blacklist).

For example, what if you know that there is a vulnerable version in your systems? Well, you could create an alert that notifies you if someone is using it. Or on the contrary, if you need an application installed on all your systems and someone does not install it, you may find out in real time.

↑ Go to index

Metaconsole / Command Center

The Command Center is the jewel in the crown of Pandora FMS.

It serves the purpose of centrally controlling an unlimited number of independent Pandora FMS instances (each with its server, its console and its databases) so that you may manage dozens of thousands of agents from a single point, while these systems are in turn managed by independent instances.

This federated management system ensures uniformity and ease of management. It is a robust system where one system failing does not affect the rest of the systems, and where growth is fully horizontal and distributes loads automatically.

We have clients with more than 40,000 agents and more than one million metrics collected.

↑ Go to index

High Availability (HA)

In critical environments and/or with lots of load, it is possible that it is necessary to distribute the load among several machines and make sure that if any Pandora FMS component fails, the system will stay online.

PFMS has been designed to be modular but it is also designed to work collaboratively with other components and to be able to take on the burden of those that failed. The most critical component is the database (MySQL/Percona) that can be configured in Active/Passive mode so that in case of failure, a read-only node is automatically activated and the system continues to operate without pause, and without data loss.

This system is integrated into Pandora FMS console.

↑ Go to index

Discovery Cloud

Discovery Cloud allows, through a fully pre-installed and centralized system, to configure native connectors (through APIs) with the most widespread public cloud providers: Amazon, Azure and Google.

You will be able to get it hooked onto your instances and explore the resources available for monitoring: machines, disks, databases and other elements.

The advantage of this system is that you may get information about the services dynamically, without installing agents. In addition, if you later install agents, you may add both monitoring approaches. Through the credential container system you may even monitor different Amazon instances, for example.


In the case of Amazon, you will also be able to find out the cost of active services.

↑ Go to index

Discovery Applications

As with cloud providers, Discovery allows out-of-the-box to monitor some extended technologies centrally and remotely: Oracle, SAP R3, DB2, SQL Server, and VmWare virtualization (through the vCenter API).

↑ Go to index

Enterprise ACL’s

Along with OEM features, it allows you to customize not only the look, but the feature accessible by all types of users (including administrators). That way you may limit the functions of a PFMS instance, even making the menus disappear.

↑ Go to index

Comparison table Open Source vs Enterprise


Features Open source Enterprise
Tech support In community forums, by volunteers Worldwide hourly coverage. 24×7 optional
Professional services
Professional certification Several levels
Operating model on-premise on-premise SaaS (MaaS)
Remote monitoring SNMP, WMI and with plugins
Monitoring with agents
Reports, dashboards and visual consoles
Alerts system
Multi-user and multi-tenant
Netflow
Network Configuration Manager
IPAM (764 version)
Mobile Console APPs
High Availability (Manual) (Integrated)
Distributed Servers (Satellite)
Policies
Services
AD Authentication
Historical DB
Remote control Only SaaS SaaS and On-premise
Transactional monitoring of user experience (UX)
IT Service Manager Partial
Remote agent deployment
Omnishell
Agent autoconfiguration / autoprovisioning
Command center (Metaconsole)
Collections
HA
Correlated alerts
Inventory alerts
Log collection
Discovery Cloud
Discovery Applications
Enterprise ACL’s
OEM and Partial Customization Partial

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Analyzing the Quantum Threat

The era of quantum computers has arrived.

This isn’t just another “next step” of computing… The application of emerging quantum computing tech in the cybersecurity industry will result in arguably the most significant disruption the world has ever seen.

It could change healthcare by revolutionizing the creation of more effective medicines and vaccines.

It could change the environment by significantly decreasing energy consumption and waste.

It could save lives that would otherwise be lost in natural disasters by facilitating the creation of extremely accurate weather forecasting.

And it could change the face of cybersecurity by obsoleting modern cryptography.

Oops.

Just how can a new evolution of computing do all this? Through the strange world of quantum mechanics.

How Quantum Mechanics Have Evolved Our Thinking

We all know the story of Schrödinger’s cat – it exists as both dead and alive inside a box until someone opens said box. If that sounds confusing, you’re not alone – the same quandary provoked the most brilliant minds in the universe nearly 100 years ago during the fifth Solvay Conference.

Nobel Prize winning minds such as Albert Einstein, Erwin Schrodinger, Werner Heisenberg, and many more, gathered to debate the most preeminent problems in the worlds of physics and chemistry. At this particular conference, the prizefight concerned a controversial theory that defied common sense. Back then, the world as most people knew it was dictated by Newtonian mechanics – the school of thought derived from Isaac Newton’s Laws of Motion.

Newtonian mechanics is, at its core, the body of physical law that emerged in the 1600s with Isaac Newton. According to Newton, objects have positions and speeds, of which they are acted upon by forces. The central tenant of Newtonian mechanics is that objects move in smooth, orderly, and predictable patterns. These are the laws that govern the physical dimension we know, see, and interact with each day.

It has defined our reality for so long that it is nearly impossible to imagine a world where any other system of mechanics could be possible at the macro level. And with it come centuries of developing, testing, and validating these classical laws of the physical world.

That all changed in 1894, when physicist Max Planck took a gig in which he would investigate the quality of heat, energy, and light within light bulbs. During his experiments, Planck noticed that as the filament of the bulb heats up, its color changes, going from red to yellow to white. Planck wondered why the filament did not turn blue as more heat energy was applied. He then assumed energy is not delivered in a continuous wave, but in packets. Packets he called “quanta,” which are mathematically proportional to a given frequency. This breakthrough led to a Nobel Prize as it described a new theory of physics: “quantum mechanics.”

Then, in 1897, J.J. Thomson identified a subatomic particle now known as an electron. This discovery turned the world upside down. If you think of Newtonian mechanics governing common, everyday scenarios, you’d imagine how objects should move and how objects should interact with one another.

For example, at a construction site, a wrecking ball colliding with a brick wall should result in the wall’s destruction. At the classical mechanical level, the space occupied by the brick wall cannot simultaneously be occupied by the wrecking ball.

But shrink our construction site down to the size of an atom and look at this from the quantum level. Here, the wrecking ball does not destroy the wall… it “quantum tunnels” through it and back again! Both the wrecking ball and the brick wall are intact.

Oh, it gets weird. But it’s real.

Enter Einstein, whose 1905 paper on the quantum mechanics of the photoelectric effect proposed that certain wavelengths require specific amounts of energy to release electron packets, called photons. This cemented the theory pioneered by Planck that light energy is released in wave packets. If the heat applied to the wavelength does not match this exact energy requirement, no photons are released.

This led to the double-slit experiment, where large objects are fired through two slits – one on the left and one on the right – into a wall behind the slits. Not all the objects fired through the left slit make it through to the wall. Some collide with the edges and are rejected – classical mechanics in action – and fall to the ground. Those that do make it through will hit the wall on the other side, forming a slit-shaped pattern on the wall’s left side. On the right side, the same thing happens.

Now, let’s reiterate this experiment in the quantum world and shrink this experiment down. Instead of large objects, we’re now firing electrons. And rather than getting the same results as in the Newtonian world, where we see two slit-shaped bands aligned with the two openings, we get five bands aligned on the back wall.

So what happened? Probability.

In quantum mechanics, each slit-shaped band on the back wall represents a potential outcome, rather than a Newtonian outcome.

The next few years were ones of rigorous academic study and debate, where the world’s foremost thinkers challenged the limits of their intellect in a back-and-forth of academic papers.

“God does not play dice with the universe,” said Einstein. To which Niels Bohr shot back, “stop telling god what to do.”

But despite this evolution in technology, the world mostly remained governed by Newtonian physics. Only today, nearly a century after quantum mechanics stumped Einstein, are we finally on the tipping point of using quantum mechanics to revolutionize everything.

But how exactly will quantum mechanics change the way we secure our collective online presence?

Read on…

The Quantum Revolution Arrives

Through quantum mechanics, the world’s biggest technology companies are building quantum computers that obsolete today’s most advanced supercomputers. How? Because they turn binarily stored data into a more powerful form, known as qubits, which can be both “1″ and “0” data stores simultaneously. This makes them extremely valuable in modern day technology, like in artificial intelligence (AI) programs that need exponentially greater processing speeds for tasks such as facial recognition software or voice transcription services.

The potential for quantum computing is almost limitless. Scientists have only just begun exploring its capabilities, but it’s clear that this technology will shift our understanding of how information can be stored and processed in ways we never thought possible before. Imagine being able to run any amount of data you want with ease – even computationally demanding tasks your current computer struggles through.

Therefore, the potential for quantum computing to revolutionize how we process information is massive. With their ability to perform tasks at incredibly fast speeds or generate complex results with pinpoint accuracy, even the most security-illiterate individuals could hack into the world’s most secure networks with ease.

Which means we will need to rethink cybersecurity from the ground up.

And we’re currently right at the doorstep of quantum computing becoming ubiquitous. For example, Google’s Sycamore achieved quantum supremacy in 2019. Amazon, too, is heading into quantum computing with Braket, forging Quantum-Computing-as-a-Service (QCaaS).

It’s very exciting stuff. But with the emergence of quantum computing comes a huge security problem that threatens to obsolete modern cryptography and expose all our online data. And within five to 10 years, everything that you think is safe will be compromised.

How to Combat the Quantum Threat

Today, cybersecurity is primarily based on asymmetric encryption, built on top of mathematical cryptography. Computers based on Newtonian mechanics are not capable enough to quickly break that mathematical cryptography. However, quantum computers are capable. And as a result, the world’s current cybersecurity systems will be made obsolete.

This is what’s known in the industry as the “Quantum Threat.” And it’s coming. But while many computer scientists believed that the quantum threat was 15-plus years away as recently as 2019, rapid advancements in quantum computing have most pegging the quantum threat to arrive between 2025 and 2030.

That means investment in modernizing today’s encryption methods needs to start now because overhauling the world’s cybersecurity system will take time. And to be ready for the quantum threat, governments and companies need to develop new quantum-safe cryptography today.

There are dozens of companies across the world working on this quantum-safe cryptography today. One such company is Arqit, which has developed the best quantum-safe method in existence to date.

Arqit’s solution involves placing a tiny quantum computer on a constellation of satellites in orbit. The satellites transmit quantumly encrypted (and unbreakable) special keys into datacenters around the world. In-house software then distributes those keys to end-point devices, like phones and laptops. The result is a provably secure ecosystem protected by unbreakable quantum encryption.

To be clear, that is a gross oversimplification of what Arqit does. But it’s sufficient in describing exactly how cybersecurity systems might change in the wake of the quantum threat.

A terrestrial version of Arqit’s technology is commercially available today in a very limited capacity. In 2023, the company intends to launch two quantum satellites into space aboard a Virgin Orbit rocket, at which point it will begin full-scale commercial operations.

As with any new breakthrough technology, investment in quantum encryption technologies to expand rapidly. This is the next evolution – and arguably the final destination – of cybersecurity. The quantum threat, however, is likely still more than five years away.

Giving us at least some time to get our collective shit together.

#vicarius_blog #quantum_computing

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

ICS / OT Security News Update | SCADAfence – August 17

Our research team compiled the latest updates on newly announced CVEs, recent ransomware attacks including BlackCat & Luna, and IoT security news. They also offer analysis of the potential impacts and their expert recommendations:

Continue reading

Identity Threat Detection & Response (ITDR): What You Need To Know

Leading research firm Gartner has highlighted Identity Threat Detection and Response (ITDR) as one of the top cybersecurity trends of 2022, along with digital supply chain risk, attack surface expansion, and others. But what exactly is ITDR, and why is it important for organizations in 2022 and beyond?

What is Identity Threat Detection & Response?

In simple words, identity threat detection and response is a new security category focused on detecting credential theft, privilege misuse, unapproved entitlements, and other identity-related threats and vulnerabilities.

While other cybersecurity tools play a role in identity threat management, there’s been a marked rise in cybercriminals targeting identity and access management (IAM) infrastructure in recent years. As a result, Gartner felt creating this new category would help organizations sharpen their focus and be better positioned to access the best tools and practices to defend their identity systems. Or in other words, identity-based attacks have become such a common cybersecurity threat that a dedicated and laser-focused approach to combating them is needed.

The Case For ITDR

Today’s cyber threat landscape is more severe than ever before. With organizations rapidly shifting to remote working and public cloud adoption, the traditional network edge effectively no longer exists. This means companies must shift their security posture to focus on identities over devices.

At the same time, identity-based attacks are rising, and this trend shows no signs of slowing down in the foreseeable future. Today, cybercriminals increasingly bypass IAM by leveraging privileged access credentials. Then, they often move laterally across the networks, undetected. They also use this access to exfiltrate valuable data like employees’ and customers’ sensitive personal or financial information.

The security impact of stolen credentials on identity systems is immense. For example, one study found by Verizon that stolen credentials cause 61% of all data breaches1.

With the current state of the cyber threat landscape, cybersecurity experts are now recognizing that IAM and other related tools are not robust security. For example, Gartner argues that threat actors are “actively targeting access management (IAM) infrastructure,” so we need to develop new ways of protecting that infrastructure.

As for a high-profile case of identity compromise in action, look no further than the SolarWinds attack of 2020. SolarWinds is a leading software company that provides system management tools for network infrastructure and monitoring to companies worldwide. Hackers inserted malware into signed versions of SolarWinds’s software, which was then used to infiltrate an eye-watering 18,000 organizations. Essentially, SolarWinds’ Orion Platform created a backdoor through which the hackers could impersonate users and accounts of the targeted organizations. The malware also accessed system files and managed to blend in with legitimate activity without detection.

What Sets ITDR Apart?

A common question around ITDR is how it differs from other threat detection or identity management systems organizations already use today. Is it more of the same? The simple answer is no, but let’s dive a little further to discover why.

Existing identity protection tools like IAM, IGA, and PAM focus primarily on authorization and authentication, ensuring that the right people have access to the files and apps they need. In recent years, organizations have spent considerable effort improving these capabilities, adopting increasingly sophisticated software to manage identities and access with authentication.

In certain cases, IAM can pose a significant security risk when used in isolation – they can become a single point of failure if compromised. This is where ITDR comes in. ITDR is really about segregating these duties so that we can secure our IAM infrastructure and ensure that it’s working as intended.

And how does ITDR stack up against Endpoint Detection and Response (EDR)? EDR is a layered approach to endpoint protection that unites real-time continuous monitoring and endpoint data analytics with a rule-based automated response. EDR solutions work similarly to ITDR but ultimately focus on different things. Namely, EDR looks for attacks on endpoints, while ITDR looks for attacks on identities.

They also work differently once an attack has been identified. For example, when an EDR system detects an attack, it isolates the system to limit the hacker’s movement or shuts down the system to stop the hacker in their tracks. By contrast, ITDR systems often add an additional layer of security by providing fake data that acts as a decoy. These solutions can also limit lateral movement through the network.

However, it’s also true that ITDR solutions may vary depending on the provider. With this in mind, here are the features a solution should have to qualify as ITDR:

It should monitor and detect nefarious identity and privileges activity.

  • It should detect identity-related misconfigurations, for example, Active Directory misconfigurations, that could lead to compromise. These misconfigurations could be intentional or unintentional, but both are equally damaging.
  • It should investigate identity threats using contextual user information. The system should be able to detect if a user deviates from their typical activity, for example, accessing the system from an unusual location or downloading files they wouldn’t normally interact with.
  • Following detection comes the response. We’ve already covered how ITDR responds to threats in action, but other responses would be removing excessive privileges (and moving towards Least Privilege) and investigating anomalies in privilege usage.

Final Thoughts

Identity security should be a top priority for organizations in today’s increasingly hostile cyber threat landscape. Effectively detecting and responding to identity-based threats is essential in a world where cybercriminals are continually bypassing authentication and authorization tools. ITDR plays a crucial role here in protecting our identity systems and keeping cyber criminals out. As a result, we expect to see more organizations investing in ITDR solutions over the coming years.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

runZero release notes v3.0.9

  • Dashboard metrics now account for unscanned assets imported from third-party integrations.
  • Internal recurring tasks for metrics calculation no longer show in the recurring task count.
  • Fingerprint updates.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×