siteadmin | DataGroupIT

To VPN or Not to VPN?

siteadmin — Tue, 27 Oct 2020 13:33:36 +0000

Over the past few years, VPN vulnerabilities have been in the spotlight and talked about everywhere. There is always some vulnerability being abused by opportunists and criminals, but VPNs still remain the majority solution of choice for remote access across the globe. The main risk lies in how VPNs work, and they haven’t changed in 20 years; they extend the boundary to the user/device and connect them as if they were now physically on the network. The trust is implicit in the solution, which presents a problem: in this modern world, with numerous devices and users connecting at all hours, who/what should we trust?

Zero-trust is rapidly becoming the new paradigm because of these over exposures and the broad attack surfaces these legacy solutions allow. With zero-trust, the user is verified first, and only then connected to the network – something a VPN was never designed to do. VPNs should still be used, but steps must be taken to ensure secure VPN deployment. It is highly recommended to investigate available security advice by your local governing bodies[1] on how to manage your VPN remote access technologies.

The following recommendations are a good place to start:

Make sure your VPN solutions are patched and up to date, both at the gateway side and at the client side.
Ensure VPN platform configurations haven’t changed, including the SSH Authorization Key files.
Monitor and analyze your logs on a very regular basis.
Make sure the accounts you’re using on your VPN gateway are isolated from your domain-authenticated accounts.
Add multi-factor authentication (MFA) to your VPN solutions to make them more complicated to break into via the accounts.
Include device authentication when authenticating users.
If possible, limit the ports exposed by your VPN to only those ports that need to be used.
Enable split tunneling when users are finally connected to the network so that external networks are not directly exposed to the sensitive internal protected networks.
Terminate your VPN connection in the DMZ so that full analysis and inspection can take place.

While a good place to start, the above list is just that – a start. The attacks increase in volume every day, making clear that a VPN on its own is no longer enough. Safe-T delivers a solution called ZoneZero, which allows you to add this level of resolution to your existing infrastructure to enhance your VPN, enable true multi-factor and continuous authentication to your service consumption sessions, and grant those individual sessions on a positive authentication basis at the point of consumption, and for that consumption. ZoneZero will achieve this clientless, with seamless integration into your infrastructure, and minimum intrusion with the quickest set up time in the industry; typically, services are deployed into production in under 2 hours.

One of the most important actions mentioned above involves adding MFA to your VPN solutions to enhance and improve your security. This is critical to protect all your applications, both legacy as well as new services. Most, if not all, legacy applications are not MFA-ready. When choosing an MFA, you are typically limited to only one MFA because it is bound to your IdP. ZoneZero enhances MFA, making it true Multi-Factor Authentication so that you can use it with all your applications and services (those supporting MFA and those that don’t). It can be used regardless of where the services are hosted, or the users are located. It can be applied when you choose to use it and not just at the beginning of a session, delivering continuous authentication.

Additionally, you will want to reduce your attack surface and lateral movement within your IT infrastructure by exposing services only when they are being used by authorized users. This is done by adopting a “least access privilege” model, and strictly enforcing access control in which all traffic is logged and inspected to ensure all resources are accessed securely regardless of their location. This is Zero Trust Network Access (ZTNA), an approach that considers all traffic a threat unless determined otherwise (i.e., everything starts with zero-trust). This prevents most risks you would typically face in an IT environment and allows you to move forward with a higher degree of IT and business agility.

Adopt a least-access privilege model and strictly enforce access control while inspecting and logging all traffic to ensure all resources are accessed security regardless of location – this can only be achieved with ZoneZero’s zero-trust network access (ZTNA) solution.

Original article from: Safe-t

The post To VPN or Not to VPN? appeared first on DataGroupIT.

Imperva’s Mobile Security App

siteadmin — Tue, 27 Oct 2020 13:29:46 +0000

How many apps do you currently have on your mobile device? Is this number a total across both your personal and professional devices? Did you know that between Android’s Google Play Store and Apple’s App Store, there are between 2.2 and 2.8 million apps available to download? Did you know that, according to research, the average person has between 60 to 90 apps on their phone? Neither did I.

However, if you’re an Apple user like me, a quick jaunt to your Settings app, followed by tapping on General and selecting About at the very top; will reveal your magic number. I’m sitting at 105 apps, which came as a surprise. I thought I was a conservative user given that my main uses are either social media, communication, or logging into my baby monitor. Yet it turns out I’m an above-average downloader. You may be too, and that’s okay.

Research continues to prove how we look at our phones every 12 minutes, so wouldn’t it be ideal if that time was spent more wisely? Say, with an app that allowed you to step away from your desk while still maintaining your confidence in your organization’s cybersecurity profile? An app that provided comprehensive visibility into your Imperva WAF dashboards, alerting you to the fact that you may be under an attack and providing you with insight into what you should be doing next? Well, in case you didn’t know, Imperva has launched that very app, available in the Apple App Store for both desktop and mobile devices, and with an Android version slated for release at the start of 2021.

Imperva’s Security app provides a clear and action-oriented dashboard, allowing you to view your Imperva WAF security posture and performance in the palm of your hand. Although you may be working from home as COVID-19 continues to keep us away from each other, our app lets you stay up-to-date with real-time push notifications on critical events while being able to drill down quickly to what’s most important.

Additional functionality includes:

Aggregate account view
TouchID for login and SSO
Access to Attack Analytics data
See trends with time period comparison
One simple view for Attack Analytics, CDN and WAF
See the %age of alerted events out of the total number of security incidents
See the %age of blocked events out of the total number of security incidents
Push notifications on DDoS, critical setting changes, data overage, and critical attack analytic events

Original article from: Imperva

The post Imperva’s Mobile Security App appeared first on DataGroupIT.

Multi-Vendor Firewall Change Tracker for Network Security Admins

siteadmin — Tue, 27 Oct 2020 13:24:22 +0000

As the spread of COVID-19 is forcing employees to work remotely, it’s put an unprecedented strain on organizations’ network and security teams, a direct result of the sudden rise in new access requests from remote employees.

For many IT departments, this means having to spread even thinner across the growing complexity and fragmentation of the enterprise network. The upsurge in requests that IT and security managers must handle, translates into an increased amount of firewall rule changes across datacenters and the cloud. It’s overwhelming, and nearly impossible to monitor and analyze every change across the complex hybrid IT environment.

To best support network and security admins, and help global enterprises regain visibility and control of firewall changes, Tufin’s offering a new FREE tool, the ‘Firewall Change Tracker’.

The Firewall Change Tracker effectively detects and highlights firewall rule changes. It’s done by connecting to firewalls and switches from all primary vendors, and provides a central console that monitors, displays and compares policy revisions from each device, in real-time. You can view what has changed, by whom, when, and why.

One of the strengths of this tool is that you can track rule changes for multi-vendor firewall devices, regardless if the firewall device is in the cloud or on-premise.

In addition to information about the change that was made, Tufin also collects information about who made the change, when it was made, and whether there’s a comment or a reference associated with it.

The Firewall Change Tracker is based on Tufin Orchestration Suite and leverages Tufin’s market-wide integrations with multiple, leading firewall vendors and cloud providers. This enables admins to add devices and immediately start detecting changes for all leading firewall devices, including tracking rule changes in AWS Security Groups and Azure Network Security Groups, as well as in VMware NSX Distributed Firewall (DFW) policies, and with Cisco ACI contracts.

How to Get Started with Firewall Change Tracker

Firewall Change Tracker is easy to use. You download the tool, deploy the OVA file as instructed, and activate the tool using the activation key in your registration confirmation email. Once you’ve installed the tool, you can start adding devices that you want to monitor and track for policy revision changes.

There’s no expiration date and no limit to the number of users per licensing key, so you can easily share visibility and increase collaboration with your peers.

Get the visibility you need to protect your network

Simplify Change Monitoring and Ensure Accountability

Most regulations and standards demand change monitoring and accountability. With the Firewall Change Tracker, you can generate reports with a comprehensive list of the changes made, and who made them, across vendors and platforms. This ensures compliance with change monitoring mandates, saving valuable time and effort as you prepare for the next audit.

Review Changes to Identify and Fix Misconfigurations

A side-by-side comparison of firewall revisions will help you review changes to identify misconfigurations and fix them. You’ll be able to notice rules that are now overly permissive, or rules that are risky, by visualizing the changes on each rule and object group. Tufin also provides automated analysis for identifying risky access and policy violations (not included in the Firewall Change Tracker).

Find the Change that Broke Connectivity

Firewall admins are often put on the spot when connectivity is broken. In some cases, this is because misconfigurations can lead to service interruptions. In cases when connectivity is broken, firewall and network engineers can search for the changes that were made to identify the root cause, and fix it. The fact that changes are retrieved in real time across all firewalls and switches, and all revisions have a time stamp, can make troubleshooting much more efficient. Tufin also provides an accurate network topology map for automated connectivity troubleshooting (not included in the Firewall Change Tracker).

Original article from: Tuffin

The post Multi-Vendor Firewall Change Tracker for Network Security Admins appeared first on DataGroupIT.

Zero Trust Architecture: Best Practices for Safer Networks

siteadmin — Tue, 27 Oct 2020 13:20:04 +0000

A zero trust architecture enables organizations to prioritize access and restrictions. The goal is to implement a zero trust policy across all traffic, to ensure no user, device, or system can put the network at risk.

Zero trust architectures typically enforce three main principles — there is no such thing as trustworthy users, multifactor authentication (MFA) is a must, and micro-segmentation is critical for enforcing restrictions.

To implement zero trust security, organizations need to adopt information security practices and tools that expand their endpoint visibility and enable control over access and privileges.

In this article, you will learn:

What is zero trust architecture
3 key elements of a zero trust architecture
How to implement a zero trust architecture

What is zero trust architecture?

Zero trust architectures are constructed on the basis that there is no secure perimeter. Instead, every event and connection is considered untrusted and potentially malicious.

The goal of zero trust architectures is to keep networks protected despite increasingly sophisticated threats and complex perimeters. This is why zero trust architecture is also called zero trust network, or in general — zero trust security.

What is zero trust?
A zero trust model implements data security that prioritizes access and restrictions. This is particularly relevant in today’s business environment, as organizations increasingly need to secure a remote workforce.

In a zero trust architecture, users, devices, and services receive the least possible privileges until proven trustworthy. Sometimes, when implementing zero trust network access, privilege restrictions extend even after authentication and authorization.

In particular, zero threat architectures are designed to reduce the vulnerabilities associated with cloud resources, ephemeral endpoints, dynamic attacks and internet of things (IoT) devices. These architectures are often adopted by organizations with highly sensitive data and systems.

3 Key Elements of a Zero Trust Architecture

When evaluating a zero trust architecture, there are three elements that should be considered. These elements are vital to the successful deployment and construction of zero trust architectures.

1. No false sense of security
In traditional architectures, anything that happens inside the perimeter of a network is considered trusted. The assumption being that any users or activity in the network has already passed authentication and is authorized to be there. This model assumes that perimeter security is flawless and that insiders are never malicious.

To anyone familiar with security, the flaws in this model should be obvious. There are many situations in which users and events inside your perimeter are not to be trusted. For example, an attacker who has entered with compromised credentials or insider threats, which may abuse privileges or move laterally through the network. A zero trust architecture makes this understanding explicit, and prioritizes protection against insider threats.

2. Multifactor authentication

Multifactor authentication (MFA) is the use of credentials in combination with an additional authenticator. For example, requiring a user to scan their fingerprint or confirm a PIN sent to a mobile device. MFA significantly reduces the chance that attackers are able to use compromised credentials to access your systems and data.

A zero trust architecture implements MFA as a double-check against its own security measures. It uses MFA to ensure that users are who they claim to be and ensures that access and transactions are allowed correctly. MFA also plays a large role in PCI security, which helps organizations protect credit card data in accordance with the PCI standard.

3. Microsegmentation
Microsegmentation is the use of access controls to isolate the various components and services in your system. It allows you to layer security measures, such as firewalls or authorization measures, for greater security. It also lets you restrict access to assets on a granular level, reducing the chance of an attacker taking advantage of lateral weaknesses.

A zero trust architecture leverages microsegmentation to ensure that even users or applications inside a network are properly restricted. It ensures that even if an attacker does enter the network, the amount of damage they can cause is severely limited.

Microsegmentation and cloud native development often go hand in hand. However, microsegmentation by itself does not cover all of your cloud security needs. It’s important to make the distinction between microsegmentation as a security measure, and cloud security as a whole.

Zero trust: principles for successful implementation

When building a zero trust architecture there are several best practices you can employ. Below are four practices to help you prioritize your efforts, securely validate devices, ensure visibility of your systems, and eliminate false trust.

1. Know your architecture including users, devices, and services
To secure your network and assets create a full inventory of your users, devices and services. This includes what data and assets each need to be accessed, what possible liabilities that access creates, and how access is managed.

In particular, focus on those assets and components that are connected to your network. For example, prioritizing focus on servers with internally or externally facing endpoints over tape backups.

It is also important to pay attention to pre-existing configurations and permissions. If you are transitioning from a traditional network model to zero trust you may need to update services and assets to ensure continued functionality.

2. Create a strong device identity
To ensure that only trusted devices are allowed on your network, start by establishing a unique, traceable identity for each. These identities allow you to verify that assets are managed efficiently and to expose untrusted devices. Additionally, the identities you create for devices are necessary to authenticate permissions and access according to the policies you define.

There are several ways to identify devices, depending on the device’s hardware, platform and type. The most reliable method is to store identity information on secure hardware co-processors. This is very difficult to fake and is a high-trust method.

When hardware storage isn’t possible you can use software-based key stores. This method provides a reasonable amount of confidence for well-managed devices. However, it can only give low confidence for poorly-managed or unmanaged devices.

3. Focus your monitoring on devices and services
Comprehensive and continuous monitoring helps ensure that even if your security measures fail, you are able to detect and stop attacks. In particular, focus on monitoring how devices and services are interacting. For example, what is being requested, what processes are performed, and what data is accessed.

When monitoring, keep in mind that each device needs to be evaluated individually. This does not mean that you should not correlate data across your devices. It does, however, mean that you can’t rely on traffic choke points to catch suspicious events. Rather, evaluate device data in context of the events occurring on your network to ensure that the traffic matches your defined security policies.

4. Don’t trust the network, including the local network
Remember that zero trust means zero. This includes your local network. You should not be relying on your network itself to protect communications.

Instead, build trust into the devices and services operating within your network. For example, by enforcing encryption protocols such as TLS. If you rely on local networks to be secure, you are potentially opening your connections to attacks such as DNS spoofing, man in the middle (MitM) attacks, or unsolicited inbound connections.

Zero Trust Architecture With Exabeam

To understand individual devices across the network, you can leverage user and entity behavior analytics (UEBA) tools. To be effective, UEBA tools must tie individual behavior back to an individual user. These tools can not only put device data in the context of your defined security policies, but also establish a behavioral baseline for normal activity.

Zero trust architecture and UEBA work together to emphasize that abnormal behavior may indicate a threat is present, even if permissions and credentials appear legitimate.

Exabeam is a smart SIEM platform that is easy to implement and use. Exabeam comes with built-in zero trust capabilities. In particular, Exabeam’s user and event behavior analytics (UEBA) features can help with the following objectives:

Incident detection that does not rely on rules or signatures—Exabeam identifies abnormal and risky activity without predefined correlation rules or threat patterns and provides meaningful alerts with lower false positives.
Security incident timelines—Exabeam stitches sessions together to create a complete timeline for a security incident, spanning users, IP addresses and IT systems.
Peer groupings—Exabeam dynamically groups similar entities, such as users who have the same organizational role, to analyze normal behavior across the group and detect unusual behavior.
Lateral movement—attackers who penetrate a system move through the network, gaining access to more and more systems using different IP addresses and credentials. Exabeam combines data from multiple sources to uncover an attacker’s journey through the network.

Original article from: Exabeam

The post Zero Trust Architecture: Best Practices for Safer Networks appeared first on DataGroupIT.

Monitoring 802.1X EAP: What You Need to Know

siteadmin — Tue, 27 Oct 2020 13:10:50 +0000

First Thing’s First

As we’ve written about previously, the standard authentication protocol used on encrypted networks is Extensible Authentication Protocol (EAP), which provides a secure method to send identifying information for network authentication. 802.1x is the standard that is used for passing EAP over wired and wireless Local Area Networks (LAN), as it provides an encrypted EAP tunnel that prevents outside users from intercepting information. The EAP protocol can be configured for credential (EAP-TTLS/PAP and PEAP-MSCHAPv2) and digital certificate (EAP-TLS) authentication and is a highly secure method for protecting the authentication process.

Throughout this article, we will look at how to monitor 802.1X EAP and why doing so is important from a network security perspective.

MAC Authentication Bypass (MAB)

MAB enables port-based access control using the MAC address of the endpoint. A MAB-enabled port can be dynamically enabled or disabled based on the MAC address of the device that connects to it. The below diagram illustrates the default behavior of a MAB-enabled port.

Session Initiation

From the switch’s perspective, the authentication session begins when the switch detects link-up on a port. The switch will initiate authentication by sending an EAP Request-Identity message to the endpoint. If the switch does not receive a response, the switch will retransmit the request at periodic intervals. If no response is received after the maximum number of retries, the switch will let IEEE 802.1X time out and proceed to MAB.

MAC Address Learning

During the MAC address learning stage, the switch begins MAB by opening the port to accept a single packet from which it will learn the source MAC address of the endpoint. Packets sent before the port has fallen back to MAB (that is, during the IEEE 802.1X timeout phase) are discarded immediately and cannot be used to learn the MAC address.

The switch can use almost any Layer 2 and 3 packets to learn MAC addresses, with the exception of bridging frames such as Link Layer Discovery Protocol (LLDP), Spanning Tree Protocol, and Dynamic Trunking Protocol (DTP). 1

After the switch learns the source MAC address, it discards the packet. Then the switch crafts a RADIUS Access-Request packet. A sample MAB RADIUS Access-Request packet is shown in the snapshot below.

By default, the Access-Request message is a Password Authentication Protocol (PAP) authentication request, The request includes the source MAC address in three attributes: Attribute 1 (Username), Attribute 2 (Password), and Attribute 31 (Calling-Station-Id). Although the MAC address is the same in each attribute, the format of the address differs. This feature is important because different RADIUS servers may use different attributes to validate the MAC address. Some RADIUS servers may look at only Attribute 31 (Calling-Station-Id), while others will actually verify the username and password in Attributes 1 and 2.

Because MAB uses the MAC address as a username and password, you should make sure that the RADIUS server can differentiate MAB requests from other types of requests for network access. This precaution will prevent other clients from attempting to use a MAC address as a valid credential. Cisco switches uniquely identify MAB requests by setting Attribute 6 (Service-Type) to 10 (Call-Check) in a MAB Access-Request message. Therefore, you can use Attribute 6 to filter MAB requests at the RADIUS server.

Session Authorization

If the MAC address is valid, the RADIUS server will return a RADIUS Access-Accept message. This message indicates to the switch that the endpoint should be allowed access to the port. Optionally, the RADIUS server may include dynamic network access policy instructions (for example, a dynamic VLAN or access control list [ACL]) in the Access-Accept message. In the absence of dynamic policy instructions, the switch will simply open the port. No further authentication methods will be tried if MAB succeeds.

If the MAC address is not valid or is not allowed to access the network for policy reasons, the RADIUS server will return a RADIUS Access-Reject message. This message indicates to the switch that the endpoint should not be allowed access to the port based on the MAC address.

If no fallback authentication or authorization methods are configured, the switch will stop the authentication process and the port will remain unauthorized.

Session Accounting

If the switch can successfully apply the authorization policy, the switch can send a RADIUS Accounting-Request message to the RADIUS server with details about the authorized session.

In the diagram above, the first frame sent is an EAPOL-Start frame. This frame is not critical, and the process can be started by the authenticator sending the EAP-Request Frame.

Next, the supplicant responds with an EAP-Response. Messages from the Authenticator to the Radius server use the radius protocol (UDP 1812 for Authentication)When the authenticator receives an Access-Accept packet from the radius server it will authorize the port and allow access to the supplicant. If access is denied by the Radius server an Access-Reject message will be sent to the authenticator and the port will stay unauthorized.

The supplicant can terminate the authentication of the port by sending an EAPOL-logoff frame to the authenticator.

Supplicant to Authenticator (EAPoL)

This is the communication method utilized that provides the Authenticator and the Client a line of communication prior to network access. This is what the capture will look like:

The EAPoL portion of communication will vary depending on the authentication type. In my examples, we are using EAP-PEAP w/EAP-MsCHAPv2. This is a fairly standard form of authentication.

The useful portions that can usually be derived from a pcap are:

In this frame, you can see the Client’s (Supplicant) Identity being used of “Vova.Halimon“. This can be extremely useful when trying to determine if the supplicant is going to authenticate as the user or the machine account as well as what the user could be typing into the username prompt.

For more information on EAP types, visit the IANA EAP registry.

EAP-TLS (Certificate Example)

EAP Auth Method Negotiation and Credential Exchange:

The first message in the above screenshot is the server’s proposal of EAP-PEAP (EAP-TLS, EAP-TTLS EAP-FAST, EAP-LEAP, EAP-MD5) then the client’s response with, “EAP-PEAP good for me” In some situations, depending on the RADIUS server configuration, the client may try to propose a method that is not permitted or supported by the server. This is where you would see that negotiation fail, and ultimately an Access-Reject / EAP-Failure.

EAP Success (Wired & Wireless) & 4-Way Handshake (Wireless):

EAP Code	Type
1	Request
2	Response
3	Success
4	Failure

Once the client has been successfully authenticated and authorized, there is an EAP Success message sent back to signify the end of the process. If this is a wired client, the process is over, and the client is able to start transmitting and receiving data frames. If this is a wireless client, the station will utilize a few EAP attributes and the AP will utilize two MPPE (Microsoft Point-to-Point Encryption – key attributes in the RADIUS Access-Accept response to perform the 4-way handshake and create the encryption keys for secure communication.

Extensible Authentication Protocol (EAP) Authentication Types

MD5 isn’t typically used as it only does a one-way authentication, and perhaps even more importantly doesn’t support automatic distribution and rotation of WEP keys so does nothing to relieve the administrative burden of manual WEP key maintenance.
TLS, while very secure, requires client certificates to be installed on each Wi-Fi workstation. Maintenance of a PKI infrastructure requires additional administrative expertise and time in addition to that of maintaining the WLAN itself.
TTLS addresses the certificate issue by tunneling TLS, and thus eliminating the need for a certificate on the client side. Making this an often preferred option. Funk Software* is the primary promoter of TTLS, and there’s a charge for supplicant and authentication server software.

LEAP has the longest history, and while previously Cisco proprietary (works with Cisco Wi-Fi adapters only), Cisco has licensed LEAP to a variety of other manufacturers through their Cisco Compatible Extensions program. A strong password policy should be enforced when LEAP is used for authentication.
EAP-FAST is now available for enterprises that can’t enforce a strong password policy and don’t want to deploy certificates for authentication.

The more recent PEAP works similarly to EAP-TTLS in that it doesn’t require a certificate on the client side. PEAP is backed by Cisco and Microsoft and is available at no additional cost from Microsoft. If desired to transition from LEAP to PEAP, Cisco’s ACS authentication server will run both.

EAP-TLS Example

However, in this graphic, you can see the client and server negotiate EAP-PEAP. Once that is completed, the server will present the client with its certificate. If the client does not trust the certificate from the server, and the user does not accept the certificate(The end-user might be presented with a dialog to trust this certificate), the exchange will fail after the first frame or two of the handshake.

In this situation, however, the client trusts the server certificate, and the two endpoints secure the medium with a TLS tunnel. Once secured you should notice that the protocol becomes purely TLS and since the traffic is encrypted, we can only see that the frames are “Application Data”. This is the point at which the client and server are exchanging inner authentication data such as EAP-MsCHAPv2 or EAP-TLS.

Original article from: Portnox

The post Monitoring 802.1X EAP: What You Need to Know appeared first on DataGroupIT.

Multi-factor authentication offers effective security, but not all solutions are created equal

siteadmin — Tue, 27 Oct 2020 12:57:39 +0000

Reports published by Proofpoint recently documenting MFA vulnerabilities in Microsoft 365 (Office 365) have likely caused concern among Microsoft customers. The report cites “critical vulnerabilities in multi-factor authentication (MFA) implementation in cloud environments where WS-Trust is enabled” ultimately allowing a potential attacker to bypass MFA and get access to an organization’s Microsoft 365 apps including email, SharePoint, CRM, data and more. On its website, Microsoft announced deprecation of the WS-Trust authentication protocol, stating it is “inherently insecure by current encryption standards”.

Making sure you are using non-deprecated protocols is important to maintaining security. But what other conclusions can security professionals take away from this vulnerability? Below are some guidelines that provide basic pointers for assessing the security of authentication and access management solutions:

1. Separate your security solution from the apps you need to protect: Segregation of duties is a basic tenet of security. The same goes for security solutions. Placing all your eggs in one basket compounds risk, so ideally you should be deploying a dedicated authentication and access management solution that can be managed and secured independently of other apps and services;

2. Apply MFA consistently to all apps and services: Look for a solution that can address all use cases. MFA is considered one of the most effective security measures for reducing risk of breach. It makes sense, therefore, to ensure an access management solution can centrally apply authentication and conditional access to all your apps, including legacy on-prem ones; and,

3. Make sure your solution is secure: One of the most prevalent authentication methods used today is PUSH OTP, but not all solutions are created equal when it comes to security. Always work with a trusted security vendor whose core business is security. Regarding PUSH OTP:

a. Make sure the OTP app cannot be backed up to an external drive or copied to another device. Apps that allow this don’t have the built-in security to ensure the apps can only be used on a specific and intended device. So always make sure that the OTP app is encrypted, protected and tied cryptographically to a specific mobile device.

b. Make sure the OTP app supports secure app enrollment and activation: In order for the security code to be protected and secured when a user installs the app, the app installation process needs to be encrypted. Otherwise, the cryptographic module that generates the security codes could be at risk. Some vendors carry out an OS check before allowing the app to be installed on the intended mobile device. However, if the app can be copied to a malicious device that complies with the OS rules, this kind of workaround wouldn’t be of any help in protecting the integrity of the app itself or a malicious actor’s ability to clone the app.

c. Make sure the OTP app can be supported on any OS. Your users will likely need to install apps on a broad range of devices, including mobiles, tablets and desktops. Broad OS and end-point device compatibility ensures a consistent and secure authentication across the board for all apps and users.

Original article from: Thales

The post Multi-factor authentication offers effective security, but not all solutions are created equal appeared first on DataGroupIT.

Increase SSO security by going passwordless

siteadmin — Tue, 27 Oct 2020 12:52:39 +0000

The acceleration of digital transformation initiatives to support the remote workforce has, in turn, sped up the development of cloud-based applications. An average employee uses 36 cloud services at work according to McAfee, and accessing those applications requires multiple passwords – opening risks of data loss and unauthorized network access if those passwords are compromised.

All of those passwords create vulnerability for enterprises. Cybercrime is growing at an alarming rate. In fact, Cybercrime Ventures predicts that cybercrime will cost $6 trillion annually by 2021 globally, when you add up lost, stolen, and damaged data, financial theft, and hits to productivity, intellectual property, business disruption, reputations, and more. Amongst different cybercrimes, 45% of breaches are a result of hacking credentials – typically passwords.

Enter Single Sign-On

IT professionals spend about 20% of their time on password-related issues, and 57% of enterprise users cite passwords as a major hassle. So it is no wonder organizations are turning to single sign-on (SSO) solutions to improve productivity with a frictionless single point of entry for multiple applications. Enterprise SSO usage has the potential to grow at 12.8% CAGR, becoming a $1 billion market by 2027.

The challenge is balancing that frictionless user experience with security. If your SSO authentication consists of a single password without multifactor authentication for multiple applications, you’ve made your users more productive, but multiplied your risk.

For enterprises that want to create a frictionless employee experience while increasing security, the best practice solution is to create conditions where you can eliminate passwords. Entrust offers a credential-based passwordless solution coupled with SSO for hybrid cloud and on-premises environments – replacing passwords with biometrics or tokens for fast, frictionless access. For additional security, enterprises can add authentication options like FIDO keys or use PKI-based high assurance credentials, while ensuring compliance with regional regulations like GDPR, HIPAA, and CCPA.

Original article from: Entrust

The post Increase SSO security by going passwordless appeared first on DataGroupIT.

5 Best Practices for Securing Privileged Access and Identities for the Cloud Management Console

siteadmin — Tue, 27 Oct 2020 12:48:45 +0000

Over the next few weeks, we’ll explore best practices for securing privileged accounts and identities in common cloud scenarios. This series can help guide effective risk reduction strategies for today and for the future as cloud workloads evolve.

First up, we’re looking at cloud management consoles, which are used by admins to set up the entire cloud environment, oversee all types of cloud activities (i.e. use tracking, data integration, resource deployment and more) and configure operational and security settings. Before we dive in, here’s a look at the current state of the cloud.

How Are Enterprises Adopting Cloud?

While achieving a fully cloud-based IT infrastructure may be an ultimate digital transformation goal for some organizations, the vast majority are taking a hybrid approach today. According to a recent industry study, 93% of enterprises have a multi-cloud strategy in place. Meanwhile, as the world adapts to new realities, software-as-a-service (SaaS) use continues to skyrocket, enabling companies to conduct critical business and empower remote workforces.

There’s no denying the business benefits of deploying cloud infrastructure and running enterprise applications in the cloud – enhanced flexibility, simplified operations, cost savings and scalability are just a few. Yet every cloud deployment scenario creates new risk. This is particularly true in the wake of COVID-19. As leaders accelerate their cloud journeys to digitize quickly, attackers are targeting critical data and assets in the cloud in earnest. Within the first few months 2020 alone, cyber attacks targeting the cloud grew by a staggering 630%.

Now more than ever, it’s important for organizations to fully understand their role in securing cloud workloads as part of the shared responsibility model. While cloud providers are responsible for the cloud infrastructure itself, cloud customers must secure their data, applications, operating systems, supporting infrastructure and other assets running in the cloud environment.

Privileged accounts associated with human users and application and machine identities are exceptionally powerful and highly susceptible to compromise in the cloud. Protecting privileged access in these environments is paramount and the onus lies on the cloud customer. In fact, more than half of the top cloud computing threats today can be mitigated with strong privileged access management (PAM) and identity access management (IAM) controls.

5 Best Practices for Securing the Cloud Management Console

Since cloud management consoles and portals enable full control of an organization’s cloud resources, they are prime targets for cyber attackers and all access to them must be secured and monitored. This is particularly true for powerful root-level accounts – the accounts with irrevocable administrative privileges such as the AWS root user account, Azure global admin role and the Google Cloud Platform (GCP) super user account.

1. Treat all cloud management console access (for both human and machine users) as privileged. First, identify what permissions a user or application/machine needs to do their specified job. Build roles for each user persona, giving them access to only what they need by following the principle of least privilege. Enforce privileged access management controls including session isolation, monitoring and credential rotation to reduce risk.

2. Implement just-in-time access to reduce the attack surface. By providing just-in-time access to the cloud management console, versus standing access, permissions are provided when the session is launched – helping to ensure that only the right users have access to the right assets at the right time, and only for a certain amount of time.

3. Secure all human access to the cloud console using single sign-on (SSO) and multi-factor authentication (MFA). Whether access to the cloud console is standing or temporary, human access should be protected by SSO and MFA. SSO makes it easier for users to access their work applications in one place without having to remember multiple passwords. Additionally, SSO via SAML to the cloud console enables federated users to assume roles within the cloud provider. A role is an IAM identity that has specific permissions and can be assumed by anyone who needs it – it is not associated with a specific user and does not have long-term credentials. The intent of a role is to provide temporary access to the console for that specific session only. In parallel, MFA confirms that users are who they say they are by requiring them to pass multiple authentication challenges.

4. Secure API and automated access to the cloud management console. Cloud management consoles and portals can be accessed by automated scripts via API access keys. These API keys are highly privileged and very powerful – for example, they can enable a script or user to stop or start a virtual server, copy a database or even wipe out entire workloads. To protect your cloud workloads, securing API keys and applying least privilege is imperative.

5. Consistently apply access policies to administrators across multi-cloud, on-premises and hybrid environments. One compromised admin is all it takes to delete your whole cloud environment configuration. Strong privileged access oversight is necessary for security and audit purposes. Record admin activity and monitor active sessions, assigning session risk scores based on pre-defined risky behavior and activity, such as accessing the console during off hours or from irregular locations. This enables organizations to identify misuse fast and terminate sessions when a potential attack is suspected.

Attackers can find and abuse permissions to escalate privileges and become full cloud admins. What’s more, they can easily use these permissions to hide stealthy shadow entities that remain hidden and can be used as backdoors to the cloud environment. Scan your environment to discover privileged entities (users, groups and roles) and expose stealthy cloud shadow admins.

A Secure Cloud Is Your Business Advantage

Today, you may be extending cloud initiatives with DevOps pipelines to increase business agility. Or maybe you’re looking at on-demand compute and storage to drive cost savings. No matter where you are on your cloud journey, privileged access and identity policies must be enforced consistently across your organization to reduce exposure and protect your critical assets. Get practical guidance in our eBook, “Securing Privileged Access and Identities In 4 Key Cloud Scenarios,” and visit cyberark.com/cloud. Be sure to check back soon to explore part two of our series on securing your organization’s dynamic cloud infrastructure.

Original article from: Cyberark

The post 5 Best Practices for Securing Privileged Access and Identities for the Cloud Management Console appeared first on DataGroupIT.

AI email security: Understanding the human behind the keyboard

siteadmin — Tue, 27 Oct 2020 12:41:21 +0000

At the heart of any email attack is the goal of moving the recipient to engage: whether that’s clicking a link, filling in a form, or opening an attachment. And with over nine in ten cyber-attacks starting with an email, this attack vector continues to prove successful, despite organizations’ best efforts to safeguard their workforce by deploying email gateways and training employees to spot phishing attempts.

Email attackers have seen such success because they understand their victims. They know that, ultimately, human beings are creatures of habit, prone to error, and susceptible to their emotions. Years of experience has allowed attackers to fine tune their emails making them more plausible and more provocative. Automated tools are now increasing the speed and scale at which criminals can buy new domains and send emails en masse. This makes it even easier to ‘A/B test’ attack methods: abandoning those that don’t see high success rates and capitalizing on those that do.

We can classify phishing attempts into five broad categories, each aiming to trigger a different emotional reaction and elicit a response.

Fear: “We have detected a virus on your device, log in to your McAfee account.”
Curiosity: “You have 3 new voicemails, click here.”
Generosity: “COVID-19 has greatly impacted homelessness in your area. Donate now.”
Greed: “Only 23 iPhones left to give away, act now!”
Concern: “Coronavirus outbreak in your area: Find out more.”

It’s worth noting that today’s increasingly dynamic workforces are more susceptible to these techniques, isolated in their homes and hungry for new information.

Turning to tech

As email attacks continue to trick employees and find success, many organizations have realized that the built-in security tools that come with their email provider aren’t enough to defend against today’s attacks. Additional email gateways are successful in catching spam and other low-hanging fruit, but fail to stop advanced attacks – particularly those leveraging novel malware, new domains, or advanced techniques. These advanced attacks are also the most damaging to businesses.

This failure is due to an inherent weakness in the legacy approach of traditional security tools. They compare inbound mail against lists of ‘known bad’ IPs, domains, and file hashes. Senders and recipients are treated simply as data points – ignoring the nuances of the human beings behind the keyboards.

Looking at these metrics in isolation fails to take into account the full context that can only be gained by understanding the people behind email interactions: where they usually log in from, who they communicate with, how they write, and what types of attachments they send and receive. It is this rich, personal context that reveals seemingly benign emails to be unmistakably malicious, especially when other data fails to reveal the danger.

Misunderstanding the human

Frustrated with the ineffectiveness of traditional tools, many organizations think that the solution is to minimize the chances that employees engage with malicious emails through comprehensive employee training. Indeed, companies often attempt to train their employees to spot malicious emails to compensate for their technology’s lack of detection.

Considering humans to be the last line of defense is dangerous, and this approach overlooks the fact that today’s sophisticated fakes can appear indistinguishable to legitimate mails. It’s only when you really break an email down beyond the text, beyond the personal name, beyond the domain and email address (in the case of compromised trusted senders), that you can decipher between real and fake.

Large data breaches of recent years have given attackers greater access than ever to corporate emails and stolen passwords, and so supply chain attacks are becoming increasingly common. When attackers take over a trusted account or an existing email thread, how can an employee be expected to notice a subtle change in wording or the different type of attached document? However rigorous the internal training program and regardless of how vigilant employees are, we are now at the point where humans cannot spot these very subtle indicators. And one click is all it takes.

Understanding the human

Email security, for a long time, remains an unsolved piece of the complex cyber security puzzle. The failure of both traditional tools and employee training has prompted organizations to take a radically different approach. Thousands of businesses across the world, in both the public and private sector, use artificial intelligence that understands the human behind the keyboard and forms a nuanced and continually evolving understanding of email interactions across the business.

By learning what a human does, who they interact with, how they write, and the substance of a typical conversation between any two or more people, AI begins to understand the habits of employees, and over time it builds a comprehensive picture of their normal patterns of behavior. Most importantly, AI is self-learning, continuously revising its understanding of ‘normal’ so that when employees’ habits change, so does the AI’s understanding.

This enables the technology to detect behavioral anomalies that fall outside of an employee’s ‘pattern of life’, or the pattern of life for the organization as a whole.

This fundamentally new approach to email security enables the system to recognize the subtle indicators of a threat and make accurate decisions to stop or allow emails to pass through, even if a threat has never been seen before.

Sitting behind email gateways, this self-learning technology has extremely high catch rates. It has caught countless malicious emails that other tools missed, from impersonations of senior financial personnel to ‘fearware’ that played on the workforce’s uncertainties at a time of pandemic.

Attackers are continuing to innovate, and automation has led to a new wave of email threats. 88% of security leaders now believe that cyber-attacks powered by offensive AI are inevitable. The email threat landscape is rapidly changing, and we can expect to receive more hoax emails that are more convincing. Now is a crucial moment for organizations to prepare for this eventuality by adopting AI in their email defenses.

Original article from: Darktrace

The post AI email security: Understanding the human behind the keyboard appeared first on DataGroupIT.

Notice the unnoticed: Threat Hunting by SandBlast Agent

siteadmin — Tue, 27 Oct 2020 12:23:46 +0000

By Yaelle Harel and Boaz Barzel

Threat Hunting is a proactive approach for finding and remediating undetected cyber-attacks. It is a process that involves searching for indicators of compromise (IoC), investigating, classifying, and remediate. Threat hunting can be IoC-Driven, in which the hunter investigates an indicator provided by external or internal sources. It can also be hypothesis-driven, in which the hunt begins with an initial hypothesis or question. For example, have we been affected by a recent campaign covered in the news? SandBlast Agent’s Threat Hunting solution is a robust platform that helps you hunt and investigate incidents promptly. In the previous chapter we explained how to avoid the damager of the dangerous wave of ransomware attacks. In this blog post, we will demonstrate how to hunt for undetected attacks such as ransomware based on an indicator of compromise and block the attack.

Why is Threat Hunting Important?

Endpoint Security experts and analysts proactively hunt and investigate incidents based on indicators provided by threat alliances, open-source intelligence (OSINT), or external intelligence. SandBlast Agent’s Threat Hunting solution offers real-time visibility to all indicators collected from all Endpoint devices in the organization. It provides a powerful investigation platform that quickly searches for indicators and provides a list of all appearances across the enterprise hosts, events timeline, and detailed information collected by SandBlast Agent automatic Forensics. Also, the solution offers actionable response options such as quarantine and termination.

Maze Ransomware

Maze was one of the two top ransomware types in Q3 2020. Maze is not like typical data-encrypting ransomware. Maze not only spreads across a network, infecting and encrypting every computer in its path, it also exfiltrates the data to the attackers’ servers where the hacker holds it for ransom. If the victim doesn’t pay the ransom, the attackers publish the files online.

The FBI privately warned businesses in December of an increase in Maze-related ransomware incidents. Since the warning, several major companies have been hit by Maze, including cyber insurer Chubb, accounting giant MNP, a law firm, an oil company, US military missile contractor, the business services giant Conduent and many more.

Let’s Start Hunting!

The Maze Ransomware hit the headlines a couple of weeks ago when the Ransomware group has claimed responsibility for attacking Virginia’s Largest School System and interrupting the distanced learning of the Fairfax County Public Schools (FCPS). This news might not concern most Endpoint Security experts, but what about those responsible for securing school systems worldwide? They were probably highly concerned and started hunting for the maze Ransomware indicators in their systems. We will now demonstrate how it to hunt for Maze SandBlast Agent’s Threat Hunting solution.

Enterprise-Wide Visibility Augmented by Threat Intelligence

We will start the investigation with a known Maze IoC: 8540030a0ea3e18e84af7ce026ab9cad

When looking in VirusTotal, it is clear that this indicator is strongly related to the Maze Ransomware:

Now, let’s have a look in SandBlast Agent’s Threat Hunting Dashboard. We see an overview of the enterprise-wide indicators, collected by SandBlast Agent in all Endpoint devices.

We will use the advanced investigation search tool to search for the indicator we’ve got:

We see that the process’s name is pithon_setup.exe, the process is not signed and it was observed only on BOAZ-GAR-WINDOWS machine. Let’s add the BOAZ-GAR-WINDOW machine to the query, search for unsigned processes and remove the MD5 to find potential backdoor processes we have yet to discover.

We see that we have 76 matches. The time-line bar shows us the number of events happening at a certain time. Let’s take a closer look:

By clicking on the red hexagon, we exclude trusted events, excellent hunting! We have found the backdoor process that the attacker used to infiltrate the server and execute a Ransomware attack. We can now quarantine the process and continue the investigation to track all possible yet to be activated backdoor processes in the organization’s history.

Enhancing Threat Hunting with globally-shared Threat Intelligence

SandBlast Agent is enriched by Check Point ThreatCloud, the most powerful threat intelligence database. ThreatCloud is continuously updated by advanced predictive intelligence engines, data from hundreds of millions of sensors, cutting-edge research from Check Point Research and external intelligence feed. On a daily basis, ThreatCloud analyzes 10 trillion logs, 86 billion IOCs, 2.6 billion attacks and 3 billion website and files. When a suspicious indicator is detected by SandBlast Agent, it is immediately sent for further analysis by ThreatCloud engines. SandBlast Agent’s will then automatically enrich the Forensics Report with ThreatCloud Intelligence. Furthermore, ThreatCloud instantly shares all indicators collected across all endpoint devices, mobile devices, network and cloud engines, with all Check Point customers to make sure that the next occurrence of the attack will be prevented even faster.

Summary

In this chapter, we explained why even organizations equipped with the most comprehensive, state-of-the-art Endpoint Security solution, still need to actively hunt for threats that remained under the radar. We demonstrated how SandBlast Agent’s Threat Hunting tool could be used to find unnoticed attacks and remediate them. Using this tool on a regularly, helps you get ready for an unexpected cyber-attack. In the next chapter, we will demonstrate another approach for Threat Hunting, using the MITRE ATT&CK dashboard in SandBlast Agent’s Threat Hunting solution.

Original article from: Checkpoint

The post Notice the unnoticed: Threat Hunting by SandBlast Agent appeared first on DataGroupIT.