The year 2019 has been a significant one in the technology world, with several high profile cases grabbing headlines. In fact, according to a recent article by DataQuest India, there were at least four areas of interest which were highlighted this year – Remote Desktop Protocol (RDP) threats, showstopper vulnerabilities like in the case of URGENT/11, speculative execution vulnerabilities such as Meltdown and Spectre, and finally the many ransomware attacks.
As we move on to a whole new decade, it’s important to take stock of what the past decade has taught us and what the future has in store. In the cybersecurity world, experts bear past experiences in mind and routinely predict a number of innovative techniques that could be used to infiltrate security systems. Each year, different methods and new approaches are introduced or discussed, touching upon all those concerns about data protection and the challenges ahead. Continue reading Cybersecurity Trends 2020: What’s in Store
Identity governance and administration (IGA) is the policy-based implementation of user identity and access to ensure security and compliance across the IT environment. In IGA, the first step is to remain aware of risks and then follow the best possible practices to mitigate them by improving visibility and accountability.Continue reading 5 Identity Governance & Administration Mistakes You Should Avoid
Online identity theft, simply put, is impersonation on an online platform. If someone else pretends to be you — either by stealing your credentials and logging into your account or by creating a fake account that others believe is yours – then your identity has been stolen.
There are a number of ways – data breaches, phishing, mishandled passwords, and more – through which personal data collected by an organization can be compromised, giving rise to the risk of identity theft. There are also a number of ways in which Akku, the Identity and Access Management (IAM) solution by CloudNow, can help you prevent it.Continue reading Prevent Online Identity Theft with Akku
If your organization relies on the cloud for a majority of its operations, you may want to look closer at the type of architecture your security solution uses – whether it is agent-based or agentless. While some might say that it is irrelevant and that you should focus only on the security solution’s efficiency, we beg to differ. Picking the right kind of cloud security solution can drastically affect your organization’s day-to-day operations and how much ownership you can take over the security solution.Continue reading Agent-based Cloud Security Solution? No thanks!
“irgvctxmsr” – sounds like gibberish, doesn’t it? But if you were to decrypt this string using a mono-alphabet shift cipher where each letter has been shifted to the right by 4 numbers, you would see that it spells “encryption”!
Protecting critical data and information by encrypting them was first performed by Julius Caesar in 120 BC. The art of encryption has been through several modern shifts, and currently most of the data on the internet is protected using sophisticated encryption algorithms like AES (Advanced Encryption Standard), RSA (Rivest-Shamir-Adlemen), ECC (Elliptic Curve Cryptography) and PGP (Pretty Good Privacy).
Deciphering an encrypted message requires a key. Nowadays, messages are encrypted using public keys and decrypted using private keys. The private keys are shared privately between two trusted parties. Losing a private key can be disastrous, as encrypted messages can then be read by anybody with access to the private key.
Password Hashing
While encryption is a two-way function and is primarily done with the intention of being decrypted, password hashing is a one-way function. Hashing allows us to use a mapping function to map data of any size to a fixed length. The resultant output is called the hash value. Technically, hashing is reversible – however, the computing power required to get the original message makes it impossible for the original message to be decoded. Simply put, encryption protects the data in transit while hashing is used to authenticate the data and lets you know if it has been tampered with.
Here is how it works – consider that you have a digital document that you have digitally signed and uploaded to your website for another person to download. Now, you will run a hash function on the document and another one on your digital signature and encrypt the resulting hash values. Once a designated person downloads the document, the browser decrypts the hash values using a key and runs the same hash function on the document. If the resulting hash values are the same for the sender and receiver, it means the document and signature have not been tampered with.
Modern hashing algorithms include SHA (Security Hashing Algorithm), RIPEMD, WHIRLPOOL, and TIGER.
Salted Passwords
Salting is the process of adding an additional layer of security to the hashing process by adding a unique value to the end of the password and hashing the new password. By adding even one letter to your password and hashing it, you can change its hash value and make it harder for interceptors to find your password. For example, if your password is “V67gHD92”, you can add a unique character or string to the end of it and make it something like “V67gHD92SPICE”. Here, the word “SPICE” is called the salt.
Salting a password protects any data from brute force attacks in which bots attempt every possible combination of letters and numbers until the password is cracked. However, if the attacker knows your salt, the entire process of salting becomes worthless.
In this day and age where network and information protection requires meticulous planning and dedicated resources, we at CloudNow Technologies want to make things easy for you. Our network security solution Akku is designed to protect your network against sophisticated and high-level attacks. To know more about how we can help you protect your network, get in touch with us now.
A brute-force attack is a type of cybercrime which involves automated hacking activity using bots. The primary aim of a brute-force attack is to crack a password in order to gain access to a user account in an unauthorized manner. Using the automation tool, an attacker repetitively attempts different alpha-numeric combinations at considerable speed – thousands per second – until the user’s password is determined and the account is unlocked.
With the advent of the cloud and the rapid innovations in technology, a brute-force attack has emerged as one of the most common types of outsider attack against web applications.
Here are three steps that will go a long way in improving the security of your network against brute-force attacks:
Enforce a strong password policy
A password is the first line of security when it comes to preventing unauthorized access. A strong password policy, therefore, can ensure that your users set up passwords that are strong and not easily compromised. Here are some important aspects you can regulate by setting up a password policy:
Password Length
A brute-force attack typically works by continuously trying every possible combination using numbers, letters and special characters. The shorter the password length, the fewer the combinations and the easier it is to crack. If the password length is known (or is fixed), again, it becomes easy for the attacker to attempt combinations of that particular length, although it will take longer depending on its length.
Password Complexity
A dictionary attack is a subset of the brute-force attack, which attempts to crack a password by trying all English words and then trying them with multiple combinations of other words and numbers. If users are setting simple passwords because they are easy to remember, they will also be easier to crack.
Password Expiry
Periodically, the system must prompt the user to change their password so that any possible ongoing attack can be effectively guarded against. Moreover, this practice will also mitigate undetected breaches of privileged accounts.
Use multi-factor authentication
Multi-factor authentication puts an additional layer of security between the brute-force attacker and your data. With MFA, even if the password has been correctly identified by the bot, the attacker will be unable to proceed because the system will require either an OTP or a confirmation from a different device (such as a smartphone app).
Another way to set up an additional layer of security at the login point would be to use a captcha – a box showing warped text or images and require manual entry of a response. This will effectively keep out a bot that is executing automated scripts.
Set up an account lockout policy
Set up a policy wherein you can detect and block suspicious login attempts. Locking an account after three failed login attempts, or attempts to login from a different country or an unlikely hour can prevent intruders from entering into the system. To resume work, the authorized user will need to seek administrator intervention to unlock the account.
You can also set up a progressive delay lockout wherein an account is locked for a fixed period of time after a certain number of failed login attempts. The lockout period can progressively increase with the increasing number of failed attempts and helps keep out brute-force attack bots long enough to make them ineffective.
Akku is an Identity and Access Management (IAM) solution that comes equipped security features to accomplish all the steps described above. Whether you are working with cloud-based or on-premise apps or a combination of both, Akku can help you protect your data from brute-force attacks. Contact us today.
One of the main reasons for a number of traditional, older enterprises still being wary of cloud computing is the concern they have over the security of their data on the cloud. There are a number of myths surrounding cloud security that make it difficult for many enterprises to take the plunge and undertake cloud migration to leverage the many benefits of the cloud.
Here are a few of these myths, and why you should stop believing them!
Myth 1: It’s not safe to use the cloud
The biggest myth of them all is that the cloud is simply insecure and more vulnerable to attacks. We understand where this comes from. If you have something you want to protect, you would rather keep it at home, under your watchful eye. By the same logic, people believe that if their data is not located within their own office premises, it isn’t safe.
When you host your data locally, you will need to constantly update your firmware and keep all your security solutions up-to-date. It also requires several maintenance and management procedures and testing at specified intervals to overcome vulnerabilities that may arise due to configuration changes.
On the other hand, when it comes to the cloud, most of these steps are taken care of by the cloud service providers, who run regular audits for their cloud security controls to make the cloud environment as safe as possible. What’s more, cloud platforms are equipped with a wide range of security capabilities that can be customized to suit specific security needs of enterprises. You may also consult cloud service providers and cloud advisory experts like CloudNow to understand and take steps to prevent potential security risks.
Myth 2: Data on the cloud can be accessed by anyone
This is a common concern for enterprises when it comes to using a public cloud. If you are using a public cloud, that doesn’t mean that your data is available publicly or to other users of the shared cloud!
Even on a shared cloud, the data of each enterprise or individual is stored as a separate instance. Despite being transmitted on a shared network, data is encrypted to prevent other entities from deciphering or decoding the data. People also tend to assume that a private cloud would be safer. Quite contrary to this belief, multi-tenant clouds or public clouds, in fact, offer an additional layer of security to separate internal network systems due to the very fact that they are accessed by many.
Find out if a public, private or hybrid environment will suit your business best. Ask CloudNow!
Myth 3: The cloud provider will take care of security
Having said (above) that cloud providers take security very seriously and go to great lengths to secure your cloud environment, on the other side of the aisle is another myth – that the cloud provider will handle it all.
While it is true that the provider does take some measures, there are certain aspects to protecting the security of your data that can only be handled by you. Therefore, it can be said that cloud security solutions are a shared responsibility of the provider, the customer and all the users involved.
More specifically, the security of the overall cloud infrastructure and the physical security of the servers are all responsibilities of the cloud service provider. However, when it comes down to your data, your cloud application security and your users, and how each of these interact on the cloud, the responsibility for their security lies with you.
At your end, you will need to set up a password policy, add layers of authentication for your users’ login process when they need access to sensitive data, set up your own DNS filters and restrictions – all of which have to do with your users and the way they handle your data on the cloud. Moreover, your administrators will need to handle identity management including permissions given to each of your users with regard to what they can access and how much they can do while using cloud applications. Opting for an identity and access management solution ( IAM ) like Akku can help by acting as a single sign on (SSO) platform and making password policy enforcement, multi-factor authentication (MFA) security and implementation of other security measures easier to implement.
Myth 4: Cloud security is a hassle for HR
According to a survey conducted by Cybersecurity Insiders, “staff expertise and training” were listed by 56% of respondents as the top reasons for hesitating to opt for cloud solutions. They believed that opting for a cloud SaaS would require rehiring or retraining the IT teams.
It is indeed surprising that a majority of companies believed this myth which underestimates their own teams who have managed to handle on-premise data and applications effortlessly!
Most cloud security solutions are actually extremely intuitive and user-friendly, and most of them can be managed by IT personnel through simple training and re-certification programmes.
And if you choose a cloud solutions provider like CloudNow to partner with you, your partner will be able guide you through the process.
Myth 5: Cloud and compliance don’t get hand in hand
Data breaches and violations to data privacy and other policies have caused governments to set up and enforce stringent data protection policies in order to increase the accountability of enterprises handling the personal data of citizens. And for some reason, business owners tend to believe that managing compliance issues on the cloud is far more complex than it is with an on-premise server.
However, the truth is far from that. Many cloud service providers, in fact, facilitate the process of keeping you compliant, as per the security requirements of your industry. For example, if you are in the healthcare industry and need to comply by HIPAA, then your cloud provider can help you maintain event logs for information access attempts with an intrusion detection systems (IDS).
What’s more, using an IAM solution can help you stay compliant and also ready for security audits. With a solution like Akku, administrators are given full control to customize and choose their password policies and other security features required for compliance and maintenance of security standards. The default password policy of Akku complies with the password policy requirements of industry standards such as ISO 27001 and PCI DSS and is customizable to the last detail.
Want to know more about using Akku to improve your cloud security? Visit www.akku.work or email us at sales@akku.work
Migration to the cloud is no longer an emerging trend. It is now a well-established method of running the operations of a business. With the cloud, you can manage data and applications in a secure environment and ensure that your users face virtually no latency while using your applications. But although the cloud comes with a basic framework for security, it still has its inherent security risks which need highly specific cloud security solutions to reliably protect your data.
To understand the need for implementing an effective cloud security solution, a deeper understanding of what causes and constitutes a cloud security threat is important.
Why Do You Need Cloud Security Solutions?
Unsecured Access Points
With several of your applications operating from the cloud, it is crucial to manage their access. Traditional methods of granting access to applications on the cloud require users to remember several sets of credentials. But with such a method, forgotten passwords would be common, draining the productivity of both your IT team and your users. To overcome this, users tend to set weak passwords which are easy to remember. But weak passwords are also easy to hack! The solution to this problem is to use an Identity and Access Management solution like CloudNow Technologies’ Akku.
Unprotected APIs
Application Programming Interfaces (APIs) are software interfaces which allow two different components of software to talk to each other. APIs are responsible for getting the requests from client systems and passing it onto the server and then retrieving the response and sending it back to the client. Considering that such an integral component is a part of your network architecture, a web application security solution is kept in place to eliminate the threat of unchecked network access from unauthorized users.
Types of Cloud Security Issues
DoS attack
DoS or Denial of Service is a distributed and malicious attack, designed to corrupt your servers and deny access to legitimate users. Such attacks require a complete hack of your network and injections of the attack code. A DoS attack is another common threat faced by organizations operating on the cloud. To eliminate this type of attack, it is important to maintain an intelligent firewall which can effectively stop the attack.
Data Breach
Cyber wars now directly translate to breaches and corruption of data. Since most organizations have to rely on third-party cloud vendors for storage, they increasingly feel like they are not in control of what happens to their data and applications. Data breach is one of the most common types of security threats, whether it happens on the cloud or any other type of storage. For this reason, companies have to go a step further and deploy high-end security solutions to prevent data breaches. While the move to the cloud can improve the efficiency of your operations to a great extent, it also requires you to choose a vendor you can trust to protect your network against the threats mentioned above. CloudNow’s cloud security solutions provide you with the security edge you require to peacefully conduct operations on the cloud without worrying about the threats trying to breach your network.
Using YouTube at the office is often viewed negatively, both because of it results in heavy bandwidth consumption, and in reduced employee productivity. At the same time, YouTube is a huge digital library where it is possible to access content on almost any subject.
In today’s fast-moving business scenario, YouTube is one of the best platforms to enhance knowledge and skills. While lectures and training may tend to get boring, digital learning is a great way to build interest. YouTube has an enormous range of content from various categories.
Training and development is a department for which YouTube is an essential and effective resource. Trainers can train employees with e-learning videos from YouTubeat no cost, and can also recommend videos related to their work and skills to help them perform better.
So completely blocking access to YouTube is not the right solution either, since you will end up restricting the biggest learning platform for your employees.
Providing access to or blocking YouTube tends to be viewed to be an all or nothing exercise – but there is a middle path. Implementing a YouTube filtering solution on your cloud can get you the best of both worlds.
What is YouTube Filtering?
YouTube Filtering is an interesting feature of select Identity and Access Management solutions, which can whitelist specific videos from YouTube based on categories and channels.
YouTube filtering restricts people from accessing irrelevant content on YouTube. Restricted and Moderate Restricted modes can also be activated using a YouTube filter – the Restricted mode helps to block all 18+ content from YouTube while the Moderate Restricted mode prevents employees from liking, commenting on or sharing videos.
How does it work?
YouTube Filtering works with the help of a proxy server which reads the metadata consisting of the channel name, category, channel ID, file name and so on.
For instance, when the user is searching for a video on YouTube, the proxy server will read the metadata to confirm whether the channel is whitelisted, based on which it displays the video. If the channel is not whitelisted, an error is displayed to the user that access to the video is not permitted.
Leverage the power of YouTube for your organization without worrying about the downside with Akku’s YouTube Filtering feature.
