Archive for the ‘Security’ Category

What is a Record? What is Records Management?

Record is a document or content that an organization need to keep as an evidence for an important transaction, activity or a business decision for regulatory, compliance and governance purposes. Not all documents are Records. Only a subset of documents that an organization need to preserve as an evidence are called as Records.

What is Records Management?

The ISO 15489-1: 2016 standard defines records management as “the field of management responsible for the efficient and systematic control of the creation, receipt, maintenance, use and disposition of records, including the processes for capturing and maintaining evidence of and information about business activities and transactions in the form of records”

What is Records Retention Schedule?

A records retention schedule is a document that identifies and describes an organization’s records and the lengths of time that each type of record must be retained. To give and idea ,the following section shows the general record keeping requirements of Texas State for statutory purposes. Every organization can have thier own set of record keeping requirements and records retention schedule which are dictated by industry and government compliance requirements.

      Wage and hour laws (FLSA) – while some payroll records need be kept only two years, most must be kept for at least three years under the federal law (FLSA); to be safe, keep all payroll records for at least three years after the date of the last payroll check.
      Unemployment compensation – keep all records relating to employees’ wages and other compensation, as well as all unemployment tax records, for at least four years.
      Family and Medical Leave (FMLA) – keep all payroll, benefit, and leave-related documentation for at least three years after conclusion of the leave event.
      I-9 records – keep all I-9 records for at least three years following the date of hire, or for one year following the employee’s date of last work, whichever point is reached last.
      New Hire reporting – report all new hire information within 20 days of hire.
      Hiring documentation – under EEOC rules, all records relating to the hiring process must be kept for at least one year following the date the employee was hired for the position in question; if a claim or lawsuit is filed, the records must be kept while the action is pending.
      Disability-related records (ADA) – keep all ADA-related accommodation documentation for at least one year following the date the document was created or the personnel action was taken, whichever comes last.
      Benefit-related information (ERISA and HIPAA) – generally, keep ERISA- and HIPAA-related documents for at least six years following the creation of the documents.
      Age-discrimination documentation (ADEA) – keep payroll records for at least three years, and any other documents relating to personnel actions for at least one year, or during the pendency of a claim or lawsuit.
      OSHA records – keep OSHA-related records for at least five years.
      Hazardous materials records – keep these for at least thirty years following the date of an employee’s separation from employment, due to the long latency period for some types of illnesses caused by exposure to hazardous materials.
      State discrimination laws – keep all personnel records for at least one year following an employee’s last day of work.
      IRS payroll tax-related records – keep these records for at least four years following the period covered by the records.

In the financial industry, Registered broker-dealers are subject to a variety of record-keeping requirements enforced by the U.S. Securities and Exchange Commission and self-regulatory agencies such as the Financial Industry Regulatory Authority (FINRA). SEA Rules 17a-3 and 17a-4, specify minimum requirements with respect to the records that broker-dealers must make, how long those records and other documents relating to a broker-dealer’s business must be kept and in what format they may be kept. FileCloud’s Financial Services Compliance white paper shows the retention periods of various records that Registered broker-dealers need to preserve as per FINRA rules.

How FileCloud can help you in managing your enterprise records?

FileCloud offers powerful record management and governance features that allows organizations to create flexible retention and archival policies to meet any compliance requirements. The following screenshots show how one can create retention schedules for different types of records.

Retention Policies


Create Retention Policies

Common Mistakes to Avoid With Online File Storage and Sharing

The cloud has become the standard for file storage and sharing today. There are many advantages to using the cloud. Millions of individuals and organizations across the world depend on the cloud to complete tasks and operate smoothly. However, there are also issues including security risks which can compromise the safety and efficiency of your cloud environment. In this article, we’ll look at some common mistakes that you may be making when storing and sharing your files online.

1. Failing to Upgrade Security on End-Point Device

We all know the importance of choosing a secure cloud storage platform, and we often focus on this while neglecting the security on end-point devices. This can be risky because if your device is not secure, the moment you download a file on it, there is a window for hackers to get access to that file.

It is relatively easy for individuals or small organizations to ensure the security of their devices. You simply need to have everyone in your organization install good anti-virus software and keep it updated. For large organizations, it can be costly (in terms of IT man-hours and licenses for anti-virus software) and time-consuming.

The best way to guarantee absolute security for online file storage and sharing in your organization is to choose a virtual desktop infrastructure (VDI) like FileCloud. You can choose to use our cloud storage platform or integrate FileCloud VDI into your in-house server and have your own Dropbox-like file storage and sharing platform. But it gets better, with FileCloud VDI, your employees work in a virtual environment. This eliminates the chances that your files will be compromised by poor security on end-point devices. What’s more, this is a more affordable option and it will be easier to maintain the security of your data center. FileCloud comes with a range of security tools including

2. Giving Too Many Users Admin Privilege

There is a saying that “too many cooks can spoil the stew.” Yes, this is true and you don’t have to be a master in the kitchen to know that this also applies to online file storage and sharing in an organization. The simple fact is that if too many people manage your cloud platform and have access to admin settings, there are greater chances that one of a clash in their roles. For example, one user with admin privilege can inadvertently change some vital security settings on your cloud platform, and this could put your files at risk.

One way to solve this is to limit admin access to only top excutives and IT experts in your organization. Another option is to use VDI. VDI platforms like FileCloud give you full control over the file sharing and storage processes in your organization. The level of proviledge that each indivdual gets is determined by the person’s role in your organization. You can choose to give particular people admin priviledge, you can also lock files to prevent anyone from downloading or editing them. FileCloud even allows you to access File Analytics and Reports so you know who is doing what and accessing particular files on your platform.

3. Downloading Data from a Protected Platform and sharing it via an Unprotected Route

Collaboration is the lifeblood of every organization. Every day, different people may have to work on a set of documents. Therefore, there is an exchange of data among them. It often happens that one person can download files from a cloud storage platform and choose to share it via email or even create a shared link and send it via Skype or any other communication platform. Yes, this is a convenient way to promote collaboration but it is very risky in terms of security. Hackers could access the data while it is in route or get the shareable link and go through your files.

You could make it a company policy that files are only shared via a secure cloud platform. You could also opt for a VDI platform like FileCloud which is designed with a focus on collaboration and security. FileCloud encrypts your files when they are in transit and in storage. Also, the platform is fitted with a range of tools to promote collaboration including allowing users to leave comments on files and sending notifications when a shared file has been changed.

4. Accessing Your Files from an Unprotected WiFi

We’ve all been faced with the need to access sensitive files while away from the office. Maybe you were at the coffee shop or even visiting a friend and you decide to log into your work storage platform to access particular files and quickly complete some pending work. This is understandable, but it is highly riskly. By accessing your company’s storage platform via an unprotected WiFi you’re essentially inviting hackers in. And as we have seen from hacking incidents in recent years, this could have some serious consequences.

One of the top reasons why more-and-more organizations are choosing VDI is to avoid this scenario. With FileCloud’s VDI, the safety of your company’s files is never at risk even if you access your work platform via an unprotected WiFi or you use someone else’s computer to work. This is because files are actually never downloaded; all the work happens on the VDI platform. FileCloud keeps your files protected at all times using multiple security mechanisms such as encryption, ransomware and anty-virus scanning, and Two-Factor Authentication (2FA).

Conclusion

There are many other mistakes that are frequently made in regards to online file storage and sharing. However, we have highlighted the four points above because they appear to be the most common ones.

What all of this shows is that cloud storage is not enough for enterprises. The ultimate solution is shifting to VDI. In the past, one of the things that kept companies from choosing VDI was cost. However, things have changed today. FileCloud has different pricing strategies to accommodate companies of different sizes. Whether your company is just starting out or you are a behemoth, we have the perfect VDI package for you. You can even choose to integrate FileCloud VDI into your existing cloud platforms like Amazon WorkSpaces or Microsoft Azure.

Author : Rahul Sharma

Data Privacy in A Digital Age

Privacy has always been a crucial aspect of human existence. But as more data becomes digitized, and more information is shared online, data privacy is becoming more important.  Data privacy denotes how information should be managed based on its perceived importance. It isn’t just a business concern; individuals have a lot at stake when it comes to the privacy of their data. The more you are aware of it, the better you’ll be able to shield yourself from multiple risks. In this digital age, the concept of data privacy is mainly applied to critical personal information, also refereed to as personally identifiable information (PII) and personal health information (PHI). This typically includes financial data, medical and health records, social security numbers, and even basic yet sensitive information like birthdates, full names, and addresses.

For a business, data privacy transcends the PII of its customers and employees. It also encompasses the information that helps it operate, whether it’s propriety research and development data or financial information that shows how money is spent within the company. Recent history has shown that when data that should remain private gets into questionable hands, bad things follow.

It’s a Data Driven Economy

User data is an extremely valuable asset in this information age. It not only helps organizations understand their customers, but also enables them to ‘track’ customers and target them with ‘relevant’ ads. Marketing is just one of the ways companies leverage user data to strengthen their position in the market and increase their revenues. There are other more harmful ways. In 2018, Facebook founder Mark Zuckerberg was called to testify before the United States Congress, following the Cambridge Analytica Scandal. Questioning during the hearings unearthed several details of a data privacy crisis for companies like Facebook that are dependent on data manipulation and harvesting.

More and more user groups, regulators and non-profits have begun demanding for a legally enforceable ‘right to privacy’. Speaking at a privacy conference in Brussels, Apple CEO, Tim Cook, called for improved privacy laws. At a time when the data practices of industry titans like Facebook and Google are being put into question, Cook is pushing Apple in the opposite direction, by not only talking up data privacy, but also embracing new regulations. Cook has also criticized companies that base their business models on the harvesting of personal data for advertising, while highlighting that his company tires to collect as little of it as possible.

The Service Affordability Tradeoff

Many in the tech industry are disinclined to support privacy regulations due to its potential to hold back innovation.  Mark Zuckerberg defended his company’s advertising-based model by pointing out that it enabled its services to “be affordable to everyone”. “Instead of charging users, we charge the advertisers”, he added. Google’s Senior VP for Global Affairs, Kent Walker, echoed the same sentiment by saying ads allow them to deliver search to users of all income levels across the globe for free. However, both executives also acknowledged that security and privacy has to be a principal consideration, even if it impacts profitability. Its impossible to ignore the fact that all this personal data can lead to interferences and intrusions with people’s private lives. This can have a damaging and distressing effect on individuals.

Data Privacy Should be a Basic Human Right

Though the US has relatively few regulations that govern the gathering and use of personal data, in several other places around the globe, data privacy is considered a basic human right. Within the European Union, the recently enacted General Data Protection Regulation (GDPR), sets stringent legal standards for the handling of personal data. While ‘privacy’ may sound like a nebulous concept, it’s not a new idea in human rights law. The right to privacy safeguards an individual’s dignity by protecting their personal information from public scrutiny. This right is typically protection by statutory law.

The UN’s human rights office inferred that governments should respect the right to privacy by regulating how private organizations – not just intelligence agencies and the police – treat personal data. Human rights courts have also acknowledged that the collection, use, storage, and sharing of personal data can balk privacy. Those actions should therefor be limited to what is unquestionably necessary and relative to a justifiable goal.

“All of us will have to think about the digital experiences we create to treat privacy as a human right”

– Satya Nadella, CEO of Microsoft

The GDPR Is Charting the Way

The EU enacted GDPR will improve privacy and should propel other countries to enhance the protection of people’s personal information. The new regulation that became legally binding across the EU’s 28 member states on May 25, 2018, is one of the most comprehensive and strongest attempts globally to regulate the collection and use of personal data by both the government and the private sector. Despite the fact that the GDPR has prompted multiple other nations to strengthen their cyber laws, none offer residents the right to data privacy. Courts and regulators have to work attentively to ensure that corporations and governments don’t try to exploit ambiguities in data protection laws.

Several companies have begun exploring how they can enhance the protection of users’ data and play a role in the continuing conversation about privacy as a human right. Those that are yet to do so have to develop the necessary tools and processes needed to track the source of the data they collect, making sure that data collected for a specific purpose is not exploited for another. They will also have to develop new policies outlining how data is collected and used in a clear, concise language, not legalese.

How VDI can Help Organizations be More Secure

With the rampant rate of hacking, cybersecurity is one of the top concerns for most organizations. Even cloud storage platforms like Dropbox and Apple’s iCloud have been victims of cyber-attacks.

Virtual desktop infrastructure (VDI) is ultimately the best solution for modern organizations. Today, employees don’t just work from home. Some of them also bring their own device to the workplace. This opens up a lot of loopholes that could compromise the security of an organization. While companies can enforce strict security policies like ensuring employees do not use unsecured public WiFis and always have updated anti-virus and anti-malware app on their devices, there is a possibility that some employees will not adhere to these rules.

However, with VDI, you do not have to worry about these security gaps since everything is managed centrally at the data center. What’s more, FileCloud, a file collaboration platform for VDI has in-built security tools which ensure your documents and applications are 100 percent safe at all times.

How VDI boosts security

1.There are no traces of activity on endpoint devices: One of the key features that make VDI highly secure is that nothing is stored on the device used to access the virtual desktop platform. When using VDI, your files and apps are all stored on the computer in the data center. This means, if you were to lose your device or if it gets stolen, you have very little to worry about. This feature of VDI takes away the threat that your company’s data may fall into the wrong hands if your employees are using a shared device or if they bring their own device to the workplace.

For example, if you are working at home and your device develops a fault, but you need to file an urgent report or sign some documents, you can easily borrow your spouse’s computer or even visit an internet cafe to get your work done without any security worries.

2. Encryption: Most VDI platforms provide encryption while files are in transit and storage. This guarantees that your files are always secure even if a hacker intercepts them during transfer. VDI encryption technology also ensures you are protected even if an employee in your organization chooses to use an unsecured WiFi. As a result, your employees can enjoy using public WiFi while at the coffee shop without jeopardizing sensitive documents. Even if the network is infected with malware, it is highly unlikely that it will filter into your virtual workspace.

3. Maintaining security is much easier: VDI can make the process of managing your organization’s security much easier. Usually, IT workers have to install antivirus and malware protection on each employee’s device and try (often without any success) to convince them to use only that device when accessing the company’s apps and documents. However, with VDI, the installation of security software happens only on the computer that is used to host the virtual desktop platform. This makes it a lot easier to manage and also reduces cost since you don’t need multiple licenses and your IT workers clock in less time on the job.

4. Data Security: Another security perk of using VDI is that it makes the process of backing up and restoring your data straightforward. Imagine there is a fire in an organization, the process of gathering the lost data would be tedious for IT workers. First, the data is stored on different devices. Also, there is no guarantee that each worker saved a backup of their files, so it is a hit-or-miss situation. With VDI, it is an entirely different story because the process of backing up files happens at the data center. This means you can always restore lost files.

How FileCloud keeps your files secure

The following are some of the ways that FileCloud keeps your data and apps protected.

A. Encryption: FileCloud also encrypts your files – while at rest and during transmission. At rest, your files are protected with AES 256-bit encryption. In transit, files are encrypted with SSL/TLS. This guarantees complete protection of your data at all times.

B. Ransomware Protection: The FileCloud VDI ecosystem comes with ransomware protection. Each file uploaded to your virtual desktop is scanned for ransomware. If any malicious software is found in the data, it is blocked before it can launch and compromise your system.

C. Anti-Virus: FileCloud does not only provide ransomware protection, but also antivirus protection. You can integrate your antivirus software into the VDI platform. All files are automatically scanned before they are uploaded to your virtual desktop. FileCloud supports Internet Content Adaption Protocol (ICAP) antivirus scanning.

D. Two-Factor Identification: Two-factor identification adds another layer of security when you are signing in to FileCloud using email or Google Authenticator. The extra security protocol ensures that no unauthorized person can gain access to the files and apps on your virtual desktop.

E. Single Sign-On (SSO): FileCloud also supports SSO. This does not only improve user experience but also strengthens the security of your virtual desktop. SSO reduces the chances that your login credentials can be compromised. Also, since you need just one login identity, you do not have to juggle your memory to remember different usernames and passwords or downgrade the complexity of your user ID to make it easily memorable.

F. Backup: FileCloud allows you to backup and restore files regardless of the type of device you are using. This means you never have to lose any file again. You can even recover files that are deleted accidentally.

G. Remote Delete: In the unlikely circumstance that an employee loses his/her computer while it is still signed into your virtual desktop platform, FileCloud allows you to wipe files or block access remotely. This means all the worker has to do is report the device stolen and request that access is blocked.

Conclusion

If you are still wondering how to solve your organization’s security issues, the apparent answer is VDI file sharing solution, FileCloud. This technology revolutionizes the working environment and makes many of our current security concerns a thing of the past. What’s more, it also has the potential to boost productivity and allow organizations to cut cost.

Author : Rahul Sharma

Everything You Needed to Know About Selecting the Perfect Encryption Solutions

The recent spate of malware, phishing, and of course, ransomware attacks have put the entirety of the IT industry on high alert. Businesses are paying more attention to security than ever before, and it’s no longer about getting a random encryption solution and being done with it. Far from it, encryption is only the beginning of a long but rewarding process of shielding your systems against the rising tide of virtual threats. Encryption by itself achieves nothing; you need to adopt several other steps and activities to keep your data far out of reach of hackers and other malicious entities.

Never Underestimate the Importance of Backups

The first thing you should realize is, encryption is a double-edged sword. On the one hand, there are hundreds of ways for your data to become compromised, so you can’t afford to be lax. On the other hand, if implemented incorrectly, the encryption process might just lock you out and prevent access to your own data. That’s why you should always remember to back up all your vital data. As an added precaution, take suitable measures to protect the backup data.

Different Kinds of Data Have Different Encryption Requirements

While on the subject of data protection, you must learn to distinguish between data in motion and data at rest. The former is the type of data that is accessed regularly or being sent. Data at rest, on the other hand, isn’t accessed, such as the files that are burned onto a CD and left on the shelf. Your primary target should be the encryption of data in motion from any user who is not authorized to access that information. However, you should not neglect the data at rest entirely because you never know when it might become data in motion. Use encryption to minimize risks.

Find Out What Data Encryption Works Best For You

Usability, scalability, and adaptability – these are the three things every good encryption solution should aspire to provide to users. After all, the needs and wants of every business are different, which means the encryption solution must have the ability to fit those parameters. When the needs change, the encryption must cope with the changes as well. Thankfully, we now have lots of encryption solutions that are flexible enough to fulfill your requirements. Also, the encryption solution chosen must not take up a lot of time during implementation and should be easily understandable. Otherwise, the usability of the strategy takes a hit in the long run and makes everyday usage difficult.

Have a Fixed Budget in Mind

Unless you’re one of the high rollers of the IT industry, like Apple and Amazon, chances have you don’t have an unlimited encryption budget. So, what you need are ways to trim costs without having to sacrifice data protection quality. For instance, your business would do better to pick an encryption solution that is scalable, meaning you would have the opportunity to add new features, if necessary.
True, a scalable encryption solution costs more upfront, but think about it: Would you rather spend some extra money now on an adaptable solution, or keep on upgrading and renewing your program on a regular basis?
Plus, keep in mind that encryption solutions are available as perpetual licenses with annual support and maintenance costs, or as subscription licenses that offer more financial flexibility and provide the opportunity to manage costs. So, pick the model that suits your business needs the best.

Select the Right Encryption Level for Your Business

The complexity of deployment and security increases when encryption is implemented higher in the technology stack. At higher levels, it is possible to break out of data encryption types according to where they are employed in the technology stack. Four levels exist in the technology stack whereby data encryption is normally employed, viz. database, file system, application, and media or full-disk. The way it works is, encryptions employed lower in the track trend to have simpler and less intrusive implementations. But the types and numbers of digital issues that can be addressed by these data encryption strategies are also decreased. But employing the encryption solution higher in the stack enables organizations to achieve greater security and contend with bigger threats.

Do Not Pick Something Overly Complicated

When you first approach an encryption solutions provider, you will hear a lot of fancy words being thrown around, like “complex password rules”, “crypto algorithms”, and “granular configuration options”. Unfortunately, most of these features have no meaning unless you know how to wield them properly. And that means providing costly consulting services and training for your employees. Moreover, several advanced solutions possess high requirements when it comes to system environment needed for operating the software. Others rely on existing, rolled-out PKI (public key infrastructures).
You need to clarify all these points before you invest a lot of money on the solution. Pay attention to multiple factors, including support for workgroups, central administration options, impact on existing user workflows, power divide between a security officer and system administrator, straightforward configurations, and emergency recovery in case of accidental key loss.

The thing is, you should never allow yourself to be waylaid by flashy technical gimmicks; always keep your eyes on the prize, which in this instance, is the perfect encryption solution for your business. Always go for the product that you think will be suitable for daily use in the long run.

The abovementioned points might not explicitly state the perfect encryption solution, but reading them can help you take a step in the right direction. They should provide you with more insight and help you formulate a more personalized strategy. Ideally, companies want encryption solutions that fit the needs of their business and ward off data attacks from all quarters without putting a huge dent in their budget. That might sound like a tall order, but considering the current state of digital affairs and the growing intensity of online threats, it is worth spending time and money to find a solution that meets all the criteria.

A Brief Overview of Threat Intelligence

In this volatile age of cybersecurity, the remaining constant has been the accelerating flood of crafty attack techniques that render organizations incapable of safeguarding the sensitive data in their care – be it attacks involving social engineering, malware, or any other advanced persistent threat. Threat intelligence, also referred to as cyber threat intelligence (CTI) is a sophisticated process that enables organizations to collect invaluable insights into contextual and situational risks that can be tied to the organization’s specific industrial processes, markets, and threat landscape.

The prime purpose of threat intelligence is to aid organizations in attaining a deeper understanding of the risks associated with recurrent and parlous external threats. Though threat actors may also include partner and internal (insider) threats, the emphasis should be on the types that will have the largest impact on the organization’s environment. The goal of threat intelligence is to gather indicators of compromise from varying sources, correlate them, and provide real-time analysis of security alerts so that it can be continuously monitored and examined by security analysts, who will be better equipped to take the right remediation steps.

Threat intelligence plays a key role in today’s cybersecurity landscape, and it has to be properly understood by IT admins working in the different domains of cybersecurity, especially those that work closely with incident response teams.

Stronger Together – A Case for Information Sharing

In a fast-paced digital economy, speed and efficacy are imperative. This means that the amount of data networks manage has exponentially increased, along with the number of devices connected to those networks. Enterprises cannot protect what they cannot see. So in addition to integrated security devices and increased performance; there should be a holistic approach that capitalizes on the value of threat intelligence and detects threat events from the vast volumes of available data. Threat intelligence collected from multitudinous sources, then processed and correlated, is the most valuable, effective, and actionable.

This ‘higher-level’ intelligence has historically been out of the reach of most organizations. In an attempt to bridge this gap, Fortinet along with Symantec, Palo Alto Networks and McAfee formed the Cyber Threat Alliance (CTA). CTA has since been established as an independent organization whose sole mandate is to provide security professionals with the technology and intelligence they require to identify an attack.

Crippling the Kill Chain: The cyber kill chain refers to the multi-phase process of how intruders launch their attacks. To win the battle against the intruder, organizations have to disrupt just one of those steps. CTA helps reduce time to detection by providing near real-time, high-quality cyber threat information sharing and operational coordination between the organization in the cybersecurity field. By utilizing contextual information about the attack – such as the way attackers stole credentials and sensitive data, or the malware being used, organizations are able to get an upper hand, even if the hackers have already compromised the network.

Moving Forward With Threat Intelligence

Coupling the capabilities of threat intelligence with an organizations hardware, software, and policy defense strategy improves the staff’s ability to look for advanced attacks, detect potential intruders, and profile aberrant malware. Current practice mostly involves sharing indicators of compromise (IOCs). As the community matures, the next step should be sharing more context to inform better decision making and direction on a defensive action plan. In order to achieve the promise of threat intelligence, organizations have to tackle and conquer their hesitancy to share information by maturing and expanding their circles of trust.

The cybersecurity industry still has to address the lack of funding, isolated security solutions, scanty correlation of threat data, and the growing shortage of qualified cybersecurity professionals. The end-game should be the automation of cybersecurity processes where possible, freeing up the finite pool of human InfoSec talent for more challenging tasks. Strides are being made in creating machine-learning and data science models that are capable of evaluating network traffic based on the collective knowledge of all previous external and internal threats to verify discrepancies that may evolve into threats.

In Closing

Enterprises solely rely on IT security risk management methods in an attempt to focus on security controls, but these methods have not evolved enough to effectively manage risk. To defend against modern attackers, enterprise security solutions have to be adaptable enough to include new techniques that enhance decision making. Adding threat intelligence to a security solution, whether via a service provider or an internal capability, helps organizations prioritize their security activities and focus on the areas that are likely to prevent attackers.

By using the right methods to identify, handle and prevent these issues, the cost of addressing these problems can significantly be reduced. With a healthy mix of threat intelligence, behavioral threat detection, and endpoint device monitoring, organizations can position themselves to stop intruders in their tracks and expel them from the network if they manage to get in.

 

Author: Gabriel Lando

The Importance of Endpoint Security in a Mobile-first, Cloud-first Era

The number of client devices within the enterprise has rapidly increased – endpoints such as tablets, smartphones, laptops and desktops. A single employee may have two or more endpoints that have been issued by the organization, on top of their personal devices. Multiply this by the number of end-users in the organization and the number of endpoints IT has to manage instantly becomes overwhelming. Each of these endpoints represents a point of multiple attacks against the organization’s network, systems, and sensitive data. Securing these endpoints from today’s threats calls for a mix of anti-malware capabilities and a high level of behavioral-based detection and visibility. This is where endpoint security comes in.

While the exact definition may vary among thought leaders in the cyber security space; in a nutshell, endpoint security refers to the process of ensuring that the risks presented by endpoints connected to a network – end-user devices are secured. Though often used interchangeably with endpoint security, the term endpoint protection can be used to describe the security solutions that addresses these risks. By equipping itself with these solutions, the organization has a chance to detect threat actors that use evasive tactics, and reduce the amount of time it takes to handle attacks and minimize the resulting damage.

The Current State of the Market

The online threat landscape is constantly evolving. There has recently been a lot of fuss concerning ransomware due to the rise in malware attacks. The new technologies used by hackers to penetrate systems require a different approach to prevent infection. Risk management and security leaders have to make sure that their enterprise protection platform (EPP) vendor evolves quickly enough to keep up with modern threats. Gartner describes an EPP as a solution deployed on endpoint devices to prevent file-based malware attacks, to detect and stop malicious activity from untrusted and trusted applications, and to offer the investigation capabilities required to respond to security incidents and alerts.

From Gartner’s recent Magic Quadrant for EPPs, we notice that the market listing criteria rose, and now needed to demonstrate even more capability beyond previous core technology offerings. A 2017 Sophos sponsored research study showed that 77 percent of surveyed ransomware victims running up-to-date endpoint security found out the hard way that they needed specialized protection. Following the high-profile Peyta and WannaCry outbreaks in 2017, a whopping 98 percent agreed that having additional technologies such as anti-ransomware technology on the endpoint is important.

Though not all attackers rely on malware, they remain prolific, and keep pounding endpoints relentlessly. The barrage of attacks has also been augmented by a growing number of more complex threat activity. These attacks often use modified or specialized tradecraft to bypass traditional security controls like antivirus and firewalls. Endpoint Protection Platforms surpasses the mere prevention of malware attacks, with data protection capabilities such as data loss prevention, file and disk encryption, and even device control for the most exhaustive endpoint protection possible.

Facing The Mounting Endpoint Security Challenges

Ruminating on the WannaCry ransomware attacks, some companies that were affected by it had the most recent operating system, just not the latest patch. This attack accentuated the perilous reality of outdated systems and the widespread nature of anachronistic technology that most companies are struggling with. When new vulnerabilities are identified, IT has to swiftly query endpoints to comprehend which devices pose the greatest risk and establish their level of exposure. After a remediation plan is established, security personnel should closely collaborate with infrastructure teams to make sure highest priority patches are rolled out as efficiently as possible to block the exploitation of these new vulnerabilities.

Endpoint landscapes are constantly evolving, and it’s no secret that keeping up with the changes can be arduous. End users perpetually download applications that haven’t been sanctioned by IT, some which may contain harmful malware. Application and operating system patches are hard to prioritize and aren’t always applied successfully the first time, especially on roaming or remote endpoints with inconsistent corporate network activity or low bandwidth. The hard truth is that endpoint management is a constant battle. That’s why you have to have a solution that allows you to manage, discover and secure your endpoints faster, more consistently and more easily.

Critical Components of Endpoint Protection

Visibility – Securing endpoints calls for round the clock visibility into the activities occurring on those endpoints. Preventing attackers is less about signature-based detection and more about spotting malicious behavior. Understanding the actions attackers took when they penetrated the network is crucial for an organization to enhance its security posture after a breach.

Threat Intelligence – mainly involves gaining insight into potential attackers, their motivations, and their techniques. The more organizations focus on signs of malicious activity, the easier it gets to prevent those that would have, otherwise, slipped under the radar. Threat intelligence allows the enterprise to see the larger picture.

Endpoint Encryption – fully encrypts sensitive corporate data on endpoints, including mobile devices, laptops and other endpoints, as well as individual files, folders, and removable storage devices like thumb drives and CD’s.

Endpoint data loss prevention (DLP) – monitors and protects network traffic when the endpoint is on a remote network, ensuring sensitive data stored on the endpoint is kept safe. It also tracks other usage like cutting and pasting between apps, or even moving a file to a portable storage.

Enterprise mobile device management (MDM) – allows IT admins to secure, control and enforce policies on tablets, smartphones and other endpoints. Enterprise MDM is essentially a suite of security controls that protects sensitive data on an endpoint.

 

Author: Gabriel Lando

Key Aspects of an Identity Access Management (IAM) Strategy

In today’s technology driven business climate, employees require fast and simple access to data and other IT resources to complete their work. Access to these resources have to be tracked and protected to guarantee security and compliance with stringent IT regulations. As a result, IT admins have to deal with a growing number of challenges: assisting users with password issues, managing access to data and applications, provisioning users across multiple platforms, and more. Identity Access Management (IAM) facilitates the secure access of IT resources and services.

IAM ensures that users are who they say they are (authorization) and that they are capable of accessing the resources and applications they are permitted to use (authorization). Its an integration of work flow systems that necessitates organizational think tanks who analyze and make security systems work efficiently. Processes, protocols, procedures and policies are linked to IAM. Security and identity applications are also crucial considerations.

Applications and standards of IAM include singular sign-on (SSO), various application accesses, the maintenance of user life cycles, multi-factor authentication (MFA), as well as a directory for securely storing profile and identity data and data governance to ensure that only relevant and required data is shared. IAM solutions can be deployed on premises, offered by a third party via a cloud-based subscription model, or a hybrid IT model comprising of an amalgamation of both.

Trends that have solidified IAM

Mobile Computing

Mobility is an important part of a modern enterprise. Organizations have adopted the bring-your-own-device (BYOD) approach to provide remote access to corporate data and business applications. IAM is a solid enabler of mobile computing and acts as a key component in mobile computing security. To enable these devices to access the organizations’ resources efficiently and quickly, mobile devices have to utilize identification mechanisms that validate and/or verify the user. As a result, confirming the identity of a mobile device user
safely facilitates the users access to business applications anytime, anywhere.

Cloud Computing

The rising demand of cloud computing services has made the IAM landscape more complex since control over access to corporate data is difficult to sustain in such an environment. The adoption of cloud computing solutions has resulted in a decreased reliance on network access controls and an increased reliance on logical controls provided by IAM services. These services facilitate the secure access of apps hosted on the cloud, while managing identities, including protecting personally identifiable information (PII). Managing virtual resources in a cloud environment calls for increased rights that when compromised, may grant attackers the ability to commandeer valuable targets in the cloud.

Social Media

The world is more connected that it has ever been, and social media is at the helm of if it. Organizations use social media to interact with clients and boost brand awareness; however, there are some resultant IAM risks that come with these technologies. Public relations, operations, and regulatory compliance are at the top of the list of potential social media risks. On top of using IAM to protect company-owned social media accounts, employees should also be educated on the importance of using social media with caution.

Data Loss Prevention

In this digital age, data is the lifeblood of the organization. IAM is the first line of defense when protecting said data. Data loss prevention (DLP) is a complimentary information security discipline that can be improved when leveraged with IAM capabilities. IAM provides identity context to DLP tools to enhance monitoring capabilities. Controlling access to data reduces the likelihood of a data loss incident – limiting users with access to data results in fewer opportunities for data to be intentionally or inadvertently compromised by an external or internal user.

Stringent Compliance Requirements

Several governments require enterprises to pay close attention to identity management. Regulations like HIPAA hold companies accountable for controlling access to employee and client information. The most recent regulation that demands strong user access controls and security is the General Data Protection Regulation (GDPR). It mandates that organizations safeguard the personal data of EU citizens. Complying to these government regulations calls for the automation of several aspects of providing secure user access to data and enterprise networks. IAM systems relieve IT of monotonous but crucial tasks and help them stay in compliance with strict government regulations.

A properly implemented IAM strategy can help an enterprise deal with the first pace of emerging technology trends. Below are some of the key aspects that should be included:

1. People are at the center of it

The most important stakeholder affected by an IAM strategy is the user. End users can make or break your security. Security is crucial but so is convenience. Significant efforts have to be made towards streamlining the process of accessing business data or applications. Authentication steps should be limited as much as possible. When the process of accessing emails or account portals seems to tedious or too long, people may seek quicker alternatives, inadvertently limiting the efficacy of your security controls. IAM solutions shouldn’t be exclusively used to control access by employees to business resources; a holistic IAM strategy should include identity and access management solutions for their clients.

2. It is Constantly Being Iterated

IT is continually evolving, but the speed of change in how companies off all sizes operate and interact has never been more frenetic. At its core, IAM aims to associate all activities within an environment with specific device or user and report those activities. The best IAM strategies are constantly being iterated. Scopes and requirements have to be reaffirmed and success metrics have to be redefined, by accessing the current state of the strategy, and defining its future state. Comprehensively auditing current processes and practices on a regular basis provides insight into exactly what types of systems are used by employees to transfer and share information.

3. Compliance is a top consideration

Current regulations governing the transmission and use of data are the direct result of State and Federal governments, and industry alliances attempting to stifle the threat of data theft. Its crucial to ensure that compliance guidelines and risk management are built into the identity management strategy. Privacy management and data access governance is an important aspect of IAM. It controls who is capable of accessing user data and how they can share or use it. This means that organizations can be sure to meet the growing requirements of changing industry and global data privacy regulations like the General Data Protection Regulation (GDPR).

4. It Leverages Cloud Computing

Adding identity and access management tools to existing on-premises solutions is seldom secure or efficient. Since applications, devices and networks all support varying protocols; this approach typically results in a contrasting collection of homegrown IAM solutions that lack centralized controls, compromising the entire layer of identity controls. Cloud based Identity and Access Management-as-a-Service (IDaaS) can simplify even the most complex user management challenges. It not only facilitates the rapid rollout of new capabilities, but also solves the issue of finding and hiring security personnel with the skill to support on-premises IAM solutions. Some cloud-based IAM solutions can benefit from include: Directory service, Single sign-on (SSO), Multifactor Authentication (MFA), OpenID connect (OIDC), OAuth, Security Assertion Markup Language (SAML) and other standards and protocols for the exchange of authorization and authentication.

5. It’s an Impetus for Collaboration

IAM systems foster collaboration by breaking down the barriers to access for employees, allowing them to work and safely share information across the organization. By utilizing authentication standards, IAM lays the groundwork to carefully share identity information across a variety of mobile applications, on-premises apps, and SaaS tools without compromising security. This expediency and ease of use will likely drive collaboration throughout the organization, enhancing employee satisfaction, productivity, research and development, and revenue.

Everything You Needed to Know About Selecting the Perfect Encryption Solutions

The recent spate of malware, phishing, and of course, ransomware attacks have put the entirety of the IT industry on high alert. Businesses are paying more attention to security than ever before, and it’s no longer about getting a random encryption solution and being done with it. Far from it, encryption is only the beginning of a long but rewarding process of shielding your systems against the rising tide of virtual threats. Encryption by itself achieves nothing; you need to adopt several other steps and activities to keep your data far out of reach of hackers and other malicious entities.

Never Underestimate the Importance of Backups

 

The first thing you should realize is, encryption is a double-edged sword. On the one hand, there are hundreds of ways for your data to become compromised, so you can’t afford to be lax. On the other hand, if implemented incorrectly, the encryption process might just lock you out and prevent access to your own data. That’s why you should always remember to back up all your vital data. As an added precaution, take suitable measures to protect the backup data.

Different Kinds of Data Have Different Encryption Requirements

 

While on the subject of data protection, you must learn to distinguish between data in motion and data at rest. The former is the type of data that is accessed regularly or being sent. Data at rest, on the other hand, isn’t accessed, such as the files that are burned onto a CD and left on the shelf. Your primary target should be the encryption of data in motion from any user who is not authorized to access that information. However, you should not neglect the data at rest entirely because you never know when it might become data in motion. Use encryption to minimize risks.

Find Out What Data Encryption Works Best For You

 

Usability, scalability, and adaptability – these are the three things every good encryption solution should aspire to provide to users. After all, the needs and wants of every business are different, which means the encryption solution must have the ability to fit those parameters. When the needs change, the encryption must cope with the changes as well. Thankfully, we now have lots of encryption solutions that are flexible enough to fulfil your requirements. Also, the encryption solution chosen must not take up a lot of time during implementation and should be easily understandable. Otherwise, the usability of the strategy takes a hit in the long run and makes everyday usage difficult.

Have a Fixed Budget in Mind

Unless you’re one of the high rollers of the IT industry, like Apple and Amazon, chances have you don’t have an unlimited encryption budget. So, what you need are ways to trim costs without having to sacrifice data protection quality. For instance, your business would do better to pick an encryption solution that is scalable, meaning you would have the opportunity to add new features, if necessary.

True, a scalable encryption solution costs more upfront, but think about it: Would you rather spend some extra money now on an adaptable solution, or keep on upgrading and renewing your program on a regular basis?

Plus, keep in mind that encryption solutions are available as perpetual licenses with annual support and maintenance costs, or as subscription licenses that offer more financial flexibility and provide the opportunity to manage costs. So, pick the model that suits your business needs the best.

Select the Right Encryption Level for Your Business

The complexity of deployment and security increases when encryption is implemented higher in the technology stack. At higher levels, it is possible to break out of data encryption types according to where they are employed in the technology stack. Four levels exist in the technology stack whereby data encryption is normally employed, viz. database, file system, application, and media or full-disk. The way it works is, encryptions employed lower in the track trend to have simpler and less intrusive implementations. But the types and numbers of digital issues that can be addressed by these data encryption strategies are also decreased. But employing the encryption solution higher in the stack enables organizations to achieve greater security and contend with bigger threats.

Do Not Pick Something Overly Complicated

 

When you first approach an encryption solutions provider, you will hear a lot of fancy words being thrown around, like “complex password rules”, “crypto algorithms”, and “granular configuration options”. Unfortunately, most of these features have no meaning unless you know how to wield them properly. And that means providing costly consulting services and training for your employees. Moreover, several advanced solutions possess high requirements when it comes to system environment needed for operating the software. Others rely on existing, rolled-out PKI (public key infrastructures).

You need to clarify all these points before you invest a lot of money on the solution. Pay attention to multiple factors, including support for workgroups, central administration options, impact on existing user workflows, power divide between a security officer and system administrator, straightforward configurations, and emergency recovery in case of accidental key loss.

 

The thing is, you should never allow yourself to be waylaid by flashy technical gimmicks; always keep your eyes on the prize, which in this instance, is the perfect encryption solution for your business. Always go for the product that you think will be suitable for daily use in the long run.

 

The abovementioned points might not explicitly state the perfect encryption solution, but reading them can help you take a step in the right direction. They should provide you with more insight and help you formulate a more personalized strategy. Ideally, companies want encryption solutions that fit the needs of their business and ward off data attacks from all quarters without putting a huge dent in their budget. That might sound like a tall order, but considering the current state of digital affairs and the growing intensity of online threats, it is worth spending time and money to find a solution that meets all the criteria.

The Changing Face of Data Governance

In our age of data-driven decision making, the new GDPR laws have once again brought the criticality of data governance to the forefront. Believed to be one of the most extensive revisions to the European data protection and privacy legislation, GDPR and its associated changes have presented businesses with the unique opportunity to organize their data houses.

So, executives should consult with experts familiar with GDPR on its impact on their operations. Businesses need to get used to the idea of handing over control of the data they share with people; only then can they achieve GDPR compliance and establish a better rapport with customers. But how does data governance figure into all this? Find out below:

 

 

Shortcomings in Traditional Data Governance

 

 

There’s nothing wrong with traditional data governance; in fact, it offers a rigorous and strategic framework for designing outline roles, data standards, and responsibilities, along with procedures and policies for data management throughout the organization. What’s more, without traditional data governance, businesses wouldn’t have been able to increase their efficiency and productivity in the use of core business data resources in data and transactional warehousing environments.

The focus of these methods was on data quality, trust, and protection, and they were great for recognized data sources that had known value. However, the modern industry is full of unstructured or unknown data sources like IoT and big data, and traditional data governance just can’t keep up. With the added features of machine learning and artificial intelligence, the shortcomings of the conventional approach are becoming obvious.

Owing to their rigid structure, conventional data governance procedures and policies hinder the possibilities formed by advanced analytics and data technologies by forcing them to fit the age-old mould for legacy infrastructure and data platforms.

 

 

Impact of Emerging Technologies

 

 

IoT provides thousands of unrelated data sources a chance to connect on the same platform. IoT gadgets are more than just data source; they are data generators and gatherers. Sensors, wearable devices, and other modern computing technology can accumulate data by the millisecond and stream the same data into a cloud of possible consumers.

Artificial intelligence and machine learning systems analyze the data in real-time to identify relationships and patterns, gain knowledge, and plan a suitable course of action. While these are data-based autonomous actions rather than explicit instruction or programming, they possess the power to find gaps or extra data requirements and send requests back to the IoT gadgets for collecting or generating fresh data.

Traditional data governance makes the onboarding of IoT devices very difficult because of conventional authorization and validation needs. To foster machine learning and artificial intelligence in these initial stages, the data lifecycle must rely on non-conformity with predefined standards and rules. So, governance must allow new data to be incorporated quickly and efficiently, and offer mechanisms to mitigate dangers, maximize value, and encourage exploration.

 

AI and IoT under the New Data Governance Methods

 

Concepts like IoT and AI aren’t new but they are still highly competitive markets for businesses. While the two undergo expansion, they tend to hypercharge the growing volume of data, especially unstructured data, to unexpected levels. As a result, the volume, velocity, and variety of data increase in unison. And as the volume rises, so does the speed and velocity at which data need to be processed. In such cases, the types of unstructured data increases as well. To manage all this, businesses have to implement the necessary data governance.

Storage and Retention

Big data has increased the variety and volume of data considerably, which means more data storage is a necessity. Data storage and data integration and provisioning are used interchangeably, but they are very distinct. Governance must address them separately and appropriately. While storage normally means the way data is physically retained by the organization, in conventional data management methods, the data storage technology impacts the storage requirements like size and structural limitations. Along with retention practices and budget limitations, often dependent on compliance, these needs restrict the amount of data stored by the business at a certain time.

 

 

 

Security and Privacy

 

 

Security and privacy are the major areas of focus for conventional data governance. But new technologies expand the scope of what needs to be secured and protected, emphasizing the need for additional protection. Even though “privacy” and “security” are thought to be one and the same, they are not.

Security strategies safeguard the integrity, confidentiality, and availability of data created, acquired, and maintained by the company. Security exclusively means protecting data, while privacy is more about protecting entities, like individuals and businesses. Privacy programs make certain that the interests and rights of an individual to control, use, and access their private details are protected and upheld. However, without a successful security strategy, a privacy program is unable to exist. Privacy needs often inform policies in large-scale security operations, but the program itself influences the processes and technology need to implement the necessary controls and protection.

As far as IoT is concerned, security is one of the most crucial aspects. The regular addition of systems and devices constantly leads to new vulnerabilities. Even though business comes first, protection is possible only if they protect and secure the network along with every touch point where data travels. Thanks to IoT, data security isn’t just about permissions and access on a given system. Data protection now incorporates network segmentation, data encryption, data masking, device-to-device authentication, cybersecurity monitoring, and network segmentation. That’s a whole lot more than what traditional governance programs envision.

 

Escalated Digital Transformation

 

The changes in digital transformation will be far-reaching. In fact, the new data governance measures will accelerate the process, thereby rewarding organizations that commit to more than just compliance with data governance. Moreover, a stronger foundation in the field of data governance will provide organizations with various benefits, such as increased operational efficiency, decision-making, improved data understanding, greater revenue, and better data quality.

Data-driven businesses have long enjoyed these advantages, using them to dominate and disrupt their respective industries. But it’s not just meant for large businesses. The moment is right, for your company to de-silo data governance and treat like a strategic operation.

Data governance is changing, and you need to work hard to keep up or get left behind in the industry. However, you can follow the tips given below for the best health and ensure your company is prepared for GDPR.

 

Author : Rahul Sharma