Cybersecurity Archives

How to Counter the Insider Threat to Stay HIPAA Compliant

Published

Written by

Filed under

The insider threat security risk is a prevalent challenge to the healthcare industry, not just in the US, but globally. A study by Verizon in 2018 suggested that more than half of healthcare breaches were caused by the insider threat, and in 2019 this figure was 34%. Although there has been some improvement, these figures are still worryingly high compared to other industries.

US healthcare organizations have become a prime target for hacking communities, not because they have weak security, but because the data they protect has considerable value. HIPAA compliance was created to ensure mandatory safeguards were being observed to reduced this risk. Some of the biggest risks to healthcare IT are ransomware (malware), poor security management (eg. weak passwords), and the insider threat.

According to the Ponemon Institute, insider threats are defined as “ a careless or negligent employee or contractor, a criminal or malicious insider or a credential thief”. There was a staggering 4,700 reported insider security breaches in 2020. It is likely the real figure is much higher than this because non-healthcare industries are not bound by regulation to disclose this information.

What causes insider data breaches?

Not all insider actors intentionally seek to damage the healthcare institution they work for, and there are many different reasons why confidential information may have been leaked. The breach could be the result of human error. Everyone makes mistakes, and it is possible that employees rushing to meet deadlines may inadvertently share protected health information (PHI) – perhaps they emailed the wrong client.

Other personnel might simply not be aware that sharing PHI is considered a breach of HIPAA regulations. The accidental sharing of PHI may have been triggered by inadequate training, or non-compliant security tools, such as an email client missing email encryption protection.

That being said, employees may also deliberately leak information to harm their employers, such as sharing confidential data with rival healthcare practice. Some may steal it for personal financial gain, others may do it to demonstrate known internal security risks, almost acting like a vigilante for the greater good.

Other risks might include employees transferring confidential information to a new employer when they move jobs, either deliberately or not. Some employees have been discovered leaking data to cybercriminals, or even selling data to a competitor. There is also a risk when employees share data on their personal devices, for example, emailing themselves, copying files to their phone, etc. Something that may seem innocent is a major breach of HIPAA compliance.

Why is healthcare a target?

Healthcare is a heavily regulated industry. HIPAA compliance was introduced in 1996 to protect the integrity of protected health information (PHI), essentially any data that can be used to identify an individual. There have been subsequent amendments to the rules as technology has evolved, notably the Security and Privacy rules of 2003, and the Final Omnibus Rule of 2013.

These safeguards are enforced by the U.S. Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR). The rules are designed to protect the patient data, any personally identifiable information such as personal addresses, bank accounts, payroll numbers, insurance information, and so on.

If any of this data got into the wrong hands it would likely cause much distress to the victim, and potentially have significant ramifications to the healthcare organization at fault. The impact of a data breach will likely cause substantial reputational damage, a loss of customers, deep financial losses to remediate the problem, and perhaps a loss of intellectual property.

What can be done to counter this threat?

The Ponemon Institute identified three key areas for Insider threat management. These are a “program that combines people, processes, and technology to identify and prevent incidents within the organization”.

Healthcare organizations and their business associates have a joint responsibility to protect PHI. Outsourcing key technology to a HIPAA compliant hosting partner is an easy win to secure PHI. Leveraging a provider’s hosting service that is built to the highest specifications, to meet and exceed the administrative, physical, and technical safeguards of HIPAA will help to create a secure ecosystem that will greatly reduce the risk of human error.

Safeguards that can track, trace, and report upon unexpected user activity and monitor user behavior analytics. Organizations must create access controls based upon the principle of least privileged, introduce strict access control management, and operate privileged access management (PAM) to servers or databases that contain restricted information. This is usually a Multi-Factor Authentication (MFA) service, similar to what you might use for online banking.

Threat detection platforms, such as an intrusion protection system (IPS) can be used to scan networks for suspicious activity and monitor network traffic for intelligent data loss prevention (DLP). Detailed logging capabilities introduce security incident and event management operations, and procedural incident response safeguards should be in place, explaining how to react if any threats are identified.

Moderate monitoring and surveillance should be conducted on employee activity, this is not a big brother scenario, instead of having checks and balances in place that can be called upon if needed. For example, detailed logging can be used to track system administrator activities, this is common practice within the industry, warnings are often displayed directly to users upon logging into a business domain using a customized interactive message.

Any investigation into insider threats can easily identify the culprits. Each user has a unique login, and event logging on servers is so detailed, it is easy to work out user activity. If suspicious activity is suspected, the appropriate escalation paths should be available within the organization to report to.

If an insider has breached information then it is important to have containment and remediation planning in place. This could be as simple as changing passwords on a user account, or it could mean powering down part, or all of a production system, or even invoking disaster recovery, which is one of the key requirements of HIPAA for this very reason.

Employees of business associates should receive regular training on data security and compliance, training is one of the best ways to protect healthcare organizations. Most breaches are not malicious and are usually the result of an honest mistake. This can be countered by offering regular employee training.

Each employee is the first line of defense, and they have a duty to uphold HIPAA regulations. Therefore the employer must ensure adequate training is provided as well as refresher courses.

To summarize, the insider threat is definitely a threat to be taken seriously by healthcare organizations, but studies have shown that the bad actor does not always breach information on purpose. Most data breaches are accidental and human error. Human error can be addressed by debriefing employees on the incident and offering training to ensure mishaps do not happen in the future.

We understand that rogue insiders do exist, but certainly to a lesser scale. The only way this can be improved upon is to firm up the selection process when hiring employees, offer ethics and security training, and ask managers to keep an eye on their employees. It would be ethically wrong to closely monitor all employee activity as trust must always exist to create a productive working environment.

The best way to counter the insider threat is to outsource healthcare IT systems to a HIPAA compliant hosting partner. Both organizations work together to secure the platform, and the business associate has a duty of responsibility to hire diligent and trustworthy employees.

Read More from this Author

If you enjoyed this article, you'll probably like:

The SolarWinds Hack: Resources and Guidance from Cybersecurity Experts

Blog Post / By John Headley

Published

Written by

Filed under

News broke to the public on Sunday, December 13th, that the SolarWinds Orion network monitoring platform had been hacked. In this sophisticated attack, SolarWinds Orion software updates had been trojanized to deliver malware, now called SUNBURST, into servers hosting the SolarWinds Orion software. Using this compromised server, the attacker is then able to move laterally in the network to compromise other assets and perform data theft.

Attack-at-Scale

This attack is part of a global intrusion campaign that began as early as March 2020 and is currently ongoing. The threat actors are identified as a nation-state advanced persistent threat (APT), with analysts suggesting that the data points to Russia. The victims have included government, consulting, technology, telecom, and extractive entities in North America, Europe, Asia, and the Middle East, and it is anticipated there will be additional victims in other countries and verticals. Included in this list are several US Federal agencies, such as the Department of Homeland Security and the State, Commerce, and Treasury Departments. Microsoft has also reported they were a victim of this attack, but they “have not found evidence of access to production services or customer data.”

Advice

If you use SolarWinds Orion software, you will want to take immediate action to mitigate the effects of SUNBURST and determine if there are any indicators of compromise (IOC). If you don’t use SolarWinds software, you may still want to take action to understand to what extent your vendors and partners use SolarWinds.

Although news around this attack is still developing, SolarWinds has since released patches to mitigate this vulnerability. SolarWinds advises:

Customers with any products for Orion Platform version 2020.2 with no hotfix installed, or version 2020.2 HF 1, should upgrade to Orion Platform version 2020.2.1 HF 2 as soon as possible to better ensure the security of your environment.
In the event that you are unable to upgrade immediately, ensure that SolarWinds servers are isolated from the network – disconnected or powered down.

Note that before following the steps above, imaging system memory and/or host operating systems hosting SolarWinds Orion is recommended to aid in forensic analysis. Furthermore, we recommend rebuilding SolarWinds Orion from scratch rather than patching a potentially compromised host. See CISA recommendations below.

Next, as part of your incident response plan, a comprehensive investigation should be performed and, if attacker activity is discovered in your environment, remediation steps should be taken based on the investigation findings. This will likely include removing threat-actor controlled accounts and persistence mechanisms.

The emergency directive from CISA recommends:

Treat all hosts monitored by the SolarWinds Orion monitoring software as compromised by threat actors and assume that further persistence mechanisms have been deployed.
Rebuild hosts monitored by the SolarWinds Orion monitoring software using trusted sources.
Reset all credentials used by or stored in SolarWinds software. Such credentials should be considered compromised.
Take actions to remediate kerberoasting, including, as necessary or appropriate, engaging with a third party with experience eradicating APTs from enterprise networks.

Resources

Resources listed below are in the recommended order of reading for organizations that do have SolarWinds Orion monitoring software in their environment.

Overwhelmed?

This is a global-scale hack with potentially dire consequences for your organization and its or its customers’ data. If your organization does run SolarWinds but does not have the time or expertise to perform any of the suggested steps above, please call VPLS. We offer free consultation on how our team of certified security experts can become an extension of your IT staff and drive these necessary incident response procedures.

Read More from this Author

If you enjoyed this article, you'll probably like:

Special Concerns for IT and Cybersecurity in Education

Blog Post / By John Headley

Published

Written by

Filed under

Even before the pandemic and the dramatic shift in both how students are learning and teachers are teaching, educational institutions have always had unique challenges when it comes to IT and cybersecurity. Not only does an educational institution have to secure a multitude of devices with different permission requirements, but it also has to ensure those devices always have reliable and high-speed access to required school resources.

The shift to work/learn from home has only compounded the challenges for the IT staff, as now these requirements for secure, high speed connectivity have extended to the homes of the students and faculty. This effectively places the majority of users outside of the secure perimeter that the IT staff has worked so hard to build on-prem.

Unsurprisingly with all these challenges, IT staff have a hard time securing the organization against every possible attack vector, and the education sector continues to be a top target for attacks. In a blog post from September 2020, “researchers at Check Point found that in the last 3 months, there was a surge in hacker interest in topics related to education, research and going back to school.” In addition, Microsoft reports Education as the most affected industry for enterprise malware encounters in the last 30 days.

In this blog post, we cover a few special concerns for IT and cybersecurity in education in detail with the recommendation that IT decision makers and their staff perform a self-assessment of their own organization in these areas.

Ransomware

According to Verizon’s 2020 Data Breach Incident Report, “Ransomware is really taking hold of Education vertical incidents, and has been responsible for 80% of the Malware-related incidents, up from 48% last year.” Edscoop also wrote a recent article in which they listed 9 high profile ransomware attacks in the education sector this year – quite an eye-opening read.

As we discussed in a previous blog post titled How to Prevent Ransomware – A Technical Checklist, a defense in depth approach must be used to protect an organization against ransomware. Note that this is only a technical checklist and it is not exhaustive. Our recommendation here is to go through the checklist, but also to consider having a security assessment performed on your organization against a trusted set of security controls, like NIST 800-53, CIS 7.1, or the ISO 27000-series, as these assess both technical controls as well as administrative controls, such as ensuring you have the correct IT and cybersecurity processes and procedures in place.

Granular Visibility & Control

Granular visibility and control is a cornerstone security capability for all verticals, but the education sector has always had one of the most challenging environments to pull this off properly in because of the wide variety of users. Faculty vs staff vs students, and all at different grade levels that have different access requirements, can leave IT staff pulling their hair out.

Luckily, there are solutions out there that simplify providing granular visibility and control even in these challenging environments. We recommend vetting your security posture for implementation of these concepts below, and if you don’t have them all in place, or you aren’t sure if you do, then please reach out to us and we’d be glad to discuss your environment in more detail.

Network Access Control

Granular Policy Enforcement

Visibility

High-Speed, Centralized Security & Network Access

Even more true in today’s unique learning environment is that education requires high speed network access, and security should not be a bottleneck. The latest generation of network hardware supports unprecedented throughput. On the LAN access side, WiFi 6 APs (802.11ax) have been released along with new “multigigabit” switches to support them, which sport 2.5/5/10 Gbps Ethernet connections.

LAN core switches now come standard with 10/25/40/100 Gbps ports, and firewalls with the same port density and speed are replacing legacy core switches in some environments. Even without venturing into chassis-based firewalls, single boxes can reach numbers of 1.2Tbps of firewall throughput and 240 million concurrent sessions, facilitating internal network segmentation and the same granular visibility and control for both north-south and east-west traffic. This is especially important for large educational institutions like school districts with a centralized firewall topology.

In addition to secure devices that support the ever-growing demand for bandwidth, management of the switches, APs, firewalls, and other infrastructure to support this goal should be painless. IT staff have a lot on their plate and the management complexity of devices can lead to a lack of standardization, misconfiguration, and ultimately a data breach.

We recommend evaluating if your current network and security infrastructure is performing up to the mark for the new demands placed upon the organization this year. Your IT staff may be spending valuable time in managing disparate and isolated infrastructure. Cost-effective solutions are available that centralize management of switches, APs, and even firewalls into one on-prem or cloud dashboard, providing a single pane of glass visibility and control into your IT infrastructure.

VPLS, a Trusted Partner in Education

VPLS has a proven track record of success within the education vertical, such as our data center migration to the VPLS Cloud for El Segundo Unified School District. Whether you want to dive deeper into the special concerns we discussed above, or you have other IT or cybersecurity items on your 2021 agenda, please don’t hesitate to reach out to us and we’d be happy to provide a free consultation.

Read More from this Author

If you enjoyed this article, you'll probably like:

FortiGate SSL VPN Certificate Vulnerability

Blog Post / By John Headley

Published

Written by

Filed under

A new article detailing an SSL VPN certificate vulnerability in FortiGate firewalls is making its rounds in cybersecurity circles. The article details how a FortiGate, if left with its default settings, could allow a man-in-the-middle attack to take place for SSL VPN users.

The article mentions that potentially 200,000 FortiGates are deployed in the wild with the “major security flaw” that this attack exploits.

Fortinet’s response is that they already provide a warning to IT administrators not to use this default configuration, so they will take no action on their part at this time. As of this blog post, no unique CVE number has been assigned to this vulnerability, and the article itself has drawn criticism for reporting as new an already well-known vulnerability that applies to this default configuration.

If you are using the default, self-signed certificate for your SSL VPN as shown in the photo above, VPLS recommends purchasing and installing a valid SSL certificate to use for the SSL VPN to mitigate this vulnerability.

Please reach out to us if you would like more information on if this vulnerability applies to your environment and what mitigation steps are required.

Additionally, VPLS would be happy to assist you with the mitigation steps mentioned above, including assistance with purchasing and installing a valid SSL certificate for your VPN, for a $500 flat fee.

Read More from this Author

If you enjoyed this article, you'll probably like:

How to Prevent Ransomware – A Technical Checklist

Blog Post / By John Headley

Published

Written by

Filed under

Unfortunately, there is no single solution to prevent ransomware or stop the spread once it has infiltrated your network; a defense in depth approach must be used. Below is a comprehensive, but not exhaustive, list of technical and administrative controls that can be used in your business’ defense against ransomware.

Your Ransomware Technical Checklist

Employee Training

Email Security

Endpoint Security

Zero Trust Network Access (ZTNA)

Security Information & Event Management (SIEM)

Business Continuity

Security Awareness Training

According to the Sophos May 2020 report, the most common attack vector for ransomware is email, with infection occurring from a user unknowingly clicking on a malicious link or attachment. Before focusing on email security (our next recommendation on this checklist), security awareness training is imperative to decrease the odds that your workforce falls for common social engineering tactics employed by attackers.

With simulated phishing attacks on your employees, ransomware simulation, domain spoof testing, and more, good security awareness training programs go far beyond than just presenting a boring slideshow to your employees, and will leave your workforce much more cautious and prepared to defend themselves against these clever attacks.

VPLS Recommends: KnowBe4

Secure Email Gateway

As we discussed above, email is statistically the most likely threat vector for ransomware and therefore one your organization should not take lightly. Major email providers, such as Office 365, do offer some level of threat prevention built into their platform, but data shows administrators are not confident in the capabilities of this included protection. Secure email gateways offer a more complete list of protection mechanisms to thwart the ever-changing techniques employed by modern day attackers, as well as providing better visibility to any incidents that may occur.

VPLS Recommends: Proofpoint Essentials

Zero-Day Threat Prevention (Sandboxing)

Of the assortment of comprehensive protection features offered by secure email gateways, ensure that your solution includes both attachment and URL sandboxing. Sandboxing is the solution for zero-day ransomware threats that can bypass normal filters. Files and URLs are automatically scanned using a cloud-based or on-prem sandbox environment, allowing full execution and analysis of the attachment or URL to ensure no bad behavior will occur once the attached has been opened or the URL visited.

VPLS Recommends: Proofpoint Essentials (email only) or FortiSandbox(standalone/multi-source)

Endpoint Detection & Response (EDR)

We discuss the what and why of EDR in our 5-minute primer on EDR, but the crux is that traditional endpoint protection is not good enough to protect against sophisticated threats like ransomware. A modern endpoint detection and response solution is what will enable both protecting the host from getting infected in the first place (pre-infection protection), as well as detecting an infection has occurred and handling the threat if it infiltrates the computer (post-infection protection).

The ability to detect and defuse ransomware, as well as automatic playbooks for responding and remediating the infection are critical to ensure one infected host does not compromise the rest of your corporate assets.

VPLS Recommends: FortiEDR via VPLS’s Managed Detection & Response (MDR) Service

Next-Gen Firewall

For protecting both on-prem and remote corporate users and company assets, a next-gen firewall is critical to ensure you have the detailed visibility and granular policy enforcement required to protect a network environment from ransomware. The old days of creating policies using just IP addresses and port numbers alone are gone, as a next-gen firewall has the intelligence to allow layer 7 application filtering and granular network access based on user ID or user group, regardless of their IP address or port numbers.

In addition to smarter policies, a next-gen firewall will commonly come equipped with things like IPS/IDS, network-level antivirus, web content filtering, DNS filtering, and SSL inspection, which when configured with ransomware in mind, will ensure that you notice and block even the most elusive indicators of attack (IOA) and indicators of compromise (IOC).

VPLS Recommends: Fortinet FortiGate via VPLS’s Managed Firewall Service

SSL Deep Packet Inspection

Commonly overlooked or put at the bottom of a firewall admin’s to-do list, SSL deep packet inspection, also known as SSL decryption, allows a next-gen firewall to inspect the payload of encrypted traffic being sent to and from corporate assets. This is important because without SSL deep packet inspection, ransomware hiding in encrypted payloads will not be caught by the next-gen firewall. Additionally, since many next-gen firewall features will not function or will only function partially, like IPS/IDS and network-level antivirus, you may miss out on key indicators of attack (IOA) and indicators of compromise (IOC) that you would otherwise have visibility into.

VPLS Recommends: Fortinet FortiGate via VPLS’s Managed Firewall Service

Internal Network Segmentation/Microsegmentation

All next-gen firewall deployments are not created equal. “Flat networks” of yesteryear allow unrestricted lateral movement of ransomware once a computer becomes infected. Internal network segmentation solves this issue by putting devices in different segments based on device type. With the next-gen firewall as the L3 gateway, you can apply the same layer 7 and user-based policies to even your internal-to-internal traffic, not just for traffic leaving the network edge.

Microsegmentation takes this internal network segmentation one step further and allows you fine-grained control to police the traffic between devices that are a part of two internal segments or even the same internal segment. This can be achieved by creating policies based on user identity and/or deploying an endpoint-level application firewall on the hosts themselves.

VPLS Recommends: Fortinet FortiGate via VPLS’s Managed Firewall Service + FortiSwitch via VPLS’s Managed Network Service

Network Access Control (NAC)

Whether your users are on-prem or remote, one computer infected with ransomware is all it takes to begin a chain reaction that will quickly bring your business to a halt. In conjunction with your next-gen firewall and the internal network segmentation deployment topology, NAC should be in place to facilitate dynamic network access control, which ensures only trusted corporate devices will automatically get placed in an appropriate internal network segment and have access to sensitive resources. Other guest and BYOD devices should be isolated and placed on a restricted network.

After the NAC solution dynamically allows access based on device trust, endpoint compliance should also be continually evaluated. If the host does not meet compliance requirements, such as if the host becomes infected, does not have antivirus running or it is out of date for too long, or the host does not have the latest OS patches installed, the host should be moved to a restricted quarantine or remediation VLAN until the missing criteria is met.

Remote users aren’t excluded here—NAC and endpoint compliance can and should be enforced for users before allowing them to connect to the corporate VPN.

VPLS Recommends: Fortinet FortiNAC

SIEM

A defense in depth approach to cybersecurity provides thorough protection against ransomware, but it also provides a thorough amount of something else—logs! Not only will many logs be generated from these various systems we have talked about, but your team must devise an efficient method to parse through the logs, pull out key information, and alert IT personnel about security events that are occurring to ensure your business has a firm grasp of the activity occurring in the network environment.

Enter the SIEM. A SIEM solves the complex problem of aggregating logs from multiple sources and performing event correlation. The logs and real-time diagnostic data from all of your endpoints and network equipment allow the SIEM to intelligently zero in on suspicious or malicious activity and send appropriate alerts to your staff in real-time. SIEMs typically also include vulnerability scanning capabilities, cloud monitoring, host-based IDS, and an assortment of other complementary components too, providing your security team with even more powerful analytics and response capabilities at their fingertips.

VPLS Recommends: AlienVault via VPLS’s Managed SOC Service

Offsite Backups & Disaster Recovery

When it comes to ransomware, a prepared business should always plan for the worst-case scenario—infection, data being held at ransom, and business grinding to a halt. In this unfortunately common doomsday scenario, having offsite backups protected from infection, as well as a dependable disaster recovery plan, can exponentially decrease financial loss and ensure your business gets back up and running within minutes.

VPLS Recommends: VPLS’s Backup as a Service (BaaS) and Disaster Recovery as a Service (DRaaS)

My checklist is complete; now what?

The checklist above contains truly business-saving technical controls that can be used to enhance your business’ security posture and increase its defenses against ransomware. However, as mentioned at the beginning of this post, this list is not exhaustive, and many things were left out from this checklist for the sake of brevity—mobile device management (MDM), cloud access security broker (CASB), browser isolation, and user entity and behavior analytics (UEBA), just to name a few.

The fight against ransomware never stops, and whether you want to discuss the items mentioned in this checklist, or are ready to explore what’s next, VPLS is here to help.

Read More from this Author

If you enjoyed this article, you'll probably like:

The Zero Trust Model

Blog Post / By Natwar Darak

Published

Written by

Filed under

With the ever-increasing number of breaches, it is quite evident that the traditional “trust but verify” model hasn’t been able to withstand today’s cybersecurity threat landscape.

In the “trust but verify” model, the network is divided into either “untrusted” network ( a network connected to the public internet) or “trusted” network (a network connected to the inside of the organization where all the users are trusted and have unrestricted access to anything and everything). As reported by Verizon, 34% of data breaches in 2019 involved internal actors. As a result, trusting anyone, on either side of the perimeter, should not be the de-facto anymore. Thus, it is quite imperative to redesign the network on a Zero Trust Model.

Defining Zero Trust

A Zero Trust Model refers to a threat model where no users, agents, or actors are trusted, irrespective of their location. Instead, all access is based upon a “need-to-know” philosophy and is enforced strictly. This even boils down to cutting off access to any network resource until the user is identified by the network and the need to access the requested resource is proven. Zero Trust Model shifts focus from securing just the network boundaries to securing the network endpoints, which implies a need for redesigning the network from the inside out.

Building a Zero Trust Model

The Zero Trust Model is vendor-agnostic and is built upon the following systems:

Micro-segmentation

Micro-segmentation is a granular approach of segregating the network according to workloads or applications. Virtualization solutions such as VMs and containers, cloud services, and Software Defined Networks (SDNs) are all part of the Micro-segmentation strategy. Being built onto the software, Micro-segmentation comes with an added benefit of reducing the management overhead of the ACLs or the security policies on the firewall.

Identity and Access Management (IAM)

The principle of least privilege should be the modus operandi to implement IAM systems for managing the access to all resources. Technologies such as Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Privileged Access Management (PAM) forms the core of any IAM system.

Log and Analyze Traffic

All traffic traversing through the network should be logged and analyzed. Security information and event management (SIEM) solutions can help easily corelate all the traffic and provide a centralized view to monitor the environment.

In today’s cyber world, it is only logical to assume that there is bound to be a network intrusion. It is not a matter of if; it’s only a matter of when. And when the inevitable occurs, micro-segmentation along with IAM can severely restrict the lateral movement of the intruder, while monitoring all the activities in the network can alert you to any unusual activity. The Zero Trust Model, thus, provides a secure framework to defend against data breaches or any advanced cyber threats.

Interested in learning more about other security tips? Check out this primer on EDR or endpoint detection and response. And learn more about the Managed Security options available from VPLS.

Read More from this Author

If you enjoyed this article, you'll probably like:

What is EDR? – A Primer in 5 Minutes

Blog Post / By John Headley

Published

Written by

Filed under

EDR stands for Endpoint Detection & Response. The “endpoint” in this phrase refers to any individual network-connected node belonging to your company, such as an employee’s workstation or a company web server.

EDR emerged because the standard endpoint protection platform (EPP), i.e. traditional antivirus products, were not cutting it in today’s world of ransomware, determined threat actors, and advanced persistent threats (APTs).

Traditional EPPs focus on preventing infection in the first place, mostly through a database of signatures. However, according to Gartner Research’s Magic Quadrant for EPP, “The security mindset has shifted to acknowledge that prevention alone is not enough; security and risk management leaders must be able to more easily harden endpoints and perform more detailed incident response to resolve alerts.”

To put it simply, threats will get through your antivirus protection. When they do, EDR will Detect that threat and Respond both quickly and automatically to ensure that the breach is stopped, and that any other relevant actions are taken, such as isolating the endpoint or rolling back malicious changes.

Where EPPs only provide pre-infection protection, EDR completes the circle by providing both pre-infection and post-infection protection.

To ensure I am honest on my 5-minute promise, I just wanted to touch on some other capabilities of EDR that set it apart from EPPs. For example, the unprecedented visibility into the endpoint provided by EDR allows your team to investigate the chain of events that led to the attack and understand how the malicious code compromised the system.

Additionally, this visibility allows members of your organization to participate in “threat hunting”, whereby the hunters can look at all of your endpoints for indicators of compromise (IOCs) and proactively investigate the endpoints for threats before a data breach occurs.

There are many more exiting capabilities of EDR, but this primer was meant to introduce those unfamiliar with EDR to the general concepts of the product and how it fits into a company’s security stack. If you are interested in going deeper into how EDR works and how it can fit into your existing environment, please contact us today to learn more.

VPLS recommends and proudly offers FortiEDR as our EDR solution of choice. We are a Fortinet Expert-level partner and MSSP, which means we have highly certified Fortinet engineers (all the way up to NSE8), as well as an in-house SOC, that can deploy and manage FortiEDR for your company with unparalleled expertise.

Read More from this Author

If you enjoyed this article, you'll probably like:

A Closer Look at Technologies Enabling Remote Work: VDI vs VPN

Blog Post / By John Headley

Published

Written by

Filed under

Government shelter-in-place orders due to COVID-19 have forced organizations to transition their employees to remote work, often for the first time. Unexpectedly, many of these organizations are seeing benefits to this new work-from-home policy—so much so, that leaving in place the ability to work from home even after the orders have lifted is now on the corporate roadmap.

Whether temporary or permanent, there are challenges to implementing work-from-home successfully and securely—internet and infrastructure stability, user access control, and securing company data, just to name a few.

With these challenges in mind, two of the most popular options for setting up a remote workspace are VPN and VDI. It’s important to know the differences between each option in order to select which, if not both, is the right fit for your business.

What is VDI?

VDI stands for Virtual Desktop Infrastructure and is the name given to a server that hosts personalized “virtual” desktops for your employees. Rather than assigning a corporate PC to each employee, this virtual desktop can be connected to any physical computer or even an inexpensive piece of hardware called a “thin client” or “zero client”.

After the user authenticates successfully, they will be taken to their personal virtual desktop instance, which provides the user the same experience as if they were using a normal PC. Since the virtual desktop is hosted within the corporate infrastructure, users will also have secure access to corporate applications and files.

What is VPN?

VPN or Virtual Private Network technology focuses on extending the corporate network to a remote PC or remote office. This is accomplished by creating a secure “tunnel” over the Internet between the corporate office and the remote location, which not only secures all data that goes between the corporate office and the remote employee, but also allows the remote employee’s PC or office to logically act like it is part of the corporate network.

By simply installing VPN client software or even just using a web browser on the remote PC, the user can access business applications and files just like they were sitting at the office.

Is VPN or VDI right for your organization?

In the context of remote work, both solutions have similar value propositions: they allow your employees to securely work from home. However, this is where the similarities end. Below are some key differentiators to consider when selecting a solution for your business.

SECURITY

The security of a remote access solution gets first priority in this debate. Both VPN and VDI ensure confidentiality and integrity of data transferred to and from the corporate network, and user authentication can optionally be secured with multi-factor authentication in both solutions.

However, VDI does have an advantage if the organization needs to allow users to connect with their own personal devices (BYOD). This is because only the virtual desktop has access to corporate files and applications, not the connecting PC, so the organization does not have to worry about corporate data being saved on personal devices.

Even with this advantage for VDI, since VPN can be restricted to only corporate-issued devices—and that’s the restriction that many of our customers want—we will have to award security as a tie overall.

Winner: Tie

DEVICE TYPE SUPPORT

As mentioned above, VDI provides remote access to a virtual desktop from any device, which is quite convenient, but it provides access ONLY to this virtual desktop. For employees that have non-PC corporate devices, like a desk phone, corporate cell phone, or IOT device, VPN is the only solution that can provide remote corporate connectivity for them.

Note that this type of VPN setup typically mandates a physical VPN gateway appliance be deployed at the user’s home office in lieu of the VPN client software we described above.

Winner: VPN

BANDWIDTH

With VPN, the secure tunnel is set up between the user’s remote PC and the corporate network, and any attempts to access resources at HQ requires data to traverse this tunnel. This puts bandwidth demands on both the user’s home Internet connection and, as the number of users increases, the Internet connection at HQ too.

VDI has less bandwidth requirements compared to VPN because the virtual desktop is already on the corporate network. Only minimal data is sent between the remote user and the virtual desktop itself.

Winner: VDI

USER EXPERIENCE & TRAINING

Users will have to be onboarded and trained when VDI is deployed, as they are essentially getting a new virtual computer.

With VPN, however, the users may have to be trained on how to connect using the VPN software, but generally speaking, the user experience won’t change for them—their computer (and any other devices) will look and feel the same.

Winner: VPN

IT MANAGEMENT OVERHEAD

Both solutions have similar overhead when it comes to maintaining policies related to user authentication and access control, but if you consider managing the remote users’ endpoints, then VDI and VPN do differ.

With VPN, a responsible organization would have to ensure a remote user’s PC is “locked down” through the use of Microsoft Group Policy and/or MDM software, since it will be this PC that will be actually connecting back to the corporate network.

With VDI, all the virtual desktops are configured and managed in one place: within the VDI infrastructure. This centralization allows for the flexibility of the virtual desktops to be reconfigured or reimaged at any time, with or without the user being present. This is just plain harder to do with remote physical machines.

Winner: VDI

And the winner is…
The goal of this blog post was to share some insight into why VPN and VDI are leading in today’s work-from-home options, and with the benefits discussed above we hope it is easy to see why. Which one is right for your organization depends on your business’ unique structure and requirements, and often our clients will utilize both technologies to satisfy the needs of their diverse workforce.

It’s important to keep in mind that either solution can be set up quickly by an experienced engineer and can be architected to support any number of users an organization requires, both now and into the future.

If your organization wants to discuss the unique work-from-home challenges you are facing, such as not having the proper staff to get a solution deployed quickly, please reach out to us; VPLS is here to help.

Read More from this Author

If you enjoyed this article, you'll probably like:

Easy and Essential Cyber Security Habits: Part 4

Blog Post / By Lisa Ly

Published

Written by

Filed under

It’s never too late to start new cyber security habits so why not start now.

Time for the final part of our series where we’ll be giving you tips the ways you can keep your router safe

Part 4: Routers

If you have home Wi-Fi, chances are you have a router that goes along with it. But has it ever crossed your mind that your router can also be compromised? Let’s see what actions you can take in order to prevent such an unfortunate scenario from ever occurring.

Change Your Password!

The password to your router can be the entry way for a hacker access your data.

So, in order to make sure that you keep hackers at bay, create a complex password and change the router’s username on a regular basis.

Not in Use? Disable!

If there are features on your router that are not currently being used, it would be in your best interest to disable them, especially if they are features that allow for remote access. Otherwise you risk being potentially hacked.

Keep It Separate!

If you are able to create different networks on your router, then by all means, you should! By doing this, you minimize your devices’ exposure to vulnerabilities that may be lurking around.

Go with The Flow!

Most current routers come equipped with firewalls in order to monitor the flow of traffic on devices and determine what connections should be allowed.

Update, Update, Update and More Updating!

Just as you would install updates on your other devices in order to protect against any potential vulnerabilities, you need to do the same with your router. However, while your computer or phone may prompt you to update automatically, routers do not possess such a convenient feature. You will just have to remind yourself to update your router regularly to provide the most current security to your devices.

Are You Verified?

Like most of us, you probably have several devices connected to your router, but are you able to identify what devices are connected to it? If you answered no, then you should take it upon yourself to know which devices you have connected to your router. This way, you can identify and verify any unauthorized devices that are not connected to your router that may compromise your information.

We hope you enjoyed this blog series and learned about the various ways you can start your easy and essential cyber security habits today! Remember it’s never too late to form better cyber security habits!

Did you miss this series? Check out Part 1 and Part 2 for more easy and essential cyber security tips.

Read More from this Author

If you enjoyed this article, you'll probably like:

Easy and Essential Cyber Security Habits: Part 3

Blog Post / By Lisa Ly

Published

Written by

Filed under

It’s never too late to start new cybersecurity habits so why not start now!

Let’s begin Part Three of our series where we’ll be exploring the ways you can keep your smartphone safely secure.

Part 3: Smartphones

Nowadays, we cannot go anywhere without bringing along our phones, whether it be for work, errands, or for leisure. Since our phones have become such a crucial part of our lives, we should make every effort to put good cyber security habits to make sure that your smartphone is safeguarded against various threats and hacks.

Lock It!

Locking up your phone with a password or pattern is a great way to keep your phone protected from prying eyes, but what may not be so obvious is knowing what type of password or pattern to lock our phones with. A good rule of thumb is to never use an easy or predictable password or pattern. By doing this, you are making yourself an easy target.

Instead, opt to use a biometric password or a face authentication password.

If you still want to use a regular password or pattern to lock your phone, consider making your password or pattern complex; the more complicated, the better.

Jailbreak…or Not!

If you find yourself in a situation, where you need to jailbreak your phone, heed our advice and DON’T do it under any circumstances.

When you jail break a phone, it leaves your phone open to more vulnerabilities since it is now being forced to utilize certain services and apps that it was not intended for. It could also add unofficial application (app) stores to your phone, which are not monitored like legitimate app stores are, and can leave your phone vulnerable to downloading an unofficial app linked to malware or viruses which can be costly to remedy.

Enable Application Permission!

Often when an app is downloaded, you are asked to grant certain permissions such as access to allow the app to fully do its job. Usually this call to action is enable through a click of an “approve” or “accept” button.

You may want to think twice before you do that so carelessly. Some apps will use that access to spy on your activity or place unnecessary charges on your account.

Phishing for a Response!

Phishing scams often take place over email, but they can also take place via text message.

Some scammers send text messages with infected links that can lead them to putting malware or a virus on your phone. These text messages can be under the guise of it being ‘from your bank’ who then calls you for the conformation number they sent you, when in fact they are not your bank and are only calling to get your banking details.

Just Don’t Answer!

Everyone gets the occasional number that calls your phone and you have no idea who it is. Sometimes they are scammers waiting for you to answer in order to trick you into giving out your personal information or attempting to sell you something that you just don’t need. Moral of the lesson? Think twice before you answer these unidentified numbers; you’re better off letting it go to voicemail to see who is really on the other side of the call.

Secure It!

Security software may be an afterthought when it comes to your phone, but it is just as important, if not even more important to properly secure your phone. Using security software designed for smart phones will help prevent your phone from suffering from a security breach or cyber-attack.

Now that Part Three is wrapped up, in the final part of your Easy and Essential Cyber Security Habits series we’ll be looking at the ways you can keep your router safe.

Read More from this Author

If you enjoyed this article, you'll probably like: