All Posts By

Nilly Assia

Employees Working All Over The World? Learn How to Protect Your Network from the Cloud

By | Cloud Security, Our Technology | No Comments

Every enterprise has a different pain point when it comes to security, whether it employs a large remote workforce or the company operates at a global scale. According to a survey by Gallup, 37% of U.S. workers have worked from home, which is up from 9% in 1995. This trend in an agile employee base allows companies to be competitive with one another when hiring talent, but it is leaving back doors and heightened risks to your network. With the right technology, companies can control access to its networks in any region and from any device.

Here are two use cases where NAC as-a-Service helps organizations control its network security. You can read more in the NAC-as-a-Service eBook.

Enterprises with Remote Workforces

As companies adopt work from home policies, it is raising security concerns for IT departments. Remote workers and co-working spaces aren’t just for startup entrepreneurs anymore. In fact, Fortune 500 companies like GM, GE, IBM and Microsoft all rent office spaces from WeWork. According to Gallup, the average U.S. employee works remotely at least two days a month. 9% of those polled work from a remote location for at least ten days a month, whether that is from their home office or a more public location.

Remote employees often connect to wireless networks that are also being accessed by other individuals whether the employee is at a coffee shop or traveling using their hotel’s guest Wi-Fi. Many companies require remote employees to authenticate their devices via a virtual private network, but enforcing VPN policies can be difficult. Using these connections may leave back doors open for hackers into the enterprise’s network.

With NAC-as-a-Service, IT departments gain visibility into their network endpoints from the cloud, giving network administrators the contextual knowledge to be confident their data and networks are secure. With strong authentication credentials, NAC as-a-Service prevents unauthorized access.

Global Companies Looking to Minimize Risk

With the growth of BYOD, IoT and companies scaling their business globally, the need to control network endpoints and streamline security practices for the network is higher than ever.  Managing global networks with multiple regional offices can be daunting. With global corporations like GE, IBM, and Microsoft encouraging co-working spaces more IT departments are sitting down to minimize the potential risks to their network. If a vulnerable device is attempting to join the network at a regional office or a shared office space like WeWork, it may put the entire global network at risk. Many traditional NAC solutions are on-premise and some regional offices may have differences in their security policies. Streamlining these policies are crucial, and with a cloud NAC solution there is no requirement for any hardware or complex installation, and can, therefore, be streamlined across a global network from the cloud.

Whether you are managing regional offices or your IT department is authenticating your work at home employees, with NAC-as-a-Service small businesses and large enterprises can monitor their risks and secure entire networks with ease. Portnox CLEAR works to put IT department’s minds at ease with NAC via the cloud whether your company works at a global scale or you are retaining a large remote workforce.

Interested in reading more about the next generation of NAC? Read our NAC-as-a-Service eBook.

nac as a service webinar

NAC as-a-Service: What it means and how it works? – Webinar

By | Our Technology | No Comments

Watch our webinar to find out what NAC as-a-Service is, how it works and how your company can benefit from it.

As we all know, NAC has been around for a while, but NAC as-a-Service, offered from the Cloud, is the new word in the market. It is true that NAC as-a-Service is still just starting out, but with the demand for current solutions, like our Cloud NAC solution, Portnox CLEAR, it’s clear that organizations are ready to take the leap and start securing access to their networks with an agile cloud-based solution.

So what is NAC-as-a-Service?

NAC-as-a-Service offers all of the same features and capabilities of an on-premise or appliance-based NAC solution with the agility, flexibility and ‘always-on’ benefits of a cloud service. This means that deployment and integration with the corporate network is a seamless zero-touch process, similar to accessing other cloud services, and the pricing model is subscription and use-based – you only pay for the endpoints you need to secure.

That is not all. NAC-as-a-Service is a one-of-a-kind offering in that it enables the strength of what used to be considered the impossibly complex 802.1X authentication protocol, from the cloud as-a-Service. By enabling 802.1X from the cloud, everything is already pre-set up and so organizations can extend strong authentication across their risk-based perimeter and to every location – on and off premise – even at the beach! It is that easy!

With NAC-as-a-Service, controlled access inherently means controlling organizational exposure to digital business risks.

Check out our webinar to learn more about NAC-as-a-Service solution and how your organization can benefit from it.

Try Portnox CLEAR Now!

Four Tips on Keeping Your Network Safe During the Holidays

By | Network Security | No Comments

The holiday season is a busy time for all of us and full of excitement. Yet as employees are likely to be working from home over their vacation, or from other remote locations such as hotels or even near the pool, there are some key steps that organizations should take to secure their network for remote access:

  1. Device Patching: Ensure that all devices accessing the corporate network are up-to-date on their security and anti-virus patches. As there will be managed, and, likely, a good deal of unmanaged devices accessing the network, send out email communication to employees ahead of the holidays with a request to update their devices. In addition, if using a network access control solution, set a policy that requires the latest patch updates in granting access. That way, even if a device isn’t updated, it will be blocked access until its posture is updated.
  2. Take Note of Your Inventory: Take the holiday season as an opportunity to gain a clear understanding of your inventory, namely unmanaged devices that are likely to be used by employees while working remotely. Ask employees to share information on the devices that they use at home to get a better understanding of any potential vulnerabilities, asking employees to patch and update those devices as well. In addition, get an understanding of which managed devices will remain in the office and ensure they are updated.
  3. Multi-factor Authentication is a Must! Deploy a VPN solution that requires MFA for network and cloud access. MFA ensures that employees are more cognizant when accessing the network. In addition, set the security policies for remote VPN access to reflect those of your network. Lastly, let employees know that network security will be on high alert in your holiday message (it could be the same message sent about patch updates).
  4. Automate Where Possible: Network security admins are no different in that they want to enjoy time with their families over the holidays, so automate security actions where possible. By deploying a network access control solution that automates network security actions based on policy, security admins can ensure that their networks are secure, without ever stepping foot into the office. And, as mentioned above, if admins communicate with employees regarding heightened security and patch updates, it’s unlikely that they will receive frantic IT calls over the break. In a word – network security admins that want to enjoy their holiday break should automate, automate, automate!

Of course, the most important tip of them all is – enjoy the holiday season by keeping network access secure and vulnerability free! With Portnox’s network access control solutions you can control access from anywhere to control exposure to digital business risks, wherever and whenever they may arise.

Try Portnox CLEAR – Network Access Control-as-a-Service

Tips to Stay Secure in the Mobile Enterprise

By | Cloud Security | No Comments

Enterprise mobility, or an approach to the workforce that enables employees to do their work from any location using available devices and applications, is a growing trend tied to digital transformation. In a 2016 survey conducted by Harris Poll, 90% of IT decision makers marked enabling enterprise mobility as a significant chunk of their IT spend due to its positive impact on workplace satisfaction, customer engagement, competitive stance and operational productivity. Yet despite the benefits of workforce mobility for a company’s business, there are a number of inherent IT security concerns that come along with the shift away from the office.

Enterprise mobility is strongly tied to BYOD trends in the enterprise that encourage employees to use their own smart devices (smartphones, tablets, laptops and watches) instead of investing extraneously dedicated corporate devices. The up-side of this trend is the budgetary savings, but the downside is that IT departments have less control over what’s connecting to the enterprise network and a weaker understanding of the vulnerabilities BYOD devices may introduce. Whether an employee intends to or not, their device may introduce cyber threats to the network that are difficult to control, as the device is not managed. Therefore, for companies that want to securely engage in BYOD and enterprise mobility, an agentless network visibility and control solution is essential, filling in the gaps on device health posture and providing methods to address threats, if they arise.

Another issue with enterprise mobility is location. Just as the location of a store is directly tied to how much it sells, the location of a connection, no matter where, is a good determiner of its security If an employee heads out on vacation with their laptop to do some work, you want to ensure that they can securely access company data without compromising it. Some IT departments set a range of valid locations from which employees can connect, but this limits the scope of activity for mobile, international organizations. Therefore, a network security solution that can provide visibility and automated methods of control will ensure that “sketchy” connections won’t jeopardize the safety of the entire network; and if they do, those connecting devices will be automatically blocked or quarantined until they are in a location with a safe connection.

A third, but by no means final, issue with enterprise mobility is that it is directly tied to the cloud computing trend. While this is great news, for a variety of reasons that we lay out here, many cloud applications only have rudimentary authentication methods that ensure the employee connecting is really who they say they are. Therefore, it’s important to have stronger authentication measure in place, either tied to a RADIUS server, Active Directory or based on a multi-factor authentication mechanism when they are connecting, be it over a wireless network or VPN connection. The cloud can definitely be trusted, but with the spike in cyber attacks such as distributed denial of service attacks and malware, it’s a good idea to add an extra layer of protection for accessing company documentation over the cloud.

The pace with which companies are embracing enterprise mobility leads many to believe that office building could soon be a thing of the past. However, it is important to remember that while employees may seem to have all the tools they need to effectively complete their tasks remotely – a laptop computer and phone connection – there is important network security ground to be laid prior to enabling this shift. By controlling access to the company network and its data, enterprises can safely engage in the mobility trend with the confidence that their network is as safe as it would be if everyone was still working from the office.

National Cyber Security Awareness Month is all about sharing knowledge to promote a safer and more secure internet environment for all users. When you hear of threats, inform your peers to prevent spreading, and always remain wary of what you search, receive and send over the internet. Awareness and education are the best ways to beat hackers!

Stay #CyberAware

Phishing And Ransomware – Your Inbox’s Worst Nightmare

By | news | No Comments

Phishing and Ransomware are two of the most common cyber attacks in the current internet landscape, yet center around the practice of digital blackmail. With a combination of the two, phishing ransomware attacks, are some of the most vicious threats. Nilly Assia, Portnox’s CMO, shares several rules of thumb that we should live by in the evolving landscape of digital threats. Published in ITProPortal.

Read the full article here.
Read about our Rapid Ransomware Response & Control Solution

IoT

IoT Poses Risks in Home, But There Are Ways to Remain Secure

By | IoT | No Comments

Imagine: You’re sitting at home on a conference call for work and, unbeknownst to you, hackers have gained access to the files you’re sharing on the call. How did they do this you ask? It’s really quite simple: through your smart home IoT devices. Because IoT devices like smart fridges, garage doors, home alarms, baby monitors and even toasters are connected to the same wireless network used to host your conference call, hackers can hijack those vulnerable, unsecure devices and gain full access to everything happening on your network. Soon enough, you might discover that they’ve gained access to your organization’s customer data, business plans and internal financial reports.

IoT devices are inherently insecure and there are a myriad of real-world examples of this very kind of occurrence. Take the massive denial of service (DDoS) attack on the Internet traffic company Dyn in 2016. The attack affected major Internet platforms and services such as Airbnb, Amazon, Box and PayPal, to name a few. It was later discovered that the attack targeted over 100,000 Internet-connected devices such as IP cameras, printers, residential gateways and baby monitors to install Mirai malware. The Mirai malware then overwhelmed Dyn-hosted sites with traffic so that they were forced to deny service to users.

The Mirai botnet is only one example. Recently, cybersecurity researchers at Black Hat 2017 proved that the mechanical components of an automated car wash could be hacked, including the entrance and exit doors, dangerously trapping the passengers of the vehicle inside. The hack was achieved by gaining access to internet-connected operating system running the car wash parts, which was protected only by a default password, readily accessible on connected device archival networks, such as the Shodan Network.

Despite these examples, only a handful of IoT device manufacturers are taking heed. As more consumers purchase connected devices – an integral part of the smart home – it’s worth taking a few precautionary measures to prevent the device from wreaking real havoc.

  1. Segment IoT Devices: Most people don’t have two wireless connections in the home, which could make segmenting a challenge, but it’s really quite easy and entirely necessary. A lot of recent 5G networks come with a 2.4G or option with a weaker bandwidth, just in case the higher bandwidth has performance issues. If you have two networks, set up the IoT device on the network with the lower bandwidth and keep it there. You could even create a separate network for all of your IoT devices, if you want to be on the safe side. Make sure to create a different password for your IoT device network so that if hackers commandeer the device, they can’t access private information.
  2. Change Default Passwords: This tip should really be the first direction in any IoT device instruction manual, but it rarely is. The moment that you begin the installation process for an IoT device, make sure to change the default password to something that’s hard to guess and not the same as other passwords that you commonly use. Even using your telephone number presents a risk as hackers could somehow access that information. This step is crucial as the passwords of connected devices are available over the Internet (see the car wash example).
  3. Create a Back-Up Plan: If some of the critical systems in your home are connected devices, make sure that you have a back-up plan in place in case they go haywire. This may seem like a silly enough step, but hacker’s goal is often to inflict physical and psychological damage on their targets in order to extract a ransom payment. A go-to strategy would be to disconnect and reset all of the IoT devices if they start acting out of line, but sometimes even those steps can’t remediate the problem. Try to consult with an expert or cybersecurity professional at the point of purchase and ask them about a continuity plan, or data back-up if the device stores information.

IoT devices are quickly becoming the mainstay of home appliances which is why it’s important to know the risks and have strategy in place that will help you recover in case the connected device is compromised. Until IoT device manufacturers are required to integrate security software into their products, make sure you are taking precautions while implementing connected technology.

National Cyber Security Awareness Month (NCSAM) is all about sharing knowledge to promote a safer and more secure internet environment for all users. Inform your peers when you hear of threats to stop them from spreading and always remain wary of what you search, receive and send over the internet. Awareness and education are the best ways to beat hackers!

Stay #CyberAware

Nominate Portnox & Portnox CLEAR in the 2018 Cybersecurity Excellence Awards

By | Cloud Security | No Comments

Portnox is proud to announce that it has been nominated in two categories for the 2018 Cybersecurity Excellence Awards, in the company category for “Most Innovative Cybersecurity Company” and in the product category, for the second-year in a row, Portnox CLEAR is nominated in the “Cloud Security” category. The Cybersecurity Excellence Awards are an annual competition, produced in partnership with the Information Security Community on LinkedIn, which has over 400K members and recognize companies, products, and individuals that demonstrate excellence, innovation, and leadership in information security.

Portnox CORE was the proud winner of the 2017 Cybersecurity Excellence Awards in the IoT Security Category for its “IoT Visibility Radar” that provides complete visibility into IoT devices on the corporate network. With the IoT Visibility Radar, organizations are able to discover the characteristics and location of IoT devices and set their network access policies. With this feature, organizations gain control over the IoT devices present on their network, to protect against hidden threats and vulnerabilities resulting from a lack of IoT security solutions.

Additionally, Portnox CLEAR was selected as a 2017 Cybersecurity Excellence Awards finalist in the Cloud Security category.

As Portnox continues to innovate the network access control space with its CORE, on-premise, and CLEAR, cloud-based, solutions, vote for us and show your support! Click here to nominate Portnox for “Most Innovative Cybersecurity Company” and here to nominate Portnox CLEAR as the top “Cloud Security” solution for the 2018 Cybersecurity Excellence Awards.

Thank you for your support and best of luck to all of the candidates!

How to Avoid the True Cost of Ransomware

How to Avoid the True Cost of Ransomware

By | Threat Detection and Response | No Comments

Recently, ransomware attacks on enterprise were all over the news. From the massive WannaCry attack in May 2017, which affected 300,000 devices worldwide (if not more), and the Petya (also known as NotPetya) attack in June 2017, it seems that there is no rest for the ransomware wicked. More than ever, businesses are aware that they need to have a ransomware game plan, and fast, because if not, they might find themselves in the headlines, having to take on the enormous costs of the attack aftershock, or worse – losing business due to system downtime and outages.

The wide-reaching effects of ransomware attacks on large corporations such as FedEx, Merck, HBO and Maersk are living examples of why it is important to avoid paying the true cost of ransomware remediation. The US pharmaceutical giant Merck was attacked by the Petya strain in June, yet still the organization is struggling to recover all its information and to account for the damages. The attack cost the organization billions in downtime, not to mention the significant funds required to staff around-the-clock IT experts, lawyers and PR reps to get business back on track. Global entertainment giant HBO was presented with a multi-million dollar ransomware demand this August, wasting billions in ad revenues for the company. These are just two examples that highlight the need for a review of remediation procedures, as well as ways to avoid paying the true cost of ransomware.

One of the easiest ways to avoid paying the true cost of dealing with a ransomware attack is simply not to pay the ransom. This may seem to go against organizational, or even your moral principles, but it has been established that paying the ransom seldom pays off. That’s because it’s unlikely that the hackers will release back all the information, upping the PR costs of dealing with potential media backlash, and, despite paying the ransom, showing a willingness to pay might brand your company as an easy target in the hacker community. But more than that, paying the ransom won’t prevent future attacks, because, in most cases, ransomware is distributed at random to any of the non-patched or vulnerable devices that particular strain is targeting. That’s why it’s a better idea to use the money that would go toward paying the ransom to shore up your cyber defenses, authentication tools and network firewalls.

Then there’s the issue of backups. Many organizations create a ransomware response plan that involves storing critical data on a secure server so that they can quickly bounce back from an attack. Yet while it is a good idea to back-up critical data, it’s possible that the back-up won’t recover all the information that’s in hackers’ hands. This presents threats to the stability and safety of your organization, and creates the possibility of a PR mishap (see the HBO example). In addition, the most recent ransomware attacks are targeting network-connected computers that have access to these back-ups, which means that attempts to fully restore systems are largely futile. So while back-ups are a good practice that should remain part of remediation plans, they shouldn’t be too heavily depended upon to get you back on your feet.

The bottom line: You need a multi-pronged approach to remediation.  If there’s one thing that can be said about ransomware, it’s that it doesn’t discriminate, which is why, more than ever, companies need to have the right remediation plan in place to avoid paying the true cost of ransomware attacks. A good place to start is integrating a solution that will allow IT professionals to remotely disconnect corporate devices from the network. This will help prevent the lateral spread of the attack throughout the organization, on both patched and unpatched devices (because the latest NotPetya strain targeted both). In addition, it’s important to have constant awareness of network areas at risk. This can be done by deploying a network access control solution that provides full visibility into devices, assess their level of digital risk to your business, and controls which devices are allowed on the network, and which aren’t.

To avoid paying the true cost of a ransomware attack, i.e. system and employee downtime, PR brand name damage as well as brand equity loss, and legal efforts and recovering data losses, your organization should consider a multi-faceted remediation approach that integrates a network authentication and endpoint control solution, allowing for business continuity with customers and partners.

Find out more about Portnox’s Rapid Ransomware Control & Response Solutions.

Cloud Security Mythbusters – Debunking the Top 5 Cloud Security Myths

By | Cloud Security | No Comments

Whether you’re a fan of digital transformation or not, there’s no denying that the shift to the cloud is engulfing enterprise IT. According to Gartner, over the next five years, over $1 trillion in compounded IT spending will be directly or indirectly impacted by the cloud shift, making cloud computing one of the most disruptive forces of IT spending since the early days of the digital age.

That said, it’s time to debunk some of the most common myths regarding cloud security before an outdated IT stack exposes your organization to emerging digital business risks.

Check out our Top 5 mythbusters Infographic here!

Myth #1 – The Cloud Isn’t Secure

The top concern among C-Suites and IT teams alike is that cloud-based security solutions are more prone to external threats than legacy security solutions.

Debunked: On-premise security appliances require firmware upgrades to protect against known exploits, resulting in a constant need to keep the solutions up-to-date. In addition, configuration changes could expose the network to potential vulnerabilities, requiring tedious maintenance of management procedures and periodic penetration testing. However, cloud-based security solutions are constructed, from the outset, to evolve to address relevant threats in the current cyber security landscape. David Linthicum, a leading cloud analyst and VP at Cloud Technology Partners, explains that the security of the cloud is on par with the security of any external device: “Anything that can be possibly accessed from the outside – whether enterprise or cloud – has equal chances of being attacked, because attacks are opportunistic in nature”.

Myth #2 – The Cloud Is Still Too ‘New’ To Be Trusted

Cloud-based applications and services are relatively new on the IT front. So why trust them?

Debunked: An increasing number of both large and small to medium-sized enterprises across a variety of industries – government, healthcare, ecommerce etc. – are employing cloud-based solutions for everything from human resource management to network security. According to IDG Research, “Cloud technology is becoming a staple to organization’s infrastructure as 70% have at least one application in the cloud”.

Use of Cloud Technology 2011-2016

Reference: “2016 IDG Enterprise Cloud Computing Survey

Myth #3 – The Cloud Is Great for Productivity Apps, But Not for Securing the Network

There is big difference between cloud productivity apps, and performing key security actions, such as Network Access Control (NAC) from the cloud.

Debunked: NAC is a growing concern for CIO/CISOs and IT teams in large to SMEs due to the increased need to gain control over digital business risks. And the stigma of the cloud being less secure isn’t necessarily correct. Gartner reports that by 2018, the 60% of enterprises that implement appropriate cloud visibility and control tools will experience one-third fewer security failures.

Myth #4 – Cloud Solutions Require Re-Educating IT Teams

Training IT teams to deploy a cloud-based security-as-a-service solution would require significant time and resources.

Debunked: Cloud solutions inherently cut time and costs associated with security management in IT teams, freeing them up to carry out more productive and profitable action items. That’s added to the easy and instant deployment associated with cloud-based solutions including automatic system updates, usage demos, access to use cases, and more.

Read our Debunking Cloud Security Myths White Paper for more fun facts!

Myth #5 – Cloud Solutions Can’t Help with Compliance

Cloud solutions are constantly changing – one minute they are a “must have” security tool, and the next they are an imminent source of risk to company information. How can you trust cloud security solutions uphold compliance?

Debunked: Cloud solutions are taking heed and are doing their part to relieve this part of the “IT headache”. Many solutions integrate compliance standards into their product while allowing for modifications to the network policy where necessary. Built-in compliance is a winning strategy for business success, and ensures that there aren’t any loopholes the IT team is missing out on.

As Gartner puts it, “By 2020, a corporate ‘no-cloud’ policy will be as rare as a ‘no-Internet’ policy is today”. While in many cases, hype can have dangerous potential, in the case of cloud security, it’s a win-win situation: a win for digital transformation and a win for the IT team that’s eager to expand their business value proposition.

Portnox CLEAR – Security-as-a-Service Solution: The first completely cloud-based Security-as-a-Service solution for Network Access Control (NAC), CLEAR controls access for all devices and users to wired, wireless and virtual networks, to effectively confront digital business risks and cybersecurity threats.

Try it Now!

Portnox’s Security Solutions Reviewed in 451 Research Report

By | Our Technology | No Comments

The leading information technology research and analyst firm 451 Research Group recently published an impact report that reviewed and commended Portnox’s Network Access Control (NAC) solutions, CORE & CLEAR, entitled “Portnox connects enterprise reality to its risk-based perimeter”. You can read the full report here.

The “451 Take” on Portnox’s solution for on-premise NAC, CORE, and cloud-based NAC, CLEAR, was that, “Portnox is helping redefine the value proposition of NAC, focusing on visibility, access control and flexibility. The company’s sensible risk orientation and the lightweight architecture of its CORE on-prem and CLEAR cloud services appear to be well aligned to help meet enterprise demand for a better NAC experience.”

Download the full report here.