Category

Cloud Security

How NAC Achieves CIS’s Top Security Controls

By | Cloud Security, Network Access Management | No Comments

The value proposition of network access control (NAC) solutions has shifted in recent years due to the onset of wireless networks, coupled with technological advancements in mobile and Internet of Things devices. Together with growing demands for the implementation compliance standards across a number of industries, companies are now required to openly communicate information about their security controls to external auditing authorities.

NAC is well positioned to provide an answer to these concerns by directly addressing the Center for Internet Security’s Top 5 Security Controls, which are a prioritized set of actions to protect organizations and data from cyber threats. NAC solutions address: collecting the inventory of authorized/unauthorized devices and software (including applications); ensuring secure configurations of hardware and software; carrying out continuous vulnerability assessments and remediation measures; and allowing for the controlled use of administrative privileges through role-based access.

Find out how NAC solutions address these security controls in our infographic and “The Importance of a NAC Solution” White Paper!

Portnox’s Predictions for Cybersecurity Trends in 2018

By | Cloud Security, IoT, Network Access Management, Network Security, Our Technology, Threat Detection and Response | No Comments

2017 was a very busy year for Portnox, yet throughout we aimed to address cybersecurity trends through our product offerings – Portnox CORE and Portnox CLEAR. With the highest number of ransomware attacks on record in 2017, we introduced a Rapid Ransomware Response and Control feature to our on-premise NAC solution, Portnox CORE, as well as the ability to see and control Internet of Things (IoT) devices through the IoT Visibility Radar. Portnox CLEAR, our cloud solution for network access control and risk management, was introduced to the market, and with its features for ensuring business continuity and securing the mobile workforce. The ability of our products to adequately address 2017 received commendation in the form of various industry awards and recognitions from leading publications and security experts.
Looking forward to 2018, the security landscape will shift and focus more heavily on IoT security, blockchain trends, automation and workforce mobility.

Here are some of our insights on what the 2018 cybersecurity landscape will look like:

  1. Extension of Automation: Together with AI and machine intelligence trends, automation will likely take center stage in 2018 as the leading security trend. Microsoft recently announced that it will begin automated anti-virus updates through its Windows Defender, which means that users and organizations will no longer have a choice when it comes to patching endpoints and software. This is good news, because it ensures that more actors have adequate security postures, and it makes sense for modular devices (like IoT) that present difficulties when it comes to firmware upgrades. Yet automation also creates challenges, namely for industries dependent on older versions of software, firmware and operating systems, such as healthcare and finance. Automated security updates could put the business continuity of these organizations at risk, and with potentially life-threatening and economically risky consequences. In addition, automated security updates across the board could actually make it easier for hackers to carry out large-scale attacks that will affect a larger number of endpoints.
  2. Blockchain and the Hacking of Applications: While many believe that the blockchain is “unhackable”, in the last year we have seen an increase in the number of attacks against blockchain-based applications. The vulnerabilities do not arise from the blockchain itself, but rather the applications that run on the blockchain. Social engineering will be used to extract private keys. Another possible blockchain hack, which has already been proven possible, is through other blockchain technologies such as Ethereum, which is an organization that’s committed to being open source for third-party applications. This creates a vulnerability because almost all applications have bugs can be manipulated by hackers as an attack surface.
  3. DDoS Ransomware: Creating a new and more pungent form of blackmail, DDoS and ransomware are joining forces to topple enterprise progress in digital transformation, while reaping monetary benefits. These attacks are made possible by using botnets, or large groups of “zombie” devices – which often happen to be Internet of Things devices, such as webcams – to funnel traffic to a malware-infected web address that, in turn, extract data from the accessing endpoint and demand ransoms for the return of that encrypted data. These attacks are often called “sinkhole” attacks because the DDoS traffic is being directed to sites that contain dangerous malware. With the wide adoption of Internet of Things devices in the enterprise, and the rise in ransomware demands, it’s likely that we’ll be seeing more of these attacks in the next year.
  4. Growing Regulation of IoT Security: Regulations governing IoT security features are beginning to be drafted, but there is still not enough demand from the consumer side to warrant manufacturer investment in security features. This begs a major question in 2018 of whether governments, in similar fashion to the US and EU, will begin issuing security regulations on IoT device manufacturers that protect consumers and companies from digital risk. Together with GDPR and other compliance regulations, we are likely to see more governments and industry authorities stepping up to enforce privacy, safety and security regulations on IoT manufacturers.
  5. Mobility of the Workforce: With more employees working remotely, organizations are enjoying a significant drop in their capital expenditures (many have even given up on the physical office space), while directing operational expenditures at digital transformation trends such as cloud and BYOD. Workforce mobility is a good thing for companies’ balance sheets, but the technological flexibility it affords results in more areas of cybersecurity vulnerability for the enterprise network. Companies that are set on accommodating mobile workforce trends will be investing in more endpoint, network and cloud security solutions that protect access and assets across a variety of locations and in various connected environments.

At Portnox, we will continue innovating our access control offerings to provide solutions to 2018 security trends and challenges, providing our customers with valuable, holistic solutions to protect their networks.
Here’s to a great 2018!

Easy 802.1X

By | Cloud Security | No Comments

The IEEE standard for port-based authentication, 802.1X, has been around since the early 2000’s, but in recent years has been met with frustration from network administrations and architectural experts. While 802.1X is well suited to the needs of the wired, desktop-dependent enterprise, with the shift to wireless networks, together with an upsurge of BYOD and Internet of Things (IoT) devices, deployment of 802.1X has become more of headache than a help.

Much of the criticism for 802.1X centers around the difficulty of deployment, namely that certain hardware infrastructure, such as RADIUS authentication and user repository servers, are required. In addition, with an increase of mobile devices in the enterprise, 802.1X is not able to provide enough contextual information on devices to allow for effective security controls. Finally, the difficulty of deployment involves the allocation of agents, which must be carefully managed on endpoints and could become a nuisance for employees if they are constantly required to enter their access credentials.

So Why Reconsider 802.1X?

Despite these technical difficulties, 802.1X has proven to be the strongest method for authenticating devices on the corporate network due to its continuous and direct communication with authenticating servers as opposed to pre/post scanners or the use of logs. The benefits for centralized management and enhanced security should not be deserted based on the sheer complexity of 802.1X deployments.

802.1X Delivered as a Cloud Service

Now, there is another way. With the growth of cloud computing technologies, Portnox CLEAR offers a solution that allows for simple deployment of 802.1X authentication , without compromising on security across the enterprise. By deploying RADIUS and user repository servers from the cloud, and delivering 802.1X as a software-defined cloud service, admins can embrace the benefits of 802.1X authentication by deploying a zero-touch solution that eliminates geo-redundancies. In a matter of minutes, admins can see and control every device connecting to their network and issue agents to monitor and control those devices with one swift action.

To find out how 802.1X authentication from the cloud works, read more in our White Paper, “802.1X Authentication Is Simpler Than You Think“, or TRY PORTNOX CLEAR NOW!

Revitalized NAC for LAN and Cloud

By | Cloud Security | No Comments

As long as enterprise organizations try to maintain private networks, the challenge of determining which devices are considered safe for entry will remain. Whether this access decision is made using physical or virtual enforcement controls does not matter much from a policy perspective. Organizations desiring private LANs will simply want something workable to determine which devices are allowed admission, and which are not.

Traditional enterprise local area security teams have relied on a technology known as network access control or NAC to provide such policy enforcement. NAC is sort of like transportation security at your local airport: You arrive at a checkpoint, you present requested credentials, you go through some careful screening, and then an access decision is made. None of this is convenient, and none of it happens instantaneously. But we all agree that it is necessary.

What are the prospects for NAC in a world where the traditional LAN is being rapidly evolved by mobile and cloud? And what of the disappointment many security experts have previously expressed with NAC?

Enterprise NAC faces challenges, and many 802.1X-based implementations burdened by unbridled complexity. But the prospects for NAC in the modern enterprise are dramatically improving, coupled with powerful means for extending such protections to the cloud. “Next generation network access controls for cloud,” according to Portnox CEO Ofer Amitai, “will be a critically important component of the virtual enterprise.”

The original approaches to NAC had several challenges from the outset. First, they tended to be vendor specific, with required endpoint agents, and mitigations based on network traffic manipulation. These methods carried considerable downside; for example, few non-trivial networks are built on the capability and offerings of a single network vendor. Even in the presence of standards, interoperability issues were often the root cause of problems.

Portnox has focused its NAC product efforts on addressing these challenges directly for both the enterprise LAN and the extended hybrid cloud (to include IoT systems as well). Seamless, agnostic coverage of multiple vendor deployments, for example, is one of the focus areas of Portnox – and this should be welcome news to any network security manager supporting complex functional requirements for the hybrid enterprise.

Perhaps the most evolved NAC consideration in the Portnox suite is its emphasis on visibility across access layers. Surprisingly, early attempts at visibility from NAC were downplayed, simply because the (stubborn) presumption was that access policy would be enforced at LAN admission time. This carries the logical assumption that only good devices would ever be permitted entry to the LAN – which we all know is not how things evolved.

All of this is good news for any CISO team operating on an existing perimeter-based LAN (which means essentially every CISO team), with clear transition on-going toward hybrid cloud. The requirements to protect admission and entry to the corporate network remains a control demand in every framework I’ve ever seen. It, therefore, stands to reason that teams should partner with NAC vendors who understand the present – as well as the future.

Tips to Stay Secure in the Mobile Enterprise

By | Cloud Security | No Comments

Enterprise mobility, or an approach to the workforce that enables employees to do their work from any location using available devices and applications, is a growing trend tied to digital transformation. In a 2016 survey conducted by Harris Poll, 90% of IT decision makers marked enabling enterprise mobility as a significant chunk of their IT spend due to its positive impact on workplace satisfaction, customer engagement, competitive stance and operational productivity. Yet despite the benefits of workforce mobility for a company’s business, there are a number of inherent IT security concerns that come along with the shift away from the office.

Enterprise mobility is strongly tied to BYOD trends in the enterprise that encourage employees to use their own smart devices (smartphones, tablets, laptops and watches) instead of investing extraneously dedicated corporate devices. The up-side of this trend is the budgetary savings, but the downside is that IT departments have less control over what’s connecting to the enterprise network and a weaker understanding of the vulnerabilities BYOD devices may introduce. Whether an employee intends to or not, their device may introduce cyber threats to the network that are difficult to control, as the device is not managed. Therefore, for companies that want to securely engage in BYOD and enterprise mobility, an agentless network visibility and control solution is essential, filling in the gaps on device health posture and providing methods to address threats, if they arise.

Another issue with enterprise mobility is location. Just as the location of a store is directly tied to how much it sells, the location of a connection, no matter where, is a good determiner of its security If an employee heads out on vacation with their laptop to do some work, you want to ensure that they can securely access company data without compromising it. Some IT departments set a range of valid locations from which employees can connect, but this limits the scope of activity for mobile, international organizations. Therefore, a network security solution that can provide visibility and automated methods of control will ensure that “sketchy” connections won’t jeopardize the safety of the entire network; and if they do, those connecting devices will be automatically blocked or quarantined until they are in a location with a safe connection.

A third, but by no means final, issue with enterprise mobility is that it is directly tied to the cloud computing trend. While this is great news, for a variety of reasons that we lay out here, many cloud applications only have rudimentary authentication methods that ensure the employee connecting is really who they say they are. Therefore, it’s important to have stronger authentication measure in place, either tied to a RADIUS server, Active Directory or based on a multi-factor authentication mechanism when they are connecting, be it over a wireless network or VPN connection. The cloud can definitely be trusted, but with the spike in cyber attacks such as distributed denial of service attacks and malware, it’s a good idea to add an extra layer of protection for accessing company documentation over the cloud.

The pace with which companies are embracing enterprise mobility leads many to believe that office building could soon be a thing of the past. However, it is important to remember that while employees may seem to have all the tools they need to effectively complete their tasks remotely – a laptop computer and phone connection – there is important network security ground to be laid prior to enabling this shift. By controlling access to the company network and its data, enterprises can safely engage in the mobility trend with the confidence that their network is as safe as it would be if everyone was still working from the office.

National Cyber Security Awareness Month is all about sharing knowledge to promote a safer and more secure internet environment for all users. When you hear of threats, inform your peers to prevent spreading, and always remain wary of what you search, receive and send over the internet. Awareness and education are the best ways to beat hackers!

Stay #CyberAware

Nominate Portnox & Portnox CLEAR in the 2018 Cybersecurity Excellence Awards

By | Cloud Security | No Comments

Portnox is proud to announce that it has been nominated in two categories for the 2018 Cybersecurity Excellence Awards, in the company category for “Most Innovative Cybersecurity Company” and in the product category, for the second-year in a row, Portnox CLEAR is nominated in the “Cloud Security” category. The Cybersecurity Excellence Awards are an annual competition, produced in partnership with the Information Security Community on LinkedIn, which has over 400K members and recognize companies, products, and individuals that demonstrate excellence, innovation, and leadership in information security.

Portnox CORE was the proud winner of the 2017 Cybersecurity Excellence Awards in the IoT Security Category for its “IoT Visibility Radar” that provides complete visibility into IoT devices on the corporate network. With the IoT Visibility Radar, organizations are able to discover the characteristics and location of IoT devices and set their network access policies. With this feature, organizations gain control over the IoT devices present on their network, to protect against hidden threats and vulnerabilities resulting from a lack of IoT security solutions.

Additionally, Portnox CLEAR was selected as a 2017 Cybersecurity Excellence Awards finalist in the Cloud Security category.

As Portnox continues to innovate the network access control space with its CORE, on-premise, and CLEAR, cloud-based, solutions, vote for us and show your support! Click here to nominate Portnox for “Most Innovative Cybersecurity Company” and here to nominate Portnox CLEAR as the top “Cloud Security” solution for the 2018 Cybersecurity Excellence Awards.

Thank you for your support and best of luck to all of the candidates!

Cloud Security Mythbusters – Debunking the Top 5 Cloud Security Myths

By | Cloud Security | No Comments

Whether you’re a fan of digital transformation or not, there’s no denying that the shift to the cloud is engulfing enterprise IT. According to Gartner, over the next five years, over $1 trillion in compounded IT spending will be directly or indirectly impacted by the cloud shift, making cloud computing one of the most disruptive forces of IT spending since the early days of the digital age.

That said, it’s time to debunk some of the most common myths regarding cloud security before an outdated IT stack exposes your organization to emerging digital business risks.

Check out our Top 5 mythbusters Infographic here!

Myth #1 – The Cloud Isn’t Secure

The top concern among C-Suites and IT teams alike is that cloud-based security solutions are more prone to external threats than legacy security solutions.

Debunked: On-premise security appliances require firmware upgrades to protect against known exploits, resulting in a constant need to keep the solutions up-to-date. In addition, configuration changes could expose the network to potential vulnerabilities, requiring tedious maintenance of management procedures and periodic penetration testing. However, cloud-based security solutions are constructed, from the outset, to evolve to address relevant threats in the current cyber security landscape. David Linthicum, a leading cloud analyst and VP at Cloud Technology Partners, explains that the security of the cloud is on par with the security of any external device: “Anything that can be possibly accessed from the outside – whether enterprise or cloud – has equal chances of being attacked, because attacks are opportunistic in nature”.

Myth #2 – The Cloud Is Still Too ‘New’ To Be Trusted

Cloud-based applications and services are relatively new on the IT front. So why trust them?

Debunked: An increasing number of both large and small to medium-sized enterprises across a variety of industries – government, healthcare, ecommerce etc. – are employing cloud-based solutions for everything from human resource management to network security. According to IDG Research, “Cloud technology is becoming a staple to organization’s infrastructure as 70% have at least one application in the cloud”.

Use of Cloud Technology 2011-2016

Reference: “2016 IDG Enterprise Cloud Computing Survey

Myth #3 – The Cloud Is Great for Productivity Apps, But Not for Securing the Network

There is big difference between cloud productivity apps, and performing key security actions, such as Network Access Control (NAC) from the cloud.

Debunked: NAC is a growing concern for CIO/CISOs and IT teams in large to SMEs due to the increased need to gain control over digital business risks. And the stigma of the cloud being less secure isn’t necessarily correct. Gartner reports that by 2018, the 60% of enterprises that implement appropriate cloud visibility and control tools will experience one-third fewer security failures.

Myth #4 – Cloud Solutions Require Re-Educating IT Teams

Training IT teams to deploy a cloud-based security-as-a-service solution would require significant time and resources.

Debunked: Cloud solutions inherently cut time and costs associated with security management in IT teams, freeing them up to carry out more productive and profitable action items. That’s added to the easy and instant deployment associated with cloud-based solutions including automatic system updates, usage demos, access to use cases, and more.

Read our Debunking Cloud Security Myths White Paper for more fun facts!

Myth #5 – Cloud Solutions Can’t Help with Compliance

Cloud solutions are constantly changing – one minute they are a “must have” security tool, and the next they are an imminent source of risk to company information. How can you trust cloud security solutions uphold compliance?

Debunked: Cloud solutions are taking heed and are doing their part to relieve this part of the “IT headache”. Many solutions integrate compliance standards into their product while allowing for modifications to the network policy where necessary. Built-in compliance is a winning strategy for business success, and ensures that there aren’t any loopholes the IT team is missing out on.

As Gartner puts it, “By 2020, a corporate ‘no-cloud’ policy will be as rare as a ‘no-Internet’ policy is today”. While in many cases, hype can have dangerous potential, in the case of cloud security, it’s a win-win situation: a win for digital transformation and a win for the IT team that’s eager to expand their business value proposition.

Portnox CLEAR – Security-as-a-Service Solution: The first completely cloud-based Security-as-a-Service solution for Network Access Control (NAC), CLEAR controls access for all devices and users to wired, wireless and virtual networks, to effectively confront digital business risks and cybersecurity threats.

Try it Now!