Month: March 2020

“Password moniter let you know if your password gets comromised in dark web“Microsoft today announced upcoming features for its Edge browser based on Google’s Chromium open source project, the same browser Google’s Chrome is based on. Consumer features like Vertical Tabs, Smart Copy, and Password Monitor are coming soon. Microsoft also shared a few updates for existing or already announced features like Collections, InPrivate mode, and Immersive Reader.

After over a year of testing, Microsoft launched Chromium Edge for Windows 7, Windows 8, Windows 10, and macOS in January 2020. That launch was largely targeted at businesses — the company promised to ship more consumer features “later this year.” Microsoft isn’t ready to ship those features yet, but it is starting to unveil them. Additionally, Microsoft still plans to roll out the new browser as a Windows update (in addition to the standalone download). Today, the company told Windows users it will “come to your PC starting next month.”

One more thing: Google paused Chrome releases earlier this month due to the COVID-19 pandemic. Last week, the company resumed updates, said it would skip Chrome 82, and rescheduled Chrome 81 and Chrome 83. For Edge, Microsoft followed suit to be “consistent with the Chromium Project.” Still, with more people spending time in their browsers at home, Microsoft is eager to talk about upcoming Edge features.

Vertical Tabs, Smart Copy, and Password Monitor
Vertical Tabs is meant to help you “find and manage many open tabs at once.” You will be able to organize your tabs on the side with a single click. Microsoft hopes this will be useful when you’re researching a topic online and open dozens of tabs.

Microsoft Edge Vertical Tabs feature

Smart Copy is supposed to help you copy and paste content from the web into documents. Specifically, Smart Copy retains formatting, including any images or links.

Password Monitor will notify you if the credentials you’ve saved to autofill have been compromised as part of a hack. If Edge matches any of your saved usernames and passwords, a notification will prompt you to take action. A dashboard in Settings will list your leaked credentials and direct you to change your password on the implicated website. Browsers like Firefox and Chrome offer similar tools.

All three features are on their way to Edge’s Insider channels: Vertical Tabs and Password Monitor “in the next few months” and Smart Copy “next month.” Microsoft didn’t provide a date for when to expect them in Edge stable.

Collections, InPrivate, and Immersive Reader
Microsoft also talked about other Edge features today. Collections (first announced in May 2019) uses “cloud-powered intelligence” to collect, organize, share, and export content you find while browsing. Collections for desktop is still baking in the Insider channels and is coming to the Stable channel “soon.” Collections for mobile is set to arrive “later this spring.”

Edge Collections feature on desktop

InPrivate mode automatically deletes your history, cookies, and site data when you finish a web browsing session. InPrivate search with Bing, which doesn’t tie your searches to you, is in the Insider channels now and coming to the Stable channel “soon.”

Immersive Reader removes distractions on the screen to help you focus on the page’s content. Line focus, which highlights individual lines as you scroll, is “coming soon.”

Microsoft Edge Immersive Reader feature

Edge wasn’t the only Microsoft app to show off incoming consumer features. Microsoft today also unveiled Microsoft 365 for consumers, which includes everything in Office 365 plus new AI and cloud-powered features.

Zero trust is shaking up VPN strategies.
The zero trust model has been developed because the distinction between “external” and “internal” areas of information systems has begun to blur. Private applications stand alongside their SaaS-based brethren, while the infrastructure transitions from virtualised servers in the data centre to services and apps residing on public clouds.

Users are also changing. Not only are they quite often mobile, but they are also no longer strictly human beings. The number of APIs is exploding, and machines now speak to each other just as much as employees do. In these circumstances, it becomes difficult to determine who is “trusted” and who is not.

When a public web server can be hosted internally in a DMZ and a critical business application is running on a public cloud service connected to a database in the data centre, what then can be deemed truly internal?

Under such conditions, matching access control lists (ACLs) and access permissions to various clouds with Active Directory services becomes complex, and keeping perfect visibility on the rights of users across all these models is an unenviable task.

The remote access VPN is challenged
It is not surprising that the concept of VPN, created at a time when network topologies were very different, is no longer able to keep up. It’s no coincidence that many organisations are realising the increasing difficulty of adapting and maintaining their VPN configurations. The strategy of granting access permission at the outset followed by virtual internal freedom (even within well-segmented VLANs) no longer actually meets organisations’ needs. The advent of 5G, by increasing the opportunities for remote connections and possibly even replacing corporate Wi-Fi connections, will certainly not simplify things.

Microsegmentation to the rescue
This is where the zero trust model comes into play. If the perimeter disappears, then the notion of trust granted by default must also disappear. It needs to be replaced by a more agile model in which each resource, wherever it is, only accepts authenticated users no matter where they are connecting. This poses serious system and network architecture challenges. Will organisations have to put a VPN termination point in front of each application? Will organizations have to go back to multiple VPN clients on a workstation? And how can enterprises centralise the different rights and permissions of a mobile user?

Introducing zero trust network access (ZTNA)
The centralization is where zero trust network access (ZTNA) technologies can help. ZTNA offers a modern alternative to network segmentation and VPNs and delivers microsegmentation instead. ZTNA services treat each connection to each application as a separate environment with individual security requirements. And, most importantly, this is completely transparent to the user. Without launching a VPN client and using a simple local client that automatically becomes active at the start of the session, it is possible to seamlessly access various company resources, wherever they are and always with the same level of security—whether you’re in the office connected via Ethernet or moving over a 4G connection.

The ZTNA service is able to identify each private application (even shadow IT private apps) and applies a specific security policy defined by the company. It is, therefore, able to selectively encrypt, apply predefined policies, or demand additional authentication depending on the risk profile. And it works on any TCP or UDP connection, whether for native application flows (SAP, for example) or network protocols (SSH, RDP, etc.).

It then becomes possible to manage remote access to any type of application with precision, wherever it is hosted and regardless of the origin of the connection. This creates a secure segment of one between a specific authorized user and private application via a dynamic TLS-encrypted microtunnel. There is no longer any distinction between hosting options or connection modes (corporate network or 4G)—everyone, whether they’re employees or third-party users, must be properly authenticated before accessing a resource.

Adapted to the zero trust model
For this reason, organisations that choose to migrate gradually to a zero trust model should start implementing microsegmentation for some of their users now and start to build up an experience that will be valuable in the future when zero trust becomes unavoidable.

That day will be here sooner than you think…. Trust wil be more published without compromising on security .

Apply caution and common sense to your inbox

Links.. Documents should be cautiously handled. Risks will be exacerbated by the simultaneous relaxing of security controls in order to facilitate the use of non-standard web conferencing software and the sharing of files by email. Attackers will have both the opportunity and the means. MFA a must.

Expanding Threat Landscape

Employees suddenly taking their work computer home with them will find themselves stripped of protection as they trade the office network for their home Wi-Fi. Without internet proxy, NAC, IDS and NGFW, client devices will now be sitting exposed on potentially unsecured networks amongst potentially compromised devices. Endpoint security will have to bear the full brunt of protection. Internal network security may be compromised as well; employees might need access to resources previously only accessible on a wired network in one location. To make it reachable over VPN, internal segmentation might need to be flattened. This will open the door to malware spread and lateral movement. Client certificate authentication protecting web services might need to be turned off to enable BYOD working for employees that don’t have a company laptop. These changes must be scrupulously logged, and dependencies understood. The extra weight will have to be carried elsewhere: perhaps host AV policies can be tightened to compensate for lack of network protection, perhaps employee devices can be reconfigured to use a secure external DNS provider instead of the on-prem DNS server.

A new wave of attacks

Beyond the weakening of existing controls, spinning up new infrastructure will bring fresh risks. In January we saw a spate of attacks on web-facing Citrix infrastructure. Companies will be rapidly deploying VPN gateways, transitioning to Sharepoint and expanding their internet-facing perimeter. This rapidly increased attack surface will need monitoring and protecting. Security teams should be on heightened alert for brute force and server-side attacks. DDoS protection will also become more important than ever; for many companies this will be the first time that a DDoS attack could cripple their business by preventing remote workers from accessing services over the internet. We should expect to see a sharp rise in both of these forms of attack immediately.

Don’t make rash decisions

Both IT and individual employees will face blockers. There won’t be an authorised solution for their needs, and those needs may well be extremely urgent. At a time when businesses are extremely worried about their financial position and ability to operate, there will be pressure to throw caution to the wind and protect ‘business as usual’. This pressure may even come from the top. Security leadership must do the best they can to both push back against rash decisions and provide creative solutions. Well-meaning employees will get creative, and responsibility will be delegated to team leaders to “do what it takes”. It may be impossible for security to police this centrally but monitoring vigilance will be required to spot risky behaviour and non-compliance.
This is easier said than done; the SOC will be asked to monitor for incidents in a sea of change. Existing use-cases and rules will not apply, and companies will need a more proactive and dynamic approach to detection and response.

Your home is a business’ zero-trust environment

Unfortunately, there will be some within our companies that want to kick us while we are down. Sudden remote working is a godsend to malicious insiders. Data can now be easily taken from a company device over USB within the privacy of their own home. Security monitoring may be crippled or disabled entirely. This risk is harder to address. It may not be eliminable, but it can be balanced against the need for productivity and access to data. We should also be wary of those around us. We all hope we can trust the people we live with. But from a company perspective, employee homes are zero-trust environments. Confidential conversations will now be conducted within range of eavesdroppers. Intellectual property will be visible on screens and monitors in living rooms around the country. This risk is greater for younger demographics likely to be house-sharing, but it remains for all workers; delivery men, visitors to the house – they could all potentially steal a company laptop from the kitchen room table. Education of employees in particular risk groups will be key.

Adjusting to the new normal

Autonomous Response technology can also surgically intervene to halt malicious activity when teams can’t be there to stop it, protecting devices and systems whilst allowing essential operations to continue unaffected.
All of the above changes and risks create a monitoring nightmare for SOCs. We are entering into a period of digital unknown, where change will be the new normal. Data flows and topology will change. New technology and services will be deployed. Logging formats will be different.
The SIEM use-cases that took 12 months to develop will need to be scrapped overnight. For the next few weeks, business practice will shift rapidly. Static defences and rules will not be able to keep up, no matter how diligently and rapidly we rewrite them.  Companies need to leverage technology that can allow them to continue to operate amidst uncertainty without choking productivity at this critical time.

Work  will rapidly change the business scope but Security posture must be retained