Author: Dinesh Harikrishnan

Cloud Security Solutions – Why do you need them?

Migration to the cloud is no longer an emerging trend. It is now a well-established method of running the operations of a business. With the cloud, you can manage data and applications in a secure environment and ensure that your users face virtually no latency while using your applications. But although the cloud comes with a basic framework for security, it still has its inherent security risks which need highly specific cloud security solutions to reliably protect your data.

To understand the need for implementing an effective cloud security solution, a deeper understanding of what causes and constitutes a cloud security threat is important.

Why Do You Need Cloud Security Solutions?

Unsecured Access Points

With several of your applications operating from the cloud, it is crucial to manage their access. Traditional methods of granting access to applications on the cloud require users to remember several sets of credentials. But with such a method, forgotten passwords would be common, draining the productivity of both your IT team and your users. To overcome this, users tend to set weak passwords which are easy to remember. But weak passwords are also easy to hack! The solution to this problem is to use an Identity and Access Management solution like CloudNow Technologies’ Akku.

Unprotected APIs

Application Programming Interfaces (APIs) are software interfaces which allow two different components of software to talk to each other. APIs are responsible for getting the requests from client systems and passing it onto the server and then retrieving the response and sending it back to the client. Considering that such an integral component is a part of your network architecture, a web application security solution is kept in place to eliminate the threat of unchecked network access from unauthorized users.

Types of Cloud Security Issues

DoS attack

DoS or Denial of Service is a distributed and malicious attack, designed to corrupt your servers and deny access to legitimate users. Such attacks require a complete hack of your network and injections of the attack code. A DoS attack is another common threat faced by organizations operating on the cloud. To eliminate this type of attack, it is important to maintain an intelligent firewall which can effectively stop the attack.

Data Breach

Cyber wars now directly translate to breaches and corruption of data. Since most organizations have to rely on third-party cloud vendors for storage, they increasingly feel like they are not in control of what happens to their data and applications. Data breach is one of the most common types of security threats, whether it happens on the cloud or any other type of storage. For this reason, companies have to go a step further and deploy high-end security solutions to prevent data breaches. While the move to the cloud can improve the efficiency of your operations to a great extent, it also requires you to choose a vendor you can trust to protect your network against the threats mentioned above. CloudNow’s cloud security solutions provide you with the security edge you require to peacefully conduct operations on the cloud without worrying about the threats trying to breach your network.


Does your IAM solution really need an Agent?

Most IAM tools utilize browser extensions or applications installed on the end-user’s machine, or on an Active Directory, for access to identity. But why?! A user can be identified even without an agent – so having an so-called ‘lightweight agent’ sitting in your Active Directory itself is not the most secure way to manage user identity.

Whenever you create a dependency to achieve a particular solution, it is important to ensure the solution is 100% secure and that applies for the dependencies (Agents) too. This could make the architecture slightly complicated, depending on how it works.

Another important factor against the use of an Agent-based architecture is that  you have to trust the Agent not to exceed its scope. This is very important because even many of the applications and services that we trust these days are not actually secure, and many act beyond their scope. For example, as per Digital Content Next, even the big boy of the tech industry, Google, still collects user location information even after turning off location settings.

So the big question is, when the things can be done without an agent, then why use an agent at all? People say it is for efficiency, and may be they are right. But is this worth the compromise on transparency and security?


Safer Interactions with the Internet through a Web Application Firewall

The internet represents a revolutionary step forward in the way data is stored and accessed, and in the way business is done. Most enterprises make use of user-friendly websites or web applications which allow their users to interact and transact.

But allowing users to seamlessly interact with your server and database presents some problems too. Primary among them is that it is difficult to differentiate between genuine users and hackers.

This is where a Web Application Firewall (WAF) comes in. A WAF allows you to protect your servers from online attacks on the internet.

For instance, there may be several nodes or entry points into your network, which security threats from the internet can penetrate. A robust security solution should ensure that these individual layers or nodes stay uniformly protected. Even if one of the layers is compromised, the impact of the breach could be severe. But micromanaging the security of every node in your network is time-consuming and invariably increases the latency of system operations.

A Web Application Firewall (WAF) can help you ensure the security of your network by monitoring and controlling all the HTTP conversations that your systems have with the internet.

What is a WAF and how does it work?

A Web Application Firewall comprises a set of instructions or protocols which have to be adhered to when using web-based applications. It protects your network and servers from websites whose scripts could be infected with malicious code intended to breach your security and access your data.

While using web applications, your searches and actions are considered client requests. These requests are processed by proxy servers which are kept in place to protect the client system. The proxy server receives the correct response from remote servers and transmits the data back to you.

A WAF acts a reverse proxy which protects your servers from attacks. It is an intermediary layer between the client and server, which makes it seem like the response is forwarded by an actual proxy server.

Website Filtering using WAF

A robust WAF comes with advanced DNS filtering features which examine every request from your network and send back only relevant and secure results. In addition to providing a layer of security to your servers and filtering websites based on its security loops, an effective web filtering solution should also simply allow you to blacklist websites because they could be irrelevant to the work done by your employees. Unmoderated internet access can have serious repercussions in terms of productivity drain.

Akku from CloudNow Technologies is a comprehensive solution to all your website filtering needs. It is a cloud-based web filtering software which allows you to specify which domains need to be blocked, for any reason – especially security or productivity concerns.

Protecting Your Vault: Safeguard your Data Center with an IAM Solution

At most enterprises, data centers are a repository of information contained within a network of servers from where data is transmitted to other touch points for processing. While these data centers could be cloud-based or on-premise, the security of such business-critical data is of paramount importance.

There could be several vulnerabilities in your network in the form of entry points that seem like they can be ignored. While there are several measures you can implement to physically secure your data center, it takes a lot more to secure remote or even on-premise servers from virtual attacks. An effective data center security solution will allow you to intuitively monitor all the entry points for possible attacks and ensure that you are protected against any breach.

One major part of the solution is the implementation of an Identity and Access Management (IAM) solution as part of your security system.

Staying Protected Online using an Identity and Access Management Solution

The two biggest focus areas for any security solution are authentication and authorization. Although there are overlaps in the usage of the two terms, there are distinct in the way they allow access of data.

Authentication determines if the user trying to enter a system is in fact who he/she is claiming to be, while authorization determines whether the user has the permission to access the data or application that he/she is attempting to access.

A comprehensive IAM solution should be able to intelligently allow you to do both by acting as the Identity Provider (IdP) for your cloud, on-premise or hybrid network and interact with the servers in the data centers to check for authentication and authorization using advanced, yet easy to implement, system architectures.

The Akku Solution

CloudNow’s Akku is an enterprise-grade IAM solution that plays this role perfectly using its custom SAML to provide a robust Single Sign-on (SSO) solution, or to integrate with an SSO solution already in place for your other applications. As an IdP, Akku communicates with the server at the time of login to carry out authentication and validate authorization.

By using a high-end security solution, you can effectively control access to your network and data center and reduce the number of resources dedicated to data center security.

Akku also removes any need for any middleware which could otherwise complicate or even corrupt the security system.

The implementation of an efficient and cost-effective security solution like Akku can go a long way in allowing you to focus on improving the operational efficiency of your organization instead of being caught up with the security threats to your data.

A Step Closer to GDPR Compliance: A Strong Password Policy

The European Union enforced the General Data Protection Regulation (GDPR) in May 2018 with three main aims: to harmonize data privacy laws across Europe, to protect and empower the data privacy of all EU citizens and to reshape the way organizations across the region approach data privacy. As you can see “data privacy” is the keyword in all three of the above mentioned aims. With multiple data breaches coming to light in the recent years, even from several of the world’s biggest corporates, the European Union has enforced stringent measures to regulate the use and prevent the misuse of citizens’ data through the GDPR.

Compliance and Consequences

As stated specifically in the GDPR, all enterprises (whether businesses or organizations) must take a “high level of protection of personal data” as one of their top priorities so that the “abuse or unlawful access or transfer” of such data may be prevented. If data is breached, or if GDPR procedures are compromised, the enterprise will face serious penalties. The fine for the non-compliance to GDPR for breach of data could be up to €20 million or 4% of annual global turnover, whichever is higher, depending on the type and extent of the breach.

This applies not only to enterprises within the EU, but also to those that may be located outside and offer goods or services of any type to the EU. The GDPR rules also apply to cloud controllers and processors.

The Emphasis on Passwords

Interestingly, the GDPR does not place any direct regulations on the way passwords are created or used. However, when it comes to the protection of online data, it’s hard to argue against securing passwords being the logical first step. On the one side, businesses that provide access to customers through an online portal typically ensure that they are creating secure passwords to sign in to by enforcing password policies that define their length and other parameters.

However, the slip often occurs when the employees of these enterprises are allowed to create weak passwords for accessing in-house applications. What is often forgotten is that these applications also carry sensitive data that belong to both the enterprise and its customers. A compromise here can cost the enterprise more than just the data; it will cost its credibility as well.

A strong password policy, therefore, becomes a key first step in the path to GDPR compliance.

The Inevitability of a Password Policy

By enforcing a strong password policy, administrators can ensure that users of an enterprise’s applications set up and use only passwords that are secure and, therefore, much less susceptible to brute force attacks and other hacking attempts.

A password policy defines and enforces a set of rules that include the minimum length, acceptable combination of small and upper case letters, use of numbers and special characters, expiration period of passwords and so on.

Without a password policy, the administrators of an enterprise would have no control over the type of passwords their users set, and would have their hands tied when it comes to situations that lead to a data breach, making it hard to demonstrate the GDPR’s requirement of a “high level of protection of personal data”.

This makes a strong password policy a critical requirement for every on-premise as well as cloud-based application, both for data security and to work towards complying with this aspect of the GDPR.

The Hybrid and Multi Cloud Conundrum

Unfortunately, setting in place a password policy across all of an enterprise’s applications is much easier said than done.

Most enterprises use a wide range of applications across different platforms – both cloud-based and on-premise – with each application operating on different technologies and each with its own identity management and password policy, controlling how users set up passwords in each application can often be an expensive and time consuming process.

Implementing a common bridge layer across of the applications used by the enterprise in the form of an Identity and Access Management (IAM) solution to act as the identity provider (IdP) across all applications is the best way to overcome this challenge.

The Akku Solution

Akku is an identity and access management solution that integrates all of the on-premise and cloud-based applications of an enterprise, providing a single platform for administrators to control employee access, permissions, and levels of control within its different applications.

With Akku playing the role of the identity provider (IdP), it enables administrators to set up a single password policy that will instantly be applied to all of the applications that are accessed by a user at the workplace. This password policy holds good, irrespective of whether the application is on-premise or cloud-based, or across different platforms. Akku also allows for the secure resetting of passwords, as specified by GDPR standards. Besides password policy enforcement, Akku also utilizes a custom salted-hash function, users’ credentials are also encrypted to ensure a high level of security.

Want to explore a quick and hassle-free password policy implementation across your enterprise applications? Get in touch with us today at sales@akku.work

Permit Access only from Approved Devices and Whitelisted IPs!

Allowing your users to access your official data from anywhere and at any time sounds like a great idea! They can complete their work even when they are on the move by accessing your company’s cloud-based applications. So, why should we restrict access when it has all these pros?

When you permit unshackled access to your company’s applications from any location and device then you also expose your company’s sensitive data and apps to the risk of security or privacy breaches. The possibility of unauthorized access to your sensitive data is a major concern for any company using cloud-based applications.

Why do you need IP restriction?

IP-based access restriction is a great way to secure and protect your mission-critical business data outside your LAN by preventing access to your apps from any IP addresses other than your trusted whitelisted IP ranges.

How does IP-based restriction work?

An IAM solution offering IP-based restriction uses a customized SAML API and integrates with your cloud-based applications. That way, identity management is brought into a common platform across all service providers, with the IAM solution acting as the identity provider. With the identity provider enabling one point control, it is possible to restrict access to your applications only from permitted locations, regulations and IP addresses.

Why restrict based on device?

Device-based access restriction allows you to allow access for specific users only from authorized devices, to prevent misuse or loss of data – that way, users cannot access applications from devices that have not been approved for their use, and unauthorized people cannot access data from devices that may have been approved for other users.

How does device-based restriction work?

With many IAM solutions, device-based restriction is applied through the use of plugins – however more advanced solutions make use of a certificate-based authentication method which has the major advantage of being tamper proof.

A secure certificate-based authentication is completely platform and browser independent and enables cloud administrators to provide or revoke access to SaaS based applications only from specific devices, even when they are outside the office network. Restricting access based on device helps to minimize data breaches and provides the right access to the right people.

Akku offers an IP and device based access restriction feature to help ensure that your data is secure and well protected.

Addressing the Data Security and Audit Worries of a Leading Manufacturer

Company X is a leading automotive hardware manufacturer. In the competitive manufacturing environment, documentation of activity are standardization of processes are critical requirements.

In the case of Company X, this was already in place, and in fact they had achieved ISO certifications for their process-based approach and class-leading quality.

However, certification brought with it a constant stream of audits to ensure that processes were in fact being followed, and standards maintained. This posed a recurring problem, since a single failed audit could result in the loss of certification and loss of business.

The employees of Company X were well equipped – every employee was given an email address, and employees above a certain grade were provided with a laptop and a smartphone as well. But being an ISO-certified enterprise, the security of devices and data were vital.

Diagnosis and Prognosis

Given the background and the critical business impact of a failed audit, potential problem areas were quickly identified, along with solutions.

One of the first problem areas that needed to be addressed was that many employees tended to set weak, easy-to-crack passwords that exposed the company to data security threats, while also failing to comply with ISO standards.

A strong, universal, standards-compliant password policy was necessary to ensure uniformly high security across user accounts.

A mandatory ISO-compliant password policy for all users could easily be set up with Akku.

The next point of concern was the possibility that sensitive business data could be compromised by employees.

The solution to this was to enable employees to access their company email accounts only from the devices provided by the company.

Akku enabled restricting access to company mail only from devices with its SSL Key installed.

Another issue identified was that website browsing restrictions were implemented only on the company’s firewall. Therefore, exposure of company devices to malware and external threats while outside the firewall was a looming worry.

A DNS filter to restrict browsing access even outside the firewall became essential.

Akku’s website filter provided this functionality with powerful control and ease of use. This helped to keep the company’s devices secure, whether they were located within the company firewall or not.

This type of device-based access control offered by Akku seemed to tick all the boxes, but it would fail to serve its purpose if it could be tampered with by a user.

Many legacy solutions built using plugins were found to be vulnerable to misuse – with these solutions, it was possible for users to find a way to circumvent the access control by simply removing the plugin to enable unrestricted access. The device could then be made to appear uncompromised by reinstalling the plugin later. Such a solution was far from water-tight.

With Akku on the other hand, the implementation of a certificate-based architecture overcame this potential challenge. This was because any attempt to tamper with Akku’s certificate would completely restrict access to their authorized services like official email and other SaaS-based applications. Reactivation would require a certificate password, available only with the systems admin.

By enabling easy identification of any attempts to evade the implemented access restrictions, potential leaks were plugged and accountability enforced.

Trial by Fire

The road to full implementation of Akku was a challenging one.

After the problem areas at Company X were identified and Akku was presented as the solution, a PoC was run successfully with 30 users to confirm that all requirements were in fact addressed completely.

With this first hurdle crossed, the client next proposed implementation and testing at their Japanese parent company. Stringent testing on every parameter of Akku’s performance was carried out over a period of several weeks in Japan.

At the end of this process, Akku was approved for the final roll-out across 300 users.