Security or Functionality? Security Risks with Digital Transformation

Digital transformation has been adopted by most companies from around the world, resulting in a more connected and innovative business environment. Today, digital transformation essentially involves an organization’s adoption of IoT, cloud computing, machine learning, and AI.  Continue reading Security or Functionality? Security Risks with Digital Transformation

How Technology Can Simplify IT Security

Just last year, the popular Q&A site Quora suffered a data breach, as reported by Techworld in their article on UK’s most infamous data breaches. This just goes to show that even the best of businesses are finding it a challenge to secure their data and vital business information in this age of digital advancements.

IT security is, no doubt, an overwhelming, daunting, and expensive task. With cybercriminals getting more advanced and sophisticated, organizations are struggling to find security solutions that will effectively counter them. Continue reading How Technology Can Simplify IT Security

Data Protection & Data Privacy – A difference that matters

Data protection and data privacy are so closely linked that people (and sometimes even organizations) tend to think of them as synonyms. However, understanding the difference between the two is crucial to ensuring that both protection and privacy are maintained. Continue reading Data Protection & Data Privacy – A difference that matters

Agent-based Cloud Security Solution? No thanks!

If your organization relies on the cloud for a majority of its operations, you may want to look closer at the type of architecture your security solution uses – whether it is agent-based or agentless. While some might say that it is irrelevant and that you should focus only on the security solution’s efficiency, we beg to differ. Picking the right kind of cloud security solution can drastically affect your organization’s day-to-day operations and how much ownership you can take over the security solution. Continue reading Agent-based Cloud Security Solution? No thanks!

The Key to Data Security: WebAuthn

What is WebAuthn?

WebAuthn (Web Authentication API) is a global standard specification for secure authentication on the Web, formulated in 2018 by the World Wide Web Consortium (W3C).

This browser-based API allows user authentication on web applications through the creation of strong “credentials” and user-agent-mediated access to authenticators. This could be either in the form of hardware tokens (like U2F security keys) or in-built modules (biometric readers like Google Hello, Apple Touch ID) in the platform. Web Authn has garnered the support of all leading browsers like Chrome, Firefox, and Edge, and is compatible with all leading platforms.

How does WebAuthn Work?

With WebAuthn, a relying party (such as web service) can integrate a strong layer of authentication into applications with a choice of authenticators. It replaces the need for a password with the generation of a private-public key pair (credential) created for a website. While the private key is stored on the user’s device, the public key is generated randomly and shared with the server. The server then uses the public key to confirm the user’s identity.

The following steps are involved in WebAuthn:

  1. The user opens a website using their device
  2. On the request of the web service (replying party) through the Credential Manager API, the browser generates a new credential, specifying the user’s device capabilities.
  3. During the registration process, the user is offered multiple authentication options. This may vary from external authenticators to biometric authenticators like fingerprint analysis or facial recognition.
  4. Choosing any of the authenticators offered, the user completes the registration process.
  5. The authenticator generates a key pair (a public and a private key) – the public key is forwarded to the server, the private key is stored in the user’s device

Why use WebAuthn?

The public key and private key, both need to be used in conjunction. Therefore, by eliminating the need for a “secret” such as a password, WebAuthn drastically improves data security and prevents data breaches. Even if the public key is hacked, it will not function without the private key – which is stored in the user’s device – and becomes useless.

These are some of the scenarios in which WebAuthn can be useful:

  • Setting up two-factor authentication (with or without passwords) that is resistant to friction and phishing
  • Using biometric authorization that eliminates the need for passwords
  • Recovering lost or stolen devices and bootstrapping of new devices 

Find out how you can improve data security and prevent data breaches with Akku. Get in touch with us for a free demo today!

Beware of Credential Stuffing

In recent times, you might have noticed user accounts being compromised by the millions, and yet companies refute these claims saying that their systems are secure and have not been attacked. In these cases, the companies are right – instead of a direct attack, the hackers may have performed an attack called ‘credential stuffing’. In this type of attack, hackers get their hands on usernames and passwords of one application or service and stuff the same credentials on another login for another digital provider.

For example, if you have used the same user ID and password for creating your Facebook and Twitter accounts, a hacker who has access to your Facebook user id and password can use the same for getting into your Twitter account. This does not mean that Twitter’s systems are faulty. It simply means that your credentials have been stuffed. Credential stuffing attacks use code injection techniques to test the credentials against multiple accounts like social media, online marketplaces, and bank accounts. Once access is gained, the hacker can get access to personal information, credit card information and other personally verifiable information.

In recent times, this type of attack has gained popularity due to the fact that most users use the same user ID and password for multiple accounts. The situation right now is precarious for most online users – a recent breach of breaches has given hackers access to a whopping 2.2 billion user IDs and passwords. It is called a ‘breach of breaches’ because a few hackers hacked into millions of Dropbox and LinkedIn accounts and compiled a list of plain text credentials. However, another team of hackers hacked into this list to compile an even bigger list of stolen credentials.

If you have built enterprise applications, how sure can you be that your users have created different passwords for all your applications? There is no way for you to know for sure. However, you could put in place a password policy which prevents them from using the same password for all the applications in your network.

Akku from CloudNow Technologies allows you to set custom password policies to help you standardize the passwords set by your users. You can also leverage it to prevent the setting of the same passwords. To know more, get in touch with us now.

7 Ways in Which Akku can Help you Address Security Challenges

While it is natural to feel apprehensive on the cloud, especially if you are new to it, remember that there are a number of ways to stay in control of your organization’s applications and data, even while ensuring that authorized users can access them with greater ease.

Here are 7 ways in which Akku, the Identity and Access Management (IAM) solution from CloudNow, can help you address security challenges

1.Helping users create strong passwords

A password is the first and most basic level of security you can apply to protect your applications from unauthorized access. However, with several hackers and bots lurking on the internet, a password is also vulnerable to attack. With the provision to set up and enforce a strong password policy, Akku allows users to only set up strong, complex passwords that are difficult to crack.

2.Adding multiple layers of security

If your business relies on highly sensitive data, you need to protect it with more than just your users’ passwords. Akku’s Multi-factor Authentication (MFA) functionality does just that, integrating a powerful additional layer of security into the sign-in process. If this functionality is enabled, Akku demands users to reconfirm their identities by using a TOTP or a push notification.

3.Enabling admins to set up restrictions

Typically, a cloud application can be accessed from anywhere and at any time. This, while being one of the biggest boons of cloud computing, can also be a potential threat. This is why, Akku enables administrators to set up restrictions — to limit access to one or more critical applications outside of a certain time slot or location, or even from unrecognized IPs or devices.

4.Preventing suspicious logins

In addition to enabling administrators to set up tailored restrictions for each user based on time, location, IP address and device, Akku also detects and responds to suspicious and unusual user activity. For example, if a user has logged in from two different countries (one familiar, one unfamiliar) within a matter of minutes or hours, access will be denied.

5.Keeping admins in control, remotely

Akku comes with a smartphone application which enables admins to receive notifications and alerts, even when they are not in the office. Moreover, with one-click access to their dashboard, they can view or review user activity as well as provide, edit or revoke access and permissions to users.

6.Encrypting all data

Akku comes with custom salted-hash functionality – a combination of salting and hashing techniques – that is used to encrypt user credentials. This way, even if users are accessing your organization’s applications form unsafe or open networks, the data is kept safe in an encrypted format.

7.Maintaining filters for company-owned devices

Akku protects your company-owned devices from malicious content by enabling you to maintain DNS filters – blocking personal email, irrelevant website access, and YouTube filtering – even when the device is being used from a network outside the organization’s firewall.

Akku is a robust, flexible identity and access management (IAM) solution that can help your organization leverage the cloud without worrying about data security, privacy, compliance with standards, and productivity. To know more or to see how Akku can be integrated with your organization’s applications, get in touch with us today!

The Problem with SMS-based Authentication

As mobile phones became more sophisticated, their usage shifted from being communication oriented to application oriented. But phone numbers were never intended to be used as secure identifiers – their purpose is to simply act as subscriber identifiers during call routing. When applications use phone numbers in their login processes, it can give attackers and hackers an advantage.

Here are a few ways in which your OTP can be intercepted by hackers:

  1. Man in the Middle attack

This is a type of eavesdropping attack in which a hacker places himself as a proxy or relay between the OTP sender and receiver. For the sender and receiver, the communication will seem like it is happening only between those two, whereas it is actually passing through an impersonator. Black hat hackers often hack into financial websites and place high-level codes which will allow them to intercept messages between banks and users, making it convenient for him/her to access an account.

  1. Malware attack

Ready-to-download malware which can easily hack into a user’s mobile devices are available online. In addition to grabbing your SMS content, these can also access other areas of your phone like your gallery and directory to extract more personal information. In fact, a few of these malware are disguised as mobile applications like fitness trackers, timers, alarm clocks, etc.

  1. SIM cloning attack

Investigative agencies use SIM cloning attacks to monitor and track suspects. However, SIM cloning modules are easy to find and purchase by anyone if they look hard enough. Using this, a user is cut off from his/her mobile network and calls and messages are redirected to the new SIM in the attacker’s phone. To carry out a SIM cloning attack, the SIM being cloned has to be of the GSM type.

  1. SMS-C hack attack

All messages are required to pass to SMS-C servers placed in a mobile service provider’s network. Only after being processed by the SMS-C servers is the message transmitted to a mobile phone. If hackers manage to hack SMS-C servers, they can very easily gain access to all the messages entering and exiting the network. SMS-C servers are often protected by high-end security solutions which are hard to break through. However, it is not impossible.

  1. Brute force attack

In brute force attacks, any and all combinations of numbers are tried to get the right OTP. If the number of entries is limited, brute force attacks can become ineffective in gaining access to an account, simply due to the number of combinations available. It also helps if the OTP is 6 digits instead of 4 digits as the combinations required to successfully execute a brute force attack increases by a factor of 100. Due to such a poor success rate, brute force attacks are not preferred by hackers.

For organizations, there is no reliable way of finding if your employees’ numbers have been compromised. To ensure that your network is secure, we suggest looking for a less-risky option for authenticating your users. You could go for an improved multi-factor authentication method like using the biometrics of a person to verify his/her identity. While there are more sophisticated attacks which can hack a biometric authentication system, it would be almost impossible to recreate a person’s thumbprint or retina blood pattern.

With Akku from CloudNow Technologies, you can easily create a fool-proof identity and access management system by integrating multi-factor authentication using biometric scanners in your login process. To make a significant improvement to your network security by enforcing biometric multi-factor authentication, get in touch with us now.

Hashing And Salting – The What And How

“irgvctxmsr” – sounds like gibberish, doesn’t it? But if you were to decrypt this string using a mono-alphabet shift cipher where each letter has been shifted to the right by 4 numbers, you would see that it spells “encryption”!

Protecting critical data and information by encrypting them was first performed by Julius Caesar in 120 BC. The art of encryption has been through several modern shifts, and currently most of the data on the internet is protected using sophisticated encryption algorithms like AES (Advanced Encryption Standard), RSA (Rivest-Shamir-Adlemen), ECC (Elliptic Curve Cryptography) and PGP (Pretty Good Privacy).

Deciphering an encrypted message requires a key. Nowadays, messages are encrypted using public keys and decrypted using private keys. The private keys are shared privately between two trusted parties. Losing a private key can be disastrous, as encrypted messages can then be read by anybody with access to the private key.

Password Hashing

While encryption is a two-way function and is primarily done with the intention of being decrypted, password hashing is a one-way function. Hashing allows us to use a mapping function to map data of any size to a fixed length. The resultant output is called the hash value. Technically, hashing is reversible – however, the computing power required to get the original message makes it impossible for the original message to be decoded. Simply put, encryption protects the data in transit while hashing is used to authenticate the data and lets you know if it has been tampered with.

Here is how it works – consider that you have a digital document that you have digitally signed and uploaded to your website for another person to download. Now, you will run a hash function on the document and another one on your digital signature and encrypt the resulting hash values. Once a designated person downloads the document, the browser decrypts the hash values using a key and runs the same hash function on the document. If the resulting hash values are the same for the sender and receiver, it means the document and signature have not been tampered with.

Modern hashing algorithms include SHA (Security Hashing Algorithm), RIPEMD, WHIRLPOOL, and TIGER.

Salted Passwords

Salting is the process of adding an additional layer of security to the hashing process by adding a unique value to the end of the password and hashing the new password. By adding even one letter to your password and hashing it, you can change its hash value and make it harder for interceptors to find your password. For example, if your password is “V67gHD92”, you can add a unique character or string to the end of it and make it something like “V67gHD92SPICE”. Here, the word “SPICE” is called the salt.

Salting a password protects any data from brute force attacks in which bots attempt every possible combination of letters and numbers until the password is cracked. However, if the attacker knows your salt, the entire process of salting becomes worthless.

In this day and age where network and information protection requires meticulous planning and dedicated resources, we at CloudNow Technologies want to make things easy for you. Our network security solution Akku is designed to protect your network against sophisticated and high-level attacks. To know more about how we can help you protect your network, get in touch with us now.

3 Important steps to improve network security against brute-force attacks

A brute-force attack is a type of cybercrime which involves automated hacking activity using bots. The primary aim of a brute-force attack is to crack a password in order to gain access to a user account in an unauthorized manner. Using the automation tool, an attacker repetitively attempts different alpha-numeric combinations at considerable speed – thousands per second – until the user’s password is determined and the account is unlocked.

With the advent of the cloud and the rapid innovations in technology, a brute-force attack has emerged as one of the most common types of outsider attack against web applications.

Here are three steps that will go a long way in improving the security of your network against brute-force attacks:

Enforce a strong password policy

A password is the first line of security when it comes to preventing unauthorized access. A strong password policy, therefore, can ensure that your users set up passwords that are strong and not easily compromised. Here are some important aspects you can regulate by setting up a password policy:

  • Password Length

A brute-force attack typically works by continuously trying every possible combination using numbers, letters and special characters. The shorter the password length, the fewer the combinations and the easier it is to crack. If the password length is known (or is fixed), again, it becomes easy for the attacker to attempt combinations of that particular length, although it will take longer depending on its length.

  • Password Complexity

A dictionary attack is a subset of the brute-force attack, which attempts to crack a password by trying all English words and then trying them with multiple combinations of other words and numbers. If users are setting simple passwords because they are easy to remember, they will also be easier to crack.

  • Password Expiry

Periodically, the system must prompt the user to change their password so that any possible ongoing attack can be effectively guarded against. Moreover, this practice will also mitigate undetected breaches of privileged accounts.

Use multi-factor authentication

Multi-factor authentication puts an additional layer of security between the brute-force attacker and your data. With MFA, even if the password has been correctly identified by the bot, the attacker will be unable to proceed because the system will require either an OTP or a confirmation from a different device (such as a smartphone app).

Another way to set up an additional layer of security at the login point would be to use a captcha – a box showing warped text or images and require manual entry of a response. This will effectively keep out a bot that is executing automated scripts.

Set up an account lockout policy

Set up a policy wherein you can detect and block suspicious login attempts. Locking an account after three failed login attempts, or attempts to login from a different country or an unlikely hour can prevent intruders from entering into the system. To resume work, the authorized user will need to seek administrator intervention to unlock the account.

You can also set up a progressive delay lockout wherein an account is locked for a fixed period of time after a certain number of failed login attempts. The lockout period can progressively increase with the increasing number of failed attempts and helps keep out brute-force attack bots long enough to make them ineffective.

Akku is an Identity and Access Management (IAM) solution that comes equipped security features to accomplish all the steps described above. Whether you are working with cloud-based or on-premise apps or a combination of both, Akku can help you protect your data from brute-force attacks. Contact us today.