ESET dope la proposition de valeur des prestataires en infogérance (MSP) en annonçant un module pour ConnectWise

Le nouveau module ESET Direct Endpoint Management, module de surveillance distant, facilite et accélère les processus d’installation des prestataires de services gérés

ESET a annoncé le lancement de l’ESET Direct Endpoint Management en collaboration avec ConnectWise, une société qui transforme la manière dont les prestataires de solutions technologiques bâtissent, gèrent et font progresser leurs activités. Le module d’extension RMM (Remote Management and Monitoring - gestion et surveillance à distance), destiné à la solution Automate de ConnectWise, accélère et améliore les processus d’installation des points d’accès ESET par des prestataires en infogérance (MSP).

ESET Direct Endpoint Management génère une connexion directe entre les points d’accès ESET et la console Automate de ConnectWise. Le module, qui a été développé pour les besoins des partenaires qui ont recours à la solution ConnectWise, tire parti de l’agent ConnectWise existant afin de simplifier les processus de déploiement et de gestion sans compromettre les performances ou les fonctionnalités.

ESET propose déjà un module qui connecte ESET Remote Administrator (ERA) avec ConnectWise Automate. Toutefois, cette nouvelle version n’oblige pas les MSP à installer ERA. Cela leur évite de devoir gérer des serveurs supplémentaires ou une console intermédiaire. Les MSP peuvent ainsi être opérationnels plus rapidement et assurer la continuité de leurs services en minimisant les problèmes dus à une intégration complexe.

« Nous entretenons des relations étroites avec ESET depuis de nombreuses années. Ayant travaillé avec eux, nous savons que ce partenaire est un acteur technologique fiable, qui a déjà fait ses preuves », déclare Travis Vigneau, directeur Canaux de vente et Alliances chez ConnectWise. « Ce nouveau module direct illustre la volonté d’ESET d’améliorer constamment les solutions que la société propose à l’ensemble de l’écosystème. »

« Nous comprenons le rôle important que jouent les MSP et nous désirons les aider à surmonter les défis auxquels ils peuvent être confrontés », souligne Jeronimo Varela, directeur commercial international chez ESET. « Voilà pourquoi nous nous concentrons sur le développement des meilleurs outils possibles et de solutions de protection de pointe, non seulement afin de garantir que nos MSP puissent prester efficacement des services de qualité supérieure mais également afin qu’ils puissent devenir des conseillers de confiance pour leurs clients. »

Pour tout renseignement supplémentaire concernant le programme MSP d’ESET, nous vous invitons à utiliser ce lien.

A propos de ConnectWise

ConnectWise transforme la manière dont les prestataires de solutions technologiques bâtissent, gèrent et font progresser leurs activités. Notre gamme de solutions logicielles, primée à plusieurs reprises, procure une expérience transparente, totalement intégrée, à des sociétés basées dans plus de 50 pays. Nous leur donnons ainsi la possibilité d’accentuer leur productivité, leur efficacité et leur rentabilité. Couplées à notre recherche incessante d’innovations, à notre puissant réseau d’idées et d’experts, à une passion inégalée pour nos utilisateurs, et à plus de 35 ans d’expérience, les solutions logicielles de ConnectWise procure aux entreprises le support qu’elles désirent, à chaque étape de leur existence commerciale. Pour toute information complémentaire, veuillez visiter le site www.ConnectWise.com.

Concerns about data breaches hitting all-time high

By Tomáš Foltýn

Organizations from various industries across the globe are increasingly hip to the magnitude of the problem posed by data breaches, with 44% of them feeling “very” or “extremely” vulnerable to data threats, according to some of the key takeaways from the global edition of Thales’ 2018 Data Threat Report.

This is a sharp increase from 30% just one year ago. In the United States alone, the ratio nearly doubled – from 29% to a full 53% this year. In total, 91% – up from 88% in the 2017 report  – admitted to feeling some degree of vulnerability to data breaches.

The report, now in its 6^th edition, sheds light on the extent of data breaches at medium and larger enterprises worldwide. The report is underpinned by a survey that Thales, a French multinational aerospace and defense technology provider, carried out together with 451 Research. It polled 1,200 senior IT executives from various sectors in Germany, Japan, India, the Netherlands, Sweden, South Korea, the United Kingdom, and the US.

A record-high proportion of organizations worldwide (67%) said that they had been breached at some point, up from 56% in the report’s previous edition.

When only the past 12 months are considered, as many as 36% of organizations globally (and 46% percent in the US alone) have suffered a breach. This is up from 26 percent worldwide in the report’s previous edition. A total of 15% of enterprises have had this experience repeatedly, having suffered breaches both in the last year and earlier.

New environments, new challenges

The increased exposure to data threats in general comes in part down to the rush to adopt new environments that engender fresh risks. Also to blame, according to Thales, is “a failure to adopt modern data security methods for existing data sets”.

Virtually all organizations have embraced cloud technology. Big data (99%), the Internet-of-Things (IoT) technologies (94%) and Blockchain (92%) are also inching close to universal adoption. Nearly all (94%) enterprises use sensitive data within such digitally transformative technologies.

The report suggested a three-pronged approach to stem the tide of data breaches – data encryption, access control on a need-to-know basis, and keeping a close eye on data usage and access patterns.

It found that the greatest proportion of the respondents (77%) rated data-at-rest defenses (encryption, tokenization, etc.) as the most effective tool for protecting data. And yet, from among five types of technology under review, data-at-rest security receives the lowest increase in planned spending.

The report also notes two legislative landmarks that have been introduced by the EU. The General Data Protection Regulation (GDPR) affects any company processing or collecting the data of a European Union citizen, regardless of where the company is based. The revised Payment Services Directive (PSD2), for its part, is effectively breaking down the monopoly of banks on their customers’ data.

https://www.welivesecurity.com/2018/02/15/thales-report-data-breaches-time-high/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Patch now! Microsoft fixes over 50 serious security flaws

By Graham Cluley

This week saw the second Tuesday of the month, and everyone who is responsible for protecting Windows computers knows what that means: another bundle of security patches have been released by Microsoft.

This month’s “Patch Tuesday” included security updates for Internet Explorer, Microsoft Edge, Microsoft Windows, Microsoft Office, Adobe Flash Player, and other software, tackling over 50 security vulnerabilities.

The most serious security patches have been given Microsoft’s highest severity ranking of “critical”. That means that Microsoft’s security team believes that the flaws could be remotely exploited by malicious hackers, often to plant malware designed to hijack targeted computers without user interaction.

One of the most worrying security holes addressed by the patches is a memory corruption bug in Outlook (CVE-2018-0852) that could allow an attacker to remotely trick your computer into running malicious code.

The attack can be triggered by opening a boobytrapped attachment, visiting a poisoned webpage, or simply viewing a malicious message in Outlook’s preview pane.

Here is Microsoft describing how a hacker could exploit the flaw:

Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Outlook software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.

Although there is no evidence yet that malicious hackers are exploiting this Outlook flaw, the fact that a computer can be compromised via the preview pane makes it particularly threatening. Patching, therefore, should be a priority.

A series of other critical security holes have been found in Edge and Internet Explorer, which could allow remote code execution just by visiting a malicious webpage.

There’s no doubting Microsoft’s desire to fix as many vulnerabilities as it can with its monthly patch bundle, but there’s at least one recently-disclosed serious security hole in a Microsoft product that has not been addressed this time.

Last September, security researcher Stefan Kanthak told Microsoft about a flaw in how the Skype desktop app updates itself which could be exploited to allow an unprivileged user to escalate themselves to full “system” level rights, giving them God-like rights over the computer.

Microsoft confirmed to Kanthak that it was able to replicate the problem, but told him that it would not be fixed until a new version of the software was released, rather than via a security update, due to the “large code revision” required.

And there’s one other possible wrinkle in your security blanket.

Last month Microsoft warned that some security products were incompatible with its mitigation against the Meltdown CPU flaw, and as a result would not receive any further Microsoft patches until those products certified that they would not cause problems.

Fortunately most of the major anti-virus products are now compliant, and ESET customers – for instance – don’t have anything to worry about, as their security products are compatible with Microsoft’s patch for the Meltdown Intel Flaw).

Obviously it’s a good idea to update your computer systems at your earliest convenience. Backing up essential systems before applying the patches is advisable, just in case something goes wrong. And if it’s not convenient, maybe now is the time to make sure it *is* convenient in future.

https://www.welivesecurity.com/2018/02/14/patch-microsoft-security-flaws/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Blockchain Hardened devices: Can they restore privacy with security by design?

Regardless of your favorite or most hated device due to security concerns, the technologists behind them and the software they use, should share a key concern: “Security by design (and by default)”. While a strong line of prose, Security by Design – as driven by the Consumer Trust Alliance (CTA) in the US and now popularized in the European Union by the huge corpus of the GDPR text – is much more than good copy.

Privacy and security by design applies far beyond mandated data and privacy practices, processes and provisions that GDPR demands. It also gives notice, to the hardware and software providers to tighten up security. For us here at WeLiveSecurity, incidents like Meltdown and Spectre shifted our usual focus away from malware and software exploits, forcing us instead to refresh our understanding of what hardware suppliers are doing to make our digital world safer too.

Regulation vs. Good Faith?

While some might see these incidents as an inevitable consequence of our reliance on technology, like the pollution produced by fossil fuels, many businesses and consumers have expressed outrage, leading to the organizing of a class action lawsuit. What does this say about the scrutiny older technologies will face in the future?

Lawsuits aside, considering how communications and data sharing have become central in today’s world, we should not only ask whether hardware suppliers have done due diligence, but whether users are ready to educate themselves and limit investment into products/services in the face of serious vulnerabilities.

“The mobile environment, as dynamic as it is, faces a paradox”

While, few in hardware or cybersecurity R&D could have anticipated digitization’s impact on business or society in 1995, at this point all users have a role in solving this challenge as industry simply tries to meet the market’s expectations as regards rapidly balancing access and security in the digital transformation.

Growth in IT over the last twenty plus years has generally followed on the heels of promised improvements in productivity, collaboration or connectivity, but not always security. However, the last five years, has seen a marked shift, with nearly every web service becoming HTTPS, encryption featured in nearly every third-party communications app and most software on auto updates. The last two years have also seen intense discussion within governments wanting to stop encryption or have back doors.

These developments show that security technology is now keeping up, or outpacing other technological and regulatory developments. Thus, while users’ wants often continue to trump their appreciation of risk, the industry has responded and in many cases gotten ahead of popular demand. And despite 2018 kicking off with Meltdown and Spectre, significant light fell on improvements to the tools we use to secure software, hardware and the internet. Is blockchain technology that silver bullet?

Is Blockchain the game changing tool?

Joining the lineup alongside two-factor authentication and encryption is blockchain – as popularized by its most popular offshoot cryptocurrency. While WeLiveSecurity has written extensively on security aspects of cryptocurrencies -the good, the bad and the ugly- we have done less so on Blockchain itself.

Perhaps that’s because with the threat landscape as diverse as it is, there is strong evidence that covering basic aspects of security more broadly can deliver better results across the wider online ecosystem. But certainly blockchain, while not new tech, is the vanguard of something broader, the Encryption of Things (EoT). Those things (devices) of course, exist without their software guts, and in many cases security can be engineered into their bones. But what about that smartphone interface?

Well, let’s try to find some extra secure devices! Aside from military-grade devices and specialized enterprise grade communications devices, and encrypted satellite phones, options are thin. This is primarily due to the costs of using software/App-based (here is an interesting example, BitVault) implementations of two-factor authentication and encryption being considerably lower -and still falling- than that of dedicated devices. Ironically, dedicated devices still rely on software upgrades and updates.

Pushing on

“The last two years have also seen intense discussion within governments wanting to stop encryption or have back doors”

A few Google searches later you’ll find the Solarin smartphone by Sirin Labs. This first product, priced at roughly US$14,000 in 2016, introduced a blockchain-based secure smartphone to market. That first device got off to a glacial start, now a new incarnation of the phone has been shown. The Finney Phone (named after Hal Finney – bitcoin pioneer) is priced to hit shelves at a more realistic 1,000 USD. Prices aside, a Blockchained-hardened OS would still face challenges. Notorious for the power consumption needed to process cryptocurrency transactions, imagine the power demands of a few billion Blockchain-hardened phones. Is that scalable?

The anticipated FINNEY devices are marketed on Sirin’s website as “the first cyber-protected, blockchain-enabled mobile phone and PCs”, and mean that the devices – which also include a desktop PC- “–will form an independent blockchain network, with a dedicated distributed ledger both scalable and lightweight”.

SIRIN’s Finney phone boasts a host of security measures, some familiar to cybersecurity vendors. Take behavior-based intrusion prevention system or multifactor authentication for example. The departure begins with the physical security switch (wallet protection), Secured Communicationss (VoIP, text, email) and its core feature –the A step too far?

tamper-proof blockchain-based Android OS.

I’ve already mentioned scalability, but while the product aims to live up to the true spirit of security by design, is this level of security necessary or even practical?

The mobile environment, as dynamic as it is, faces a paradox. It can only be as secure as public awareness and good practice allow, since human factors are core to security. For example, if people don’t carry RFID shielded wallets, how much utility can there be in cryptocurrency? Closer to home, if users leave default settings on ISP provided home routers, why invest in super secure devices?

The intent of the hardened device is clear, distributed encryption equals significantly improved security. With Blockchain Hardened handsets, a business case born in 2017?

Sirin’s ICO reaching completion December 26, 2017, production looks to have gotten a green light.

Features are one thing, but predicting which factors will enable the cyber-hardened Finney phone to find market success is anyone’s guess. Another barrier may be the acceptance of services like Apple Pay and other secure Mobile Payment platforms as a kind of cryptocurrency, e.g. no cash ever trades hands and card details are never transmitted. This payment approach also has stability and the backing of the world’s banks and governments. It’s practical security that average users are unlikely to undermine through poor practice.

All that said, security by design and the Finney phone, may have found their moment. 2017 showed us the Cost(s) of our connected world via a diversity of threats to everything from critical infrastructure in Ukraine, to business via the devastating global WannaCryptor.D outbreak and DiskCoder.C data-destroying pandemics.

Now with ongoing attacks on cryptocurrency infrastructure, Mobile malware and zombie IoT devices upping the ante, anxiety is running high. It’s no wonder that just prior to Christmas, the price and interest in bitcoin (and blockchain) exploded. Lucky for Sirin Labs, and their competitors, the last 12 months have seen a market materialize around them. What the threat landscape brings in 2018 and whether more vendors will follow now seems more likely. Let’s see what develops at the booths of hardware providers at Mobile World Congress in a few weeks’ time.

https://www.welivesecurity.com/2018/02/13/blockchain-hardened-devices/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

All HTTP websites to soon be marked as “not secure” by Google Chrome

By Graham Cluley posted 12 Feb 2018 - 11:51AM

If you’re still running a website that is still using insecure HTTP then it’s time to wake up and drink the coffee.

Because unless you take action soon, you’re going to find many of your visitors are going to distrust your website.

The reason? Google is pushing ahead with its plan for the Chrome browser to start labelling all sites that continue to use unencrypted HTTP as “not secure” from July 2018.

A marked improvement over HTTP, the HTTPS protocol provides end-to-end encryption between the website’s server and your computer,  preventing snoopers from seeing what messages you might be sending to a site, or the information you may be downloading.

In the last year more and more sites have made the switch to HTTPS, which is terrific news for everyone who cares about security and privacy.

According to a Google blog post, more than 68% of Chrome traffic on Android and Windows is now protected with HTTPS. The figure is even higher on Chrome OS and Mac, where Chrome traffic is protected over 78% of the time. And, importantly 81% of the top 100 websites are using HTTPS by default.

That’s excellent progress, but Google wants to push HTTPS adoption even harder.

Google’s Chrome browser has already been marking HTTP pages that collect passwords or credit card information as not secure since early 2017. It then began displaying the “not secure” warning in two additional situations: when an HTTP webpage is visited in Incognito (private browsing) mode, and when users enter data on an HTTP webpage.

But this latest step will brand all HTTP sites with a non-secure stamp, and owners of non-HTTPS websites need to consider how their site visitors will react to that warning. My guess is that it will unsettle many users.

Many internet users may not understand the difference between a secure encrypted HTTPS connection and whether a website itself can be considered to be properly secured or not.

Remember, just because a website is using HTTPS does not mean that it can necessarily be 100% trusted – and similarly, a website that is still using HTTP just might be doing a decent job in how it handles the rest of its security or your personal information (although its lack of HTTPS in such a situation would be a surprising omission).

However, Google is between a rock and a hard place. It seems impossible to find a mark of whether a website is properly encrypting information sent between its server and visiting computers that gets the balance right between being easy-to-understand, clearly visible, and not inferring that everything is safe (or unsafe) about the site you are visiting.

Google Chrome’s warning may not be perfect, but it’s the best we’ve got. And things are going to become even more obvious at some later date when Google changes its upcoming grey-coloured “not secure” warning in the browser’s URL bar to a vivid red colour alongside a warning triangle.

It goes without saying then, that if you haven’t already switched your website to HTTPS you really should.

https://www.welivesecurity.com/2018/02/12/http-websites-marked-google-chrome/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

How will WPA3 improve WiFi security?

By Cecilia Pastorino

In October 2017, researchers made public a serious vulnerability in WPA2, the security protocol that protects most of today’s WiFi networks. This discovery put the protocol’s security in the spotlight and led to discussions about the need for a new standard.

Finally, the WiFi Alliance, the organization that certifies WiFi devices, announced WPA3, a new and enhanced authentication protocol that is set to be rolled out in 2018. This new version isn’t aimed at improving the reputation of WPA2, as various manufacturers are patching the disclosed vulnerability in their updates. Instead, it seeks to implement new features and increase the security of a protocol that hasn’t been improved in the past 13 years.

This new protocol is looking to bring improvements in authentication and encryption while facilitating the configuration of wireless networks. Crucially for the enhancing of encryption, the new security protocol will feature 192-bit encryption. Although the Alliance did not explicitly state so, it is safe to assume that, just like its predecessor and as utilized in WPA, WPA3 will also use a 48-bit initialization vector. That way, this new protocol is in line with the highest security standards and is fit for use in networks with the most stringent security requirements, such as those of governments, defense or industrial systems.

Another notable feature of WPA3 is the implementation of the Dragonfly protocol, also referred to as Simultaneous Authentication of Equals (SAE). This is aimed at improving security at the time of the handshake, which is when the key is being exchanged. As a result, WPA3 is poised to provide robust security even if short or weak passwords are used, i.e. those that don’t contain a combination of letters, numbers and symbols.

This feature is very useful, especially considering that users have difficulties creating strong and hard-to-guess passwords. According to the WiFi Alliance, it will be almost impossible to breach a WiFi network using current methods such as dictionary and brute-force attacks.

Finally, for those who usually work remotely and use public WiFi networks in coffee shops, hotels or at airports, WPA3 will be a robust solution to privacy problems. This is because by applying individualized data encryption – where every connection between a device and a router will be encrypted with a unique key – it seeks to further mitigate the risk of Man-in-the-Middle (MitM) attacks.

“This new protocol is looking to bring improvements in authentication and encryption while facilitating the configuration of wireless networks”

The improvements that are expected to be brought by WPA3 are clearly aimed at strengthening the protocol and at enhancing security for users. At the same time, the protocol also seeks to simplify WiFi connections for devices that don’t have a graphical user interface (GUI) or, where they do have it, it is rather rudimentary. This is highly important if we consider just how many IoT devices hit the market every day. In these cases, connecting to a wireless network will be even simpler. We assume, therefore, that WPA3 will also improve connection by pressing the WPS button as used by WPA2.

Although more specifics about the implementation of WPA3 are not available yet, some standards that underpin this new protocol have already been around for some time. However, manufacturers will now be obliged to observe the applicable requirements in order for their devices to receive the ‘WPA3-certified’ seal of approval from the WiFi Alliance. On the other hand, since WPA3 will be newly incorporated into devices and given that many users rarely change their router at home, it will take a while before the protocol is used in all households.

Therefore, WPA3 is not an immediate replacement for its predecessor. On the contrary, WPA2 will continue to be maintained and updated for a long time while WPA3 is being incorporated into devices available on the market and before those devices are used in homes. In fact, the Alliance also announced that it will continue to perform security tests on WPA2 with an eye toward reducing the impact of vulnerabilities caused by unsafe configurations and towards further enhancing the protection of wireless networks. Therefore, until we have more information about this new protocol, we recommend you to continue to follow our tips for securing your WiFi network.

https://www.welivesecurity.com/2018/02/09/will-wpa3-improve-wifi-security/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29