Search results

Strategic consulting – Blueprint for success Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

As cloud adoption and digital transformation increases, more sensitive data from applications is being stored in data containers. This is... Application Connectivity Management How to Make Container Security Threats More Containable Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 9/8/22 Published As cloud adoption and digital transformation increases, more sensitive data from applications is being stored in data containers. This is why effective container security controls to securely manage application connectivity is an absolute must. AlgoSec CTO and Co-Founder, Prof. Avishai Wool provides some useful container security best practices to help you do just that. What is Container Security? Organizations, now more than ever, are adopting container technology. Instead of powering up servers and instances in the cloud, they are using containers to run business applications. Securing these is equally as important as securing other digital assets that the business is dependent on. There are two main pillars to think about: The code: you want to be able to scan the containers and make sure that they are running legitimate code without any vulnerabilities. The network: you need to control access to and from the container (what it can connect to), both inside the same cluster, other clusters, and different parts of the network. How critical is container security to managing application connectivity risks? To understand the role of container security within the overall view of network security, there are three points to consider. First, if you’re only concerned about securing the containers themselves, then you’re looking at nano-segmentation , which involves very granular controls inside the applications. Second, if you’re thinking about a slightly wider scope then you may be more concerned with microsegmentation , where you are segmenting between clusters or between servers in a single environment. Here you will want to enforce security controls that determine the allowable communication between specific endpoints at specific levels. Finally, if the communication needs to go further, from a container inside one cluster within one cloud environment to an asset that’s outside of the data center, then that might need to go through broader segmentation controls such as zoning technologies, security groups or a firewall at the border. So, there are all these layers where you can place network security policies. When you’re looking at a particular connectivity request (say for a new version of an application) from the point of view of a given container you should ask yourself: what is the container connected to? What is it communicating with? Where are those other sides of the connectivity placed? Based on that determination, you will then know which security controls you need to configure to allow that connectivity through the network. How does containerization correlate with application centric security policy management? There are a number of different aspects to the relationship between container security and application security. If an application uses containers to power up workloads then container security is very much an integral part of application security. When you’re adding new functionality to an application, powering up additional containers, asking containers to perform new tasks whereby they need to connect to additional assets, then the connectivity of those containers needs to be secured. And security controls need to be regulated or changed based on what the application needs them to do. Another factor in this relationship is the structure of the application. All the containers that run and support the application are often located in one cluster or a micro-segment of the network. So, much of the communication takes place inside that cluster, between one container or another, all in the same cluster. However, some of it can go to another cluster or somewhere that’s not even containerized. This is actually a good thing from an application point of view as the container structure can be used to understand the application structure as well. Not sure about container orchestration? Here’s what to know Container orchestration is part of a bigger orchestration play which is, in general, related to the concept of infrastructure as code. You want to be able to power up an environment with all the assets it requires, and have it function simultaneously so you can duplicate it. There are various orchestration technologies that can be used to deploy the security policies for containers , which is an excellent way to maintain container-based applications in a consistent and repeatable manner. Then if you need to double it or multiply it by 100, you can get cookie-cutter copies of the same thing. How will container security solutions play out in the future? Organizations today have the technology to enforce security controls at the container level, but these controls are very granular and it’s time-consuming to set policies and enforce them, particularly with issues like staff or skills shortages. Looking ahead, companies are likely to take a hierarchical view where container-based security is controlled at the application level by app owners or developers, and at the broader levels to ensure that the measures deployed throughout the network have the same degree of sophistication. Procedures and tooling are all evolving, so we don’t have a definitive answer as to how this will all end up. What are organizations going to be doing? Where will they place their controls? Who has the power to make the changes? When newer technologies are deployed, customer adoption will be crucial to understanding what makes the most sense. This will be interesting as there will be multiple scenarios to help companies master their security blueprint as we move forward. To learn how the use of containerization as a strategy can help reduce risk and drive application-centric security, check out this video . Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

AlgoSec & Check Point AlgoSec seamlessly integrates with Check Points NGFWs to automate application and user aware security policy management and ensure that Check Points’ devices are properly configured. AlgoSec supports the entire security policy management lifecycle — from application connectivity discovery, through ongoing management and compliance, to rule recertification and secure decommissioning. Solution brief Cloudguard datasheet How to Check Point Regulatory compliance Learn how to prepare your Check Point devices for a regulatory audit Check Point Risk Assessment Learn how assess risk on your Check Point devices with AlgoSec Mapping your Network Visualize your complex network, including your Check Point devices, with a dynamic network topology map See how Check Point Users Can Benefit from AlgoSec Schedule time with one of our experts

Avivi Siman-Tov, Director of Product Management at AlgoSec, discusses the benefits of network automation and takes us through a... Firewall Change Management Change automation: A step-by-step guide to network security policy change management Avivi Siman Tov 2 min read Avivi Siman Tov Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 10/21/21 Published Avivi Siman-Tov, Director of Product Management at AlgoSec, discusses the benefits of network automation and takes us through a step-by-step process to standardize change management In today’s fast-paced, data-driven environment, the only constant that businesses can bank on is change. For organizations to function and compete in the modern digital landscape, they need their data to be able to move freely and unobstructed through every branch of their business, unimpeded by security issues that require constant manual attention. The network is arguably the beating heart of an organization but keeping it ticking requires more maintenance than it once did, owing to constantly changing risk profiles and circumstances. That’s why a greater number of businesses are turning to change automation to bridge the gap between network alerts and the action that needs to be taken. Barriers to automation According to Gartner , organizations that can automate more than 70% of their network changes can reduce the number of outages by at least 50% and deliver services up to 50% faster. That’s because a lot of legacy solutions tend to take a reactive rather than proactive approach to dealing with security. There are multiple controls in place that simply don’t talk to each other. While most businesses get alerts from SIEM solutions and vulnerability scanners, responding to them turns into a full-time job, distracting your team from other important work they could be doing. Most organizations know that manual policy changes impact their productivity, but they’re afraid to take the leap to automation because of an ill-placed perception around security. Production environments in all organizations are maintained by different teams — for example, DevOps, maintenance, cloud security, IT, and more. Not all of these teams are educated to the same level in security matters, and some see it as a constraint that slows their work. This can lead to conflict between teams, which means that automation is not always welcome. Despite some resistance to change, enterprise-wide change automation makes it possible to transform network security policies without needing to reinvent the wheel or replace existing business processes. Automation and actionable intelligence are proven to enhance security and business agility without the stress often associated with misconfigurations caused by manual, ad-hoc processes. A typical network change workflow By elevating firewall change management from a manual, arduous task to a fully automated, zero-touch process, networks can become more agile and organizations far more adaptive. There are several steps that organizations need to take towards complete network security automation, from a simple change request through to implementation and validation. Let’s take a look at the most common steps in establishing automation for a simple change request. Step 1 – Request a network change Every change begins with a request. At this stage, you need to clarify who is asking for the amendment and why because sometimes the request is unnecessary or covered by an existing ruleset. Step 2 – Find relevant security devices Once this request is translated, the change automation platform will handle the request and implement the changes to hybrid networks. The administrator will be able to see which firewall and routing devices are involved and what impact the change will have. Step 3 – Plan change The change automation platform understands how to deal with different vendor-specific settings and how to implement the requests in a way that avoids creating any duplicates. Step 4 – Risk check The administrator will get a ‘ what if’ analysis, which checks the change for any risks. In this phase, the decision as to whether to allow the change and expose the network to the risk mentioned is in the hands of the network admin or security manager, depending on who is handling this phase. Step 5 – Push change to device Once planned changes are approved, the ‘magic’ happens. The change automation platform implements and pushes the changes to the desired devices automatically, either through APIs or directly to the device (CLI). This is a fully automated action that can be conducted on multiple devices, whether cloud-based or on-premises. The push can be done in a scheduled manner, in your maintenance window, or on-demand. Step 6 – Validate change At the end of each request, the solution will check that the request was successfully implemented across all devices. The solution also provides ongoing audits of the whole process, enabling easy checking of each stage. Step 7 – Documentation and logging Network security automation platforms can provide you with a full, automated audit trail. Documentation happens on the go, saving IT and security teams time and accelerating tedious network compliance management tasks. Put your trust in network automation While change management is complex stuff, the decision for your business is simple. It’s like the engine of an expensive car. Would you drive at high speeds if you didn’t have your brakes tested or a steering wheel to keep your course straight? Hopefully, the answer is no. With AlgoSec FireFlow , you can automate the security policy change process without introducing any element of risk, vulnerability, or compliance violation. AlgoSec FireFlow allows you to analyze every change before it is introduced, and validate successful changes as intended, all within your existing IT Service Management (ITSM) solutions . By putting your trust in us we can put you firmly in the driving seat with zero-touch change management and secure application deployment. For more information, or to arrange a demo , visit our website . Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

14 Step Checklist for a Flawless Network Security Audit If security policies aren’t periodically updated to meet modern threat demands, organizations risk introducing vulnerabilities into their IT security posture. Comprehensive audit reports help security leaders gain in-depth visibility into their organization’s cybersecurity strategy and assess the resilience of its network infrastructure. Network Security Audit Checklist: What Does Your IT Security Audit Need to Cover? Cybersecurity... Cyber Attacks & Incident Response 14 Step Checklist for a Flawless Network Security Audit Tsippi Dach 2 min read Tsippi Dach Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/20/23 Published 14 Step Checklist for a Flawless Network Security Audit If security policies aren’t periodically updated to meet modern threat demands, organizations risk introducing vulnerabilities into their IT security posture. Comprehensive audit reports help security leaders gain in-depth visibility into their organization’s cybersecurity strategy and assess the resilience of its network infrastructure . Network Security Audit Checklist: What Does Your IT Security Audit Need to Cover? Cybersecurity audits demand an extensive overview of the organization’s security posture and risk profile. It requires gathering and analyzing network data to identify security vulnerabilities, monitor access controls, and assess potential threats. It also includes an overview of operational security practices, penetration testing results, and incident response playbooks . Ultimately, comprehensive risk assessment data should guide the organization towards improving its security measures and preventing hackers from breaching critical data and assets. A complete network security audit should include provide in-depth visibility into the following: Security controls and their implementation. The availability of network devices and access points. High-impact security risks and their potential consequences. The effectiveness of information security management processes. Performance data on security systems and network assets like firewalls. What Do Network Security Audits Help You Achieve? Conducting in-depth security audits helps security leaders identify data breach risks and develop plans for managing those risks. Audit results play an incredibly important role in preventative risk management and in the remediation of cyberattacks. Organizations that regularly conduct these kinds of assessments are better equipped to address the security weaknesses that might arise when onboarding new users, adding new endpoints to the network, or installing new apps. Network audits and security assessments can also help you achieve other important goals as well, such as: Identifying network performance issues and addressing them to improve overall performance. Unlocking opportunities to leverage network assets and mobile devices more efficiently. Demonstrating compliance with regulatory frameworks like the NIST Cybersecurity Framework 1.1 , ISO 27001 and 27002 , and SOC 2 Type 2 . Present security performance information to core stakeholders to demonstrate the value of security policies and controls. Update system security processes to address new vulnerabilities and potential threats. Recommended Read: 20 Best Network Security Solutions + FAQs How to Perform a Network Security Audit The network audit process involves collecting data, analyzing it to identify potential threats, and using it to compile a formal audit report. Depending on the size and complexity of the organization, this audit may be performed by an individual network analyst, a third-party IT security audit specialist, or an entire team of internal security professionals. These are the steps that make up a typical network audit: 1. Plan for the audit and inform everyone involved The audit process will involve many different types of technical tasks. The specific steps you take will change depending on the complexity of your network and the specialist talent required to assess data security in different IT contexts. You will need to verify authentication protocols, operating system security, password policies, and more. It’s rare for an individual security auditor to have all the technical skills necessary to do this on every app, device, and platform an organization uses. In most cases, you’ll need to work with other employees, third-party service providers, and other stakeholders to obtain the data you need. 2. Document all procedures and processes associated with the audit Recording every process that takes place during the audit is crucial. When preparing your final report, you may want to go back and verify some of the processes that took place to ensure the fidelity and accuracy of your data. If methodological errors creep into your data, they can skew your final report’s findings and end up damaging your ability to secure sensitive data correctly. Documentation is especially important in network security audits because you are looking for systematic flaws in the way user accounts, network assets, and security systems interact with one another. These flaws may not reveal themselves without clear documentation. 3. Review standard operating procedures and how they are managed Protecting sensitive information and critical network assets from security threats takes more than sophisticated technology. It also requires strict adherence to security policies and best practices from human users. Security audits should verify that employees and third-party providers are observing security policies in their operating procedures, and provide evidence attesting to that fact. Reviewing the organization’s procedure management system should provide key insight into whether users are following procedures or not. If they are not, there is a high risk of shadow IT processes leading to phishing attacks and security breaches. This should be reported so that the security team can find ways to remediate these threats. 4. Assess the training logs and operations Human error is behind eight out of ten cyberattacks . All customer-facing employees should be trained to detect phishing and social engineering attacks, and internal staff should know how to prevent malware from infecting the network. Every employee should understand how their role contributes to the security profile of the organization as a whole. Verifying authentication processes, permissions, and password policy is also part of employee training. Every user account should be protected by a consistent policy that follows the latest guidelines for beating brute force and dictionary-based credential attacks. Data encryption policies should keep sensitive login credentials secure even if hackers successfully compromise network assets. 5. Confirm the security patches for network software are up-to-date Start by creating a list of every software application used on the network. This can be a long, time-consuming manual process, but there are automated vulnerability scanning solutions that can help you automate this step. You will have to investigate each item on the list and determine whether new security patches are installed in a reasonably tight time frame. Keep in mind that cybercriminals often exploit security patch releases by scanning for organizations that delay installing new patches. Patch release changelogs essentially broadcast known vulnerabilities directly to hackers, so exploiting late patch installations is a trivial task. 6. Confirm the penetration testing policy and process is sufficient Penetration testing is one of the best ways to identify vulnerabilities on a network. If your organization has invested in pentesting initiatives, you will need to review and confirm its policies as part of the network security audit process. If you haven’t yet invested in pentesting, you may wish to outline a potential path for incorporating it into your security processes here. You may wish to verify the size and scope of your pentesting processes at this point. Assess some of the vulnerabilities you have uncovered and determine whether the organization is investing the appropriate resources into pentesting, or whether other security initiatives should take precedence. 7. Identify gaps and misconfigurations in your firewall policies Your organization’s firewalls play an important role managing traffic between network assets. Firewall rules should not be static. They must be continuously updated to meet the needs of the organization as it changes and grows. These devices can enforce bring your own device (BYOD) mobile policies, prevent distributed denial of service (DDoS) attacks, and contribute to proper network segmentation. Manually configuring firewall policies can be costly and time-consuming. Consider using an automated change management platform like AlgoSec Horizon Security Analyzer to rapidly identify potential vulnerabilities in your firewall rules. Document any changes you make and include those updates in your report. 8. Ensure all sensitive and confidential data is stored securely Every organization has to store some form of sensitive or confidential data. A major goal of network security audits is making sure this data is kept separate from non-sensitive data and protected by a higher standard of security. This data includes individuals’ names, addresses, phone numbers, financial information, and government ID data. Access to sensitive data should be only allowed when critical for business purposes, and every action involving sensitive data should generate comprehensive logs. The data itself should be encrypted so that even if attackers successfully breach the database, they won’t be able to use the data itself. It may also be worth considering an enterprise data backup solution to provide a failsafe in the event of a disaster. 9. Encrypt the hard disks on any company laptops Portable devices like laptops should not generally hold sensitive data. However, many employees can’t work without processing some amount of sensitive data and storing it on the local hard drive. This is usually less than critical data, but it can still contribute to a cyberattack if it falls into the wrong hands. Encrypting laptop hard disks can help prevent that from happening. If all the data on the device is encrypted, then the organization can avoid triggering a crisis-level security incident every time an employee misplaces or loses a company device. 10. Check the security of your wireless networks Wireless network security is vital for preventing hackers from conducting phishing attacks against employees and on-premises customers. If your organization’s Wi-Fi network is not secured, hackers can spoof the network and trick users into giving up vital information without their knowledge. All modern Wi-Fi equipment supports multiple security protocols. Avoid WEP and WPA – these are old protocols with well-known security vulnerabilities – and make sure your networks are using WPA2. If the organization has equipment that does not support WPA2, you must upgrade the equipment. 11. Scan for and identify any unauthorized access points Your network may have access points that were never set up or approved by the organization. Cybercriminals can use these unauthorized access points to steal data without triggering exfiltration alerts. Additional Wi-Fi frequencies are a common culprit here – your private Wi-Fi network may be configured to use the 2.4 GHz band even though you have equipment that supports 5 GHz frequencies. If someone sets up an access point on the 5 GHz frequency, you can easily overlook it. Data breaches can occur over a wide variety of similar media. USB and Bluetooth-enabled devices have introduced malware into corporate networks in the past. Your security audit should cover as many of these communication channels as possible. 12. Review the event log monitoring process The best way to verify security events is by analyzing the logs generated by network assets as they respond to user interactions. These logs can tell you who accessed sensitive data and report where and when that access took place. Security analysts can connect log data across applications to contextualize security incidents and understand how they took place. The problem is that even a small organization with a simple network can generate an enormous volume of log data every day. Your security audit should investigate the event log monitoring process and look for opportunities to streamline it. You may consider implementing a security information and event management (SIEM) platform or improving your existing one. 13. Compile a comprehensive report Once you’ve gathered all the relevant data and included your insight into the organization’s security posture, you are ready to create your audit report. This report should compile all of your findings into a single well-organized document, with evidence supporting the claims you make and clear recommendations for improving operational security moving forward. Consider creating customized data visualizations to showcase how key performance metrics change over time. The way you choose to communicate data can have a major impact on the way it is received, potentially convincing key stakeholders to implement the changes you suggest. 14. Send the final report to appropriate stakeholders and other key parties. Once you’ve finished your network security audit, you are ready to send it to your organization’s leaders and any other stakeholders who have an interest in your findings. Be prepared to explain your recommendations and justify the methods you used to collect and analyze the organization’s security data. The more confident you are in the accuracy of your findings, the better-equipped you’ll be to present them if called upon. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Are you tired of playing whack-a-mole with cloud security risks? Do endless compliance reports and alert fatigue leave you feeling... Cloud Security Unleash the Power of Application-Level Visibility: Your Secret Weapon for Conquering Cloud Chaos Asher Benbenisty 2 min read Asher Benbenisty Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 7/22/24 Published Are you tired of playing whack-a-mole with cloud security risks? Do endless compliance reports and alert fatigue leave you feeling overwhelmed? It's time to ditch the outdated, reactive approach and embrace a new era of cloud security that's all about proactive visibility . The Missing Piece: Understanding Your Cloud Applications Imagine this: you have a crystal-clear view of every application running in your cloud environment. You know exactly which resources they're using, what permissions they have, and even the potential security risks they pose. Sounds like a dream, right? Well, it's not just possible – it's essential. Why? Because applications are the beating heart of your business. They're what drive your revenue, enable your operations, and store your valuable data. But they're also complex, interconnected, and constantly changing, making them a prime target for attackers. Gain the Upper Hand with Unbiased Cloud Discovery Don't settle for partial visibility or rely on your cloud vendor's limited tools. You need an unbiased, automated cloud discovery solution that leaves no stone unturned. With it, you can: Shine a Light on Shadow IT: Uncover all those rogue applications running without your knowledge, putting your organization at risk. Visualize the Big Picture: See the intricate relationships between your applications and their resources, making it easy to identify vulnerabilities and attack paths. Assess Risk with Confidence: Get a clear understanding of the security posture of each application, so you can prioritize your efforts and focus on the most critical threats. Stay Ahead of the Game: Continuously monitor your environment for changes, so you're always aware of new risks and vulnerabilities. From Reactive to Proactive: Turn Your Cloud into a Fortress Application-level visibility isn't just about compliance or passing an audit (though it certainly helps with those!). It's about fundamentally changing how you approach cloud security. By understanding your applications at a deeper level, you can: Prioritize with Precision: Focus your remediation efforts on the applications and risks that matter most to your business. Respond with Agility: Quickly identify and address vulnerabilities before they're exploited. Prevent Attacks Before They Happen: Implement proactive security measures, like tightening permissions and enforcing security policies, to stop threats in their tracks. Empower Your Teams: Give your security champions the tools they need to effectively manage risk and ensure the continuous security of your cloud environment. The cloud is an ever-changing landscape, but with application-level visibility as your guiding light, you can confidently navigate the challenges and protect your organization from harm. Don't be left in the dark – embrace the power of application understanding and take your cloud security to the next level! Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

NAT Network Security I came across some discussions regarding Network Address Translation (NAT) and its impact on security and the... Firewall Change Management To NAT or not to NAT – It’s not really a question Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 11/26/13 Published NAT Network Security I came across some discussions regarding Network Address Translation (NAT) and its impact on security and the network. Specifically the premise that “ NAT does not add any real security to a network while it breaks almost any good concepts of a structured network design ” is what I’d like to address. When it comes to security, yes, NAT is a very poor protection mechanism and can be circumvented in many ways. It causes headaches to network administrators. So now that we’ve quickly summarized all that’s bad about NAT, let’s address the realization that most organizations use NAT because they HAVE to, not because it’s so wonderful. The alternative to using NAT has a prohibitive cost and is possibly impossible. To dig into what I mean, let’s walk through the following scenario… Imagine you have N devices in your network that need an IP address (every computer, printer, tablet, smartphone, IP phone, etc. that belongs to your organization and its guests). Without NAT you would have to purchase N routable IP addresses from your ISP. The costs would skyrocket! At AlgoSec we run a 120+ employee company in numerous countries around the globe. We probably use 1000 IP addresses. We pay for maybe 3 routable IP addresses and NAT away the rest. Without NAT the operational cost of our IP infrastructure would go up by a factor of x300. NAT Security With regards to NAT’s impact on security, just because NAT is no replacement for a proper firewall doesn’t mean it’s useless. Locking your front door also provides very low-grade security – people still do it, since it’s a lot better than not locking your front door. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

AlgoSec Horizon ObjectFlow Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

If your firewall shows a notification that it has detected a new network, it means it is doing one of its fundamental jobs properly. But good network security does not stop with just detecting a new network. You will have to analyze the network location, ensure it is authorized to connect with your network, automate this process, and ensure full-on monitoring so that none of the intrusive attempts ever go unnoticed. A good amount of all these tasks can be made more efficient, accurate, and... Firewall Change Management Firewall has detected a new network Tsippi Dach 2 min read Tsippi Dach Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/9/23 Published If your firewall shows a notification that it has detected a new network, it means it is doing one of its fundamental jobs properly. But good network security does not stop with just detecting a new network. You will have to analyze the network location, ensure it is authorized to connect with your network, automate this process, and ensure full-on monitoring so that none of the intrusive attempts ever go unnoticed. A good amount of all these tasks can be made more efficient, accurate, and automated with the help of strong network security solutions. What should you do if your firewall has detected an unrecognized network? 1. Analyze the incoming network request If the process is not automated, you might have to check for the incoming network request’s trustworthiness manually. You can check the security certificates associated with the request, check its source, validate with the right information whether this source can be trusted, and then decide whether to allow access. The best way to deal with any new network detection is to automate the authorization by using a strong network security policy that outlines what sources can be trusted, what cannot be trusted, and which decisions require further approval. 2. Analyze your network for any impact In case of an untrusted new network detection and possible intrusion, you should be able to check the impact or effect it has had on your current assets. You should analyze the entire system for performance, feature validation, and asset availability. A quick way to do this would be to use any network visualization product, such as Horizon Security Analyzer . This tool can also assess how your overall home network will be impacted by any possible security policy 3. Reassess your security policies and improve them In the event of any security incident, you will have to isolate your network, mitigate any impact caused by the intrusion and reset the system to a healthy state. And most importantly, you will have to investigate the incident, figure out the root cause, and fix it. This would require updating your security policies, risk management, and local network security settings. Following up on any security incident is highly recommended so that no unauthorized intrusion attempts go unnoticed and are handled appropriately. And like any other seemingly enormous task, this can be automated too. Check out firewall change management tools to help you implement continuous improvement within your network security management, contributing to network protection. How to setup strong firewall protection Here are some security measures and troubleshooting tips you need to employ to strengthen your Microsoft firewall management and network security. 1. Establish a strong network security policy management To implement a strong network security management framework, you must design the security policies, systems, and solutions as per your operating system. A network security policy framework can help you guide and streamline the security design and guide you with the enforcement of the same. As with any process, policy management should also be a continuously evolving framework and must be managed well to facilitate all the relevant tasks. Use intelligent systems like Algosec’s Algobot to help your firewall admins to carry out their tasks efficiently. And if you are looking to automate the security policy management tasks, you can also check out Fireflow . It helps you automate the security policy change process across the many phases of policy management, from planning to implementation and validation. 2. Visualize the network data Network monitoring is critical to enabling t strong firewall While AI-based alerting and monitoring systems could greatly help automate intrusion detection and notification, certain tasks require human supervision and deep analysis of the network logs. This way, you can not only analyze the network for any intrusion attempts (whether it be through malware sent through a web browser, file sharing, router, ethernet network adapter, or wi-fi) but also get to have a good understanding of your traffic and business trends. Horizon AppViz from Algosec is a helpful tool for achieving this functionality. 3. Optimize your firewall configuration Firewall configurations include a broad range of activities that range from designing your firewall solution and choosing the right software/hardware to setting up the firewall rules and management processes. Set these configurations early on with all necessary considerations regarding your environment and applications. This process should also include the overall policy configurations and security rules that define the change process, firewall administration, monitoring, and management operations. Read this resourceful guide to learn more about firewall configuration, its challenges, and guidance on implementation. 4. Ensure cloud compliance Compliance and security go hand in hand in protecting your assets and boosting the overall goodwill and trust associated with your brand. Cloud compliance frameworks provide guidelines and cover most of the pain points of managing cloud security. Staying compliant with these guidelines means that your security is up to date and can be considered on par with the high standards set by these frameworks. 5. Micro-segmentation Micro-segmentation is a domain network security technique that helps you implement flexible security measures for individually segmented data center parts. It is most helpful with protecting your virtual machine implementations as it allows you to deploy specific security measures crafted to fit each virtual machine’s requirements. With security deployed on segmented workloads, your network becomes more resilient to attacks. 6. Perform regular firewall audits To ensure continuous compliance, you must conduct regular audit checks on the status of your firewall settings, policies, and implementations. Gather all the related documents and key information, review your current processes, firewall mechanisms, perform penetration tests, assess the security measures, and optimize as required. Perform a complete risk assessment on your Windows server and fix any issues that might be discovered as part of the audit process. Tips and best practices for enhanced network security 1. Firewall for native cloud applications Make use of cloud-first prioritized firewall solutions to protect your native cloud applications. You need comprehensive visibility on all your cloud assets, ensuring advanced threat detection and protection. This requires a whole set of tools and security applications working together to provide a centralized security system. You will also have to ensure data compliance at all levels as well. You can try to employ native cloud solutions such as the extensive tools provided by Algosec. 2. Use centralized solutions Make use of centralized solutions to manage hybrid and multi-cloud applications so that you have all the important information accessible from a single platform. AlgoSec Cloud from Algosec is an amazing solution to achieve centralized visibility across hybrid and multi-cloud accounts and assets. 3. Follow the best security practices and guidelines Look into the best security practices and guidelines put forth by your cloud vendor and follow them to get the best out of the collective knowledge. You can also use vendor-specific firewall management solutions to help you deal with issues related to specific cloud accounts you might be using. Additionally, having an antivirus like Windows Defender and using a VPN also helps. A good practice to follow in case of uncertainty is to block by default. Any new network or source must be blocked unless specifically permitted by the user. Regarding access privileges, you can follow the principle of least privilege, where users are only granted as many privileges as would be required for their specific roles and responsibilities. Use audit tools for regular auditing and keep improving on any vulnerabilities your firewall may have. To increase the performance of your firewall applications, you can look into how you have set up your firewall rules and optimize them for better performance. Here are some more best practices you can follow when setting up your firewall rules: Document all your rules and firewall configurations across all the devices. Make sure to document every new rule created and keep your documentation up to date. This can help security admins review the rules and optimize them as and when necessary. As mentioned earlier, follow a zero trust policy where you block traffic by default and permit network access only on a need basis. Monitor your firewall logs even when there is no particular security incident to investigate. Regular monitoring and analysis will give you a better understanding of your network traffic and can help you identify suspicious activities early on. Group the firewall rules to boost performance and avoid complications and loopholes. You can hire expert security administrators and security solutions such as Algosec to help review your firewall rules and keep them updated. Firewall management FAQs What can a firewall do? A Windows firewall can be interpreted as similar to a literal wall. It blocks unwanted access to your system and lets you decide whether or not to allow any new network connection or access request. Similar to how a fort works, you only give access to access requests that you trust and block the rest. It is the first defensive setup you can set up for your network security. You can set a list of trusted sources, and the requests from these sources will be given automated access. The rest of the access requests from any other source, be it a third-party network, mobile devices, internet connection, or any other endpoint, can be blocked by your firewall. You can set up firewall rules that dictate which type of requests and sources can be trusted. A firewall can be implemented by using multiple methods. It can be a cloud app, hardware, software, virtualizations, an access-restricted private cloud, and more. A typical firewall ruleset consists of the following specifications: Source address Source port Destination address Destination port Information on whether to block or permit the traffic to the respective address and port criteria. A firewall can be implemented by using multiple methods. It can be a cloud app, hardware, software, virtualizations, an access-restricted private cloud, and more. How does a firewall protect businesses from cyberthreats? The obvious main use of the firewall is to restrict all kinds of unauthorized access, thus protecting your systems from cyberattacks. But it also has several other benefits, such as: Providing data privacy so your work network traffic is guarded from outside public networks. Restricting content access to your private network For instance, educational institutions can block inappropriate sites for their students while in class. Blocking unwanted traffic from ads, spam, and gaming sites. Ensuring data confidentiality and keeping you compliant with security standards. Monitoring all your incoming traffic, helping you analyze your network profile, and helping you gain insights into trending user behavior. Filtering out unwanted traffic and restricting access to certain websites. Providing secure remote access through VPNs and similar remote access mechanisms. What are the most common types of firewalls? Based on the way data is filtered through a firewall, it can be broadly classified into one of the following types: Packet filtering Stateful inspection firewalls Circuit-level gateway firewalls Proxy firewalls Next-generation firewalls (NGFWs) Threat focused NGFWs Virtual firewalls Cloud-native firewalls Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

In this guest blog, Jeff Yager from IT Central Station (soon to be PeerSpot), discusses how actual AlgoSec users have been able to... Security Policy Management Securely accelerating application delivery Jeff Yeger 2 min read Jeff Yeger Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 11/15/21 Published In this guest blog, Jeff Yager from IT Central Station (soon to be PeerSpot), discusses how actual AlgoSec users have been able to securely accelerate their app delivery. These days, it is more important than ever for business owners, application owners, and information security professionals to speak the same language. That way, their organizations can deliver business applications more rapidly while achieving a heightened security posture. AlgoSec’s patented platform enables the world’s most complex organizations to gain visibility and process changes at zero-touch across the hybrid network. IT Central Station members discussed these benefits of AlgoSec , along with related issues, in their reviews on the site. Application Visibility AlgoSec allows users to discover, identify, map, and analyze business applications and security policies across their entire networks. For instance, Jacob S., an IT security analyst at a retailer, reported that the overall visibility that AlgoSec gives into his network security policies is high. He said, “It’s very clever in the logic it uses to provide insights, especially into risks and cleanup tasks . It’s very valuable. It saved a lot of hours on the cleanup tasks for sure. It has saved us days to weeks.” “AlgoSec absolutely provides us with full visibility into the risk involved in firewall change requests,” said Aaron Z. a senior network and security administrator at an insurance company that deals with patient health information that must be kept secure. He added, “There is a risk analysis piece of it that allows us to go in and run that risk analysis against it, figuring out what rules we need to be able to change, then make our environment a little more secure. This is incredibly important for compliance and security of our clients .” Also impressed with AlgoSec’s overall visibility into network security policies was Christopher W., a vice president – head of information security at a financial services firm, who said, “ What AlgoSec does is give me the ability to see everything about the firewall : its rules, configurations and usage patterns.” AlgoSec gives his team all the visibility they need to make sure they can keep the firewall tight. As he put it, “There is no perimeter anymore. We have to be very careful what we are letting in and out, and Firewall Analyzer helps us to do that.” For a cyber security architect at a tech services company, the platform helps him gain visibility into application connectivity flows. He remarked, “We have Splunk, so we need a firewall/security expert view on top of it. AlgoSec gives us that information and it’s a valuable contributor to our security environment.” Application Changes and Requesting Connectivity AlgoSec accelerates application delivery and security policy changes with intelligent application connectivity and change automation. A case in point is Vitas S., a lead infrastructure engineer at a financial services firm who appreciates the full visibility into the risk involved in firewall change requests. He said, “[AlgoSec] definitely allows us to drill down to the level where we can see the actual policy rule that’s affecting the risk ratings. If there are any changes in ratings, it’ll show you exactly how to determine what’s changed in the network that will affect it. It’s been very clear and intuitive.” A senior technical analyst at a maritime company has been equally pleased with the full visibility. He explained, “That feature is important to us because we’re a heavily risk-averse organization when it comes to IT control and changes. It allows us to verify, for the most part, that the controls that IT security is putting in place are being maintained and tracked at the security boundaries .” A financial services firm with more than 10 cluster firewalls deployed AlgoSec to check the compliance status of their devices and reduce the number of rules in each of the policies. According to Mustafa K. their network security engineer, “Now, we can easily track the changes in policies. With every change, AlgoSec automatically sends an email to the IT audit team. It increases our visibility of changes in every policy .” Speed and Automation The AlgoSec platform automates application connectivity and security policy across a hybrid network so clients can move quickly and stay secure. For Ilya K., a deputy information security department director at a computer software company, utilizing AlgoSec translates into an increase in security and accuracy of firewall rules. He said, “ AlgoSec ASMS brings a holistic view of network firewall policy and automates firewall security management in very large-sized environments. Additionally, it speeds up the changes in firewall rules with a vendor-agnostic approach.” “The user receives the information if his request is within the policies and can continue the request,” said Paulo A., a senior information technology security analyst at an integrator. He then noted, “Or, if it is denied, the applicant must adjust their request to stay within the policies. The time spent for this without AlgoSec is up to one week, whereas with AlgoSec, in a maximum of 15 minutes we have the request analyzed .” The results of this capability include greater security, a faster request process and the ability to automate the implementation of rules. Srdjan, a senior technical and integration designer at a large retailer, concurred when he said, “ By automating some parts of the work, business pressure is reduced since we now deliver much faster . I received feedback from our security department that their FCR approval process is now much easier. The network team is also now able to process FCRs much faster and with more accuracy.” To learn more about what IT Central Station members think about AlgoSec, visit https://www.itcentralstation.com/products/algosec-reviews Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

In the previous parts of our blog ( part I and part II ), we have described the most important parts of the Sunburst backdoor... Cloud Security Sunburst Backdoor, Part III: DGA & Security Software Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/22/20 Published In the previous parts of our blog ( part I and part II ), we have described the most important parts of the Sunburst backdoor functionality and its Domain Generation Algorithm (DGA). This time, let’s have a deeper look into the passive DNS requests reported by Open-Source Context and Zetalytics . The valid DNS requests generated by the malware fall into 2 groups: DNS requests that encode a local domain name DNS requests that encode data The first type of DNS requests allows splitting long domain names into separate requests. These requests are generated by the malware’s functions GetPreviousString() and GetCurrentString() . In general, the format of a DNS request that encodes a domain name may look like: USER_ID.NUM.COMPUTER_DOMAIN[.]appsync-api.us-west-2[.]avsvmcloud[.]com where: USER_ID is an 8-byte user ID that uniquely identifies a compromised host, encoded as a 15-character string NUM is a number of a domain name – either 0 or 1, encoded as a character COMPUTER_DOMAIN is an encoded local computer domain Let’s try decoding the following 3 DNS requests: olc62cocacn7u2q22v02eu.appsync-api.us-west-2.avsvmcloud.com r1qshoj05ji05ac6eoip02jovt6i2v0c.appsync-api.us-west-2.avsvmcloud.com lt5ai41qh5d53qoti3mkmc0.appsync-api.us-west-2.avsvmcloud.com String 1 Let’s start from the 1st string in the list: olc62cocacn7u2q22v02eu.appsync-api.us-west-2.avsvmcloud.com. In this string, the first 15-character string is an encoded USER_ID : “olc62cocacn7u2q” . Once it is base-64 decoded, as explained in the previous post, it becomes a 9-byte byte array: 86 7f 2f be f9 fb a3 ae c4 The first byte in this byte array is a XOR key: 0x86 . Once applied to the 8 bytes that follow it, we get the 8-byte user ID – let’s take a note and write it down, we will need it later: f9 a9 38 7f 7d 25 28 42 Next, let’s take the NUM part of the encoded domain: it’s a character “2” located at the position #15 (starting from 0) of the encrypted domain. In order to decode the NUM number, we have to take the first character of the encrypted domain, take the reminder of its division by 36 , and subtract the NUM ‘s position in the string “0123456789abcdefghijklmnopqrstuvwxyz” : num = domain[0] % 36 – “0123456789abcdefghijklmnopqrstuvwxyz”.IndexOf(domain.Substring(15, 1)); The result is 1 . That means the decrypted domain will be the 2nd part of a full domain name. The first part must have its NUM decoded as 0. The COMPUTER_DOMAIN part of the encrypted domain is “2v02eu” . Once decoded, using the previously explained method, the decoded computer domain name becomes “on.ca” . String 2 Let’s decode the second passive DNS request from our list: r1qshoj05ji05ac6eoip02jovt6i2v0c.appsync-api.us-west-2.avsvmcloud.com Just as before, the decoded 8-byte user ID becomes: f9 a9 38 7f 7d 25 28 42 The NUM part of the encoded domain, located at the position #15 (starting from 0), is a character “6” . Let’s decode it, by taking the first character ( “r” = 114 ), take the reminder of its division by 36 ( 114 % 36 = 6 ), and subtracting the position of the character “6” in the “0123456789abcdefghijklmnopqrstuvwxyz” , which is 6 . The result is 0 . That means the decrypted domain will be the 1st part of the full domain name. The COMPUTER_DOMAIN part of the encrypted domain is “eoip02jovt6i2v0c” . Once decoded, it becomes “city.kingston.” Next, we need to match 2 decrypted domains by the user ID, which is f9 a9 38 7f 7d 25 28 42 in both cases, and concatenate the first and the second parts of the domain. The result will be “city.kingston.on.ca” . String 3 Here comes the most interesting part. Lets try to decrypt the string #3 from our list of passive DNS requests: lt5ai41qh5d53qoti3mkmc0.appsync-api.us-west-2.avsvmcloud.com The decoded user ID is not relevant, as the decoded NUM part is a number -29 . It’s neither 0 nor 1 , so what kind of domain name that is? If we ignore the NUM part and decode the domain name, using the old method, we will get “thx8xb” , which does not look like a valid domain name. Cases like that are not the noise, and are not some artificially encrypted artifacts that showed up among the DNS requests. This is a different type of DNS requests. Instead of encoding local domain names, these types of requests contain data. They are generated by the malware’s function GetNextStringEx() . The encryption method is different as well. Let’s decrypt this request. First, we can decode the encrypted domain, using the same base-64 method, as before . The string will be decoded into 14 bytes: 7c a5 4d 64 9b 21 c1 74 a6 59 e4 5c 7c 7f Let’s decode these bytes, starting from the 2nd byte, and using the first byte as a XOR key. We will get: 7c d9 31 18 e7 5d bd 08 da 25 98 20 00 03 In this array, the bytes marked in yellow are an 8-byte User ID, encoded with a XOR key that is selected from 2 bytes marked in red. Let’s decode User ID: for ( int i = 0 ; i < 8 ; i++) { bytes[i + 1 ] ^= bytes[ 11 - i % 2 ]; } The decoded byte array becomes: 7c f9 a9 38 7f 7d 25 28 42 25 98 20 00 03 The User ID part in marked in yellow. Does it look familiar? Indeed, it’s the same User ID we’ve seen before, when we decoded “city.kingston.on.ca” . The next 3 bytes marked in red are: 25 98 20 . 2 0x59820 The first number 2 stands for the size of data that follows – this data is 00 03 (selected in green). The number 0x59820 , or 366,624 in decimal, is a timestamp. It’s a number of 4-second periods of time since 1 January 2010. To obtain the real time stamp, we need to multiple it by 15 to get minutes, then add those minutes to 1 January 2010: var date = ( new DateTime( 2010 , 1 , 1 , 0 , 0 , 0 , DateTimeKind.Utc)).AddMinutes(timestamp * 15 ); For the number 0x59820 , the time stamp becomes 16 July 2020 12:00:00 AM – that’s the day when the DNS request was made. The remaining 2 bytes, 00 03 , encrypt the state of 8 security products, to indicate whether each one of them is running or whether it is stopped. The 8 security products are: Windows Live OneCare / Windows Defender Windows Defender Advanced Threat Protection Microsoft Defender for Identity Carbon Black CrowdStrike FireEye ESET F-Secure 2 states for 8 products require 2 * 8 = 16 bits = 2 bytes. The 2 bytes 00 03 in binary form are: 00 00 00 00 00 00 00 11 Here, the least-significant bits 11 identify that the first product in the list, Windows Live OneCare / Windows Defender, is reported as ‘running’ ( 1 ) and as ‘stopped’ ( 1 ). Now we know that apart from the local domain, the trojanised SolarWinds software running on the same compromised host on “city.kingston.on.ca” domain has also reported the status of the Windows Defender software. What Does it Mean? As explained in the first part of our description, the malware is capable of stopping the services of security products, be manipulating registry service keys under Administrator account. It’s likely that the attackers are using DNS queries as a C2 channel to first understand what security products are present. Next, the same channel is used to instruct the malware to stop/deactivate these services, before the 2nd stage payload, TearDrop Backdoor, is deployed. Armed with this knowledge, let’s decode other passive DNS requests, printing the cases when the compromised host reports a running security software. NOTES: As a private case, if the data size field is 0 or 1 , the timestamp field is not followed with any data. Such type of DNS request is generated by the malware’s function GetNextString() . It is called ‘a ping’ in the listing below. If the first part of the domain name is missing, the recovered domain name is pre-pended with ‘*’ . The malware takes the time difference in minutes, then divides it by 30 and then converts the result from double type to int type; as a result of such conversion, the time stamps are truncated to the earliest half hour. 2D82B037C060515C SFBALLET Data: Windows Live OneCare / Windows Defender [running] 11/07/2020 12:00:00 AM Pings: 12/07/2020 12:30:00 AM 70DEE5C062CFEE53 ccscurriculum.c Data: ESET [running] 17/04/2020 4:00:00 PM Pings: 20/04/2020 5:00:00 PM AB902A323B541775 mountsinai.hospital Pings: 4/07/2020 12:30:00 AM 9ACC3A3067DC7FD5 *ripta.com Data: ESET [running] 12/09/2020 6:30:00 AM Pings: 13/09/2020 7:30:00 AM 14/09/2020 9:00:00 AM CB34C4EBCB12AF88 DPCITY.I7a Data: ESET [running] 26/06/2020 5:00:00 PM Pings: 27/06/2020 6:30:00 PM 28/06/2020 7:30:00 PM 29/06/2020 8:30:00 PM 29/06/2020 8:30:00 PM E5FAFE265E86088E *scroot.com Data: CrowdStrike [running] 25/07/2020 2:00:00 PM Pings: 26/07/2020 2:30:00 PM 26/07/2020 2:30:00 PM 27/07/2020 3:00:00 PM 27/07/2020 3:00:00 PM 426030B2ED480DED *kcpl.com Data: Windows Live OneCare / Windows Defender [running] 8/07/2020 12:00:00 AM Carbon Black [running] 8/07/2020 12:00:00 AM Full list of decoded pDNS requests can be found here . An example of a working implementation is available at this repo. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Best practices for network security governance in AWS and hybrid network environments Webinars Cut the Clutter with ChatOps & Improve Network Security IT teams’ alerts are overflowing with questions about network status from coworkers. Say no to overwhelming alerts in multiple applications. There is a better way to get critical answers about the state of your network: ChatOps. ChatOps, using your existing chat tools such as Slack or Microsoft Teams, can get the crucial questions answered, and not have to track multiple apps separately. In this webinar, Dania Ben Peretz, Product Manager at AlgoSec, demonstrates the latest in AlgoBot and show how to: Get immediate answers to pressing network traffic questions Get immediate answers about whether your business applications are secure Decrease the time it takes to resolve critical security incidents Empower your business and application teams to drive innovation Ensure that your network and security teams are focusing on the most critical issues Efficiently manage security by transparently collaborating with IT, Security, Network and DevOps teams All while saving time, reducing resources, and cutting the clutter. May 13, 2020 Dania Ben Peretz Product Manager Relevant resources AlgoBot: Your Network Security Policy Management Assistant Watch Video Boosting Network Security with ChatOps Keep Reading A Siri for network security: the benefits of AlgoBot and ChatOps Keep Reading Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue