As your organization adopts a hybrid IT infrastructure, there are more ways for hackers to steal your sensitive data. This is why cloud application security is a critical part of data protection. It allows you to secure your cloud-based applications from cyber threats while ensuring your data is safe. This post will walk you through cloud application security, including its importance. We will also discuss the main cloud application security threats and how to mitigate them. What is Cloud... Cloud Security Cloud Application Security: Threats, Benefits, & Solutions Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 6/29/23 Published As your organization adopts a hybrid IT infrastructure, there are more ways for hackers to steal your sensitive data. This is why cloud application security is a critical part of data protection. It allows you to secure your cloud-based applications from cyber threats while ensuring your data is safe. This post will walk you through cloud application security, including its importance. We will also discuss the main cloud application security threats and how to mitigate them. What is Cloud Application Security Cloud application security refers to the security measures taken to protect cloud-based assets throughout their development lifecycle. These security measures are a framework of policies, tools, and controls that protect your cloud against cyber threats. Here is a list of security measures that cloud application security may involve: Identity management and access controls to prevent unauthorized access to your cloud-based apps. Data encryption and tokenization to protect sensitive data. Vulnerability management through vulnerability scanning and penetration testing. Network perimeter security, such as firewalls, to prevent unwanted access. The following are some of the assets that cloud security affects: Third-party cloud providers like Amazon AWS, Microsoft Azure, and Google GCP. Collaborative applications like Slack and Microsoft Teams. Data Servers. Computer Networks. Why is Cloud Application Security Important Cloud application security is becoming more relevant as businesses migrated their data to the cloud in recent years. This is especially true for companies with a multi-cloud environment. These types of environments create a larger attack surface for hackers to exploit. According to IBM , the cost of a data breach in 2022 was $4.35 million. And this represents an increase of 2.6% from the previous year. The report also revealed that it took an average of 287 days to find and stop a data breach in a cloud environment. This time is enough for hackers to steal sensitive data and really damage your assets. Here are more things that can go wrong if organizations don’t pay attention to cloud security: Brand image damage: A security breach may cause a brand’s reputation to suffer and a decline in client confidence. During a breach, your company’s servers may be down for days or weeks. This means customers who paid for your services will not get access in that time. They may end up destroying your brand’s image through word of mouth. Lost consumer trust: Consumer confidence is tough to restore after being lost due to a security breach. Customers could migrate to rivals they believe to be more secure. Organizational disruption: A security breach may cause system failures preventing employees from working. This, in turn, could affect their productivity. You may also have to fire employees tasked with ensuring cloud security. Data loss: You may lose sensitive data, such as client information, resulting in legal penalties. Trade secrets theft may also affect the survival of your organization. Your competitors may steal your only leverage in the industry. Compliance violations: You may be fined for failing to comply with industry regulations such as GDPR. You may also face legal consequences for failing to protect consumer data. What are the Major Cloud Application Security Threats The following is a list of the major cloud application security threats: Misconfigurations: Misconfigurations are errors made when setting up cloud-based applications. They can occur due to human errors, lack of expertise, or mismanagement of cloud resources. Examples include weak passwords, unsecured storage baskets, and unsecured ports. Hackers may use these misconfigurations to access critical data in your public cloud. Insecure data sharing: This is the unauthorized or unintended sharing of sensitive data between users. Insecure data sharing can happen due to a misconfiguration or inappropriate access controls. It can lead to data loss, breaches, and non-compliance with regulatory standards. Limited visibility into network operations: This is the inability to monitor and control your cloud infrastructure and its apps. Limited network visibility prevents you from quickly identifying and responding to cyber threats. Many vulnerabilities may go undetected for a long time. Cybercriminals may exploit these weak points in your network security and gain access to sensitive data. Account hijacking: This is a situation where a hacker gains unauthorized access to a legitimate user’s cloud account. The attackers may use various social engineering tactics to steal login credentials. Examples include phishing attacks, password spraying, and brute-force attacks. Once they access the user’s cloud account, they can steal data or damage assets from within. Employee negligence and inadequately trained personnel: This threat occurs when employees are not adequately trained to recognize, report and prevent cyber risks. It can also happen when employees unintentionally or intentionally engage in risky behavior. For example, they could share login credentials with unauthorized users or set weak passwords. Weak passwords enable attackers to gain entry into your public cloud. Rogue employees can also intentionally give away your sensitive data. Compliance risks: Your organization faces cloud computing risks when non-compliant with industry regulations such as GDPR, PCI-DSS, and HIPAA. Some of these cloud computing risks include data breaches and exposure of sensitive information. This, in turn, may result in fines, legal repercussions, and reputational harm. Data loss: Data loss is a severe security risk for cloud applications. It may happen for several causes, including hardware malfunction, natural calamities, or cyber-attacks. Some of the consequences of data loss may be the loss of customer trust and legal penalties. Outdated security software: SaaS vendors always release updates to address new vulnerabilities and threats. Failing to update your security software on a regular basis may leave your system vulnerable to cyber-attacks. Hackers may exploit the flaws in your outdated SaaS apps to gain access to your cloud. Insecure APIs: APIs are a crucial part of cloud services but can pose a severe security risk if improperly secured. Insecure APIs and other endpoint infrastructure may cause many severe system breaches. They can lead to a complete system takeover by hackers and elevated privileged access. How to Mitigate Cloud Application Security Risks The following is a list of measures to mitigate cloud app security risks: Conduct a thorough risk analysis: This entails identifying possible security risks and assessing their potential effects. You then prioritize correcting the risks depending on their level of severity. By conducting risk analysis on a regular basis, you can keep your cloud environment secure. You’ll quickly understand your security posture and select the right security policies. Implement a firm access control policy: Access control policies ensure that only authorized users gain access to your data. They also outline the level of access to sensitive data based on your employees’ roles. A robust access control policy comprises features such as: Multi-factor authentication Role-based access control Least Privilege Access Strong password policies. Use encryption: Encryption is a crucial security measure that protects sensitive data in transit and at rest. This way, if an attacker intercepts data in transit, it will only be useful if they have a decryption key. Some of the cloud encryption solutions you can implement include: Advanced Encryption Standard (AES) Rivest -Shamir-Addleman (RSA) Transport Layer Security (TSL) Set up data backup and disaster recovery policies: A data backup policy ensures data is completely recovered in case of breaches. You can always recover the lost data from your data backup files. Data backup systems also help reduce the impact of cyberattacks as you will restore normal operations quickly. Disaster recovery policies focus on establishing protocols and procedures to restore critical systems during a major disaster. This way, your data security will stay intact even when disaster strikes. Keep a constant watch over cloud environments: Security issues in cloud settings can only be spotted through continuous monitoring. Cloud security posture management tools like Horizon ACE can help you monitor your cloud for such issues. With its layer analysis feature, you’ll know the exact area in your cloud and how to fix it. Test and audit cloud security controls regularly: Security controls help you detect and mitigate potential security threats in your cloud. Examples of security controls include firewalls, intrusion detection systems, and database encryption. Auditing these security controls helps to identify gaps they may have. And then you take corrective actions to restore their effectiveness. Regularly evaluating your security controls will reduce the risk of security incidents in your cloud. Implement a security awareness training program: Security awareness training helps educate employees on cloud best practices. When employees learn commonly overlooked security protocols, they reduce the risks of data breaches due to human error. Organize regular assessment tests with your employees to determine their weak points. This way, you’ll reduce chances of hackers gaining access to your cloud through tactics such as phishing and ransomware attacks. Use the security tools and services that cloud service providers offer: Cloud service providers like AWS, Azure, and Google Cloud Platform (GCP) offer security tools and services such as: Web application firewalls (WAF), Runtime application self-protection (RASP), Intrusion detection and prevention systems Identity and access management (IAM) controls You can strengthen the security of your cloud environments by utilizing these tools. However, you should not rely solely on these features to ensure a secure cloud. You also need to implement your own cloud security best practices. Implement an incident response strategy: A security incident response strategy describes the measures to take during a cyber attack. It provides the procedures and protocols to bring the system back to normal in case of a breach. Designing incident response plans helps to reduce downtime. It also minimizes the impact of the damages due to cyber attacks. Apply the Paved Road Security Approach in DevSecOps Processes: DevSecOps environments require security to be integrated into development workflows and tools. This way, cloud security becomes integral to an app development process. The paved road security approach provides a secure baseline that DevSecOps can use for continuous monitoring and automated remediation. Automate your cloud application security practices Using on-premise security practices such as manual compliance checks to mitigate cloud application security threats can be tiring. Your security team may also need help to keep up with the updates as your cloud needs grow. Cloud vendors that can automate all the necessary processes to maintain a secure cloud. They have cloud security tools to help you achieve and maintain compliance with industry security benchmarks to prevent data breaches. You can improve your visibility into your cloud infrastructures by utilizing these solutions. They also spot real-time security challenges and offer remediations. For example, Horizon ACE’s cloud security solutions monitor cloud environments continually from the cloud. They can spot possible security threats and vulnerabilities using AI and machine learning. What Are Cloud Application Security Solutions? Cloud application security solutions are designed to protect apps and other assets in the cloud. Unlike point devices, cloud application security solutions are deployed from the cloud. This ensures you get a comprehensive cybersecurity approach for your IT infrastructure. These solutions are designed to protect the entire system instead of a single point of vulnerability. This makes managing your cybersecurity strategy easier. Here are some examples of cloud security application solutions: 1. Cloud Security Posture Management (CSPM) : CSPM tools enable monitoring and analysis of cloud settings for security risks and vulnerabilities. They locate incorrect setups, resources that aren’t compliant, and other security concerns that might endanger cloud infrastructures. 2. The Cloud Workload Protection Platform (CWPP) : This cloud application security solution provides real-time protection for workloads in cloud environments . It does this by detecting and mitigating real-time threats regardless of where they are deployed. CWPP solutions offer various security features, such as: Network segmentation File integrity monitoring Vulnerability scanning. Using CWPP products will help you optimize your cloud application security strategy. 3. Cloud Access Security Broker (CASB) : CASB products give users visibility into and control over the data and apps they access in the cloud. These solutions help businesses enforce security guidelines and monitor user behavior in cloud settings. The danger of data loss, leakage, and unauthorized access is lowered in the process. CASB products also help with malware detection. 4. Runtime Application Self Protection (RASP): This solution addresses security issues that may arise while a program is working. It identifies potential threats and vulnerabilities during runtime and thwarts them immediately. Some of the RASP solutions include: Input validation Runtime hardening Dynamic Application Security testing 5. Web Application and API protection (WAAP) : These products are designed to protect your organization’s Web applications and APIs. They monitor outgoing and incoming web apps and API traffic to detect malicious activity. WAAP products can block any unauthorized access attempts. They can also protect against cyber threats like SQL injection and Cross-site scripting. 6. Data Loss Prevention (DLP): DLP products are intended to stop the loss or leaking of private information in cloud settings. These technologies keep track of sensitive data in use and at rest. They can also enforce rules to stop unauthorized people from losing or accessing it. 7. Security Information and Event Management (SIEM) systems : SIEM systems track and analyze real-time security incidents and events in cloud settings. The effect of security breaches is decreased thanks to these solutions. They help firms in detecting and responding to security issues rapidly. Cloud Native Application Protection Platform (CNAPP) The CNAPP approach raises the bar for cloud security. It combines CSPM, CIEM, IAM, CWPP, and more in one tool. A CNAPP delivers a complete security solution with sophisticated threat detection and mitigation capabilities for packaged workloads, microservices, and cloud-native applications. The CNAPP can find and eliminate security issues in your cloud systems before hackers can exploit them. With its layer analysis feature, you can quickly fix any potential vulnerabilities in your cloud . It pinpoints the exact layer of code where there are errors, saving you time and effort. CNAPP also offers a visual dynamic analysis of your cloud environment . This lets you grasp the state of your cloud security at a glance. In the process, saving you time as you know exactly where to go. CNAPP is also a scalable cloud security solution. The cloud-native design of Horizon ACE’s CNAPP enables it to expand dynamically and offer real-time protection against new threats. Let Horizon ACE Solve Your Cloud Application Security Needs Cloud security is paramount to protecting sensitive data and upholding a company’s reputation in the modern digital age. To be agile to the constantly changing security issues in cloud settings, Horizon ACE’s Cloud Native Application Protection Platform (CNAPP) offers an all-inclusive solution. From layer analysis to visual dynamic analysis, CNAPP gives you the tools you need to keep your cloud secure. You can rely on Horizon ACE to properly manage your cloud application security needs. Try Horizon ACE today! Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

In the bustling world of cloud security, where complexity and rapid change are the norms, Ava Chawla, Director of Cloud Security at... Cloud Security Securing the Future: A Candid Chat with Ava Chawla, Director of cloud security at AlgoSec Adel Osta Dadan 2 min read Adel Osta Dadan Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 6/16/24 Published In the bustling world of cloud security, where complexity and rapid change are the norms, Ava Chawla, Director of Cloud Security at AlgoSec, sits down to share her insights and experiences. With a relaxed yet passionate demeanor, Ava discusses how her team is pioneering strategies to keep businesses safe and thriving amidst the digital transformation. Embracing the “100x Revolution” “Look, the landscape has transformed dramatically,” Ava reflects with a thoughtful pause. “We’re not just talking about incremental changes here; it’s about a revolution—a ‘100x revolution.’ It’s where everything is exponentially more complex and moves at breakneck speeds. And at the heart? Applications. They’re no longer just supporting business processes; they’re driving them, creating new opportunities, modernizing how we operate, and pushing boundaries.” The Power of Double-Layered Cloud Security Leaning in, Ava shares the strategic thinking behind their innovative approach to cloud security. “One of the things we’ve pioneered is what we call application-centric double-layered cloud security. This is about proactively stopping attacks, and better managing vulnerabilities to safeguard your most critical business applications and data. Imagine a stormy day, you layer up with raincoat and warm clothes for protection The sturdy raincoat represents the network layer, shielding against initial threats, while the layers of clothing underneath symbolize the configuration layer, providing added insulation. Together, these layers offer double layer protection. For businesses, double-layer cloud security means defense in depth at the network layer, unique to AlgoSec, and continuous monitoring across everything in the cloud. Now combine double-layered security with an application centric approach focused on business continuity and data protection across the applications that run the business. Cloud configurations risks are inevitable. You are responsible for safeguarding the business. Imagine you have a tool where you start with an AI-driven view of all your business applications and the attack surface, in seconds you can spot any vulnerable paths open for exploitation as it relates to your most critical applications. Application centric double layer security – the double layers is that extra layer of protection you need when the environment is unpredictable. Combine this with an app-centric perspective for effective prioritization and better security management. It’s a powerful combination! This approach isn’t just about adding more security; it’s about smart security, designed to tackle the challenges that our IT and security teams face every day across various cloud platforms.” Making Security Predictive, Not Just Reactive Ava’s passion is evident as she discusses the proactive nature of their security measures. “We can’t just be reactive anymore,” she says, emphasizing each word. “Being predictive, anticipating what’s next, that’s where we really add value. It’s about seeing the big picture, understanding the broader implications of connectivity and security. Our tools and solutions are built to be as dynamic and forward-thinking as the businesses we protect.” Aligning Security With Business Goals “There’s a beautiful alignment that happens when security and business goals come together,” Ava explains. “It’s not just about securing things; it’s about enabling business growth, expansion, and innovation. We integrate our security strategies with business objectives to ensure that as companies scale and evolve, their security posture does too.” A Vision for the Future With a reflective tone, Ava looks ahead. “What excites me the most about the future is our commitment to innovation and staying ahead of the curve. We’re not just keeping up; we’re setting the pace. We envision a world where technology empowers, enhances, and expands human potential. That’s the future we’re building towards—a secure, thriving digital landscape.” A Closing Thought As the conversation wraps up, Ava’s enthusiasm is palpable. “Our promise at AlgoSec is simple: we empower businesses without interfering with their productivity. We turn digital challenges into growth opportunities. It’s not just about managing risks—it’s about leveraging them for growth.” In a world driven by rapid technological advancements and significant security risks, Ava Chawla and her team at AlgoSec are crafting solutions that ensure businesses can navigate the complexities of the digital landscape with confidence and creativity. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Navigating compliance in 2026: The path to automated security WhitePaper Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

With AlgoSec you will manage your network security confidently, no matter where your network lives Gain complete visibility, automate changes, and always be compliant Looking for a Firemon alternative? Switch To AlgoSec & Securely Accelerate Your Application Delivery Easily visualize and manage application connectivity and security policy across your entire hybrid network estate Schedule a demo See how AlgoSec stacks up against Firemon Key Capabilities Business App Vulnerability & FW Rules Firewall Automation Custom policy rule documentation Integration with SIEM systems Cloud Security Integration IaC Risk Analysis Bid Goodbye To Firemon & Get Started With AlgoSec Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue Trusted by over 2,200 organizations since 2004 Based on hundreds reviews on G2.com
Crowd & PeerSpot Reviews

In the previous parts of our blog ( part I and part II ), we have described the most important parts of the Sunburst backdoor... Cloud Security Sunburst Backdoor, Part III: DGA & Security Software Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/22/20 Published In the previous parts of our blog ( part I and part II ), we have described the most important parts of the Sunburst backdoor functionality and its Domain Generation Algorithm (DGA). This time, let’s have a deeper look into the passive DNS requests reported by Open-Source Context and Zetalytics . The valid DNS requests generated by the malware fall into 2 groups: DNS requests that encode a local domain name DNS requests that encode data The first type of DNS requests allows splitting long domain names into separate requests. These requests are generated by the malware’s functions GetPreviousString() and GetCurrentString() . In general, the format of a DNS request that encodes a domain name may look like: USER_ID.NUM.COMPUTER_DOMAIN[.]appsync-api.us-west-2[.]avsvmcloud[.]com where: USER_ID is an 8-byte user ID that uniquely identifies a compromised host, encoded as a 15-character string NUM is a number of a domain name – either 0 or 1, encoded as a character COMPUTER_DOMAIN is an encoded local computer domain Let’s try decoding the following 3 DNS requests: olc62cocacn7u2q22v02eu.appsync-api.us-west-2.avsvmcloud.com r1qshoj05ji05ac6eoip02jovt6i2v0c.appsync-api.us-west-2.avsvmcloud.com lt5ai41qh5d53qoti3mkmc0.appsync-api.us-west-2.avsvmcloud.com String 1 Let’s start from the 1st string in the list: olc62cocacn7u2q22v02eu.appsync-api.us-west-2.avsvmcloud.com. In this string, the first 15-character string is an encoded USER_ID : “olc62cocacn7u2q” . Once it is base-64 decoded, as explained in the previous post, it becomes a 9-byte byte array: 86 7f 2f be f9 fb a3 ae c4 The first byte in this byte array is a XOR key: 0x86 . Once applied to the 8 bytes that follow it, we get the 8-byte user ID – let’s take a note and write it down, we will need it later: f9 a9 38 7f 7d 25 28 42 Next, let’s take the NUM part of the encoded domain: it’s a character “2” located at the position #15 (starting from 0) of the encrypted domain. In order to decode the NUM number, we have to take the first character of the encrypted domain, take the reminder of its division by 36 , and subtract the NUM ‘s position in the string “0123456789abcdefghijklmnopqrstuvwxyz” : num = domain[0] % 36 – “0123456789abcdefghijklmnopqrstuvwxyz”.IndexOf(domain.Substring(15, 1)); The result is 1 . That means the decrypted domain will be the 2nd part of a full domain name. The first part must have its NUM decoded as 0. The COMPUTER_DOMAIN part of the encrypted domain is “2v02eu” . Once decoded, using the previously explained method, the decoded computer domain name becomes “on.ca” . String 2 Let’s decode the second passive DNS request from our list: r1qshoj05ji05ac6eoip02jovt6i2v0c.appsync-api.us-west-2.avsvmcloud.com Just as before, the decoded 8-byte user ID becomes: f9 a9 38 7f 7d 25 28 42 The NUM part of the encoded domain, located at the position #15 (starting from 0), is a character “6” . Let’s decode it, by taking the first character ( “r” = 114 ), take the reminder of its division by 36 ( 114 % 36 = 6 ), and subtracting the position of the character “6” in the “0123456789abcdefghijklmnopqrstuvwxyz” , which is 6 . The result is 0 . That means the decrypted domain will be the 1st part of the full domain name. The COMPUTER_DOMAIN part of the encrypted domain is “eoip02jovt6i2v0c” . Once decoded, it becomes “city.kingston.” Next, we need to match 2 decrypted domains by the user ID, which is f9 a9 38 7f 7d 25 28 42 in both cases, and concatenate the first and the second parts of the domain. The result will be “city.kingston.on.ca” . String 3 Here comes the most interesting part. Lets try to decrypt the string #3 from our list of passive DNS requests: lt5ai41qh5d53qoti3mkmc0.appsync-api.us-west-2.avsvmcloud.com The decoded user ID is not relevant, as the decoded NUM part is a number -29 . It’s neither 0 nor 1 , so what kind of domain name that is? If we ignore the NUM part and decode the domain name, using the old method, we will get “thx8xb” , which does not look like a valid domain name. Cases like that are not the noise, and are not some artificially encrypted artifacts that showed up among the DNS requests. This is a different type of DNS requests. Instead of encoding local domain names, these types of requests contain data. They are generated by the malware’s function GetNextStringEx() . The encryption method is different as well. Let’s decrypt this request. First, we can decode the encrypted domain, using the same base-64 method, as before . The string will be decoded into 14 bytes: 7c a5 4d 64 9b 21 c1 74 a6 59 e4 5c 7c 7f Let’s decode these bytes, starting from the 2nd byte, and using the first byte as a XOR key. We will get: 7c d9 31 18 e7 5d bd 08 da 25 98 20 00 03 In this array, the bytes marked in yellow are an 8-byte User ID, encoded with a XOR key that is selected from 2 bytes marked in red. Let’s decode User ID: for ( int i = 0 ; i < 8 ; i++) { bytes[i + 1 ] ^= bytes[ 11 - i % 2 ]; } The decoded byte array becomes: 7c f9 a9 38 7f 7d 25 28 42 25 98 20 00 03 The User ID part in marked in yellow. Does it look familiar? Indeed, it’s the same User ID we’ve seen before, when we decoded “city.kingston.on.ca” . The next 3 bytes marked in red are: 25 98 20 . 2 0x59820 The first number 2 stands for the size of data that follows – this data is 00 03 (selected in green). The number 0x59820 , or 366,624 in decimal, is a timestamp. It’s a number of 4-second periods of time since 1 January 2010. To obtain the real time stamp, we need to multiple it by 15 to get minutes, then add those minutes to 1 January 2010: var date = ( new DateTime( 2010 , 1 , 1 , 0 , 0 , 0 , DateTimeKind.Utc)).AddMinutes(timestamp * 15 ); For the number 0x59820 , the time stamp becomes 16 July 2020 12:00:00 AM – that’s the day when the DNS request was made. The remaining 2 bytes, 00 03 , encrypt the state of 8 security products, to indicate whether each one of them is running or whether it is stopped. The 8 security products are: Windows Live OneCare / Windows Defender Windows Defender Advanced Threat Protection Microsoft Defender for Identity Carbon Black CrowdStrike FireEye ESET F-Secure 2 states for 8 products require 2 * 8 = 16 bits = 2 bytes. The 2 bytes 00 03 in binary form are: 00 00 00 00 00 00 00 11 Here, the least-significant bits 11 identify that the first product in the list, Windows Live OneCare / Windows Defender, is reported as ‘running’ ( 1 ) and as ‘stopped’ ( 1 ). Now we know that apart from the local domain, the trojanised SolarWinds software running on the same compromised host on “city.kingston.on.ca” domain has also reported the status of the Windows Defender software. What Does it Mean? As explained in the first part of our description, the malware is capable of stopping the services of security products, be manipulating registry service keys under Administrator account. It’s likely that the attackers are using DNS queries as a C2 channel to first understand what security products are present. Next, the same channel is used to instruct the malware to stop/deactivate these services, before the 2nd stage payload, TearDrop Backdoor, is deployed. Armed with this knowledge, let’s decode other passive DNS requests, printing the cases when the compromised host reports a running security software. NOTES: As a private case, if the data size field is 0 or 1 , the timestamp field is not followed with any data. Such type of DNS request is generated by the malware’s function GetNextString() . It is called ‘a ping’ in the listing below. If the first part of the domain name is missing, the recovered domain name is pre-pended with ‘*’ . The malware takes the time difference in minutes, then divides it by 30 and then converts the result from double type to int type; as a result of such conversion, the time stamps are truncated to the earliest half hour. 2D82B037C060515C SFBALLET Data: Windows Live OneCare / Windows Defender [running] 11/07/2020 12:00:00 AM Pings: 12/07/2020 12:30:00 AM 70DEE5C062CFEE53 ccscurriculum.c Data: ESET [running] 17/04/2020 4:00:00 PM Pings: 20/04/2020 5:00:00 PM AB902A323B541775 mountsinai.hospital Pings: 4/07/2020 12:30:00 AM 9ACC3A3067DC7FD5 *ripta.com Data: ESET [running] 12/09/2020 6:30:00 AM Pings: 13/09/2020 7:30:00 AM 14/09/2020 9:00:00 AM CB34C4EBCB12AF88 DPCITY.I7a Data: ESET [running] 26/06/2020 5:00:00 PM Pings: 27/06/2020 6:30:00 PM 28/06/2020 7:30:00 PM 29/06/2020 8:30:00 PM 29/06/2020 8:30:00 PM E5FAFE265E86088E *scroot.com Data: CrowdStrike [running] 25/07/2020 2:00:00 PM Pings: 26/07/2020 2:30:00 PM 26/07/2020 2:30:00 PM 27/07/2020 3:00:00 PM 27/07/2020 3:00:00 PM 426030B2ED480DED *kcpl.com Data: Windows Live OneCare / Windows Defender [running] 8/07/2020 12:00:00 AM Carbon Black [running] 8/07/2020 12:00:00 AM Full list of decoded pDNS requests can be found here . An example of a working implementation is available at this repo. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Fortinet algosec security management suite Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Tsippi Dach, Director of Communications at AlgoSec, explores what happened during this past summer’s Fastly outage, and explores how your... Application Connectivity Management The great Fastly outage Tsippi Dach 2 min read Tsippi Dach Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 9/29/21 Published Tsippi Dach, Director of Communications at AlgoSec, explores what happened during this past summer’s Fastly outage, and explores how your business can protect itself in the future. The odds are that before June 8th you probably hadn’t heard of Fastly unless you were a customer. It was only when swathes of the internet went down with the 503: Service Unavailable error message that the edge cloud provider started to make headlines . For almost an hour, sites like Amazon and eBay were inaccessible, costing millions of dollars’ worth of revenue. PayPal, which processed roughly $106 million worth of transactions per hour throughout 2020, was also impacted, and disruption at Shopify left thousands of online retail businesses unable to serve customers. While the true cost of losing a significant portion of the internet for almost one hour is yet to be tallied, we do know what caused it. What is Fastly and why did it break the internet? Fastly is a US-based content distribution network (CDN), sometimes referred to as an ‘edge cloud provider.’ CDNs relieve the load on a website’s servers and ostensibly improve performance for end-users by caching copies of web pages on a distributed network of servers that are geographically closer to them. The downside is that when a CDN goes down – due to a configuration error in Fastly’s case – it reveals just how vulnerable businesses are to forces outside of their control. Many websites, perhaps even yours, are heavily dependent on a handful of cloud-based providers. When these providers experience difficulties, the consequences for your business are amplified ten-fold. Not only do you run the risk of long-term and costly disruption, but these weak links can also provide a golden opportunity for bad actors to target your business with malicious software that can move laterally across your network and cause untold damage. How micro-segmentation can help The security and operational risks caused by these outages can be easily mitigated by implementing plans that should already be part of an organization’s cyber resilience strategy. One aspect of this is micro-segmentation , which is regarded as one of the most effective methods to limit the damage of an intrusion or attack and therefore limit large-scale downtime from configuration misfires and cyberattacks. Micro-segmentation is the act of creating secure “zones” in data centers and cloud deployments that allow your company to isolate workloads from one another. In effect, this makes your network security more compartmentalized, so that if a bad actor takes advantage of an outage in order to breach your organization’s network, or user error causes a system malfunction, you can isolate the incident and prevent lateral impact. Simplifying micro-segmentation with AlgoSec Security Management Suite The AlgoSec Security Management Suite employs the power of automation to make it easy for businesses to define and enforce their micro-segmentation strategy, ensuring that it does not block critical business services, and also meets compliance requirements. AlgoSec supports micro-segmentation by: Mapping the applications and traffic flows across your hybrid network Identifying unprotected network flows that do not cross any firewall and are not filtered for an application Automatically identifying changes that will violate the micro-segmentation strategy Ensuring easy management of network security policies across your hybrid network Automatically implementing network security policy changes Automatically validating changes Generating a custom report on compliance with the micro-segmentation policy Find out more about how micro-segmentation can help you boost your security posture, or request your personal demo . Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

AlgoSec ISO/IEC 27001 Certificate Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

AlgoSec Security Management Solution for Cisco ACI and Cisco Nexus Dashboard Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Securely accelerate digital transformation – A joint VMware AlgoSec webinar VMware AlgoSec Webinar Webinars Securely Accelerate Digital Transformation – A Joint VMware & AlgoSec Webinar This past year was an earthquake. The global pandemic amplified the urgent need for businesses to accelerate digital transformation, at the same time that concerns about security achieved heightened levels of urgency. Digital transformation offers the ability to turn these challenges into opportunities. In this joint session by VMware and AlgoSec, you’ll find out how you can maintain both security and agility throughout your digital business transformation project though the AlgoSec integration with VMware NSX-T. Our experts, Brian Heili from VMware and Jeremiah Cornelius from AlgoSec will show you: How VMware simplifies security deployments with NSX Service-defined Firewall by delivering a fundamentally different, “intrinsic” approach to securing east-west traffic at scale — one that’s built into the hypervisor and available at every host. How to gain complete visibility in NSX and across your entire hybrid network with AlgoSec. How to automatically discover, map and manage application connectivity in VMware NSX. How to assess risk in configuration of all network security policy changes and eliminate error with zero-touch automation. How to ensure continuous compliance, by having AlgoSec monitor and track changes to network security policies, whether on VMware NSX firewalls, traditional firewalls or cloud security control February 17, 2021 Brian Heili Network Security Solution Engineer Jeremiah Cornelius Technical Leader for Alliances and Partners at AlgoSec Relevant resources Tips on How to Create Filtering Policies for VMware NSX Keep Reading Partner Solution Brief: AlgoSec and VMware Read Document Network Security for VMware NSX Watch Video Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

As with all cloud vendors, AWS users share responsibility for securing their infrastructure against risk. Amazon provides the tools you... AWS Security group architecture for AWS: How to overcome security group limits Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/9/23 Published As with all cloud vendors, AWS users share responsibility for securing their infrastructure against risk. Amazon provides the tools you need to filter traffic, but configuring those tools is up to you. Firewalls are one of the tools you’ll use to filter traffic and secure Virtual Private Cloud (VPC) instances. Instead of using traditional firewalls, Amazon provides users with AWS security groups, which are flexible, stateful firewalls capable of filtering inbound and outbound traffic. However, there are limits to what you can do with AWS security groups. First, they only allow traffic – you can’t configure them to deny traffic. Second, the maximum number of rules you can set for a single group is 60. This isn’t a big issue for an Amazon EC2 instance designed to address inbound traffic. You’ll either want your AWS EC2 to accept ingress from the entire internet or you’ll want to configure access for a few internal IP addresses. But for outbound traffic, 60 rules simply isn’t enough. You’ll use a dozen of them just allowing access to GitHub’s API . Add in a few third-party partners and you’re already well past the limit. Amazon VPC resource limits explained Amazon sets clear limits on the AWS services and resources it makes available to users. In some cases, you can increase these limits by contacting AWS support. These limits are generally assessed on a per-Region basis. Here are some of the limits Amazon places on AWS users: Security group limits 2500 VPC security groups per Region 60 IPv4 rules per security group 60 IPv6 rules per security group 5 security groups per network interface VPC and subnet limits 5 VPCs per Region 200 Subnets per VPC 5 IPv4 CIDR blocks per VPC 5 IPv6 CIDR blocks per VPC Limits to elastic IP addresses and gateways 5 Elastic IP addresses per Region 2 Elastic IP Addresses per public NAT gateway 5 Egress-only internet gateways per Region 5 NAT gateways per Availability Zone One carrier gateway per VPC Prefix list limits 100 prefix lists per Region 1000 versions per prefix list 5000 prefix list references per resource type Network ACL limits 200 Network ACLs per VPC 20 Rules per Network ACL How to manage AWS cloud security group limits effectively Traditional firewalls may have thousands of security rules, including a complex combination of inbound rules and egress filters. Crucially, they can also enforce outbound rules that include denying traffic – something Amazon does not allow regular security groups to do. While AWS offers powerful tools for securing cloud workflows, Amazon VPC users must find ways to overcome these limitations. Fortunately, there are a few things you can do to achieve exactly that. Optimize your VPC security groups. Use Network Access Control Lists to secure assets at the subnet level. Use a domain name filtering system that reduces the number of IP addresses security group rules need to resolve. Optimize your Amazon virtual private cloud configuration Amazon VPC is a virtual network that contains many of the elements you’d expect from a traditional network. It has IP addresses, route tables, subnets, and internet gateways. Unlike a traditional network, you can easily configure many of your VPC environment through a command line interface (CLI). You can establish VPC peering connections, implement identity and access management (IAM) protocols, and configure elastic network interfaces without manually handling any hardware. But first, you need to set up and protect your VPC by setting up and configuring security groups. If you don’t specify a particular group, Amazon EC2 will use the default security group. If you haven’t added new security groups since creating your AWS account, you may only have that one default security group. The first step to optimizing security is expanding the number of security groups you have available. Here’s an example of the code you can use to create a new security group in the AWS console:aws ec2 create-security-group –group-name web-pci-sg –description “allow SSL traffic” –vpc-id vpc-555666777 This creates a new group named web-pci-sg and describes it as a group designed to allow SSL traffic on the network. Remember that security groups don’t support deny rules. Here is the code you would use to add a rule to that group: aws ec2 authorize-security-group-ingress \ –group-name web-pci-sg \ –protocol https \–port 443 \ –cidr This rule specifically allows SSL traffic using the HTTPS protocol to use port 443, which is the standard port for HTTPS traffic. You can use the last argument to specify the cidr block the rule will direct traffic through. This gives you the ability to manage traffic through specific subnets, which is important for the next step. This example focuses on just one type of rule in one context. To take full advantage of the security tools AWS makes available, you’ll want to create custom rules for endpoints, load balancers, nat gateways, and more. Although you’re limited to 60 rules per security group, creating many groups lets you assign hundreds of rules to any particular instance. Security architecture and network ACLs Network Access Control Lists provide AWS users with additional filtering capabilities. Network ACLs are similar to security groups in many ways, but come with a few key differences: Network ACLs can contain deny rules. You can write Network ACL rules to include explicit actions, like blocking particular IP addresses or routing VPN users in a specific way. Network ACLs are enforced at the subnet level. This means they apply to every instance in the subnet, in addition to whatever rules exist at the security group level. As mentioned above, each Network ACL can contain up to 20 rules. However, you can have up to 200 Network ACLs per VPC, which gives you a total of 4000 potential rules. Along with instance-specific security group rules, this offers much more flexibility for setting up robust AWS security architecture. Since Network ACLs can deny traffic, they are a useful tool for managing access to databases and other sensitive assets. For example, you may wish to exclude users who don’t have the appropriate permissions from your Amazon RDS instance. You may also want to filter SSH (Secure Shell) connections coming from unknown sources, or limit connections between different internal instance types. To do this effectively, you need to group these assets under the same subnet and make sure that the appropriate rules are enabled for all of them. You can also write asset-specific rules at the security group level, ensuring every asset has its own optimal configuration. The larger your AWS environment is, the more complex this process may become. Take care to avoid misconfigurations – it’s very easy to accidentally write security group rules and Network ACL rules that aren’t compatible, or that cause problems when you access the instance. To avoid this, try to condense your rules as much as possible. Avoid limits by filtering domain names directly Although you can create a large number of rules by creating additional security groups, you still may want to add more than 60 rules in a single group. There are many scenarios where this makes more sense than arbitrarily adding (and managing) new groups. For example, you might have a production instance that needs updates from several third-party partners. You also need to periodically change and update the technologies this instance relies on, so you’d like to keep its rules in a single security group. This reduces misconfiguration risk by keeping all the relevant rules in one place – not spread out across multiple groups. To overcome this limit, you need to reduce the number of IP addresses that the security group filters. You can do this by deploying a third-party solution that allows security rules to perform DNS resolution. This eliminates the need for AWS to resolve the domain name. Since AWS security groups can’t compute domain names on their own, you’ll need to deploy a third-party NAT gateway on your public VPC to filter outbound traffic in this way. Once you do this, you can write rules that filter outgoing connections based on their domain name. This effectively bypasses the 60 IP limit because you are not referring to specific IP addresses. At the same time, it simplifies management and makes rules much easier to read and understand. Instead of looking up and adding all of Github’s API IP addresses, you can write rules that reference the domain “Github.com”. If Github decides to change its IP infrastructure, your security rules will automatically reference the new addresses – you won’t have to go back and update them. The earlier you address AWS security group limits, the better There is an unlimited number of ways you can arrange your security groups and Network ACLs. Even in a small environment, the prospect may seem daunting. However, the flexibility Amazon provides to its cloud users is a valuable security feature. Those who go the process enjoy clear security performance benefits. If you start to planning for the architecture of your security and filtering policies early, you’ll be better equipped to scale those policies upwards as your organization grows. This will prevent security processes from becoming a growth bottleneck and maintain a high level of efficiency even as those policies become larger and more complex. See me explain this issue in person in my new whiteboard video: Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

The cloud visibility imperative WhitePaper Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue