Search results

Discover five essential tips for securing your network in 2021 with Algosec's network security experts. Webinars 5 power tips to keep your network secure in 2021 No one could have predicted how unpredictable 2020 would be, so we’re here to help you get prepared for whatever is in store in 2021. No matter what happens in the upcoming year – there are five things you can do now to keep your network secure in 2021. Join network security experts Jade Kahn and Asher Benbenisty, and learn how to: Never fly blind: Ensure visibility across your entire hybrid network Do more with less: Accelerate digital transformation & avoid misconfigurations with automation Stay continuously compliant Fight ransomware with micro-segmentation Accelerate in the cloud January 13, 2021 Jade Kahn CMO Asher Benbenisty Director of product marketing Relevant resources 5 Network Security Management Predictions for 2020 Watch Video Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Explore Algosec's customer success stories to see how organizations worldwide improve security, compliance, and efficiency with our solutions. Discovery Streamlines Firewall Audits And Simplifies The Change Workflow Organization Discovery Industry Financial Services Headquarters Johannesberg, South Africa Download case study Share Customer
success stories "With AlgoSec we can now get, in a click of a button, what took two to three weeks per firewall to produce manually" Background Discovery Limited is a South African-founded financial services organization that operates in the healthcare, life assurance, short-term insurance, savings and investment products and wellness markets. Founded in 1992, Discovery was guided by a clear core purpose — to make people healthier and to enhance and protect their lives. Underpinning this core purpose is the belief that through innovation, Discovery can be a powerful market disruptor. The company, with headquarters in Johannesburg, South Africa, has expanded its operations globally and currently serves over 4.4 million clients across South Africa, the United Kingdom, the United States, China, Singapore and Australia.Operating in the highly regulated insurance and health sectors, Discovery monitors its compliance with international privacy laws and security criteria, includingPCI-DSS globally, Sarbanes-Oxley and HIPAA in the US, the Data Protection Act in the UK, and South Africa’s Protection of Personal Information Act. Challenge During its early years, the company managed its firewalls through an internally developed, legacy system which offered very limited visibility into the change request process.“We grew faster than anyone expected,” says Marc Silver, Security Manager at Discovery. “We needed better visibility into what changes were requested to which firewall, for what business need and also to ensure proper risk analysis.”Discovery’s growth necessitated a rapid increase in the number of firewalls deployed, and the corresponding ruleset sizes. The time required to audit them grew by orders of magnitude, ultimately taking up to three weeks per firewall. The IT Security team of four engineers recognized that it needed a fresh approach to manage risk and ensure compliance. Solution Discovery chose the AlgoSec Security Management Solution to deliver automated, comprehensive firewall operations, risk analysis and change management. Silver states that compared to AlgoSec’s competitors, “AlgoSec has a more tightly integrated change control, and is easier to manage. Another big advantage is how it finds unused rules and recommends rule consolidations,” says Silver.AlgoSec’s integration with Request Tracker (RT) change management system was also important in Discovery’s selection of a security management solution. “We use RT for our internal ticketing system, and the stability of AlgoSec’s integration with RT met our requirements. AlgoSec’s visual workflow is clear, easy to understand and more mature than the others we evaluated,” adds Silver. Results Since implementing AlgoSec, Discovery has found its security audits running more effectively. Discovery relies on AlgoSec’s built-in compliance reports to address Sarbanes-Oxley, HIPAA, PCI-DSS, and other national and international regulatory requirements. “Every year internal auditors would take our entire rulesets for each firewall pair and tell us where we needed to make improvements. AlgoSec now allows us to submit an automated report to our auditing team. It tells them what our security state is, and what needs to be remediated. The total process used to take three months. Now, in a click of a button, we can get what took two to three weeks per firewall to produce manually,” says Silver.Discovery has also found an unexpected advantage: “AlgoSec tells us what rules are in use and what rules are not. For one firewall, we were able to remove 30,000 rules. A firewall with 500,000 rules isn’t going to cope as well as one with 100,000 rules. By optimizing our devices, AlgoSec saves us money in the long term by enabling us to delay upgrading to a larger firewall,” adds Silver.In conclusion, Silver states that “Now we can see what is and isn’t happening in our security system. It has made a much bigger impact than we thought it would. With AlgoSec’s policy optimization, and the time we save on compliance, AlgoSec has given us a much stronger competitive edge than we had six months ago.” Schedule time with one of our experts

AlgoSec leads in automating application connectivity and security policy management, essential for complex hybrid and multi-cloud networks AlgoSec Achieves Outperformer Status in GigaOm’s Cloud Network Security Radar Report AlgoSec leads in automating application connectivity and security policy management, essential for complex hybrid and multi-cloud networks February 15, 2024 Speak to one of our experts RIDGEFIELD PARK, N.J., Feb 15, 2024 – Global cybersecurity leader AlgoSec has been named a Market Outperformer in GigaOm’s first cloud network security Radar Report, recognizing its position at the forefront of Cloud security innovation. The GigaOm Radar report highlights key cloud network security vendors to equip IT decision-makers with the information they need to select the best fit for their business. It measures selected vendors based on their execution and ability to innovate. In the report, Andrew Green, IT writer and practitioner, acknowledged several of AlgoSec’s distinguishing capabilities including Automation and Security Policy Management: “AlgoSec automates application connectivity and security policy across the hybrid network estate including public cloud, private cloud, containers, and on-premises networks.” Comprehensive Solution Suite : “AlgoSec delivers cloud network security solutions via its Firewall Analyzer, FireFlow, and AlgoSec Cloud products. AlgoSec Cloud provides application-based risk identification and security policy management across multi-cloud environments.” Real-Time Network Mapping : “A real-time network map provides a comprehensive view and connectivity flows of security and networking appliances such as firewalls, routers, and switches.” Other highlights from the report include infrastructure as code (IaC) security scanning capability, which produces “what-if” risks and vulnerability analysis scans within existing source control applications, and AlgoBot, an intelligent chatbot that assists with change management processes. Green said: “Network security policy managers have a distinct set of features, with particularly strong observability, misconfiguration, and simulation capabilities. These solutions are less invasive as they orchestrate only existing appliances without imposing architectural changes, and they can help enterprises reach the low-hanging fruit for improving their security posture. AlgoSec offers a range of innovative developments, including AlgoBot, which helps with change management processes, and the solution’s capabilities for planning and simulations.” “We are at the forefront of a pivotal shift within cloud network security”, said Eran Shiff, VP Product at AlgoSec. “To effectively address the needs of businesses working in a complex hybrid world, we are disregarding conventional norms and operating deep within the cloud application level. By understanding the business context and purpose of every application, we are enabling our customers to gain visibility, reduce overall risk and process hundreds of application changes with zero-touch across a hybrid network. Our inclusion in this report is a testament of this evolution and marks a new chapter in securing application connectivity.” AlgoSec is trusted by more than 1,800 of the world’s leading organizations including NCR Corporation, a leading global point-of-sale (POS) provider for restaurants, retailers, and banks and a provider of multi-vendor ATM software. Commenting on the partnership, Scott Theriault, Global Manager, Network Perimeter Security at NCR said: “As we aspire to achieve zero-trust, when moving into the cloud, micro-segmentation and container security come into play. Therefore, we need tools like AlgoSec to assist us in the journey because most application owners do not know what access is needed. This tool helps them learn what needs to be implemented to reduce the attack surface,” stated Theriault. About AlgoSec AlgoSec, a global cybersecurity leader, empowers organizations to secure application connectivity and cloud-native applications throughout their multi-cloud and hybrid network. Trusted by more than 1,800 of the world’s leading organizations, AlgoSec’s application-centric approach enables to securely accelerate business application deployment by centrally managing application connectivity and security policies across the public clouds, private clouds, containers, and on-premises networks. Using its unique vendor-agnostic deep algorithm for intelligent change management automation, AlgoSec enables acceleration of digital transformation projects, helps prevent business application downtime and substantially reduces manual work and exposure to security risks. AlgoSec’s policy management and CNAPP platforms provide a single source for visibility into security and compliance issues within cloud-native applications as well as across the hybrid network environment, to ensure ongoing adherence to internet security standards, industry, and internal regulations. Learn how AlgoSec enables application owners, information security experts, DevSecOps and cloud security teams to deploy business applications up to 10 times faster while maintaining security at www.algosec.com . About GigaOm GigaOm provides technical, operational, and business advice for strategic digital enterprise and business initiatives. Enterprise business leaders, CIOs, and technology organizations partner with GigaOm for practical, actionable, strategic, and visionary advice for modernizing and transforming their business. GigaOm’s advice empowers enterprises to successfully compete in an increasingly complicated business atmosphere that requires a solid understanding of constantly changing customer demands. GigaOm works directly with enterprises both inside and outside of the IT organization to apply proven research and methodologies designed to avoid pitfalls and roadblocks while balancing risk and innovation. Research methodologies include but are not limited to adoption and benchmarking surveys, use cases, interviews, ROI/TCO, market landscapes, strategic trends, and technical benchmarks. Our analysts possess 20+ years of experience advising a spectrum of clients from early adopters to mainstream enterprises. GigaOm’s perspective is that of the unbiased enterprise practitioner. Through this perspective, GigaOm connects with engaged and loyal subscribers on a deep and meaningful level.

Explore Algosec's customer success stories to see how organizations worldwide improve security, compliance, and efficiency with our solutions. Leading Life Insurance Company Ensures Security and Compliance Organization Life Insurance Industry Financial Services Headquarters Texas, USA Download case study Share Customer
success stories "AlgoSec worked right out of the box. We got started quickly and never looked back.” A leading insurance provider of life, disability and other benefits for individuals increases efficiency and ensures continuous compliance on their networks. Background This life insurance company provides insurance and wealth-management products and services to millions of Americans. The company employs thousands of people and maintains a network of several thousand financial representatives. They offer a wide range of insurance products and services that include life insurance, disability income insurance, annuities, investments, dental and vision. Challenges For decades, the company operated a large and growing data center in Bethlehem, PA which they recently transferred to Dallas, TX. During and since the transfer, the company has been replacing much of its multi-vendor network infrastructure, consolidating on Cisco Firepower technology, but still maintaining vestiges of other routers, firewalls and network equipment. At the new data center, the company’s IT staff maintains more than 100 firewalls that host some 10,000 rules. The company’s network security engineer described the considerable pressure on the security staff: “Change requests are frequent, 25-30 per week, demanding considerable time and effort by the security team.” Due to the presence of firewalls from multiple vendors, change requests were analyzed manually and pushed to devices with great care so as not to interrupt the operation of a rapidly growing body of applications. “The change–request process was tedious and very time consuming,” declared the engineer. “as was the pressure to maintain a strong compliance posture at all times.” The company is subject to a litany of demanding insurance-industry regulations that concern the care of personal information and processes. Managing risk is critical to the success of the business and being able to ascertain compliance with regulations is always vital. Solution The security team turned to AlgoSec to help them manage network security policy across the large data center that includes firewalls from multiple vendors. After a careful review, the security team acquired AlgoSec’s Firewall Analyzer to speed up the process of firewall change management as well as to continuously quantify the degree of compliance and level of risk. Vendor-agnostic AlgoSec Firewall Analyzer delivers visibility and analysis of complex network security policies across on–premise and cloud networks. It automates and simplifies security operations including troubleshooting, auditing and risk analysis. Firewall Analyzer optimizes the configuration of firewalls, routers, web proxies and related network infrastructure to ensure security and compliance. Results After a very short installation and learning period, the security staff became proficient at operating Firewall Analyzer’s helpful capabilities. Soon thereafter, staff members undertook AlgoSec certification courses to become experts in using the solution for firewall analysis. “AlgoSec worked right out of the box,” said the engineer. “We got started quickly and never looked back.” The AlgoSec solution has significantly improved processes, delivering significantly improved results for their security team: Reduced time to analyze and optimize firewall rules, automatically checking for shadow rules and discovering other rules eligible for consolidation or deletion. Continual optimization of firewall rules across their entire network estate. Increased efficiency of security staff, enabling them to keep up with the volume of change requests. Accelerated and more accurate change verification. Audit-readiness, generating scheduled and on-demand compliance reports. The security staff looks forward to implementing AlgoSec FireFlow (AFF), that will enable them to push changes automatically to their population of firewalls, eliminating errors and further reducing risk. With AFF, the staff will be able to respond to changing business requirements with increased speed and agility. They added: “We are also checking out AlgoSec’s new cloud-security solution since we are migrating a growing number of applications to AWS.” Schedule time with one of our experts

Webinars Radically reduce firewall rules with application-driven rule recertification Does your network still have obsolete firewall rules? Do you often feel overwhelmed with the number of firewall rules in your network? To make sure your network is secure and compliant, you need to regularly review and recertify firewall rules. However, manual firewall rule recertification is complex, time-consuming and error-prone, and mistakes may cause application outages. Discover a better way to recertify your firewall rules with Asher Benbenisty, AlgoSec’s Director of Product Marketing, as he discusses how associating application connectivity with your firewall rules can radically reduce the number of firewall rules on your network as well as the efforts involved in rule recertification. In this webinar, we will discuss: The importance of regularly reviewing and recertifying your firewall rules Integrating application connectivity into your firewall rule recertification process Automatically managing the rule-recertification process using an application-centric approach October 14, 2020 Asher Benbenisty Director of product marketing Relevant resources Changing the rules without risk: mapping firewall rules to business applications Keep Reading AlgoSec AppViz – Rule Recertification Watch Video Choose a better way to manage your network Choose a better way to manage your network Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Continue

Explore Algosec's customer success stories to see how organizations worldwide improve security, compliance, and efficiency with our solutions. ORMAT MANAGES RISK AND NERC COMPLIANCE WITH ALGOSEC Organization ORMAT Industry Technology Headquarters Reno, Nevada, United States Download case study Share Customer
success stories "We’re managing our network security with much greater confidence. With the value of the time we save and our improved compliance readiness, we can clearly see that AlgoSec is delivering on our investment" Global Geothermal Power Producer Improves Security and Compliance and Takes Control of DailyFirewall Management Operations at 14 Global Facilities AlgoSec Business Impact • Automated notifications improve firewall management processes.• Visibility of firewall rules allows better management of security infrastructure.• Built-in reports provide instant proof of SOX and NERC compliance. Background Ormat Technologies, Inc. a world leader in the geothermal power plant sector, is committed to developing green, sustainable energy solutions. The company has installed over 2000 MW of geothermal and Recovered Energy (REG) power plants worldwide. Ormat’s global IT department manages network security and ensures compliance with SOX (Sarbanes-Oxley) regulations and NERC (North American Electric Reliability Corporation) at 14 of its power plants. Challenge Ormat’s firewall configurations typically need updating on a daily basis to address the changing roles and information technology requirements of Ormat’s global employees. As the department has assumed greater responsibility for regulatory compliance in addition to internal operations, firewall management has become cumbersome and costly.“With multiple managers adding and changing firewall configurations at our various locations, we had no way to review each change, see who made it, or know if a change was made at all,” explains Meir Moshka, IT Manager at Ormat. Without this information, reviewing firewall configurations against regulations and standards was difficult and time-consuming. “To stay compliant and secure, we needed better controls for firewall management, but we also had to stay responsive to the employees we serve,” says Moshka. Solution After evaluating several firewall management products, Ormat selected the AlgoSec Security Management solution for its ease of use, and for the superiority of its built-in SOX and NERC compliance reports. “The web user interface is easy and friendly,” comments Moshka. His team installed and tested AlgoSec themselves, in a matter of days. Another capability that drove Ormat to select AlgoSec was its ability to create a workflow for their firewall configuration process. “Every time a change is made, the security manager receives an email describing the new configuration,” says Moshka. “The change is only made after the manager approves it.” The new process will ensure that all configuration changes are properly reviewed. Results Today, in addition to maintaining its network security policies more effectively, Ormat is dramatically reducing the time spent preparing for compliance audits. “Together, the firewall management process and reports keep us ready for an audit at all times. We save a great deal of audit preparation time because we already review each configuration change against the requirements on a daily basis.” Automated compliance reporting also gives Ormat the power to demonstrate compliance to customers and prospects, as the company pursues new contracts for power plant operations in the US. “By using the built-in reports, we can instantly show we are NERC and SOX compliant. It’s a valuable proof for the plant owners.” Moshka and his team also rely on AlgoSec’s built-in knowledgebase of best practices for firewall configuration. Additionally, they have customized the out-of-the-box functionality by defining additional risks that apply to Ormat’s environment. With their customized risk profile in place, each firewall configuration change is evaluated against the knowledgebase to determine which configurations to improve or avoid. “Often, a change to the firewall needs to be more restrictive than we thought,” says Moshka. “AlgoSec gives us recommendations for each new change, and we minimize security risks by following them.” Another improvement is how AlgoSec’s policy cleanup and optimization features ensure Ormat’s security policy is streamlined and easy to maintain. “Now I see exactly which policy applies to which firewall, which rules are duplicated, expired, or unused, and get recommendations on the most effective way to reorder the most used rules,” says Moshka. With AlgoSec, Ormat has taken back control for its firewall policies and compliance requirements. “We’re managing our network security with much greater confidence,” Moshka says. “Add together the value of the time we save on a daily basis, and our improved compliance readiness, and we can clearly see that AlgoSec is delivering on our investment.” Schedule time with one of our experts

As you may have heard already, the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) released a joint... Cloud Security Drovorub’s Ability to Conceal C2 Traffic And Its Implications For Docker Containers Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 8/15/20 Published As you may have heard already, the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory about previously undisclosed Russian malware called Drovorub. According to the report, the malware is designed for Linux systems as part of its cyber espionage operations. Drovorub is a Linux malware toolset that consists of an implant coupled with a kernel module rootkit, a file transfer and port forwarding tool, and a Command and Control (C2) server. The name Drovorub originates from the Russian language. It is a complex word that consists of 2 roots (not the full words): “drov” and “rub” . The “o” in between is used to join both roots together. The root “drov” forms a noun “drova” , which translates to “firewood” , or “wood” . The root “rub” /ˈruːb/ forms a verb “rubit” , which translates to “to fell” , or “to chop” . Hence, the original meaning of this word is indeed a “woodcutter” . What the report omits, however, is that apart from the classic interpretation, there is also slang. In the Russian computer slang, the word “drova” is widely used to denote “drivers” . The word “rubit” also has other meanings in Russian. It may mean to kill, to disable, to switch off. In the Russian slang, “rubit” also means to understand something very well, to be professional in a specific field. It resonates with the English word “sharp” – to be able to cut through the problem. Hence, we have 3 possible interpretations of ‘ Drovorub ‘: someone who chops wood – “дроворуб” someone who disables other kernel-mode drivers – “тот, кто отрубает / рубит драйвера” someone who understands kernel-mode drivers very well – “тот, кто (хорошо) рубит в драйверах” Given that Drovorub does not disable other drivers, the last interpretation could be the intended one. In that case, “Drovorub” could be a code name of the project or even someone’s nickname. Let’s put aside the intricacies of the Russian translations and get a closer look into the report. DISCLAIMER Before we dive into some of the Drovorub analysis aspects, we need to make clear that neither FBI nor NSA has shared any hashes or any samples of Drovorub. Without the samples, it’s impossible to conduct a full reverse engineering analysis of the malware. Netfilter Hiding According to the report, the Drovorub-kernel module registers a Netfilter hook. A network packet filter with a Netfilter hook ( NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT ) is a common malware technique. It allows a backdoor to watch passively for certain magic packets or series of packets, to extract C2 traffic. What is interesting though, is that the driver also hooks the kernel’s nf_register_hook() function. The hook handler will register the original Netfilter hook, then un-register it, then re-register the kernel’s own Netfilter hook. According to the nf_register_hook() function in the Netfilter’s source , if two hooks have the same protocol family (e.g., PF_INET ), and the same hook identifier (e.g., NF_IP_INPUT ), the hook execution sequence is determined by priority. The hook list enumerator breaks at the position of an existing hook with a priority number elem->priority higher than the new hook’s priority number reg->priority : int nf_register_hook ( struct nf_hook_ops * reg) { struct nf_hook_ops * elem; int err; err = mutex_lock_interruptible( & nf_hook_mutex); if (err < 0 ) return err; list_for_each_entry(elem, & nf_hooks[reg -> pf][reg -> hooknum], list) { if (reg -> priority < elem -> priority) break ; } list_add_rcu( & reg -> list, elem -> list.prev); mutex_unlock( & nf_hook_mutex); ... return 0 ; } In that case, the new hook is inserted into the list, so that the higher-priority hook’s PREVIOUS link would point into the newly inserted hook. What happens if the new hook’s priority is also the same, such as NF_IP_PRI_FIRST – the maximum hook priority? In that case, the break condition will not be met, the list iterator list_for_each_entry will slide past the existing hook, and the new hook will be inserted after it as if the new hook’s priority was higher. By re-inserting its Netfilter hook in the hook handler of the nf_register_hook() function, the driver makes sure the Drovorub’s Netfilter hook will beat any other registered hook at the same hook number and with the same (maximum) priority. If the intercepted TCP packet does not belong to the hidden TCP connection, or if it’s destined to or originates from another process, hidden by Drovorub’s kernel-mode driver, the hook will return 5 ( NF_STOP ). Doing so will prevent other hooks from being called to process the same packet. Security Implications For Docker Containers Given that Drovorub toolset targets Linux and contains a port forwarding tool to route network traffic to other hosts on the compromised network, it would not be entirely unreasonable to assume that this toolset was detected in a client’s cloud infrastructure. According to Gartner’s prediction , in just two years, more than 75% of global organizations will be running cloud-native containerized applications in production, up from less than 30% today. Would the Drovorub toolset survive, if the client’s cloud infrastructure was running containerized applications? Would that facilitate the attack or would it disrupt it? Would it make the breach stealthier? To answer these questions, we have tested a different malicious toolset, CloudSnooper, reported earlier this year by Sophos. Just like Drovorub, CloudSnooper’s kernel-mode driver also relies on a Netfilter hook ( NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT ) to extract C2 traffic from the intercepted TCP packets. As seen in the FBI/NSA report, the Volatility framework was used to carve the Drovorub kernel module out of the host, running CentOS. In our little lab experiment, let’s also use CentOS host. To build a new Docker container image, let’s construct the following Dockerfile: FROM scratch ADD centos-7.4.1708-docker.tar.xz / ADD rootkit.ko / CMD [“/bin/bash”] The new image, built from scratch, will have the CentOS 7.4 installed. The kernel-mode rootkit will be added to its root directory. Let’s build an image from our Dockerfile, and call it ‘test’: [root@localhost 1]# docker build . -t test Sending build context to Docker daemon 43.6MB Step 1/4 : FROM scratch —> Step 2/4 : ADD centos-7.4.1708-docker.tar.xz / —> 0c3c322f2e28 Step 3/4 : ADD rootkit.ko / —> 5aaa26212769 Step 4/4 : CMD [“/bin/bash”] —> Running in 8e34940342a2 Removing intermediate container 8e34940342a2 —> 575e3875cdab Successfully built 575e3875cdab Successfully tagged test:latest Next, let’s execute our image interactively (with pseudo-TTY and STDIN ): docker run -it test The executed image will be waiting for our commands: [root@8921e4c7d45e /]# Next, let’s try to load the malicious kernel module: [root@8921e4c7d45e /]# insmod rootkit.ko The output of this command is: insmod: ERROR: could not insert module rootkit.ko: Operation not permitted The reason why it failed is that by default, Docker containers are ‘unprivileged’. Loading a kernel module from a docker container requires a special privilege that allows it doing so. Let’s repeat our experiment. This time, let’s execute our image either in a fully privileged mode or by enabling only one capability – a capability to load and unload kernel modules ( SYS_MODULE ). docker run -it –privileged test or docker run -it –cap-add SYS_MODULE test Let’s load our driver again: [root@547451b8bf87 /]# insmod rootkit.ko This time, the command is executed silently. Running lsmod command allows us to enlist the driver and to prove it was loaded just fine. A little magic here is to quit the docker container and then delete its image: docker rmi -f test Next, let’s execute lsmod again, only this time on the host. The output produced by lsmod will confirm the rootkit module is loaded on the host even after the container image is fully unloaded from memory and deleted! Let’s see what ports are open on the host: [root@localhost 1]# netstat -tulpn Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1044/sshd With the SSH server running on port 22 , let’s send a C2 ‘ping’ command to the rootkit over port 22 : [root@localhost 1]# python client.py 127.0.0.1 22 8080 rrootkit-negotiation: hello The ‘hello’ response from the rootkit proves it’s fully operational. The Netfilter hook detects a command concealed in a TCP packet transferred over port 22 , even though the host runs SSH server on port 22 . How was it possible that a rootkit loaded from a docker container ended up loaded on the host? The answer is simple: a docker container is not a virtual machine. Despite the namespace and ‘control groups’ isolation, it still relies on the same kernel as the host. Therefore, a kernel-mode rootkit loaded from inside a Docker container instantly compromises the host, thus allowing the attackers to compromise other containers that reside on the same host. It is true that by default, a Docker container is ‘unprivileged’ and hence, may not load kernel-mode drivers. However, if a host is compromised, or if a trojanized container image detects the presence of the SYS_MODULE capability (as required by many legitimate Docker containers), loading a kernel-mode rootkit on a host from inside a container becomes a trivial task. Detecting the SYS_MODULE capability ( cap_sys_module ) from inside the container: [root@80402f9c2e4c /]# capsh –print Current: = cap_chown, … cap_sys_module, … Conclusion This post is drawing a parallel between the recently reported Drovorub rootkit and CloudSnooper, a rootkit reported earlier this year. Allegedly built by different teams, both of these Linux rootkits have one mechanism in common: a Netfilter hook ( NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT ) and a toolset that enables tunneling of the traffic to other hosts within the same compromised cloud infrastructure. We are still hunting for the hashes and samples of Drovorub. Unfortunately, the YARA rules published by FBI/NSA cause False Positives. For example, the “Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client binaries based on unique strings and strings indicating statically linked libraries” enlists the following strings: “Poco” “Json” “OpenSSL” “clientid” “—–BEGIN” “—–END” “tunnel” The string “Poco” comes from the POCO C++ Libraries that are used for over 15 years. It is w-a-a-a-a-y too generic, even in combination with other generic strings. As a result, all these strings, along with the ELF header and a file size between 1MB and 10MB, produce a false hit on legitimate ARM libraries, such as a library used for GPS navigation on Android devices: f058ebb581f22882290b27725df94bb302b89504 56c36bfd4bbb1e3084e8e87657f02dbc4ba87755 Nevertheless, based on the information available today, our interest is naturally drawn to the security implications of these Linux rootkits for the Docker containers. Regardless of what security mechanisms may have been compromised, Docker containers contribute an additional attack surface, another opportunity for the attackers to compromise the hosts and other containers within the same organization. The scenario outlined in this post is purely hypothetical. There is no evidence that supports that Drovorub may have affected any containers. However, an increase in volume and sophistication of attacks against Linux-based cloud-native production environments, coupled with the increased proliferation of containers, suggests that such a scenario may, in fact, be plausible. Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

A recent news article from Bleeping Computer called out an incident involving Japanese game developer Ateam, in which a misconfiguration... Cyber Attacks & Incident Response Mitigating cloud security risks through comprehensive automated solutions Malynnda Littky-Porath 2 min read Malynnda Littky-Porath Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 1/8/24 Published A recent news article from Bleeping Computer called out an incident involving Japanese game developer Ateam, in which a misconfiguration in Google Drive led to the potential exposure of sensitive information for nearly one million individuals over a period of six years and eight months. Such incidents highlight the critical importance of securing cloud services to prevent data breaches. This blog post explores how organizations can avoid cloud security risks and ensuring the safety of sensitive information. What caused the Ateam Google Drive misconfiguration? Ateam, a renowned mobile game and content creator, discovered on November 21, 2023, that it had mistakenly set a Google Drive cloud storage instance to “Anyone on the internet with the link can view” since March 2017. This configuration error exposed 1,369 files containing personal information, including full names, email addresses, phone numbers, customer management numbers, and device identification numbers, for approximately 935,779 individuals. Avoiding cloud security risks by using automation To prevent such incidents and enhance cloud security, organizations can leverage tools such as AlgoSec, a comprehensive solution that addresses potential vulnerabilities and misconfigurations. It is important to look for cloud security partners who offer the following key features: Automated configuration checks: AlgoSec conducts automated checks on cloud configurations to identify and rectify any insecure settings. This ensures that sensitive data remains protected and inaccessible to unauthorized individuals. Policy compliance management: AlgoSec assists organizations in adhering to industry regulations and internal security policies by continuously monitoring cloud configurations. This proactive approach reduces the likelihood of accidental exposure of sensitive information. Risk assessment and mitigation: AlgoSec provides real-time risk assessments, allowing organizations to promptly identify and mitigate potential security risks. This proactive stance helps in preventing data breaches and maintaining the integrity of cloud services. Incident response capabilities: In the event of a misconfiguration or security incident, AlgoSec offers robust incident response capabilities. This includes rapid identification, containment, and resolution of security issues to minimize the impact on the organization. The Ateam incident serves as a stark reminder of the importance of securing cloud services to safeguard sensitive data. AlgoSec emerges as a valuable ally in this endeavor, offering automated configuration checks, policy compliance management, risk assessment, and incident response capabilities. By incorporating AlgoSec into their security strategy, organizations can significantly reduce the risk of cloud security incidents and ensure the confidentiality of their data. Request a brief demo to learn more about advanced cloud protection. Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

Can Firewalls Be Hacked? Yes, Here’s 6 Vulnerabilities Like all security tools, firewalls can be hacked. That’s what happened to the... Cyber Attacks & Incident Response Can Firewalls Be Hacked? Yes, Here’s 6 Vulnerabilities Tsippi Dach 2 min read Tsippi Dach Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 12/20/23 Published Can Firewalls Be Hacked? Yes, Here’s 6 Vulnerabilities Like all security tools, firewalls can be hacked. That’s what happened to the social media platform X in January 2023, when it was still Twitter. Hackers exploited an API vulnerability that had been exposed since June the previous year. This gave them access to the platform’s security system and allowed them to leak sensitive information on millions of users. This breach occurred because the organization’s firewalls were not configured to examine API traffic with enough scrutiny. This failure in firewall protection led to the leak of more than 200 million names, email addresses, and usernames, along with other information, putting victims at risk of identity theft . Firewalls are your organization’s first line of defense against malware and data breaches. They inspect all traffic traveling into and out of your network, looking for signs of cyber attacks and blocking malicious activity when they find it. This makes them an important part of every organization’s cybersecurity strategy. Effective firewall management and configuration is vital for preventing cybercrime. Read on to find out how you can protect your organization from attacks that exploit firewall vulnerabilities you may not be aware of. Understanding the 4 Types of Firewalls The first thing every executive and IT leader should know is that there are four basic types of firewalls . Each category offers a different level of protection, with simpler solutions costing less than more advanced ones. Most organizations need to use some combination of these four firewall types to protect sensitive data effectively. Keep in mind that buying more advanced firewalls is not always the answer. Optimal firewall management usually means deploying the right type of firewall for its particular use case. Ideally, these should be implemented alongside multi-layered network security solutions that include network detection and response, endpoint security, and security information and event management (SIEM) technology. 1. Packet Filtering Firewalls These are the oldest and most basic types of firewalls. They operate at the network layer, checking individual data packets for their source IP address and destination IP. They also verify the connection protocol, as well as the source port and destination port against predefined rules. The firewall drops packets that fail to meet these standards, protecting the network from potentially harmful threats. Packet filtering firewalls are among the fastest and cheapest types of firewalls available. Since they can not inspect the contents of data packets, they offer minimal functionality. They also can’t keep track of established connections or enforce rules that rely on knowledge of network connection states. This is why they are considered stateless firewalls. 2. Stateful Inspection Firewalls These firewalls also perform packet inspection, but they ingest more information about the traffic they inspect and compare that information against a list of established connections and network states. Stateful inspection firewalls work by creating a table that contains the IP and port data for traffic sources and destinations, and dynamically check whether data packets are part of a verified active connection. This approach allows stateful inspection firewalls to deny data packets that do not belong to a verified connection. However, the process of checking data packets against the state table consumes system resources and slows down traffic. This makes stateful inspection firewalls vulnerable to Distributed Denial-of-Service (DDoS) attacks. 3. Application Layer Gateways These firewalls operate at the application layer, inspecting and managing traffic based on specific applications or protocols, providing deep packet inspection and content filtering. They are also known as proxy firewalls because they can be implemented at the application layer through a proxy device. In practice, this means that an external client trying to access your system has to send a request to the proxy firewall first. The firewall verifies the authenticity of the request and forwards it to an internal server. They can also work the other way around, providing internal users with access to external resources (like public web pages) without exposing the identity or location of the internal device used. 4. Next-Generation Firewalls (NGFW) Next-generation firewalls combine traditional firewall functions with advanced features such as intrusion prevention, antivirus, and application awareness . They contextualize data packet flows and enrich them with additional data, providing comprehensive security against a wide range of threats. Instead of relying exclusively on IP addresses and port information, NGFWs can perform identity-based monitoring of individual users, applications, and assets. For example, a properly configured NGFW can follow a single user’s network traffic across multiple devices and operating systems, providing an activity timeline even if the user switches between a desktop computer running Microsoft Windows and an Amazon AWS instance controlling routers and iOT devices. How Do These Firewalls Function? Each type of firewall has a unique set of functions that serve to improve the organization’s security posture and prevent hackers from carrying out malicious cyber attacks. Optimizing your firewall fleet means deploying the right type of solution for each particular use case throughout your network. Some of the most valuable functions that firewalls perform include: Traffic Control They regulate incoming and outgoing traffic, ensuring that only legitimate and authorized data flows through the network. This is especially helpful in cases where large volumes of automated traffic can slow down routine operations and disrupt operations. For example, many modern firewalls include rules designed to deny bot traffic. Some non-human traffic is harmless, like the search engine crawlers that determine your website’s ranking against certain keyword searches. However, the vast majority of bot traffic is either unnecessary or malicious. Firewalls can help you keep your infrastructure costs down by filtering out connection attempts from automated sources you don’t trust. Protection Against Cyber Threats Firewalls act as a shield against various cyber threats, including phishing attacks, malware and ransomware attacks . Since they are your first line of defense, any malicious activity that targets your organization will have to bypass your firewall first. Hackers know this, which is why they spend a great deal of time and effort finding ways to bypass firewall protection. They can do this by exploiting technical vulnerabilities in your firewall devices or by hiding their activities in legitimate traffic. For example, many firewalls do not inspect authenticated connections from trusted users. If cybercriminals learn your login credentials and use your authenticated account to conduct an attack, your firewalls may not notice the malicious activity at all. Network Segmentation By defining access rules, firewalls can segment networks into zones with varying levels of trust, limiting lateral movement for attackers. This effectively isolates cybercriminals into the zone they originally infiltrated, and increases the chance they make a mistake and reveal themselves trying to access additional assets throughout your network. Network segmentation is an important aspect of the Zero Trust framework. Firewalls can help reinforce the Zero Trust approach by inspecting traffic traveling between internal networks and dropping connections that fail to authenticate themselves. Security Policy Enforcement Firewalls enforce security policies, ensuring that organizations comply with their security standards and regulatory requirements. Security frameworks like NIST , ISO 27001/27002 , and CIS specify policies and controls that organizations need to implement in order to achieve compliance. Many of these frameworks stipulate firewall controls and features that require organizations to invest in optimizing their deployments. They also include foundational and organizational controls where firewalls play a supporting role, contributing to a stronger multi-layered cybersecurity strategy. Intrusion Detection and Prevention Advanced firewalls include intrusion detection and prevention capabilities, which can identify and block suspicious activities in real-time. This allows security teams to automate their response to some of the high-volume security events that would otherwise drag down performance . Automatically detecting and blocking known exploits frees IT staff to spend more time on high-impact strategic work that can boost the organization’s security posture. Logging and Reporting Firewalls generate logs and reports that assist in security analysis, incident response, and compliance reporting. These logs provide in-depth data on who accessed the organization’s IT assets, and when the connection occurred. They enable security teams to conduct forensic investigations into security incidents, driving security performance and generating valuable insights into the organization’s real-world security risk profile. Organizations that want to implement SIEM technology must also connect their firewall devices to the platform and configure them to send log data to their SIEM for centralized analysis. This gives security teams visibility into the entire organization’s attack surface and enables them to adopt a Zero Trust approach to managing log traffic. Common Vulnerabilities & Weaknesses Firewalls Share Firewalls are crucial for network security, but they are not immune to vulnerabilities. Common weaknesses most firewall solutions share include: Zero-day vulnerabilities These are vulnerabilities in firewall software or hardware that are unknown to the vendor or the general public. Attackers can exploit them before patches or updates are available, making zero-day attacks highly effective. Highly advanced NGFW solutions can protect against zero-day attacks by inspecting behavioral data and using AI-enriched analysis to detect unknown threats. Backdoors Backdoors are secret entry points left by developers or attackers within a firewall’s code. These hidden access points can be exploited to bypass security measures. Security teams must continuously verify their firewall configurations to identify the signs of backdoor attacks. Robust and effective change management solutions help prevent backdoors from remaining hidden. Header manipulation Attackers may manipulate packet headers to trick firewalls into allowing unauthorized traffic or obscuring their malicious intent. There are multiple ways to manipulate the “Host” header in HTTP traffic to execute attacks. Security teams need to configure their firewalls and servers to validate incoming HTTP traffic and limit exposure to header vulnerabilities. How Cyber Criminals Exploit These Vulnerabilities Unauthorized Access Exploiting a vulnerability can allow cybercriminals to penetrate a network firewall, gaining access to sensitive data, proprietary information, or critical systems. Once hackers gain unauthorized access to a network asset, only a well-segmented network operating on Zero Trust principles can reliably force them to reveal themselves. Otherwise, they will probably remain hidden until they launch an active attack. Data Breaches Once inside your network, attackers may exfiltrate sensitive information, including customer data, intellectual property, and financial records (like credit cards), leading to data breaches. These complex security incidents can lead to major business disruptions and reputational damage, as well as enormous recovery costs. Malware Distribution Attackers may use compromised firewalls to distribute malware, ransomware, or malicious payloads to other devices within the network. This type of attack may focus on exploiting your systems and network assets, or it may target networks adjacent to your own – like your third-party vendors, affiliate partners, or customers. Denial of Service (DDoS) Exploited firewalls can be used in DDoS attacks, potentially disrupting network services and rendering them unavailable to users. This leads to expensive downtime and reputational damage. Some hackers try to extort their victims directly, demanding organizations pay money to stop the attack. 6 Techniques Used to Bypass Firewalls 1. Malware and Payload Delivery Attackers use malicious software and payloads to exploit firewall vulnerabilities, allowing them to infiltrate networks or systems undetected. This often occurs due to unpatched security vulnerabilities in popular firewall operating systems. For example, in June 2023 Fortinet addressed a critical-severity FortiOS vulnerability with a security patch. One month later in July, there were still 300,000 Fortinet firewalls still using the unpatched operating system. 2. Phishing Attacks Phishing involves tricking individuals into divulging sensitive information or executing malicious actions. Attackers use deceptive emails or websites that may bypass firewall filters. If they gain access to privileged user account credentials, they may be able to bypass firewall policies entirely, or even reconfigure firewalls themselves. 3. Social Engineering Tactics Cybercriminals manipulate human psychology to deceive individuals into disclosing confidential information, effectively bypassing technical security measures like firewalls. This is typically done through social media, email, or by telephone. Attackers may impersonate authority figures both inside and outside the organization and demand access to sensitive assets without going through the appropriate security checks. 4. Deep Packet Inspection Evasion Attackers employ techniques to disguise malicious traffic, making it appear benign to firewalls using deep packet inspection, allowing it to pass through undetected. Some open-source tools like SymTCP can achieve this by running symbolic executions on the server’s TCP implementation, scanning the resulting execution paths, and sending malicious data through any handling discrepancies identified. 5. VPNs and Remote Access Attackers may use Virtual Private Networks (VPNs) and remote access methods to circumvent firewall restrictions and gain unauthorized entry into networks. This is particularly easy in cases where simple geo restrictions block traffic from IP addresses associated with certain countries or regions. Attackers may also use more sophisticated versions of this technique to access exposed services that don’t require authentication, like certain containerized servers . 6. Intrusion Prevention Systems (IPS) Bypass Sophisticated attackers attempt to evade IPS systems by crafting traffic patterns or attacks that go undetected, enabling them to compromise network security. For example, they may use technologies to decode remote access tool executable files hidden inside certificate files, allowing them to reassemble the malicious file after it passes through the IPS. Protecting Against Firewall Vulnerabilities Multi-factor Authentication (MFA) MFA adds an extra layer of security by requiring users to provide multiple forms of identification, such as a password and a one-time code sent to their mobile device, before they gain access. This prevents attackers from accessing sensitive network assets immediately after stealing privileged login credentials. Knowing an account holder’s password and username is not enough. Two-factor Authentication (2FA) 2FA is a subset of MFA that involves using two authentication factors, typically something the user knows (password) and something the user has (a mobile device or security token), to verify identity and enhance firewall security. Other versions use biometrics like fingerprint scanning to authenticate the user. Intrusion Prevention Systems (IPS) IPS solutions work alongside firewalls to actively monitor network traffic for suspicious activity and known attack patterns, helping to block or mitigate threats before they can breach the network. These systems significantly reduce the amount of manual effort that goes into detecting and blocking known malicious attack techniques. Web Application Firewalls (WAF) WAFs are specialized firewalls designed to protect web applications from a wide range of threats, including SQL injection, cross-site scripting (XSS), and other web-based attacks. Since these firewalls focus specifically on HTTP traffic, they are a type of application level gateway designed specifically for web applications that interact with users on the public internet. Antivirus Software and Anti-malware Tools Deploying up-to-date antivirus and anti-malware software on endpoints, servers, and Wi-Fi network routers helps detect and remove malicious software, reducing the risk of firewall compromise. In order to work effectively, these tools must be configured to detect and mitigate the latest threats alongside the organization’s other security tools and firewalls. Automated solutions can help terminate unauthorized processes before attackers get a chance to deliver malicious payloads. Regular Updates and Patch Management Keeping firewalls and all associated software up-to-date with the latest security patches and firmware updates is essential for addressing known vulnerabilities and ensuring optimal security. Security teams should know when configuration changes are taking place, and be equipped to respond quickly when unauthorized changes take place. Implementing a comprehensive visibility and change management platform like AlgoSec makes this possible. With AlgoSec, you can simulate the effects of network configuration changes and proactively defend against sophisticated threats before attackers have a chance to strike. Monitoring Network Traffic for Anomalies Continuous monitoring of network traffic helps identify unusual patterns or behaviors that may indicate a security incident. Anomalies can trigger alerts for further investigation and response. Network detection and response solutions grant visibility into network activities that would otherwise go unnoticed, potentially giving security personnel early warning when unannounced changes or suspicious behaviors take place. Streamline Your Firewall Security With AlgoSec Organizations continue to face increasingly sophisticated cyber threats, including attacks that capitalize on misconfigured firewalls – or manipulate firewall configurations directly. Firewall management software has become a valuable tool for maintaining a robust network security posture and ensuring regulatory compliance. AlgoSec plays a vital role enhancing firewall security by automating policy analysis, optimizing rule sets, streamlining change management, and providing real-time monitoring and visibility. Find out how to make the most of your firewall deployment and detect unauthorized changes to firewall configurations with our help. Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

A Decoy Network The strategy behind Sun Tzu’s ‘Art of War’ has been used by the military, sports teams, and pretty much anyone looking... Cyber Attacks & Incident Response How to Use Decoy Deception for Network Protection Matthew Pascucci 2 min read Matthew Pascucci Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 6/30/15 Published A Decoy Network The strategy behind Sun Tzu’s ‘Art of War’ has been used by the military, sports teams, and pretty much anyone looking for a strategic edge against their foes. As Sun Tzu says “All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near.” Sun Tzu understood that to gain an advantage on your opponent you need to catch him off guard, make him believe you’re something you’re not, so that you can leverage this opportunity to your advantage. As security practitioners we should all supplement our security practices with this timed and tested decoy technique against cyber attackers. There are a few technologies that can be used as decoys, and two of the most common are honeypots and false decoy accounts: A honeypot is a specially designed piece of software that mimics another system, normally with vulnerable services that aren’t really vulnerable, in order to attract the attention of an attacker as they’re sneaking through your network. Decoy accounts are created in order to check if someone is attempting to log into them. When an attempt is made security experts can then investigate the attackers’ techniques and strategies, without being detected or any data being compromised. Design the right decoy But before actually setting up either of these two techniques you first need to think about how to design the decoy in a way that will be believable. These decoy systems shouldn’t be overtly obvious, yet they need to entice the hacker so that he can’t pass up the opportunity. So think like an attacker: What would an attacker do first when gaining access to a network? How would he exploit a system? Will they install malware? Will they perform a recon scan looking for pivot points? Figuring out what your opponent will do once they’ve gained access to your network is the key to building attractive decoy systems and effective preventive measures. Place it in plain sight You also need to figure out the right place for your decoys. You want to install decoys into your network around areas of high value, as well as systems that are not properly monitored with other security technologies. They should be hiding in plain sight and mimicking the systems or accounts that they’re living next to. This means running similar services, have hostnames that fall in line with your syntax, running on the same operating systems (one exception is decoys running a few exploitable services to entice the attacker). The goes the same for accounts that you’ve seeded in applications or authentication services. We decided that in addition to family photos, it was time to focus on couples photoshoot ! Last fall we aired our popular City Photoshoot Tips & Ideas and as a result, gave you TONS of ideas and inspiration. And last but not least, you need to find a way to discretely publicize your applications or accounts in order to attract the attacker. Then, when an attacker tries to log in to the decoy applications or accounts (which should be disabled) you should immediately and automatically start tracking and investigating the attack path. Watch and learn Another important point to make is that once a breach attempt has been made you shouldn’t immediately cut off the account. You might want to watch the hacker for a period of time to see what else that he might access on the network. Many times tracking their actions over a period of time will give you a lot more actionable information that will ultimately help you create a far more secure perimeter. Think of it as a plainclothes police officer following a known criminal. Many times the police will follow a criminal to see if he will lead them toward more information about their activities before making an arrest. Use the same techniques. If an attacker trips over a few of carefully laid traps, it’s possible that he’s just starting to poke around your network. It’s up to you, while you have the upper hand, to determine if you start remediation or continue to guide them under your watchful eye. Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

CIS provides best practices to help companies like yours improve their cloud security posture. You’ll protect your systems against... Cloud Security What is CIS Compliance? (and How to Apply CIS Benchmarks) Rony Moshkovich 2 min read Rony Moshkovich Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 6/20/23 Published CIS provides best practices to help companies like yours improve their cloud security posture. You’ll protect your systems against various threats by complying with its benchmark standards. This post will walk you through CIS benchmarks, their development, and the kinds of systems they apply to. We will also discuss the significance of CIS compliance and how Prevasio may help you achieve it. What are CIS benchmarks? CIS stands for Center for Internet Security . It’s a nonprofit organization that aims to improve companies’ cybersecurity readiness and response. Founded in 2000, the CIS comprises cybersecurity experts from diverse backgrounds. They have the common goal of enhancing cybersecurity resilience and reducing security threats. CIS compliance means adhering to the Center for Internet Security (CIS) benchmarks. CIS benchmarks are best practices and guidelines to help you build a robust cloud security strategy. These CIS benchmarks give a detailed road map for protecting a business’s IT infrastructure. They also encompass various platforms, such as web servers or cloud bases. The CIS benchmarks are frequently called industry standards. They are normally in line with other regulatory organizations, such as ISO, NIST, and HIPAA. Many firms adhere to CIS benchmarks to ensure they follow industry standards. They also do this to show their dedication to cybersecurity to clients and stakeholders. The CIS benchmarks and CIS controls are always tested through on-premises analysis by leading security firms. This ensures that CIS releases standards that are effective at mitigating cyber risks. How are the CIS benchmarks developed? A community of cybersecurity professionals around the world cooperatively develops CIS benchmarks. They exchange their knowledge, viewpoints, and experiences on a platform provided by CIS. The end result is consensus-based best practices that will protect various IT systems. The CIS benchmark development process typically involves the following steps: 1. Identify the technology: The first step is to identify the system or technology that has to be protected. This encompasses a range of applications. It can be an operating system, database, web server, or cloud environment. 2. Define the scope: The following stage is to specify the benchmark’s parameters. It involves defining what must be implemented for the technology to be successfully protected. They may include precise setups, guidelines, and safeguards. 3. Develop recommendations: Next, a community of cybersecurity experts will identify ideas for safeguarding the technology. These ideas are usually based on current best practices, norms, and guidelines. They may include the minimum security requirements and measures to be taken. 4. Expert consensus review: Thereafter, a broader group of experts and stakeholders assess the ideas. They will offer comments and suggestions for improvement. This level aims to achieve consensus on the appropriate technical safeguards. 5. Pilot testing: The benchmark is then tested in a real-world setting. At this point, CIS aims to determine its efficacy and spot any problems that need fixing. 6. Publication and maintenance: The CIS will publish the benchmark once it has been improved and verified. The benchmark will constantly be evaluated and updated to keep it current and useful for safeguarding IT systems. What are the CIS benchmark levels? CIS benchmarks are divided into three levels based on the complexity of an IT system. It’s up to you to choose the level you need based on the complexity of your IT environment. Each level of the benchmarks offers better security recommendations than the previous level. The following are the distinct categories that benchmarks are divided into: Level 1 This is the most basic level of CIS standards. It requires organizations to set basic security measures to reduce cyber threats. Some CIS guidelines at this level include password rules, system hardening, and risk management. The level 1 CIS benchmarks are ideal for small businesses with basic IT systems. Level 2 This is the intermediate level of the CIS benchmarks. It is suitable for small to medium businesses that have complex IT systems. The Level 2 CIS standards offer greater security recommendations to your cloud platform. It has guidelines for network segmentation, authentication, user permissions, logging, and monitoring. At this level, you’ll know where to focus your remediation efforts if you spot a vulnerability in your system. Level 2 also covers data protection topics like disaster recovery plans and encryption. Level 3 Level 3 is the most advanced level of the CIS benchmarks. It offers the highest security recommendations compared to the other two. Level 3 also offers the Security Technical Implementation Guide (STIG) profiles for companies. STIG are configuration guidelines developed by the Defense Information Systems Agency. These security standards help you meet US government requirements. This level is ideal for large organizations with the most sensitive and vital data. These are companies that must protect their IT systems from complex security threats. It offers guidelines for real-time security analytics, safe cloud environment setups, and enhanced threat detection. What types of systems do CIS benchmarks apply to? The CIS benchmarks are applicable to many IT systems used in a cloud environment. The following are examples of systems that CIS benchmarks can apply to: Operating systems: CIS benchmarks offer standard secure configurations for common operating systems, including Amazon Linux, Windows Servers, macOS, and Unix. They address network security, system hardening, and managing users and accounts. Cloud infrastructure: CIS benchmarks can help protect various cloud infrastructures, including public, private, and multi-cloud. They recommend guidelines that safeguard cloud systems by various cloud service providers. For example, network security, access restrictions, and data protection. The benchmarks cover cloud systems such as Amazon Web Services (AWS), Microsoft Azure, IBM, Oracle, and Google Cloud Platform. Server software: CIS benchmarks provide secure configuration baselines for various servers, including databases (SQL), DNS, Web, and authentication servers. The baselines cover system hardening, patch management, and access restrictions. Desktop software: Desktop apps such as music players, productivity programs, and web browsers can be weak points in your IT system. CIS benchmarks offer guidelines to help you protect your desktop software from vulnerabilities. They may include patch management, user and account management, and program setup. Mobile devices: The CIS benchmarks recommend safeguarding endpoints such as tablets and mobile devices. The standards include measures for data protection, account administration, and device configuration. Network devices: CIS benchmarks also involve network hardware, including switches, routers, and firewalls. Some standards for network devices include access restrictions, network segmentation, logging, and monitoring. Print devices: CIS benchmarks also cover print devices like printers and scanners. The CIS benchmark baselines include access restrictions, data protection, and firmware upgrades. Why is CIS compliance important? CIS compliance helps you maintain secure IT systems. It does this by helping you adhere to globally recognized cybersecurity standards. CIS benchmarks cover various IT systems and product categories, such as cloud infrastructures. So by ensuring CIS benchmark compliance, you reduce the risk of cyber threats to your IT systems. Achieving CIS compliance has several benefits: 1. Your business will meet internationally accepted cybersecurity standards . The CIS standards are developed through a consensus review process. This means they are founded on the most recent threat intelligence and best practices. So you can rely on the standards to build a solid foundation for securing your IT infrastructure. 2. It can help you meet regulatory compliance requirements for other important cybersecurity frameworks . CIS standards can help you prove that you comply with other industry regulations. This is especially true for companies that handle sensitive data or work in regulated sectors. CIS compliance is closely related to other regulatory compliances such as NIST, HIPAA, and PCI DSS. By implementing the CIS standards, you’ll conform to the applicable industry regulations. 3. Achieving CIS continuous compliance can help you lower your exposure to cybersecurity risks . In the process, safeguard your vital data and systems. This aids in preventing data breaches, malware infections, and other cyberattacks. Such incidents could seriously harm your company’s operations, image, and financial situation. A great example is the Scottish Oil giant, SSE. It had to pay €10M in penalties for failing to comply with a CIS standard in 2013. 4. Abiding by the security measures set by CIS guidelines can help you achieve your goals faster as a business. The guidelines cover the most important and frequently attacked areas of IT infrastructure. 5. CIS compliance enhances your general security posture. It also decreases the time and resources needed to maintain security. It does this by providing uniform security procedures across various platforms. How to achieve CIS compliance? Your organization can achieve CIS compliance by conforming to the guidelines of the CIS benchmarks and CIS controls. Each CIS benchmark usually includes a description of a recommended configuration. It also usually contains a justification for the implementation of the configuration. Finally, it offers step-by-step instructions on how to carry out the recommendation manually. While the standards may seem easy to implement manually, they may consume your time and increase the chances of human errors. That is why most security teams prefer using tools to automate achieving and maintaining CIS compliance. CIS hardened images are great examples of CIS compliance automation tools. They are pre-configured images that contain all the necessary recommendations from CIS benchmarks. You can be assured of maintaining compliance by using these CIS hardened images in your cloud environment. You can also use CSPM tools to automate achieving and maintaining CIS compliance. Cloud Security Posture Management tools automatically scan for vulnerabilities in your cloud. They then offer detailed instructions on how to fix those issues effectively. This way, your administrators don’t have to go through the pain of doing manual compliance checks. You save time and effort by working with a CSPM tool. Use Prevasio to monitor CIS compliance. Prevasio is a cloud-native application platform (CNAPP) that can help you achieve and maintain CIS compliance in various setups, including Azure, AWS, and GCP. A CNAPP is basically a CSPM tool on steroids. It combines the features of CSPM, CIEM, IAM, and CWPP tools into one solution. This means you’ll get clearer visibility of your cloud environment from one platform. Prevasio constantly assesses your system against the latest version of CIS benchmarks. It then generates reports showing areas that need adjustments to keep your cloud security cyber threat-proof. This saves you time as you won’t have to do the compliance checks manually. Prevasio also has a robust set of features to help you comply with standards from other regulatory bodies. So using this CSPM tool, you’ll automatically comply with HIPAA, PCI DSS, and GDPR. Prevasio offers strong vulnerability evaluation and management capabilities besides CIS compliance monitoring. It uses cutting-edge scanning algorithms to find known flaws, incorrect setups, and other security problems in IT settings. This can help you identify and fix vulnerabilities before fraudsters can exploit them. The bottom line on CIS compliance Achieving and maintaining CIS compliance is essential in today’s continually changing threat landscape . However, doing the compliance checks manually takes time. You may not also spot weaknesses in your cloud security in time. This means that you need to automate your CIS compliance. And what better solution than a cloud security posture management tool like Prevasio? Prevasio is the ideal option for observing compliance and preventing malware that attack surfaces in cloud assets. Prevasio offers a robust security platform to help you achieve CIS compliance and maintain a secure IT environment. This platform is agentless, meaning it doesn’t run on the cloud like most of its competitors. So you save a lot in costs every time Prevasio runs a scan. Prevaiso also conducts layer analysis. It helps you spot the exact line of code where the problem is rather than give a general area. In the process, saving you time spent identifying and solving critical threats. Try Prevasio today! Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call

As cloud adoption and digital transformation increases, more sensitive data from applications is being stored in data containers. This is... Application Connectivity Management How to Make Container Security Threats More Containable Prof. Avishai Wool 2 min read Prof. Avishai Wool Short bio about author here Lorem ipsum dolor sit amet consectetur. Vitae donec tincidunt elementum quam laoreet duis sit enim. Duis mattis velit sit leo diam. Tags Share this article 9/8/22 Published As cloud adoption and digital transformation increases, more sensitive data from applications is being stored in data containers. This is why effective container security controls to securely manage application connectivity is an absolute must. AlgoSec CTO and Co-Founder, Prof. Avishai Wool provides some useful container security best practices to help you do just that. What is Container Security? Organizations, now more than ever, are adopting container technology. Instead of powering up servers and instances in the cloud, they are using containers to run business applications. Securing these is equally as important as securing other digital assets that the business is dependent on. There are two main pillars to think about: The code: you want to be able to scan the containers and make sure that they are running legitimate code without any vulnerabilities. The network: you need to control access to and from the container (what it can connect to), both inside the same cluster, other clusters, and different parts of the network. How critical is container security to managing application connectivity risks? To understand the role of container security within the overall view of network security, there are three points to consider. First, if you’re only concerned about securing the containers themselves, then you’re looking at nano-segmentation , which involves very granular controls inside the applications. Second, if you’re thinking about a slightly wider scope then you may be more concerned with microsegmentation , where you are segmenting between clusters or between servers in a single environment. Here you will want to enforce security controls that determine the allowable communication between specific endpoints at specific levels. Finally, if the communication needs to go further, from a container inside one cluster within one cloud environment to an asset that’s outside of the data center, then that might need to go through broader segmentation controls such as zoning technologies, security groups or a firewall at the border. So, there are all these layers where you can place network security policies. When you’re looking at a particular connectivity request (say for a new version of an application) from the point of view of a given container you should ask yourself: what is the container connected to? What is it communicating with? Where are those other sides of the connectivity placed? Based on that determination, you will then know which security controls you need to configure to allow that connectivity through the network. How does containerization correlate with application centric security policy management? There are a number of different aspects to the relationship between container security and application security. If an application uses containers to power up workloads then container security is very much an integral part of application security. When you’re adding new functionality to an application, powering up additional containers, asking containers to perform new tasks whereby they need to connect to additional assets, then the connectivity of those containers needs to be secured. And security controls need to be regulated or changed based on what the application needs them to do. Another factor in this relationship is the structure of the application. All the containers that run and support the application are often located in one cluster or a micro-segment of the network. So, much of the communication takes place inside that cluster, between one container or another, all in the same cluster. However, some of it can go to another cluster or somewhere that’s not even containerized. This is actually a good thing from an application point of view as the container structure can be used to understand the application structure as well. Not sure about container orchestration? Here’s what to know Container orchestration is part of a bigger orchestration play which is, in general, related to the concept of infrastructure as code. You want to be able to power up an environment with all the assets it requires, and have it function simultaneously so you can duplicate it. There are various orchestration technologies that can be used to deploy the security policies for containers , which is an excellent way to maintain container-based applications in a consistent and repeatable manner. Then if you need to double it or multiply it by 100, you can get cookie-cutter copies of the same thing. How will container security solutions play out in the future? Organizations today have the technology to enforce security controls at the container level, but these controls are very granular and it’s time-consuming to set policies and enforce them, particularly with issues like staff or skills shortages. Looking ahead, companies are likely to take a hierarchical view where container-based security is controlled at the application level by app owners or developers, and at the broader levels to ensure that the measures deployed throughout the network have the same degree of sophistication. Procedures and tooling are all evolving, so we don’t have a definitive answer as to how this will all end up. What are organizations going to be doing? Where will they place their controls? Who has the power to make the changes? When newer technologies are deployed, customer adoption will be crucial to understanding what makes the most sense. This will be interesting as there will be multiple scenarios to help companies master their security blueprint as we move forward. To learn how the use of containerization as a strategy can help reduce risk and drive application-centric security, check out this video . Schedule a demo Related Articles 2025 in review: What innovations and milestones defined AlgoSec’s transformative year in 2025? AlgoSec Reviews Mar 19, 2023 · 2 min read Navigating Compliance in the Cloud AlgoSec Cloud Mar 19, 2023 · 2 min read 5 Multi-Cloud Environments Cloud Security Mar 19, 2023 · 2 min read Speak to one of our experts Speak to one of our experts Work email* First name* Last name* Company* country* Select country... Short answer* By submitting this form, I accept AlgoSec's privacy policy Schedule a call