Corona virus
Employers See Rising Number of Remote Workers During Corona Scare
Reading Time: 4 minutes

In late January, the World Health Organization declared the Coronavirus outbreak an international health emergency, stressing that for the time being, it is not a pandemic, but merely an epidemic. 

While people think coronavirus is a new outbreak of disease, it is actually a common thread of various, known viruses. There are many different types and concentrations of these viruses, some being mild and some being serious enough to cause death. The majority of patients affected with a coronavirus don’t experience death, however, as most people treat it soon after being initially affected.

Officially named the 2019 Novel Coronavirus, or Wuhan Coronavirus, this latest outbreak concerns the most severe type of the virus. Some of the symptoms include coughs, sore throat, vomiting, lack of breath, and fever. A respiratory illness, the severity for patients has ranged from a mild cold to very serious symptoms that can (and do) lead to death. These symptoms tend to occur between 2 to 14 days after being infected.

Wuhan Coronavirus is the first large-scale global viral threat in almost 20 years since the SARS outbreak. Similar to SARS, health officials and governments were caught off guard, which resulted in many deaths. However, unlike previous epidemics, there are now systems in place for better containment of the virus to make sure it doesn’t spread like wildfire.  

The effects of this particular coronavirus have put a spotlight on the need to protect employee health and that of their organizations. Accordingly, remote work has become a basic strategy for companies with headquarters in the far East and even in the United States, for certain industries. 

Organizations that are based in or have contact with people from locations affected by the Wuhan strain of coronavirus need to consider how to restrict their employees from being in physical contact with each other and potentially infected individuals. As a central tenet of this strategy, gatherings of large numbers of people in public places or in the office should be avoided as much as possible. 

A clear example of this precaution is the recently cancelled World Mobile Congress. A majority of vendors decided to pull out of the event and its organizers requested that the city of Barcelona declare a state of health emergency, due to numerous attendees coming directly from the epicenter of Wuhan Coronavirus’s origins.

Coronavirus has Boosted Remote Work

The concept of working remotely or working on the go isn’t a new trend. More and more organizations are enabling remote work by the day. Allowing workers to work “off campus” is a perk that is rewarded with the employer’s trust in their employees. For remote workers, it comes with many advantages such as working from anywhere and not depending on certain work hours. Usually, most remote workers ask for or are given permission to work remotely, but in China, this request has turned into a requirement. 

To fight off the spread of Coronavirus, organizations are enforcing remote work as a necessity instead of a privilege. Around 60 million people in China were forced to work from home in January as the government tried to contain the virus. This unexpected experiment has been so well-received, and not just in its deterrence of outbreak, that Chinese organizations are considering adopting it as a more permanent measure moving forward. 

China’s IT sector is the best-suited industry for remote workers and thus has been advocating for a more flexible work lifestyle. Prominent companies suggest that remote work can be successful if implemented with the correct infrastructure that will benefit both employees and employers.

Over the past ten years, organizations around the globe are increasing and expanding opportunities for remote work due to the need for an agile workforce spurred on by new technology. Despite the advancement of tech and the tools that create an increasingly mobile workforce, the trend comes with risks that have more to do with network health than personal health. 

More Remote Workers, More Security Holes 

The burgeoning remote work paradigm is creating countless security gaps for organizations. While remote workers might be easier targets for hackers, all employees must be aware of the different attacks that will exploit human behavior to open the door for hackers. One of the easiest attack vectors is unsecured Wi-Fi networks. 

When allowing employees to work remotely, organizations must clearly outline those remote employees’ responsibilities regarding IT security best practices and the importance of data protection. To provide another layer of defense vs unauthorized network access, organizations must implement remote-worker-specific security policies which include device monitoring, multi-factor authentication and Wi-Fi security.

Today the majority of global organizations still depend on legacy hardware-based VPN technology for secure network access and access to cloud resources on different networks.  These site-centric and hardware-based network security appliances that we’ve relied on for the past 30 years are no longer adequate in securing remote and on-premise access.

In providing secure network access to remote workers, organizations need to create and implement different security strategies to fight off different attacks on their network and resources. The user-centric Zero Trust security model enforces multiple layers of verification before granting resource access to any user.

Additionally, by implementing a solution that offers Software-Defined Perimeter architecture, organizations are helped to deploy perimeters globally while retaining the traditional model’s value of invisibility and inaccessibility to “outsiders”. These can be deployed anywhere – on the internet, in the cloud, at a hosting center, on the private corporate network, or across some or all of these locations.

Security Hygiene and Health Go Hand in Hand

To prevent remote access risks such as a sudden movement of employees off-premises in order to fight off Coronavirus, organizations should implement Software-Defined Perimeter technology and the Zero Trust model to ensure secure access by authorized devices, users and locations. They should also seek services such as Perimeter 81 which include advanced or even automatic Wi-Fi security features, ensuring employee communications are encrypted across all Internet connections. With Perimeter 81, organizations can ensure that only authorized connections are being established while leaving their cloud environments completely hidden from attacks, giving networks as clean a bill of health as their users.

To learn more about Perimeter 81’s Zero Trust Secure Network as a Service be sure to request a complimentary demo.

Read More
ddos-attacks
The Psychology Behind DDoS: Motivations and Methods
Reading Time: 5 minutes

DDoS attacks, also known as distributed denial of service attacks, are one of the oldest internet cyberweapons used today by everyone from hacktivists and governments to disgruntled video game players and thrill-seekers purely for personal enjoyment. The attacks disrupt access to web sites and servers or take them offline completely by using co-opted online resources such as zombie PCs and servers or Internet of Things (IoT) bot networks that flood and overwhelm victims with online traffic.

If you want to take a network off the Internet, the easiest way to do it is with a distributed denial-of-service attack,” says security researcher Bruce Schneier. “These attacks are not new: hackers do this to sites they don’t like, and criminals have done it as a method of extortion. There is an entire industry, with an arsenal of technologies, devoted to DDoS defense. But largely it’s a matter of bandwidth. If the attacker has a bigger fire hose of data than the defender has, the attacker wins.”

Although individual and group motivations may differ, DDoS attacks have the same objective: take a target server or servers offline with internet traffic until the internet services are no longer operational. DDoS targets range from individuals to government organizations and businesses such as e-commerce sites, banks, stock exchanges, credit bureaus, gaming sites or internet service providers.

DDoS Attack Psychological Motivations

The motivations and psychology behind DDoS attacks vary. They span financial or economic benefits, revenge, ideological beliefs, cyberwarfare or even solely personal enjoyment. Large scale DDoS cyber attacks tend to be the result of group efforts, as opposed to individual actors, with a specific goal or agenda in mind.

DDOS graph

 Images from Elsevier Inc, 2015

The majority of DDoS cyber-attack psychological motivations fall into several categories:  

  • Financial gain or economic benefit. DDoS attacks against e-commerce sites and banks is a growing trend, especially during the holidays, according to technology industry research firm Forrester. And extortion or blackmail is another motivating factor to use DDoS attacks. Using DDoS attacks as a financial weapon is also a favorite technique for hackers who demand Bitcoin via email to stop the onslaught of traffic.
  • Revenge. It’s a DDoS attack motivation used against companies, organizations, and individuals where victims include non-profit organizations, community colleges, courts and law enforcement entities, or journalists. In most cases, the disgruntled individual or group behind the attack has a goal of inflicting damage for a perceived wrong.
  • Ideological belief. Also known as hacktivism, some attackers become motivated to attack political targets because of their ideological beliefs against a nation-state or government policies. This motivation has become an influential reason behind many DDoS attacks where independent “hacktivists” DDoS government websites to cause outages and disruption. In January 2019, Zimbabwean government-related websites were hit with a DDoS attack by hacktivist group Anonymous protesting internet censorship in the country.
  • Intellectual challenge. Some attackers DDoS web sites to demonstrate their technical capabilities skills. DDoS tools and even services are available via the Dark Web making it easy for attackers to deploy and experiment with the latest technologies such as automation and botnets against targets.
  • Personal Enjoyment. This type of DDoS attack falls under the category of cyberbullying and trolling. It’s intentional and meant to be either fun or vindictive (or both) while at the same time demonstrating the power to disrupt a web site or network.
  • Cyberwar. Used for political and military advantage, cyberwarfare is normally associated with nation-states. It’s designed to inflict economic or physical impact on its targets. Groups that use cyber warfare strategies and tactics and are well-trained, organized, and belong to government militaries or terrorist organizations. Many world governments have devoted significant resources and time to conduct attacks that have disrupted an adversary’s online and critical infrastructure.

DDoS Attack Methodologies

DDoS attacks consist of three major phases and four different sub-components, according to researchers. The sub-components are an attacker, multiple control master or handler computers, multiple “slave” computers or botnets, agents, or zombies, and a victim or target machine. 

In the first phase of a DDoS attack, hackers take control of network-attached computers called “masters or handlers” to control other machines that will ultimately execute the DDoS attack. Creating a network of handlers and attack machines is an automated process where hackers scan the internet for computers or Internet of Things devices that can be compromised, usually with malware. 

When the desired number of compromised machines is reached, hackers start the second attack phase. The aggregate number of machines, called a botnet, is loaded with the necessary instructions and commands to launch an attack by the network of compromised zombie computers.

In the final DDoS phase, hackers direct the botnet to execute the attack or attacks on victim machines. The distributed nature of the attack sends massive amounts of internet traffic to the victim’s system or online resources that in turn disrupts or slows down the intended target’s services. Spoofed or fake IP addresses hide compromised device identities and discourage the victims to filter out malicious traffic to find the attack source.

Increasing DDoS Sophistication

The threat landscape of today is constantly opening up new opportunities for attackers to take advantage of the latest internet-connected devices and cloud technologies to launch even more massive DDoS attacks. These new attacks have also gotten easier to execute with zombie botnets able to take down large corporations or government entities.

The latest attack vector is physical access control systems installed in places including corporate headquarters, factories, or industrial parks. “Hackers are actively searching the internet and hijacking smart door/building access control systems, which they are using to launch DDoS attacks,” according to firewall company SonicWall.

Hackers are now scanning the internet for exposed Nortek Security & Control (NSC) Linear eMerge E3 devices and exploiting one of the ten newly discovered vulnerabilities, according to SonicWall. Their primary purpose is to control what doors and rooms employees and visitors can access based on their credentials (access codes) or smart cards and then block or disrupt access to physical buildings.

DDoS-as-a-Service

To mitigate the popularity and accessibility of DDoS attacks as a tool for non-technical attackers, security researchers and law enforcement agencies regularly track and take down malicious web services that are now offering for-profit DDoS-as-a-Services that have weaponized for the masses what was once only done by sophisticated hackers.  

Called “booter” or “stresser” sites, cybercriminals are marketing and selling attack-for-hire services that can be easily purchased online. According to Cloudflare, “Booters are slickly packaged as SaaS (Software-as-a-Service), often with email support and YouTube tutorials. Packages may offer one-time service, multiple attacks within a defined period, or even “lifetime” access. A basic, one-month package can cost as little as $19.99. Payment options may include credit cards, Skrill, PayPal or Bitcoin (though PayPal will cancel accounts if malicious intent can be proved).”

And security journalist Brian Krebs says “Booter sites are dangerous because they help lower the barriers to cybercrime, allowing even complete novices to launch sophisticated and crippling attacks with the click of a button.”  DDoS-as-a-Service provides yet another attack vector for non-technical users to use for cybercrime, revenge, hacktivism, enjoyment or even cyberwar. 

Finally, the motivation or psychology behind DDoS attacks can also be viewed as merely a tool meant for distraction. Hosting company LiquidWeb claims that “while your security team is distracted mitigating the denial of service attack, the party responsible is free to go after what they actually want – whether it is financial information, intellectual property, or client data.”

If, as LiquidWeb states, DDoS attacks are the “equivalent of driving a bus through the front door of a bank while an associate tunnels into the bank vault from below,” then organizations must be vigilant about their IT security and take an approach that makes securing the network edge against all attacks a top priority.

Read More
press release image
Perimeter 81 Disrupts Traditional Network Security; Partners with SonicWall on New SASE Platform
Reading Time: 3 minutes

Integrated Cloud and Service-Based Solutions Redefine the Future of Network Security Without Traditional Perimeters

TEL AVIV, Israel–(BUSINESS WIRE)–Perimeter 81, a leading Zero Trust network provider for enterprises and organizations, today announced a new Secure Access Service Edge (SASE) platform that combines its Network as a Service offering with advanced cloud security capabilities from SonicWall, a Francisco Partners portfolio company. The integrated, cloud-native platform will deliver Zero Trust access to internal resources, user and branch internet security, branch interconnectivity and endpoint security.

Identified by Gartner as one of the most promising emerging technologies in enterprise networking, SASE is a cloud-native architecture model that supports dynamic secure access to organizational assets by combining multiple network technologies delivered as a service, including Secure Web Gateway, Cloud Access Security Broker, Firewall-as-a-Service (FWaaS) and Zero Touch Network Access with WAN capabilities (i.e., SDWANaaS).

In November 2019, Perimeter 81 partnered with SonicWall to integrate its security services features, including Content Filtering, Application Control, Intrusion Prevention System (IPS), File Sandboxing, Real-Time Deep Memory InspectionTM (RTDMI), antivirus and more, to create one of the strongest SASE offerings in the network security space. Perimeter 81 will be launching Web Filtering and DNS Filtering in Q1 and, with SonicWall, will gradually roll out security features to customers throughout 2020, starting with FWaaS. Additional functionalities, such as SaaS security and Endpoint Protection Platform, will be introduced later in the year.

By integrating SonicWall’s Capture Cloud Platform and real-time breach detection and prevention technologies, the Perimeter 81 SASE platform provides organizations with a holistic and unified security solution to authenticate and consume their network and security needs across all enterprise edges. Businesses can connect to a single secure network and gain access to physical and cloud resources no matter their location, allowing IT teams to easily access and secure their organization’s networks and users in an agile, easy-to-use, cost-effective and scalable way.

“The consumption of modern network security and cybersecurity solutions needs to fundamentally change. With today’s increasingly distributed and mobile workforce, this paradigm shift begins with replacing the traditional and perimeter-based network model with cloud, cyber and network security platforms,” said Amit Bareket, Co-Founder and CEO of Perimeter 81. “Our partnership with SonicWall and integrated SASE offering is a positive first step towards this market transformation. Companies are seeking solutions that are cloud-native, easy to use and encompass many functionalities in a one-stop-shop. We will deliver a converged cloud-delivered secure access service edge that is needed to effectively serve the secure these access requirements of the digital business.”

“Existing security models are failing to meet the needs of today’s digital business. Organizations are looking to adopt integrated and intelligent networking and security solutions that deliver compute power in the cloud and at the edge,” said Bill Conner, President and CEO of SonicWall. “SonicWall’s advanced cloud security capabilities and Perimeter 81’s innovative secure cloud-based network offerings will allow us to provide the most advanced SASE platform available today and place ourselves, and our customers, at the forefront of an emerging and promising market.”

Perimeter 81 will be showcasing the features of the new SASE platform at RSAC 2020, taking place February 24-28, 2020, at the Moscone Center in San Francisco, CA. To learn more visit booth #1365, or set up a meeting with one of our experts at: https://www.perimeter81.com/start/schedule-meeting-rsa-2020/

About Perimeter 81
Perimeter 81 is a Zero Trust Secure Network as a Service that is simplifying network security for the modern and distributed workforce. Based in Tel Aviv, the heart of the startup nation and a global hub for innovative technology development, Perimeter 81 was founded by two IDF elite intelligence unit alumni, CEO Amit Bareket and CPO Sagi Gidali. The team of security as a service experts comes together every day to deliver a truly innovative, world-class network security service. Perimeter 81’s clients range from SMB to include Fortune 500 businesses and industry leaders across a wide range of sectors, and its partners are among the world’s foremost integrators, managed service providers and channel resellers. Earlier this year, Gartner selected Perimeter 81 as a “Cool Vendor in Network and Cyber-Physical Systems Security. For more information, visit www.perimeter81.com

About SonicWall
SonicWall has been fighting the cybercriminal industry for over 28 years defending small and medium businesses, enterprises and government agencies worldwide. Backed by research from SonicWall Capture Labs, our award-winning, real-time breach detection and prevention solutions secure more than a million networks, and their emails, applications and data, in over 215 countries and territories. These organizations run more effectively and fear less about security. For more information, visit www.sonicwall.com or follow us on TwitterLinkedInFacebook and Instagram.

Read More
URL Filtering
Exploring URL Filtering & Why Organizations Need to Implement It
Reading Time: 3 minutes

It’s not news that the majority of data breaches and network attacks occur due to poor internal security hygiene. However, what some of the headlines forget to mention is how easy it is for employees to leave the door open for attackers. In some cases, just a single click on an unsecured URL can expose your organization’s network and resources to those with malicious intent. This is one of the main reasons why organizations need to implement different security features to fight off unwanted attacks.  

To repel these accidental internal breaches, most experts will suggest security training and policy implementation, but that’s not enough. Organizations should instead choose the correct security solutions and policies to fit best their company’s needs. And in the case of limiting employee access to URLs that don’t relate to their job, this is where URL filtering comes in.

What is URL Filtering?

URL filtering provides organizations’ IT and security teams the ability to limit employees’ access to certain URLs, by defining which are either permitted or blocked sites. The most important reason your organization needs to integrate a URL filtering tool is to prevent employees from gaining access to websites that don’t help them with their jobs, or sites that can create major security risks for the organization.

By limiting access to certain URLs, it helps employees be more productive and helps to fight off potential security risks such as data loss, malware, or even legal issues. 

DNS Filtering Vs URL Filtering

DNS filtering, or Domain Name System blocking, is indeed useful for some ideas surrounding security but ultimately has less finesse than URL filtering. IT administrators can use a DNS filter to limit access to sites based on the DNS name resolution, or the site’s IP address, so whenever any URL resolves to this IP it’s blocked. This would also include all sub URLs, meaning it’s impossible to pick and choose which pages of a website (for example) are whitelisted and which are blocked. 

URL filtering has this capability and blocks access based on the exact URL as written in the filtering tool. With a URL filter, it would be possible to block access to facebook.com and still allow employees to see the company’s own Facebook page. This type of granular stratification of website access boosts the control that IT admins wield over the organization.

How Does URL Filtering Work?

URL filtering compares all web traffic with a database containing predetermined groups of URLs and then initiates the process of permitting or denying access to a site based on the categorization of the group that the URL belongs to. A URL filtering database operates with predefined URL lists such as gambling or pornography to groups of websites and allows managers to define the different access conditions to these URLs. 

Most organizations usually set up defined conditions similar to the following: 

  • Blocked: These URLs tend to be websites that distract employees from their work such as social media, news sites, or unsecured sites. Additionally, lists of URLs that are categorized with different security risks or have a history of malware or other attacks will be defined as blocked.
  • Allowed: Most sites that are defined as allowed concern employees’ daily work environments and tasks, such as workflow sites, email, work productivity sites, and more.
  • Allowed with Security Policies: These tend to be specific URLs that are set by the security and IT team, which will allow users access but with logging and monitoring by the security and IT teams.  

Customizing URL Filtering 

No matter if it’s integrated into different devices or a standalone platform, URL filtering provides another layer of security for organizations against unknown threats so employees can work normally without thinking about security. For all organizations looking to integrate a URL filtering feature, the following are the main security factors for integrating a URL filtering feature in your security strategy.

  • Enforcing Best Security Practices: By controlling access to different sites it helps IT teams to have full control of who is accessing what, where, and when. This plays a huge role in avoiding unwanted security threats.
  • Avoiding Phishing and Malware: By denying access to known flawed sites the opportunity for hackers to create a security breach will be decreased.
  • Implementing Security Policies: By setting up a security playbook that includes whitelisted and blacklisted URLs and user identification rules it will add another layer between malicious attackers and your organization. 
  • Clearly Defined Whitelists and Blacklists:  With IT and security teams fully controlling all the different sites that are being accessed by employees, it provides the guarantee of zero unwanted and accidental URL blocks.

URL Filtering is Better Security for the Future

By implementing URL filtering into your cloud security, you take a major step towards an airtight network. URL filtering additionally protects different endpoint devices and cloud services from cyber threats while boosting employee productivity and performance. By protecting and managing your employee’s access, it supplements your lines of defense in the fight against malicious attackers on your organization. The more secure your employees’ access, the more comprehensive your organizational security.

Read More
Product Updates
February 2020 Product Updates: Splunk Integration, Linux Agent and More
Reading Time: 2 minutes

The new year has only just begun, and thanks to many different customer requests we have recently implemented and launched new features and updates, and are thrilled to share. It’s no stretch to say that the best feedback is from customers using your platform on a daily basis, but nowhere is it written in ink that this feedback justifies any changes. In our case, we write it in stone, because our users are just that good.

With the excellent feedback you’ve provided, we’re proud to highlight the latest product updates and integrations since the start of 2020 to our Network as a Service solution.

Splunk Integration

Traditional security solutions tend to lack the ability to monitor, log, alert and integrate data from cloud resources into Security Information Event Management (SIEM) systems.

Lacking the right monitoring processes and systems also makes it difficult to respond in real-time to a cyber attack or data breach. No less important is having skilled security analysts who are able to take action when recognizing network anomalies, correlate events, and eliminate manual data analysis for AWS action detection such as suspicious instance creation, new user account creation or resource access and security group modification.

Accordingly, we have recently launched our new Splunk Integration into the Perimeter 81 platform. Splunk enables organizations of all sizes to search, analyze, and view the data gathered from all components of their IT infrastructure or business. Splunk users can enable log aggregation of event data from across their environment into a single repository of critical security insights within their Splunk platform.

In the video below we walk you through how to configure Splunk in order to have full visibility of your Perimeter 81 activity.

New Linux Agent

Customers often request new features and integrations, however in late 2019 we saw a surge of requests for our application to be available for Linux operating systems. Now your calls have been answered, as our application is now available with Linux X64.

You can download the Linux agent inside your platform under the Downloads tab, or you can download it in the Downloading the Applications page in our knowledge base. Additionally, if you would like to manually configure for your Linux agent we provide a step by step process here.  

24/7 Phone and Chat Support

As a company that strives for exceptional customer support, we are continuously updating our knowledge base with different articles to help our customers solve any issues they encounter on their own steam.

Now we are excited to share that our customer support services have expanded with 24/7 chat support and phone support. Our chat and phone support teams will be able to answer issues or requests you might have in real time. 

New Pricing Packages

As the Perimeter 81 solution evolves with new security features, so does the flexibility and accessibility of our application. We are thrilled to announce that we’ve launched our new Perimeter 81 subscription plans and billing system on the platform and on our website. 

Our new plans will allow users to get the services and features that they actually need while utilizing our new robust billing system. The new billing system is an improved self-service experience that allows users to easily change subscription plans with a click of their mouse. 

Stay Tuned

We’d love to hear your feedback going into the busy spring months and stay tuned for more product updates in the upcoming months. We are planning to launch our new unified network and security platform with more network and security features in the upcoming year.

Read More
CSIO Mistakes
5 Security Mistakes CISOs Must Avoid in 2020
Reading Time: 4 minutes

With every new security breach announced, the CISO position is becoming more and more trendy for organizations. However, CISO is not a new position – it’s just only now getting the attention it deserves. Outside of enterprises, we rarely see an organization or a startup with a CISO and this is a huge mistake. There are many different security challenges in organizations of all sizes that prove why the need for an internal CISO will play a critical role in your organization’s success. 

Before we dig into the different challenges and mistakes that CISOs make let’s discuss what does the role entails. The position, Chief Information Security Officer (CISO) is fully in charge of the organization’s cyber and information security responsibilities and risk management. 

As we have seen in past years with huge breaches like the Equifax and Capital One breach, CISO’s have a lot of responsibilities on their plate when strategizing their organization’s risk management. As the threat landscape is continuously evolving with hackers implementing different dynamic and complicated attack tactics, the traditional risk management strategy can not withstand these styles of attacks. By implementing an outdated strategy your organization can become victim to massive fines, losing the trust of your customers and brand damage if your strategy isn’t up to par with the latest best security practices.  

CISO Responsibilities 

Today, your average CISO resources are mainly allocated to monitoring and responding to different security threats and making certain that their organization meets all the different compliance requirements.  

The organization’s CISO key responsibilities include identifying and securing any potential leaks in the network, creating and managing a risk management strategy for security incidents, researching and implementing new security tools and technologies. Last but not least the CISO is the go-to employee for all things security and with that, it’s their responsibility to inform everyone from junior developers to the sales team to C-level management about all the different security team activities in the organization.  

Mistakes Will Happen 

No matter how experienced your CISO is, mistakes will happen. The difference is how big are the mistakes and how often are they occurring. As we start a new year organization’s CISOs should be well aware of what are the best practices and what are the new style of different attacks. So with further ado, here are the 5 mistakes your CISO should avoid in 2020. 

Not Hacking Your Own Network

Organizations that aren’t using external or internal white hackers (ethical hackers) and think their network or environments are secure are dead wrong. Without knowing how secure or insecure your internal resources is like launching your product without testing with quality assurance.  While your CISO might tell the management team that everything is secure but until your organization has implemented hacks by white hackers on your system you can’t be 100% sure that your organization is safe.

Advice: Hire white hackers internally but if you don’t have the necessary resources to hire professional penetration testers. Pen testers will look for everything from testing network security protocols and settings, software vulnerabilities and even will try different malware and targeted phishing campaigns on the organization employees. Your organization’s CISO should implement a yearly internal security test to take the extra step ensuring the organization’s cybersecurity is up to date. 

Nobody Likes a “Dr. No” 

Every organization has employees who are yes men/women but when it comes to the different responsibilities of a CISO, one of the worst mistakes they can make is becoming a “Dr. No”. The CISO is often seen as the organizational blocker telling employees they can’t do things and forcing them through unwieldy processes in the name of compliance. Despite looking out for what’s best for the organization, CISO’s should have a good balance of when to say yes and no to different requests.

Advice: Instead of CISO’s denying and putting their foot down, they should be open to change. They should be able to easily recognize the benefits of new security tools and solutions and how it will help the organization on a security level. Secondly, instead of saying no to everyone and everything, become the person that everyone seeks to implement new technology in the organization, but don’t forget to check the risk factor. 

Not Sticking to a 360 Degrees Security Strategy 

The security space has two players, the organizations and the hackers. While some people might say it’s a fair matchup, it’s not. Organizations are expected to know how to defend every attacker from every angle, while hackers have it easy by finding one small leak and then they have access to the organization’s network. To make it simple, CISO’s should understand and accept that you won’t be able to fight off every attack. 

Advice: As a CISO who is always thinking about one’s security, one of the worst mistakes they can make is thinking that you can stop every single attack. Instead, CISO’s should clearly understand the organization’s technology, vision, and limitations and strategize for minimal risk with the different resources you have in the organization. In a world where there are endless attacks it’s best to survive than not be prepared. 

Not Setting up a Security Policy for the Future 

Today, organizations are making changes and decisions quicker than ever. They’re focusing more on how many new features and products can we launch in a certain amount of time. One major factor that is being forgotten is the security risk factor. While moving fast and making quick changes is great, organizations of all sizes need to make sure the right security is put into place so your organization won’t become an easy target for hackers.

Advice: Implement a cybersecurity policy and architecture in the organization. If there isn’t a security policy in place there is a very high chance your organization will be hacked and breached. Organizations and CISO need to emphasize on a cybersecurity strategy as early as possible to provide the best defense plan against hackers. This strategy should include incident response strategies, creating a security policy, employee training and assigning employees as the security team. 

Not asking for Help

Despite the increase of cybersecurity jobs worldwide, there is a huge shortage of proper cybersecurity skills in most organizations. However, with a CISO they should never be afraid to ask when they don’t know the answer or can’t find the answer. CISO’s can have the “perfect team” but if they’re lacking the right security skills, the CISO decisions will backfire without reasons. 

Advice: Instead of making choices with a gut feeling or best practices, CISO’s should ask the experts which is the correct direction and have a clear understanding of why they are making the decision with the correct reason to back it up.  

Better be Prepared then Attacked

While a CISO will never be correct 100 percent of the time, they should learn from their mistakes and have the right strategy in place to fight off everything. By strategizing correcting with the right security approach that has a mix of experience, security knowledge, strategy, and organization’s expectations, the CISO will be more ready to grasp every security activity they will encounter. 

Read More
Cloud Policies
Why Your Organization’s Security Strategy Starts with a Cloud Security Policy
Reading Time: 4 minutes

The IT industry has made significant strides with cloud computing security and many organizations remain anxious about emerging cloud security risks. A new generation of malware and hacking techniques continue to threaten different organizations’ data and apps on the cloud. We are seeing many different cloud security vulnerabilities being introduced through bringing your own device (BYOD) risks, web application risks and incomplete cloud visibility. 

To fight off these cloud risks, organizations need to act quickly to seek the cloud’s advantages while maintaining control over their assets. So how do organizations grow with the cloud and ensure they’re acting responsibly when it comes to cloud security? 

The Cloud is Not as Secure as You Think

When we think of cloud security, the first thing that comes to mind is data loss but that is the wrong way to think about it. When organizations implement different cloud services, one of the main security factors that is focused on is if the network and resources are safe. Instead, we should be additionally focusing more on how employees are using cloud services. One of the lesser-known challenges with the cloud is if your team is implementing and taking the appropriate cautionary steps when deploying resources.

Organizations need to implement different cloudy security tools that encrypt data and access control and implement organization-wide cloud policies. By implementing these tools they will fix or play safeguard with the appropriate amount of cloud security hygiene. But at the end of the day, it all starts with a strong cloud security policy.

What is a Cloud Security Policy?

With the increasing global adoption of cloud computing, having a cloud security policy is essential for every organization. Cloud security policies are the guidelines under which companies operate in the cloud, often implemented in order to ensure the integrity and privacy of company-owned information.

When most organizations migrate to the cloud, they often mistakenly indicate that the current security policy will cover the cloud security rules in their policy. While there is some sense to this, it’s rather lacking and it can create specific holes exposed to potential risks. However, organizations need to consider incorporating the importance of cloud security into their existing security policies and standards. A cloud security policy needs to be flexible and interchangeable in order to meet the new security rules of the organization. 

Your policy must be simple to understand by all of your employees. In order to keep training costs down, it’s best to avoid overcomplication and technical complexity in the policy. The best security policy will be one that is clear and concise. Don’t be afraid to state the obvious, as that way nobody can claim to have missed the point. Every cloud security policy should start with a definition of intent, which clearly outlines the whole point of the policy. 

The Key Principles of a Successful Cloud Security Policy 

The policies for your organization’s cloud security must come from all corners of an organization; from your developers, security team, management team, and so on. These policies are the basis for all cloud security planning, design and deployment. These policies should be able to provide direction on how the issues should be handled and what are the best technologies to be used. 

While security policies are very easy to decide on, the main issue is to implement them properly. The organization’s security policies depend on the different content on which they are implemented. These security policies of an organization are required to protect the cloud security of an organization.

Here are the key principles of successful cloud security policies that you can implement at your organization:

Implementing Security Awareness Program

Educating users on the need for security is important as it will help them understand the importance of cloud security, and how it will benefit them in their daily work. Implementing a security awareness program is a major step with your cloud security policy. 

The program should explain why security is everyone’s responsibility and show the users about their role in maintaining security. This is because people often tend to think that only the security team’s responsibility in protecting the security of their company.

Clear Communication

Once an organization has implemented the policy, it has to be clearly communicated to all the people responsible for enforcing and complying with it. It can include employees, service providers, and other relevant users. 

The policy can be introduced to the employees during their start at the organization and incorporated into the company’s Employee Handbook. A key part of the communication process is to establish a record that those involved have read, understood, and agreed to abide by the policy. It is a challenge to ensure that users understand and accept the policy that governs them. A clear, concise, coherent, and consistent policy is more likely to be accepted and followed.

Authorized Access Regulations

To prevent any unauthorized access to your cloud network environment or cloud resources, organizations need to implement precise access control regulations internally. By implementing access regulations it will prevent potential holes in your organization’s network on the cloud. 

By implementing these regulations in your cloud security policy you will be only giving access to the users that actually need access for their day to day job. The policy should include authentication protocols, identity and authorization management, authorization, and authentication protocols.

Encrypting Cloud data

When creating a cloud security policy one of the most important sections has to be data encryption. By enforcing cloud data encryption, organizations will be more secure knowing that only authorized users will be able to access sensitive data and cloud resources. Additionally, organizations should encrypt data and cloud resources that are being uploaded to the cloud to ensure that they are secure and protected.  

We recommend that you schedule a monthly data encryption update to make sure that your data and resources on the cloud are secure and protected.

Monitoring your cloud environment

Monitoring is a critical component of cloud security policy. By implementing automated tools helps your organization get a macro view of your entire network. Cloud monitoring provides an easier way to see different activity patterns and any potential vulnerabilities in your network on the cloud.  By implementing an effective cloud monitoring solution it will put the organization’s security and compliance team at ease knowing there is a system in place. 

An organization’s cloud security policy can be a decisive factor when deciding the right direction by implementing different cloud services and resources. However, it shouldn’t change the organization’s mission. With that in mind, it’s important to create an employee-friendly cloud security policy that is aligned with an organization’s culture and helps the employee work more smoothly without interfering with their day to day work environment. In conclusion, a more complete cloud security policy will keep your company safe but don’t forget the policy starts with your employees. 

Read More
2020 Predictions
2019 Security Trends & 2020 Predictions That Will Shape Your Organization’s Strategy
Reading Time: 5 minutes

As we commence a new year and century, we tend to look at the different trends from the previous years and think about what the future holds for us.

When looking back at 2019, it was a wild run for organizations that were fighting different challenges such as cryptojacking, phishing, ransomware and making sure their critical resources stayed in the clear from hackers. However, not everyone stayed safe in 2019 as we saw different organizations fall prey, for example, the Capital One breach. As we move forward it is important to dwell on what we experienced, take those lessons, and implement them in order to improve your organization’s internal and external security.

Looking forward to 2020 and beyond, organizations will need to be prepared against attackers who will create and implement different kinds of attacks. We talked to different security experts who explained what 2019 trends and 2020 predictions they’re most excited about seeing in security in the upcoming year.

2019 Network Security Trends

Insider Threat Attacks

Hackers and malicious actors have a massive resource pool available to them which helps them easily access an organization’s networks and resources. One of the most popular kinds of attacks in 2019 was insider threat attacks.

“The insider threat is one of the greatest drivers of security risks that organizations face as a malicious insider utilizes credentials to gain access to a given organization’s critical assets. Many organizations are challenged to detect internal nefarious acts, often due to limited access controls and the ability to detect unusual activity once someone is already inside their network. The threat from malicious insider activity is an increasing concern, especially for financial institutions, and will continue to be so in 2020.” – Steve Durbin, Managing Director of the Information Security Forum

More Data Privacy Regulations

“With new legislation such as CCPA for California Residents and previous regulations such as GDPR, Data Privacy and Compliance are huge issues for 2019. There is an ongoing focus on protecting consumer’s personally identifiable information (PII) and a lot of companies are falling short. If each person took five minutes to run an internet search, they would likely find a wealth of information about themselves on public websites that they didn’t know existed. This will continue to be a problem in 2020 as not all companies will comply with privacy laws and some companies will continue to sell people’s personal information for profit.” – Courtney H. Jackson, Founder & Chief Information Security Officer (CISO) at Paragon Cyber Solutions

5G leading to More IoT Risks

With the rollout of 5G, we have seen more data than ever before being gathered from IoT, to protect access to those devices, IAM solutions for IoT will be a major need in 2020.

“With the opportunity of higher bandwidth provided by 5G, there are emerging threats, to name a few, that threat actors will dedicate more effort to hijack these devices for botnets for DDOS, malware distribution and recognizance of the target organization.

Enterprises should start planning now to protect this type of asset that is often forgotten, leaving them unmanaged from a security point of view and a low effort entry point for an attacker, often combined with the device vendor unwilling or unable to patch known vulnerabilities. This lead to a continued spread of Mirai botnet and their clones across the globe in 2019, three years after the threat was identified it is still a danger, given the current trend, I predict we will continue to see them grow in 2020.”- Fausto Oliveira, Principal Security Architect at Acceptto

2020 Security Predictions

Ransomware

Ransomware has always been a continuous threat to organizations over the years and in 2020 and beyond we will see many businesses and users in the financial sector become a more popular target by hackers.

“We will continue to expect to see more ransomware attacks on healthcare, education, and government sectors due to the large ransoms and success over the past year. Additionally, several ransomware groups have started to exfiltrate data in order to force victims to pay ransoms as many organizations started to ensure that they had good backup systems in place and avoided paying ransoms. But with this new twist to ransomware, companies now face the release of information and a data breach.“ – Shannon Wilkinson, CEO of Tego Cyber

Increasing Automated Security

There’s a huge shortage of skilled cybersecurity personnel, several million worldwide according to some reports.

“To make do with too few skilled resources, more companies will explore and expand security automation initiatives. In recent years, a whole market has emerged for Security Orchestration Automated Response (SOAR) platforms which enable teams to orchestrate and automate security actions to get more done in less time and with less manual effort. In 2020, look for greater adoption of SOAR platforms and automated playbooks, as well as for SIEM and Threat Intelligence Platform vendors to add more SOAR-type capabilities.” – Atif Mushtaq, CEO of SlashNext

Shadow IT

Over the past decade, many organizations have considered “shadow IT” as one of the key risk trends expected to change the way we think about security risk. As we enter 2020 and the next decade, shadow IT will become not just a trend but the native way we do business.

“Organization, from the largest hospital systems to rapidly-growing startups, will have an ever-growing set of thousands of external, cloud-based software systems, or externally managed dependencies introduced into their systems and software. It will be critical that companies understand which type of data they are sharing and with which third parties – and the security postures of those third parties.

In order to mitigate the risk in this fundamental change to the way we do business, information security organizations will need to support all areas of the business with more efficient processes and practices so everyone can make informed, risk-based decisions about the software they use and how to manage it securely – in line with a shared responsibility model.” – Ben Waugh, CSO at digital health firm Redox.

Unified Security Platforms

Today the majority of organizations are continuously adopting many different kinds of security solutions. Most of them are outdated, hard to manage and no longer relevant to the modern world and its new threats. The idea of a unified security platform will be introduced in 2020.

“Modern organizations will need to adopt Saas based unified cybersecurity platforms that are easier to implement and manage inside the organization’s environment. Moving forward, instead of using different vendors for different security needs, I believe IT managers will prefer to implement a central security system that provides complete visibility of its networks to help the cybersecurity analysts identify threats and respond in real-time in case of an incident. This concept presents the idea of having one platform for all solutions which provide the idea of a  one-stop-shop to consume cybersecurity.” – Amit Bareket, Co-Founder and CEO of Perimeter 81

Looking Past the Predictions

When looking back at 2019 and even earlier, we must learn from our previous security experiences and mistakes to learn what worked well and what didn’t. However,  looking into 2020 and forward we can’t depend on outdated tactics to fight off hackers and attacks.

The security community as a whole needs to stay informed daily about the different kinds of attacks, tactics and trends and start implementing them on an organization level to stay safe in 2020. We wish everyone a happy and secure 2020!

Read More
CCPA
Why Your Organization Needs to Become California Consumer Privacy Act (CCPA) Compliant
Reading Time: 4 minutes

Over the past decade, organizations are getting familiar with the different new privacy laws being enforced by governments. In 2018, GDPR went into effect and we are seeing the huge impact this law has had on organizations when dealing with people’s personal data. Now, there’s another major regulation that just went into effect.

On January 1, 2020, the California Consumer Privacy Act of 2018 (CCPA) went into effect and sets new requirements and rights relating to personal information of California consumers. This is the first state-level privacy law in the United States.

Data-driven companies are quickly making the right adjustments with the new regulation into their system, similar to how they prepared for GDPR. 

Despite not knowing how much of an impact this new regulation will have on organizations, it’s always best to prepare and be compliant. In this blog post, we will explain what the CCPA is, how it will impact your business and any other lingering questions you may have about CCPA. 

What is the CCPA?

The CCPA was created in order to protect the privacy and personal data of consumers who live within the state of California. The CCPA grants people the right to know what information businesses are storing about them. The act additionally gives people the right to tell businesses they cannot use their personal information.

Similar to GDPR, people may request that a business discloses the types of personal information it collects, the purpose of collecting that information, and who the information is being sold to. According to the regulation, people are allowed to request this data report twice a year, free of charge.

Why did California pass CCPA?

The California legislature approved the CCPA regulation after the mining of personal data was brought to light in 2018 with the famous data mining Cambridge Analytica scandal and how the congress hearing proved how vulnerable personal information can be misused. The state desired to create more laws that will implement better data privacy control and transparency.   

According to CNET, more states are considering similar laws and similar proposals are being presented at the federal level.

What CCPA Means for Consumers

The CCPA regulation provides California residents with 4 basic rights with their personal information:

  • The right to know what personal information, including specific pieces of information which are being stored and what the business is doing with the information.
  • The right to request that the business who is storing their information delete their personal information.
  • The right to opt-out of the sale of their personal information. 
  • If a consumer takes advantage of their rights under the CCPA, freedom from discrimination of price or services. However, a business may offer financial incentives, including payments to consumers, for the collection, sale, or deletion of personal information

How Do I Know If My Organization Is Impacted by the CCPA?

The CCPA regulation affects any organization that collects, shares, or sells California residents’ personal data and meets any of the following three criteria:

  • Has an annual gross revenue of $25 million or more.
  • Possesses the personal information of 50,000 or more consumers, households, or devices.
  • Earns more than half of its annual revenue by selling personal information.

How Can My Organization Become CCPA Compliant?

Your organization can implement different privacy steps to ensure consumers are able to exercise their rights under the CCPA. Here are the key steps to make:

  • Provide two or more methods for consumers to submit requests about their personal information. At a minimum, these methods must include a toll-free telephone number and at least one additional method such as a designated email address or online form.
  • Establish protocols to respond to consumer requests within 45 days of receiving them.
  • Update your privacy policies to include new CCPA privacy rights.
  • Analyze your data collection and documentation processes. Ensure that you are able to track how you collect data, how you use it, where it resides, and have a system in place to provide consumers with this information. 
  • Provide consumers with notice that their personal information is being sold. Implement a process to honor opt-out requests in a timely manner.
  • Assess and document your data security practices to ensure your business takes the necessary steps to avoid data theft and any other security breaches. 

Make sure your legal team reviews the entire CCPA initiative to identify all steps your business must implement to remain CCPA compliant. We highly recommend that you educate your entire staff on the main factors of CCPA compliance. 

Meeting CCPA with a Zero Trust Network As a Service

Although the law requirements are clear, CCPA does not provide a technical direction on how to meet these standards. Instead, organizations are required independently to create a plan to meet data security requirements. Admittingly, this sounds quite data-heavy, but each of these benchmarks can be easily met using a Zero Trust Network as a Service platform.

A Zero Trust Network as a Service (ZTNA) uses pre-shared keys to identify, authenticate and authorize user access. Using a ZTNA which offers a centralized cloud management platform, an entity can create customized user access to sensitive data – including cloud environments, SaaS services, sandbox and production environments, and more.

Additionally, any data which passes over any network is secured with advanced encryption. This creates a virtual tunnel so data can’t be intercepted by users who don’t have access. By offering network visibility and identifying risks and vulnerabilities to your systems and data, detailed activity reports provide insight into which resources are being accessed, what applications are being used, and how much bandwidth is being consumed.

Accelerate Your CCPA Compliance with Perimeter 81

At Perimeter 81, we are committed to protecting your company’s data and your customers’ data. In order to ensure complete CCPA compliance, we have:

  • Undergone a full third-party audit
  • Updated our terms of service and Privacy Policy
  • Ensured that our platform meets all data storage requirements

To help you navigate the CCPA and secure your clients’ data, we provide:

Automatic Wi-Fi Security for CCPA Compliance

With CCPA in effect, the way businesses handle Wi-Fi security will change drastically. At Perimeter 81, we have made this one of our key priorities. Our patented, Automatic Wi-Fi Security feature is a special built-in functionality to all of our applications that allows users to automatically deploy a VPN connection even if the device is locked and in your pocket.

Once you install Perimeter 81’s client applications, you can rest assured that data passing over any network is secured with 256-bit bank-level encryption. Perimeter 81’s innovative Automatic Wi-Fi Security immediately shields data by automatically activating VPN protection when employees connect to unknown, untrusted networks.

If you have any more questions about CCPA, our Automatic Wi-Fi Security feature, or the steps we at Perimeter 81 have taken to protect your data, please don’t hesitate to contact us at [email protected]

Read More
2020_Security_Experts
Top 10 Security Experts You Should be Following in 2020
Reading Time: 4 minutes

Data breaches and cybersecurity attacks tend to dominate the global headlines with the prominent details of the attack or hack. However, when looking for the bolts and nuts of a security breach, you need to know where and whom should you go for answers. 

Twitter and different security blogs are the most popular places to gain more insights and expertise from different security experts. These ever-changing platforms provide any user or person to engage and learn from the best minds in the security industry. You have the chance to communicate and interact with experts that you normally wouldn’t have the opportunity to by reaching out, commenting or tagging them in their tweets or comment section of their blog post.

While the common internet user will go to Twitter to see what their favorite athlete or musician is commenting or discussing on, the network security community uses the platform to provide another angle on different attacks or the direction of the industry. 

So before you go follow everyone who says they are the “must follow” security expert, you need to ask yourself who you should be following. We recommend that you check their expertise in security, whether they are active, and finally, what do they actually tweet or blog about. Once you know who to follow or subscribe to, we recommend creating Twitter lists or feeds per category of the expert. This will be key to simplifying the different numerous network security expert opinions that matter most to you.

We have assembled the best network security experts you should be following in 2020 and forward. Don’t have time to follow them all? Follow our list here

Brian Krebs (@briankrebs)

Brian Krebs is the most well-known cybersecurity expert in security. He is an independent investigative security journalist who spends his days investigating and reporting the latest hacks and breaches. Krebs started his career as a reporter for The Washington Post but only started to write about cybersecurity after his entire home network was taken over by a Chinese hacking group. His security blog mainly focuses on all things considered computer security and cybercrime. Brian tweets on a daily basis about security vulnerabilities and current InfoSec issues.

Graham Cluley (@gcluley)

Graham Cluley is one of the most active security bloggers, researchers, podcasters, and public speakers. Since the early ’90s, Cluley has been fighting to make the internet a safer place with his endless investigations and blogging about different hacks and breaches. Graham’s blog and daily tweets cover the latest security news, malware, breaches and cyberattacks.

Troy Hunt (@troyhunt)

Troy Hunt is one of the best experts when it comes to data breaches and security practices. Currently Troy is the  Microsoft Regional Director, a Microsoft Most Valuable Professional (MVP) for Developer Security and an international speaker on web security. He also runs the site Have I been pwned?, a free tool that aggregates every public data breach and instantly lets people know if their email account has been compromised in a breach. He tweets and blogs about network attacks and app security on a daily basis.

Bruce Schneier (@schneierblog)

Bruce Schneier is an internationally known privacy specialist and cybersecurity writer who famously was named the “Security Guru” by The Economist. Over the years, he has shared his cybersecurity experience and in-depth knowledge as an author of over 13 books. On his website Schneier on Security”, he regularly writes about the top security issues that we as internet users are facing. While he has an active Twitter account, it’s best to bookmark his security blog as that’s where he goes into the small details.   

The Grugq (@thegrugq)

While The Grugq doesn’t share his real identity, he is one of the most popular and well respected independent information security consultants and anti-forensic researcher. His detailed blogs on Medium are insightful and must-reads after a hack has become public. His Twitter account provides a sharp and witty commentary for pointing out the absurd and real concerns in the security space

Richard Stiennon (@stiennon

Richard Stiennon is an industry analyst who not only covers the IT security space but has spent a lot of time investigating the technology research business. Richard authored the book “There Will Be Cyberwar”, a book about the U.S. military’s shift to network-centric warfare and what that portends for cyberwar. He was named one of the “50 Most Powerful People in Networking” by Network World Magazine. His twitter account is filled with his interviews and articles on different topics within cybersecurity. 

Shira Rubinoff (@shirastweet)

Shira Rubinoff is one of the most recognized and popular female cybersecurity experts who leads multiple women-in-technology efforts. Additionally, she is one of the leading experts when it comes to the human factors of information technology and security. She lectures and publishes on a  regular basis on different topics that relate to cybersecurity and psychology. She tweets daily about all things considered security and how the human factor plays into cybersecurity.

Zack Whittaker (@zackwhittaker)

Zack Whittaker is the lead security editor for TechCrunch. He has been a security journalist for over 10 years writing for ZDNet, CNET and CBS News. Additionally, his articles have been featured in Time, WIRED, Fortune and other online outlets. He is constantly tweeting about news stories on security, legal, privacy, cybersecurity, national security, government and technology. He also produces a cybersecurity newsletter where he summarizes the previous week’s news.

InfoSec Taylor Swift (@SwiftOnSecurity)

Swift On Security is a parody account that was originally created to discuss with the Twittersphere about the famous HeartBleed bug, but currently, it has grown to Twitter famous in the security industry. For those who like their security with the right amount of mockery and passion, this is a must-follow.

Daniel Miessler (@DanielMiessler)

Daniel Miessler is one of the most veteran security bloggers in the industry. He has shared his thoughts on the interactions between technology and society since 1999 and his current focus is on the security of networks, web applications, mobile, and IoT systems. His Twitter account is a great place to find out what’s happening with all aspects of cybersecurity that you rarely will find elsewhere. Every week he puts an email newsletter about all the interest security news over the past week, you can subscribe here.

We’ve highlighted just a few of the best security experts in the industry that will help you stay connected with everything security-related. Of course, we have to mention that you can always stay updated with all our news and content by following @Perimeter_81 on Twitter.

Read More
amazon_reinvent
AWS re:Invent 2019: The Future is in the Cloud
Reading Time: 3 minutes

December started with a bang, culminating in the always exciting AWS re:Invent conference. Over 65,000 attendees made the trek to Las Vegas to get a grasp of the plethora of new updates at AWS and learn more about the different security vendors (including Perimeter 81) who were exhibiting at the conference. 

After the action-packed week that was AWS re:Invent, it’s time to reflect on the highlights and great conversations we had with customers, partners and thousands of potential clients that we met throughout the four-day conference.

Join us as we look back on last week’s event from start to finish, sharing our key learnings, conversations and booth activities.

AWS Doubling Down on Entire Cloud Migration

Every re:Invent, AWS announces different new features and services to their customers and this year they kept it simple with Andy Jassy’s keynote session. The clear message was organizations need to migrate everything to the cloud. Jassy’s and AWS vision is that by organization fully adopting AWS cloud services it will unlock additional IT spending. The main point presented was that AWS has the most features and capabilities of any provider and that competitors aren’t getting any closer. So in short AWS wants to become the pillar of next-generation of businesses in the upcoming year. 

One of the Best Conference to meet Customers

While exhibiting at AWS re:Invent, we had endless opportunities to meet with our amazing clients. Even if it’s just a quick hello or a longer conversation, it’s great to have the face to face discussion with our customers. While at the conference we had great conversations with different customers from different sectors and each conversation provided us with real-time customer insights into our solution. Their personal insights and feedback will help our team to continue to build the best Network as a service solution in the market.

                       Catching up with True{X} at the Perimeter 81 booth

Attendees Came for Company Swag and Were Welcomed with Demos

Like other large security conferences, we went all out at AWS re:Invent – we ran a voluminous amount of demos so attendees could receive a better understanding of our product and walk through our Zero Trust Network as a Service solution and all of its capabilities.

AWS__1

We also made sure that people didn’t leave empty-handed! Attendees who stopped by our booth had the option of different company stickers and swag.

Swag

Additionally, each visitor of our booth received a scratch card with the opportunity to win great prizes. Winners received Bluetooth turntable with speakers, portable speakers, Instax cameras and more.

AWS_conference_photo

Until Next Time

When looking back at the jam-packed week that was AWS re:Invent, it was a very enjoyable and exciting week, filled with great activities, the opportunity to meet up with old colleagues, and the chance to make some new connections. A big hats-off to everyone who helped make AWS re:Invent 2019 a huge success! We look forward to seeing you at the next industry event soon.

We’d love to have you join us for a webinar discussing simplifying connectivity to AWS transit gateway with Perimeter 81. 

Read More
Product Updates
December 2019 Product Updates: Automatic WI-Fi, WireGuard and More
Reading Time: 3 minutes

Over time, we have learned that we develop products, not for our solution, but for you, the customer, to help resolve your network access problems. But just resolving a customer’s problem is not enough – the product should also be intuitive and user-friendly. 

It’s clear that the best people to provide feedback about the ease of use of our platform are our customers. We listened to your feedback and requests and recently have made some significant updates across the Perimeter 81 platform that will help your employees achieve easy and secure network access. 

Below, we’ve outlined the highlights of our latest product updates over the past 6 months to our Network as a Service solution.

Automatic Wi-Fi Security Feature

As the number of public Wi-Fi hotspots worldwide is projected to reach 432 million by 2020, Wi-Fi continues to pose serious risks to businesses of all sizes. Due to the lack of encryption and open passwords, open networks can be hacked in a matter of seconds. Wi-Fi hotspots are everywhere – cafes, airports, hotels, smart cities, but only one out of every three people know how to identify unsecured networks. Simply, it’s no surprise that one out of every five people and three out of ten organizations fall prey to cybercrime while on-the-go.

Due to this, we have integrated our patented Automatic Wi-FI technology (Patent number: 10440762) which automatically secures your Wi-Fi connection no matter where you are working from. Our Automatic Wi-Fi security feature activates an instantaneous connection if an employee’s device connects to unsecured Wi-Fi, and establishes a private and secure connection. This security feature will be a key addition to our upcoming bundle of new security capabilities. 

Automatic Wi-Fi Security is enabled by default. Each user can adjust this configuration locally in their account when signed into the client application on their device.

WireGuard Connector 

Customers often ask how we are improving the performance and the speed of our solution. Now your questions are answered by our latest integration of the WireGuard® connector into the Perimeter 81 platform.

WireGuard connector is a free and open-source software application and communication protocol that implements virtual private network (VPN) techniques to create secure point-to-point connections in routed or bridged configurations. It aims to be faster, simpler, leaner, and more useful than IPsec while avoiding the challenges of IPsec. Compared to OpenVPN, Wireguard connectors have outperformed when it comes to quicker performance and simplified implementation. 

While it was initially released for the Linux kernel, it is now available and deployable on all major platforms (Windows, macOS, BSD, iOS, Android). By implementing WireGuard Connector in our platform, users will experience a faster performance within their Perimeter 81 application, 

Always-on VPN

In the summer days of July, we added a new configuration feature into the Perimeter 81 applications, Always-On VPN. This simple new feature establishes an automatic VPN connection any time an authorized client has an active internet connection. 

We recommend that all administrators enable the Always-On VPN technology feature in the configuration settings for all client applications. No matter which team member is using the application, they will always be connected to a secure network while working.  

New Gateway Locations

As the Perimeter solution advances with new security features, so does the amount of public and private gateway locations. We are now offering you over 36 global public gateway locations within in the Perimeter 81 platform.

While we always recommend all users to create private networks for their teams, we kindly remind you have the option to use the public gateway inside the platform.

That’s a Wrap

2019 was filled with different product updates and our latest partnership with SonicWall. This has capped off a huge 12 months at Perimeter 81. We’d love to hear your feedback going into the holidays and stay tuned for more product updates in 2020 as we are planning to launch our new unified network and security platform with more network and security features

Read More