Dashboard Data is power. Data generated at run-time data is even more powerful as it enables the CISO to make quicker decisions. Keeping that in mind, Sectona now provides a dashboard that gives a running information about all the assets, accounts and users that SpectraPAM manages. This also includes the session activity and the health of the PAM system. The dashboard not only answers essential questions, but also reveals trends that let the PAM administrator gain important insights to analyze faster and make critical decisions. You can quickly find answers to your most pertinent questions: Out of all the accounts that are managed, how many accounts are synced? How many accounts were accessed more than a month ago? How many users log in through Windows Authentication vs. Sectona authentication? How many workflow activities were approved vs. rejected? Host header injection mitigation When a browser sends a request to the web server, the request has a field named 'Host Header' in it which has the requested domain as its value. Many times the physical server which hosts this particular web application also has many other web applications running on it or it may have virtual hosts, some of which may be running web applications inside them. Host header makes it possible for this server to serve different content based on the domain inside this header. If a user specifies an invalid Host Header, most web servers are configured to either return an error message or to pass the unrecognized host header to the first virtual host in the list. Therefore, it’s possible to send requests with unrecognized host headers to the first virtual host. Web cache poisoning and Password reset poisoning are two attacks that happen due to this Host Header injection. SpectraPAM can now mitigate the Host Header injection attack. Manually on-boarding accounts When we run Account discovery, the accounts get on-boarded to PAM by having their passwords reset. For some administrative accounts it is not advisable to reset their passwords. For those cases, Sectona now gives the option to manually onboard the accounts. This gives the flexibility to the PAM administrator by letting the accounts be discovered by SpectraPAM yet the administrator has the option to add the discovered account to the PAM system manually.  

Internship is a keyhole for someone starting out to understand and get a first-hand experience of how things work in an organization. An internship gives you the opportunity to learn in a new environment where everyone is willing to help you as you are new to it. Like every year, this year as well Sectona conducted summer internship programs in the Research & Development department. This time around, as part of the internship feedback process, we decided to evaluate the intern experiences. Here is what some of our interns had to say about their experience of working with us - “The experience was wholesome, and I learnt a lot apart from the technical knowledge that I got over the internship period. A few of those were understanding how a firm functioned, role of all the individuals in creating and maintaining a product and working to the strengths of everyone here. I yearn to work for firms like Sectona who offer such privileges to grow and become a better version of themselves to all the individuals.” – Shantanu Das, Manipal Institute of Technology, Manipal. “I worked as a Technical Writing intern with Sectona for 3 months. Working with Sectona was an excellent learning opportunity, especially since I was new to the field of Technical writing. Here, at Sectona I got hands on experience as well as valuable guidance. Personally, I loved the working environment. People here are easy to bond with and are liberal in lending a helping hand” – Sneha Naranje, The English and Foreign Languages University (EFLU), Hyderabad. “The main reason I wanted to do the internship is to get some technical experience and work on a real time project and this internship has fulfilled that purpose. I have learned about how to research and do analysis on a problem which is the main role of a data analyst. I am sure this experience will be useful for me in the future.” – BVS Revanth, Manipal University, Jaipur. For an intern it is important to learn and gain as much knowledge as possible because that is what gives them experience and it’s their biggest asset. We are happy that our interns were able to get it. It has been our pleasure to have them intern with us. We wish them all the best with their future endeavours.

Turns out Karate and cyber security had more in common than we thought. Principles that are followed in karate stay pretty damn relevant even when it comes to keeping your organization cyber ready. Here are some of the basic principles in karate. Let's see how they correlate so well with good practices as far as cyber security is concerned. Respect your enemy (rei) Breach of access, website defacement, denial of your service etc are just some of the outcomes of not taking cyber security seriously or in other words giving your enemy (cyber risk) the respect it deserves. Respect your enemy by understanding the level of damage it can cause. This should always be the initial step towards any fight. First, know yourself and then your enemy Its important to know where you stand before you start the fight. Know the strengths and weaknesses of your organization. Creating a checklist of things to be taken care of can give you an idea of what needs to be done. Firewall Cyber security policies Enforce safe password practices Regular data back up Anti-malware These are just some items that should be on that checklist. Identifying which out of these is taken care of and which still needs to be done can simplify your path of action forward. Calamity springs from carelessness Careless actions like we all know can lose someone a fight. Karate teaches us that taking care of these actions will keep us from losing. Some trivial easily avoidable mistakes like Clicking on hypertext links Usages of portable storage devices Transacting on unsecured websites Usage of pirated software Can prove to be of grave danger to any organization and can put your security at risk. Karate is like boiling water; without heat, it returns to its tepid state Karate says that its important to always stay on you’re A game. To keep the water boiling calls for practice and constant introspection. Just like this even cyber security practices need constant updates and support. Its also important to conduct drills where situations of cyber attacks can be simulated to teach employees how to respond. Making cyber security practices an essential part of timely employee evaluations can also be a good way to keep the water boiling. Adjust according to your opponents Karate teaches us that its important to be aware of the strengths of your opponent so that we can train ourselves to cope with their strengths. This helps us to adopt new methods, learning new techniques, basically doing what it takes to survive undesirable situations. Similarly, Staying updated about cyber security attacks happening world over and striving to incorporate the solution that will help us overcome such attacks becomes an essential preparation for the war against cyber risk. Be constantly mindful, diligent, and resourceful, in your pursuit of the Way Having an open mind towards new and better ways is very important because doing something over and over again in a similar fashion is only going to give us the same output. Need a different output? Try a better way! In this Volatile, Uncertain, Complex and Ambiguous world its only obvious that we reinvent methods and means to keep what we hold dear safe. Inducing habits of educating all stakeholders on cyber security and rewarding those who come up with innovative ways of staying safe needs to be imbibed into our systems.   Karate is a lifelong pursuit Pursuing karate is a process that consumes time and effort. It takes persistence to stay in the process. A secure organization too cannot be looked at an event, it’s a process just like the pursuit of karate. Locate a security partner who will be there by your side in this pursuit. A partner who knows what's going on and what needs to be done. Living on the edge is the key to survival. Because remember that the attacker has to be right only once but the defender must be right every time.  

Its proven that what may appear as complex can easily be simplified when looked at as a game. Don’t believe me? Ask that 7-year-old who learned multiplication table the fun way. Can Privileged access management be looked at as a game? Let's break a game down and see what its made of. A game is nothing but a structured form of play. A game has various components like a goal, challenges, tools or enablers, skills required to ace it and of course competition. If we establish that PAM has these components, then we can conclude with certainty that it can be looked at as a game. Goal Goals can be on two types, long term and short term. A typical game would have both and so does PAM. Long term goals Secure your organization from cyber attacks by securing all the systems within the network To be compliant to the norms of regulators and scaling up sustainably without additional costs. Short term goals Rotating password Password encryption Increase automation Reducing human dependency Challenges Challenges in any game, are very important components. It's true that they do keep you from going to the next level, but once you figure out how to beat these challenges then nothing stops you from moving ahead. If it's Roadrash that you’re playing, then the cops that start to tail you become the challenge that you have to deal with. Even PAM has some challenges that will require us to bring in our A game. User awareness becomes the key challenge. It is essential that the user knows about the devices that he/she has access to and also about the PAM solution. Poor hardware on devices also becomes a challenge at times. Attaining the level of customization expected and defining user groups correctly are some challenges that PAM companies are still struggling with. Although developing empathy towards the client and understanding the what and why of his business can effectively dodge these challenges. Tools Dangerous dave had a jet pack, NFS requires you to collect NOS so that your car can zoom past others and get ahead in the race. PAM has some tools as well that enable you to get ahead in the race. Reporting forms an essential part of the tool kit. Easy to understand dashboards let you have a birds-eye view of everything that goes on within your network. Risk analyzer pushes you to be ahead on the curve by warning you about anomalies on basis of risk scores allotted to every activity. Automated asset and account discovery is also a tool that can exponentially ease PAM functioning. Remote access and activity trail being others. Competition In the case of PAM, defining competition can be tricky. It’s a long list if we go around looking. Competition can be classified as internal and external. Internal competition An employee gone rogue External competition A hacker sitting in a distant country. Ignorance towards cyber risk and internal resistance to transform and adapt better methods become competition too because when they win, you lose.   Skill Last but not least, developing the required skill because very important to win any game. In case of a computer game, it's mostly hand and eye coordination. When it comes to PAM, Its majorly about taking users from the low level of awareness to high. We could imagine the user awareness scale to range from 0 to 10 with three levels in it. 0-4 becomes level 1, 4-8 becomes level 2 and 8-10 becomes level 3. Level 1 Understanding PAM superficially without getting into the technicalities. Level 2 Understanding how PAM functions and the scope of it. It’s a stage where the user understands which business problem PAM solves. Level 3 Building a strong feedback loop with the users and customizing the PAM solution by keeping the user at the center. This loop requires users to participate actively resulting in the PAM solution to mature well. Coordination Just like a game that we play in teams, PAM requires high coordination among players/stakeholders. Now that we’ve established PAM can be looked at as a game, we have strong reasons to not do so. Unlike a game, PAM does not run in a simulated environment. Threats in PAM are not fictitious like in a game. It can be argued that games are unproductive in nature but PAM solutions unlike that has a very high ROI if we consider what’s at stake and are highly recommended by experts. You deserve this star if you think you understand PAM better now, just like the kid who now knows his multiplication. Thanks to games!

What is trending now? Earlier this year, Deloitte released its annual edition of emerging trends in government technology ‘A Government Perspective: Tech Trends 2018’. It spoke about how automation, artificial intelligence & cognitive technologies are set to change the way work gets done. Another one of the trends highlighted was that of re-engineering technology where modernized IT infrastructure is being created to enhance efficiency and service delivery. Furthermore, it mentioned of the adoption of newer technologies & newer ways to manage interrelationships, storage and security of organizational data while dramatically improving both availability and security. Co-incidentally, I also happened to come across a strategic move implemented by the Singapore Government where they have set up a G-Cloud, a private cloud infrastructure that meets all the required security assurances the government has mandated. The benefit – all branches of Singapore’s government can scale, deploy & scale up applications much more quickly, efficiently & securely. The reason why they have implemented the G-Cloud is to transform the way the government delivers services by enabling new technology & by using a transformed IT department. Moreover, based on our interaction with enterprises across sectors, we observed a trend where co-existence of hybrid infrastructure seems to be taking shape. And with that there seems to be an overall refresh in the associated aspects including security tools.   Synergy in above trends The above cases point to a similar direction – a transformation in IT. Transformation not just in terms of the IT infrastructure but also other parameters associated with it such as automation, new technologies, security & efficiency. Taking these trends to a broader setting, we can to a certain extent also assume that this is true not just in case of government enterprises but also other enterprises – small, medium & large. And while unsaid, with this transformation comes the challenge of IT security at all levels, especially with regards to IT infrastructure. Needless to mention, security around user access to critical IT infrastructure cannot be neglected and that should maintain top priority. Reason being that compromising this security aspect could lead to unlimited access & control of critical infrastructure accounts/privileged accounts & their passwords falling into the wrong hands.   Time to re-evaluate your IT security solutions Evaluating a priority security solution tailored to protect IT assets such as a privileged access security solution could be a long-winded process. However, the ROI in terms of recurring cost, security, compliance & business reputation is worth the time & money invested. For instance, Apple devices have gained popularity not just for its features & sleek design but for the fact that they are protected from ransomware. Similarly, customers of any organization would look at the enterprises’ security measures in today’s time & age to build trust in that organization. More than strong revenue, profits & popularity, it is information security as an evaluation parameter that has taken dominance in customer decision making, come to think of it. One can argue that the only way customers would know of an organization’s security is until a security breach takes place. But why wait for that to happen? Prevention is better than cure, the age old saying. With that in mind, it has become important for security teams in enterprises to do a continuous assessment & monitoring of existing security solutions & evaluate the solutions’ capability to support & scale with modernized IT infrastructure. Having said that, prioritization is equally important. When it comes to security solutions, the first thing that you would think of securing is the core of your IT environment - the privileged accounts. And why wouldn't it be? A study by Ponemon Institute has pegged the average cost of insider threats for an organization at over $8 million, not to mention losses suffered due to a hit on the reputation . It is therefore time to re-evaluate your security with regards to privileged access. Re-evaluation of privileged access security is not cumbersome Times have changed. Every simple item we use today demands a re-evaluation, why not security solutions then. Privileged access security is not what it used to be before. Most enterprises might have implemented a privileged password vault some time ago but with such massive IT transformations happening at all levels, it is also important to re-assess your privileged access security programs. You may already have a robust privileged access solution in place but are they built to scale and suit the modernized IT infrastructure? If not, then having implemented such a solution could lead to spending more time and resources in maintaining the solution alone. Moreover, there is risk of sticking to a traditional solution that may have an architectural shortcoming considering the new age infrastructure changes. It, therefore, is best practice to re-evaluate existing security solutions in terms of their capability to support an agile and scalable IT environment without impacting productivity, compromising security & increasing costs. You have to take action before a potential security threat event could occur even with the existing solutions in place. Imagine the plight of security teams in the event of a potential mishap (breach) despite having an erstwhile compliant solution. It is worth the time & effort to look at transforming and reworking privileged access security program to ensure data security is abreast with your IT transformation.  The current scenario demands a Privileged Access Security/Privileged Access Management (PAM) solution that is capable of adjusting and adapting to the dynamic IT infrastructure. And if there is a PAM solution that is engineered on a new age technology suited to adjust and adapt to the dynamically evolving IT setting, it may be worthwhile evaluating such a solution and considering a change, wouldn’t it? Reworking privileged access security program is not as tedious as you think it is. Alternatively, you may even want to consider keeping a backup PAM solution, if not replace it. Think about it.   How can Sectona help? Sectona has engineered a Privileged Access Management to adapt to the dynamically changing IT infrastructure. The solution has been built with the intention to scale flexibly without compromising on security or increasing costs. Designed with a new process & approach, Spectra Privileged Access Management has been conceived & architected with the right amount of time and energy to realize the right ROI. Learn more about Spectra here and see it in action.