#thycotic

New Post has been published on https://is.gd/sTD4MB

Thycotic, distribuita da Ingecom, acquisisce Onion ID

Thycotic, fornitore statunitense di soluzioni per la gestione degli accessi privilegiati (PAM), ha acquisito il provider californiano Onion ID. Thycotic è distribuita da Ingecom. L’accordo rafforza la posizione di Thycotic nella gestione degli accessi privilegiati in cloud. Il portfolio dell’azienda si arricchisce di 3 nuove soluzioni, sempre distribuite da Ingecom in esclusiva sul mercato italiano.

Arrivato sul mercato italiano nel 2019, Thycotic con questo accordo protegge anche l’accesso alle applicazioni SaaS, all’infrastruttura IaaS e garantendo la produttività e la sicurezza dei lavoratori in remoto.

“Con l’improvvisa crescita a livello mondiale del numero di persone che lavorano in smart working, i controlli di sicurezza degli accessi privilegiati devono tenere in considerazione anche degli utenti aziendali ordinari, come quelli del dipartamento di finanza e di marketing, che accedono ai dati sensibili da dispositivi non attendibili su reti non affidabili” ha dichiarato James Legg, Presidente e CEO di Thycotic. “Grazie a Onion ID, ora siamo in grado di implementare controlli di accesso, basati su ruoli ottimizzati in qualsiasi applicazione web, console IaaS e database in cloud. Inoltre, possiamo fornire l’autenticazione flessibile multi-fattore, che offre ai responsabili di sicurezza un sistema molto più semplice per garantire percorsi di accesso sicuri”.

Thycotic acquisisce Onion ID

Con l’acquisizione del provider californiano, il portfolio PAM di Thycotic si amplia di tre nuove soluzioni. Thycotic Remote Access Controller, semplifica e automatizza la gestione degli accessi dei dipendenti e delle terzi parti che accedono alle risorse IT da remoto, garantendo un livello di sicurezza. La soluzione sfrutta l’autenticazione multi-fattore (MFA) e la registrazione delle sessioni, senza richiedere software o estensioni del browser, per fornire un livello avanzato di granularità della sicurezza, che permette di rispettare le politiche aziendali di sicurezza e conformità.

La seconda tecnologia, Thycotic Cloud Access Controller, garantisce che gli amministratori che accedono alle piattaforme IaaS e alle applicazioni SaaS mantengano il controllo degli accessi basato su ruoli (RBAC). Inoltre, il controller mette a disposizione una dashboard centralizzata, che permette di visualizzare le applicazioni alle quali ha avuto accesso ciascun utente, la rimozione degli accessi, la produzione di report di audit e molto altro ancora, garantendo una maggiore sicurezza e una conformità semplificata.

Infine, Thycotic Database Access Controller consente alle aziende di adottare i database in cloud mantenendo livelli di accesso adeguati, MFA e flussi di lavoro completi di reportistica e audit. I clienti possono registrare intere sessioni di accesso al database, fornire l’accesso JIT (Just-in-Time), segnalare e registrare log, generare avvisi e spegnere le connessioni in modo automatico.

The cloud has always been this mysterious place—many companies embraced it and put everything they could into the cloud, while others watched cautiously from a distance, wondering whether they should do the same.

Before taking you on the journey to the cloud, let’s answer the question “What is the cloud, exactly?” Clearly, it’s been a source of confusion. In fact, many still point up when they use the term “The Cloud”, as if it was some kind of magical place in the sky.

The cloud is simply someone else’s servers, in another location, and you get to use those servers whenever you need to. Think of it like electricity: you don’t need to own a power station to get electricity, or own the infrastructure. You just need to be connected to the network so that when you flip the switch the lights come on, and you get charged for consumption.  That is the cloud in its most simplistic terms.  So, the cloud is an on-demand, shared network of connected computer resources.

To be clear, from this point onward when I refer to the cloud I am referring to actual servers and services running in a data center.

A Cloud-First Approach

Many organizations have adopted a cloud-first approach. This means they must first consider cloud deployment options unless the services do not exist, it is not technically possible yet, or legal issues prevent a cloud option. In today’s modern era of cloud computing some companies are ALL cloud, meaning they completely consume and deliver all their business services from the cloud, and they don’t own any physical servers or locations to place them.

Data Classification and Access Audits (What data is important, and who has access?)

Before you move your business data to the cloud you must know which data is regulated and be familiar with the boundaries that restrict where the data can be located. This may determine which type of cloud can be chosen, as well as geographic locations.

It is important to perform a complete Data Impact Assessment and ensure that access to sensitive data has full access audits.  I recommend performing a data classification after an impact assessment to determine which data is more sensitive and identify what type of data it is. In the past I have used a process similar to Data Center Classification that determines the data in relation to its importance, and aligned with the CIA Triad, to figure out what is important to the data—is it availability, integrity or confidentiality?  Once you have classified the data you must align it to security and access controls to ensure adequate security is applied and the risk is reduced.

A data assessment and classification will help an organization determine what type of data might be impacted by compliance and regulation, and whether that data is permitted to be stored outside of the country’s borders.

The cloud has significant benefits for organizations which makes it very compelling, and a must for consideration when embracing new services

The Benefits of Cloud for Business are plentiful:

Dynamic and Agile

Organizations who adopt a cloud-first approach naturally get to be very dynamic and agile so that when they need new servers those resources can be obtained in minutes with any operating system or application requirements. This means that businesses that are growing quickly, or have fluctuations in requirements, can increase or decrease the computer resources they need on demand.

The Cloud gives organizations the greatest flexibility and quickest time to value

Capital Expenditure versus Operational Expenditure

Another huge benefit of the cloud is that it typically comes from a different cost structure. This is because you are renting the computer resources and not owning them, so you do not inherit depreciation costs, maintenance costs, upgrades and even sometimes expensive decommissioning costs.

Going with cloud enables an organization to pay-as-you-go and reduce wasted time, resources and huge upfront investments

Disaster Recovery

For any business-critical systems, organizations must double-up on everything from servers and software to backups, connectivity, databases etc. This means any new business-critical service can be double the cost too.  Cloud services will have disaster recovery built in, so you do not have to worry about backups and maintaining them.

Software Updates

Businesses get automatic software updates when available.  But one big challenge, and a pain for businesses, is when they need to perform major software updates that could result in downtime, failures and hefty resource costs.  A cloud approach enables your organization to focus on using the software rather than keeping it updated and running.

Best in Class Security

Cyber security has been a serious threat in recent years for governments and businesses all around the world.  Strengthening cyber security and reducing risks has been a priority. However, many businesses continue to struggle, patching systems, applying security best practices and trying hard to prevent sensitive data from being stolen in a cyber-attack.  IT resources are struggling to stay up to date on all these threats and have become overwhelmed. After all, it’s impossible to be a cyber security expert in everything. But in recent years organizations have become more confident about consuming cyber security solutions from the cloud as they can then focus on the business priorities and not have to become experts in everything.

Immediate Service and Value

With cloud you can get immediate service and value without waiting for internal IT to make system resources available, or pending additional license purchases such as operating systems or databases, etc.  With cloud you can simply get the service without any other dependencies.

Major Skills Shortages

Probably the biggest challenge today is that many businesses are facing a major skills shortage, especially in remote areas or large cities where they are competing for experts who tend to rotate frequently.  With cloud solutions the business does not need to find Operating Systems experts, database experts and system backup experts.  So, you can focus on the resources and skills needed to support the business while the cloud service takes care of having the skills and expertise. You simply consume the service, needing only to learn how to use it versus installing and maintaining the solution.

You no longer need to have an expert for everything

It is ALL about the Data and the Law

What prevents some countries or companies from adopting cloud is when a legal obligation stands in the way, as mentioned above regarding the data assessment.  Some countries have laws that relate to placing citizens’ data outside of the country’s borders.  What this means for these governments and companies is that when the cloud services are not available within the borders of the country or region, then they are unable to store the citizens’ data in the cloud.  A lot of cloud providers have reduced this issue by making data centers available in each region such as North America, Europe and Australia, and other locations,  thereby providing a dedicated location where the cloud services run and enabling the entity to stay compliant with the laws where applicable.

More organizations are moving to the cloud for security solutions so they can focus more time and resources on the business

As we open 2019, we are expecting the issue of least privilege cybersecurity to become a priority for companies across the spectrum. One of the big reasons, of course, is that 80 percent of breaches today involve the compromise of IT and business user credentials including usernames and passwords.  To combat the exploitation of compromised accounts, organizations increasingly recognize how important it is to secure and protect privileged access across the enterprise for super users and business users, services, applications, data and systems.

The concept of least privilege cybersecurity has come to the forefront because it offers a means to proactively make sure that when credentials are hacked or abused (and we should assume they will be sooner or later), privileges are restricted or limited so that any exploitation can be quickly detected and contained.  This is particularly important in securing hundreds or even thousands of vulnerable endpoints.  However, restricting privileged access poses significant challenges that must be addressed.

How do we prevent overprivileged access without negatively impacting productivity?

If users can’t get access to an account, server or device such as a printer or application, they will have to call the helpdesk. Helpdesk staff, under pressure to keep things running, all too often end up granting more privileges than needed to get users quickly back on track.  The dilemma becomes:  How do we prevent overprivileged access by users, applications and services without negatively impacting productivity?

To help organizations understand the principle of least privilege and how to successfully implement a least privilege strategy, I’ve just authored a new eBook, published by Thycotic called Least Privilege Cybersecurity for Dummies.

Much like the previous two “Dummies” books that I’ve authored (PAM for Dummies, Cybersecurity for Dummies), this new book gives you an easily readable 16-page introduction to least privilege cybersecurity that you can share with your IT staff as well as business users and executives.

Learn the five key action steps to help assure success in implementing least privilege

The book explains how to define least privilege cybersecurity, with examples to illustrate the dangers of overprivileged users. It shows how to lay the proper groundwork for implementing a least privilege strategy in terms of identifying critical data assets, mapping them to privileged accounts, and incorporating a privileged account lifecycle of protection.  It then provides five key action steps to help assure success in implementing least privilege, including the combination of least privilege with application control—essential to any least privilege plan.

Before you make any decisions to deploy an Endpoint Protection Platform (EEP), or any kind of complex Endpoint Discovery and Remediation (EDR) solution, you need to consider how a implementing a least privilege strategy with application control could work in your organization.  It could save you enormous amounts of time and resources by limiting privileges to stop exploits in their tracks.

Compliance audits are a stressful, time-consuming effort for many companies. In the Lockdown blog, we often talk about the tools and processes customers use to prepare for both internal and external information security audits. This time we thought we’d turn the tables and speak directly to an auditor to hear his perspective.

In this post, auditor and Information Security Specialist Edgar Perez Espinosa shares what’s on his security audit checklist and what really goes through his mind when he’s conducting an information security audit.

Thycotic: How prepared are companies you audit?

Auditor: There is not much advance notice in terms of process. Basically, companies focus more on investing in the “new generation” tools for increasing security and account management, but 70% of them lack a complete lifecycle to dispose accounts correctly.

50% of the time companies do not properly understand the scope of the audit

Thycotic: How long do you spend on an audit?

Auditor: Usually audits take from two weeks to one month. It will depend on the scope of the audit.

Thycotic: What frustrates you the most about auditing organizations?

Auditor: What is most frustrating about security audits is that the 40% of companies repeat the same missing controls: updated inventories (hardware and software), vulnerability management and monitoring of PAM. That makes our work easy, as the findings repeat, but it continues to be a risk for them.

Thycotic: What do you enjoy the most?

Auditor: What I enjoy the most is the fact that companies trust in our advice as experienced auditors, not only to find missing controls but to understand what really works for different companies. I like when Directors understand the risk for their organizations and they thank you for having made them conscious about that.

Thycotic: With respect to privileged accounts, what type of security controls do you expect to see?

Auditor: First of all, I like to see the inventory of privileged accounts, who is responsible and the process of assigning one of them. Then, in practice, what I usually look for is the workflow of real-time use of a privileged account and how it’s used, authorized, monitored, logged and disposed.

Thycotic: How often do you see companies that do not achieve what is required of an audit?

Auditor: I might say that 50% of the time companies do not properly understand the scope of the audit, and do not even know their internal process and that is a big mistake. Audits are conducted to improve the security posture, but you should know your risks and define plans to minimize them.

Thycotic: In what areas do you see most companies fall short? Why do you think that is?

Auditor: Based on experience, the top three domains where companies fall short are:

Risk Management (mainly because strategically this has not been properly understood)s

Secure Software Lifecycle (usually because they focus on functionality instead of security by design)

Incident Management (they respond to incidents but they do not know how to manage outside the organization and how to disclose breaches appropriately.

Thycotic: What would you recommend to any company to be better prepared for a security compliance audit?

Auditor: In my opinion, my best advice is do not fear audits. They should be seen as part of an improvement process. Instead, think of audits like a health check. How would you know if you have a disease if you don’t visit your doctor?

What steps can you take to prepare for your next compliance audit?

To see where you stand, first run an internal audit of your privileged account security. Run Thycotic’s free Privilege Discovery Tool and get a comprehensive summary report highlighting your risks.

Users are the biggest risk to information security. That’s why it’s so important to have a usable software product, especially in the cyber security space. Our goal is to give people the agility and control they need to reduce risk. Usability is our North Star.  

With this goal foremost in our minds, we’re building a growing team of usability experts, including cyber security software UX researchers, UI designers, and developers, continually improving the Thycotic experience. This post is the first in a series in which you’ll hear about the process we’re using to research how people use privileged access management (PAM) tools and the steps we are taking to address those requirements in our product interface and overall user experience.  

The first-time user experience must be so intuitive that people can jump right in

Why now?  

The PAM software market is growing rapidly. More types of organizations and more people within an organization are using software for privileged access management for the first time. We need to make the first-time user experience so intuitive that people can jump right in. People should be able to figure out how to use PAM software in a matter of minutes, with a consumer-grade user experience, or they’ll get frustrated, abandon the tool – and increase their risk as a result.  

In terms of design and usability, B2B software products often lag behind consumer products, but we believe they don’t need to. Most of us spend a third of our lives at work. There is no reason that tools we use in the workplace shouldn’t receive the same level of attention as the products we use at home. You deserve to spend time with products that you enjoy using.  

Our guiding principles  

In our PAM product development and design we have several guiding principles and we rigorously test our products with these in mind. These principles hold true whether our customers have 5-6 folders with a few thousand secrets or need to search and retrieve information across hundreds of thousands of secrets.

Clarity. It’s important that we create a balance of information awareness and usability without cluttering your screen. This is not about making things “pretty,” it’s about data saturation. When people are paralyzed with choices, they are less productive and may avoid the product altogether. Our team works to prioritize the most common, most essential controls and surface certain controls only when needed. Our goal is that software users should be able to do 90% of the actions they require within one click.

Flexibility. Security, IT Operations and Development roles used to be very distinct. Everyone stayed in their box and contributed according to their specialization. But now, each of those departments interacts with PAM and has different needs. That’s why we look at our user experience from many angles – from the people deploying the software to those using it every day – and built a ton of flexibility into our product so people so people can make it their own.

Accessibility. Everyone should be able to manage our products. Long term, we are working toward the goal of 508 compliance and ensuring access for people with vision impairment.

Light footprint. Our developers don’t create spaghetti code and our products consume minimal resources so we don’t negatively impact the user experience. We don’t want to slow you down when you are trying to get things done.  

Data-backed decisions  

Our user experience process includes a mix of usability testing methods, including direct interviews, A/B testing, and more. We check our assumptions and we listen. We’re open to surprises.    

With so many different implementations and customizations of PAM software, we screenshare with customers so we understand the context of how Thycotic fits into their environment and their workflow. Are they switching back and forth with Azure, or Active Directory, or Android devices? How do they want to use the space within the PAM interface?  

Iterative design approach  

One thing we’ve learned is that design cannot be a stop and start activity. If you neglect design it very quickly becomes stagnant. We’ve taken the approach to change design gradually so that our users don’t feel a radical change that interrupts their workflow.  

We’re continually assessing our product design with user testing and direct input from customers. As new features and workflows are integrated into the Thycotic software experience we’ll be letting you know and asking for your feedback.  

How will the rollout plan work?  

Thycotic’s cloud PAM users are first to experience our new user interface, with the 10.6 release of Secret Server Cloud.  

Customers: When you log in to Secret Server Cloud you’ll see an option to switch to the new UI within your Settings. (If you like the Classic UI, that’s ok too. You can switch between them as you like).

If you’re considering Thycotic we invite you to experience Secret Server Cloud and preview the new UI with a free, 30-day trial

This first update focuses on areas of Secret Server where users spend 90% of their time. The result is a Secret Server UI that helps you view and manage secrets even faster.  

The modern, clean interface eliminates distractions so you can focus on priority tasks

New styles indicate the next step to advance your workflow

Drag-and-drop modules let you customize your dashboard

Context-sensitive elements appear only when you need them  

Compare the Classic Secret Server UI to the New Secret Server UI

Classic UI (click for larger image)

New UI (click for larger image)

Cyber security was a major topic in 2018 as the compromise of elections and voting machines was at the top of everyone’s minds.

Given the critical impact of the midterm elections on future governance, election security is a major concern. It’s especially concerning after it was demonstrated at DEF CON how voting machines could be hacked in two minutes, and even young children had successfully displayed how easily they could hack these critical systems. With ransomware cyber-attacks on the decline and cryptomining on the rise, it appears that rather than trying to extort money from victims, cyber criminals are using victims’ stolen computer resources to mine cryptocurrencies, increasing their profit from previous years’ financial fraud, and basically stealing energy from victims.

Email continues to be the number one method of delivering malicious payloads and identity theftcontinues to be most targeted by cyber criminals. This year’s data breaches have personal data at the top of the list of stolen assets from major data breaches such as Exactis, Under Armour and MyHeritage.  The education and airlines industries have been targeted by cyber criminals stealing intellectual property that can be used to make counterfeit products and airline passenger data, such as passport details that could be used to create fake identities. Air Canada, British Airlines and Cathay Pacific have all experienced major data breaches in 2018.

Email continues to be the number one method at delivering malicious payloads and identity theft continues to be most targeted by cyber criminals.

Facebook had a horrible year for cyber security after making their relationship with Cambridge Analytica transparent. The British consulting firm had a major impact on the 2016 Presidential Election and the Brexit Campaign, and Facebook’s involvement forced founder Mark Zuckerburg to appear before Congress to explain what happened and how Facebook was going to take responsibility. Facebook’s woes continued: they later experienced one of the biggest data breaches in 2018, with 50 million victims—the result of poor security.

Cyber attacks caused major disruption throughout 2018 and we saw the World Economic Forum raise cyber-attacks to be the third-highest risk to world economies, just behind climate change and extreme weather events.

With cyber attacks dominating the world stage, what predictions do we have for 2019?  I am always trying to figure out what will happen next. Below are my 2019 predictions for the future of cyber attacks, and the type of threats you need to prepare yourself for.

1. Million-dollar data breach fines

In 2018, we saw the EU GDPR come into enforcement as well as the California Consumer Privacy Act, both of which have serious financial penalties for organizations that fail to protect personal data. We also saw some serious financial costs from cyber attacks with Uber agreeing to pay $148 million from a data breach that occurred in 2016, and both Equifax and Facebook were fined £500,000—the maximum penalty possible under the older UK data protection law.  In 2019 we are going to see some serious financial penalties, with Facebook, Google, and British Airways all under the microscope This could prompt the first billion-dollar data breach fines for failure to secure and protect personal data.

2. Regulations get tough, and the rest of the world will update laws for data protection

Following the EU’s GDPR and the California Consumer Privacy Act, the rest of the world is ramping up data protection laws, responding to the modern global economy in which data is now exceeding the value of oil, becoming the most valuable asset. Governments have now seen that importance of protecting their citizens’ sensitive personal data and punishing corporations for failure to protect individuals’ data., particularly organizations that are profiting from the data. In 2019, we will see the rest of the world continue to increase legislation related to personal data and IoT (Internet of Things) devices to ensure that the standards of cyber security in place to protect data are at a standard equal to the value of the data itself.

3. Machines will attack humans

In 2019, with so many connected devices, we are very likely to see machines attack humans.  Yes, machines will be used to target humans with cyber attacks and many of those machines will be controlled by other humans. Cyber attacks will start to have a direct impact on humans and possibly cause physical harm or eventually even death. You might go as far as saying we could see a vacuum cleaner chase your kids around the room, your fridge spit water in your face, a kettle heat water to extreme temperatures, or your car veering into another car—all resulting from malicious acts to attack humans.  IoT could potentially become the future assassin, and attacks could easily be carried out across country borders. At least in 2019, these devices will be controlled by other humans, but with AI (Artificial Intelligence) we may lose this control to devices in the future.

4. Government will engage in cyber offensives

Governments have been developing cyber weapons for several years and many have been using them in secret to attack other countries causing situations just short of war.  Nuclear weapons no longer have the deterrence they once had, and cyber weapons have allowed countries to disrupt our society and political stability that was protected in previous years. In 2019, we will likely see governments reveal their cyber weapon capabilities to create a future deterrence in showing other countries what will happen if they continue using cyber techniques to cause social and political harm.

5. Email and compromised privileges continue to be the major cause of data breaches

Email and compromised privileges will continue to be the primary method at bypassing company security controls to disrupt services, steal sensitive data or cause financial fraud. Reducing the impact and risk of emails and privileges should be the number one priority for organizations if they want to reduce the risk of cyber attacks.  If you can control email hyperlinks and attachments as well as implement a least privilege strategy, that will limit and control privileges and reduce your risks.  2019 is the time to get in control of privileges.