The release of Kubernetes version 1.18 comes at an interesting time, to say the least. The Kubernetes release team has done an amazing job of pushing out the new version despite all the turmoil and uncertainty caused by the spread of COVID-19, which impacts the global Kubernetes developer community members like everyone else.

The release features a number of new enhancements and changes. New and maturing features include enhanced security options, improved support for Windows, multiple extensions to the Container Storage Interface, and more. We will cover a few of these changes and enhancement highlights.

Version 1.18 includes several backwards-incompatible changes that users and developers need to know about before upgrading.

kubectl no longer defaults to using http://localhost:8080 for the Kubernetes API server endpoint, to encourage using secure, HTTPS connections. Users must explicitly set their cluster endpoint now.

Cluster administrators can choose to use a third-party Key Management Service (KMS) provider as one option for encrypting Kubernetes secrets at rest in the etcd data store backing the cluster. The KMS provider uses envelope encryption, which uses a data encryption key (DEK) to encrypt the secrets. Kubernetes stores a KMS-encrypted copy of the DEK locally. When the kube-apiserver needs to encrypt or decrypt a Secret object, it sends the DEK to the KMS provider for decryption. Kubernetes does not persist the decrypted DEK to storage.

Release 1.18 makes several changes to the KMS provider interface used for EncryptionConfiguration resources. The CacheSize field no longer accepts 0 as a valid value; the CacheSize type changes from int32 to *int32; and validation of the Unix domain socket for the KMS provider endpoint now happens when the EncryptionConfiguration is loaded.

Weve compiled a checklist to help ensure your K8s clusters are production-ready for security, stability, and scale.

Download Today

To simplify the configuration and security of Kubernetes API calls that involve streaming connections to containers, this change deprecates two streaming configurations.

Kubernetes persistent volumes default to giving containers in a pod access to the volume by mounting the filesystem, a suitable method for the majority of applications and use cases. However, some applications require direct access to the storage block device, notably certain databases that use their own storage format for increased performance.

This enhancement allows users to request a persistent volume as a block device where supported by the CSI and underlying storage provider. In the corresponding pods container specification, users can set the device path which the containers application can use to access the block device.

The horizontal pod autoscaling (HPA) API allows users to configure the automatic addition and removal of pods in a replica set based on various metric values. This enhancement adds an optional behavior field to the HorizontalPodAutoscaler resource type. Users can set the scale-up and scale-down rates, enabling them to customize the HPA behavior for different applications. For example, an application like a web server which sometimes gets sudden spikes in traffic may require adding new pods very quickly.

Because web servers are generally stateless, pods could also be removed quickly when the traffic subsides. On the other hand, users may want to slow the scale-down for deployments with a higher initialization overhead, e.g., containers running Java.

Cloud providers and many on-premises environments offer multiple zones or other topological divisions that provide redundancy in case of a localized failure. For applications to benefit from the independent availability of multiple failure zones, replicas need to be deployed to multiple zones. However, the default Kubernetes scheduler had no awareness or options for spreading a replica sets pods across zones.

This feature adds an optional topologySpreadConstraints field to the pod specification. Users can select node labels to use for identifying these domains and configure the tolerance and evenness for replica placement.

Currently, Secret and ConfigMap objects mounted in a container periodically get updated with the new object value if the associated Kubernetes resource gets changed. In most cases, that behavior is desirable. Pods do not need to be restarted to see the new value, and if a workload only needs the startup value, it can read it once and ignore future changes.

Some use cases may benefit from preserving the secret or config map data as it was at the pods start time. Making the data available in the mounted volume immutable protects applications from potential errors in updates to the underlying Kubernetes object. It also reduces the load on the kubelet and the kubeapi-server, because the kubelet no longer has to poll the Kubernetes API for changes for immutable objects.

This change adds the optional ability to make Secret and ConfigMap objects immutable through the new immutable field in their specifications. A resource created as immutable can no longer be updated, except for metadata fields. Users will need to delete an existing resource and recreate it with new data to make changes. If users do replace an object with new values, they will need to replace all running pods using those mounts, because existing pods will not get updates for the new data.

The ability to create a persistent volume cloned with the data from an existing persistent volume claim as source graduates to generally available. This feature is supported only via the Container Storage Interface, not in in-tree drivers. In addition, the back-end storage provider and the CSI plugin in use must support creating a volume from an existing volumes image. Specify a dataSource in a PersistentVolumeClaim to clone from an existing PVC.

Note that the exact method of cloning depends on the storage provider. Some providers may not support cloning mounted volumes or volumes attached to a virtual machine. In addition, cloning active volumes creates the possibility of data corruption in the copy.

Currently, the kube-apiserver in most Kubernetes clusters uses one of two methods to connect to nodes, pods, and service endpoints in the cluster. In most cases, the server makes a direct connection to the target, but this ability requires a flat network with no overlap between the IP CIDR blocks of the control plane, the nodes, and the clusters pod and service network.

The other method, largely used only in Google Kubernetes Engine, creates SSH tunnels from the control plane network to the cluster. The reliability and security of the SSH tunnel method have not held up well. SSH tunnel support in Kubernetes has been deprecated and will be removed altogether in the future.

As a replacement, this feature creates an extensible TCP proxy system for connections from the control plane to endpoints in the cluster. It uses the new Konnectivity service, with a server component in the control plane network and clients deployed as a DaemonSet on the cluster nodes. This architecture simplifies the API servers code base, as well as opening up the possibility of using a VPN to secure and monitor traffic between the control plane and the nodes and offering other opportunities for customization.

We just covered a handful of the enhancements in the 1.18 release, focusing on new features that may be extremely useful to some users and others which highlight the ongoing work to improve the security posture of Kubernetes and to address the complexity of the code base, which had created issues and questions during last years audit. Check out the (soon to be published) official release notes for a complete list of changes. Also, in case you missed it, you can find a great interactive tool for searching Kubernetes release notes at https://relnotes.k8s.io/.

View original post here:
Whats New in Kubernetes 1.18? Enhancements and Feature Updates - Security Boulevard

Apart from the obvious health and economic impacts, the coronavirus also presents a major opportunity for cybercriminals.

As staff across sectors and university students shift to working and studying from home, large organisations are at increased risk of being targeted. With defences down, companies should go the extra mile to protect their business networks and employees at such a precarious time.

Reports suggest hackers are already exploiting remote workers, luring them into online scams masquerading as important information related to the pandemic.

On Friday, the Australian Competition and Consumer Commissions Scamwatch reported that since January 1 it had received 94 reports of coronavirus-related scams, and this figure could rise.

As COVID-19 causes a spike in telework, teleheath and online education, cybercriminals have fewer hurdles to jump in gaining access to networks.

The National Broadband Networks infrastructure has afforded many Australians access to higher-speed internet, compared with DSL connections. Unfortunately this also gives cybercriminals high-speed access to Australian homes, letting them rapidly extract personal and financial details from victims.

The shift to working from home means many people are using home computers, instead of more secure corporate-supplied devices. This provides criminals relatively easy access to corporate documents, trade secrets and financial information.

Read more: What's your IT department's role in preventing a data breach?

Instead of attacking a corporations network, which would likely be secured with advanced cybersecurity countermeasures and tracking, they now simply have to locate and attack the employees home network. This means less chance of discovery.

Cryptolocker-based attacks are an advanced cyberattack that can bypass many traditional countermeasures, including antivirus software. This is because theyre designed and built by advanced cybercriminals.

Most infections from a cryptolocker virus happen when people open unknown attachments, sent in malicious emails.

In some cases, the attack can be traced to nation state actors. One example is the infamous WannaCry cyberattack, which deployed malware (software designed to cause harm) that encrypted computers in more than 150 countries. The hackers, supposedly from North Korea, demanded cryptocurrency in exchange for unlocking them.

If an employee working from home accidentally activates cryptolocker malware while browsing the internet or reading an email, this could first take out the home network, then spread to the corporate network, and to other attached home networks.

This can happen if their device is connected to the workplace network via a Virtual Private Network (VPN). This makes the home device an extension of the corporate network, and the virus can bypass any advanced barriers the corporate network may have.

Read more: Hackers are now targeting councils and governments, threatening to leak citizen data

If devices are attached to a network that has been infected and not completely cleaned, the contaminant can rapidly spread again and again. In fact, a single device that isnt cleaned properly can cause millions of dollars in damage. This happened during the 2016 Petya and NotPetya malware attack.

On the bright side, there are some steps organisations and employees can take to protect their digital assets from opportunistic criminal activity.

Encryption is a key weapon in this fight. This security method protects files and network communications by methodically scrambling the contents using an algorithm. The receiving party is given a key to unscramble, or decrypt, the information.

With remote work booming, encryption should be enabled for files on hard drives and USB sticks that contain sensitive information.

Enabling encryption on a Windows or Apple device is also simple. And dont forget to backup your encryption keys when prompted onto a USB drive, and store them in a safe place such as a locked cabinet, or off site.

A VPN should be used at all times when connected to WiFi, even at home. This tool helps mask your online activity and location, by routing outgoing and incoming data through a secure virtual tunnel between your computer and the VPN server.

Existing WiFi access protocols (WEP, WPA, WPA2) are insecure when being used to transmit sensitive data. Without a VPN, cybercriminals can more easily intercept and retrieve data.

VPN is already functional in Windows and Apple devices. Most reputable antivirus internet protection suites incorporate them.

Its also important that businesses and organisations encourage remote employees to use the best malware and antiviral protections on their home systems, even if this comes at the organisations expense.

People often backup their files on a home computer, personal phone or tablet. There is significant risk in doing this with corporate documents and sensitive digital files.

When working from home, sensitive material can be stored in a location unknown to the organisation. This could be a cloud location (such as iCloud, Google Cloud, or Dropbox), or via backup software the user owns or uses. Files stored in these locations may not protected under Australian laws.

Read more: How we can each fight cybercrime with smarter habits

Businesses choosing to save files on the cloud, on an external hard drive or on a home computer need to identify backup regimes that fit the risk profile of their business. Essentially, if you dont allow files to be saved on a computers hard drive at work, and use the cloud exclusively, the same level of protection should apply when working from home.

Appropriate backups must observed by all remote workers, along with standard cybersecurity measures such as firewall, encryption, VPN and antivirus software. Only then can we rely on some level of protection at a time when cybercriminals are desperate to profit.

See original here:
'Click for urgent coronavirus update': how working from home may be exposing us to cybercrime - The Conversation AU

Working From Home Creates New Security Concerns for Companies

The global pandemic caused by the novel coronavirus is changing work environments to an unprecedented degree. More employees than ever are being asked to work remotely from home. Along with the new work practices comes a variety of security challenges.Without the proper precautions, working from home could become a cybersecurity nightmare, says Purdue University professor Marcus Rogers. Criminals will use the crisis to scam people for money, account information and more, he says. With more people working from home, people need to make sure they are practicing good cybersecurity hygiene, just like they would at work. There is also a big risk that infrastructures will become overwhelmed, resulting in communication outages, both internet and cell.Covid-19 concernsConcerns about the coronavirus have increased the business worlds dependence on teleworking. According to Cisco Systems, WebEx meeting traffic connecting Chinese users to global workplaces has increased by a factor of 22 since the outbreak began. Traffic in other countries is up 400% or more, and specialist video conferencing businesses have seen a near doubling in share value (as the rest of the stock market shrinks).Basic email security has remained unchanged for 30 yearsEmail is a core element of business communications, yet basic email security has remained unchanged for 30 years. Many smaller businesses are likely to still be using outdated Simple Mail Transfer Protocol (SMTP) when sending and receiving email. The default state of all email services is unencrypted, unsecure and open to attack, putting crucial information at risk, says Paul Holland, CEO of secure email systems provider Beyond Encryption.With remote working a likely outcome for many of us in the coming weeks, the security and reliability of our electronic communication will be a high priority, says Holland. The companys Mailock system allows employees to work from any device at home or in the office without concerns about data compromise or cybersecurity issues.Acting quickly and effectivelyAs the virus spreads, businesses and organizations will need to act quickly to establish relevant communication with their employees, partners and customers surrounding key coronavirus messages, says Heinan Landa, CEO and Founder of IT services firm Optimal Networks. Employers should also enact proper security training to make sure everyone is up to speed with whats happening and can report any suspicious online activity.Reviewing and updating telework policies to allow people to work from home will also provide flexibility for medical care for employees and their families as needed.Scammers, phishing, and fraudAn additional factor in the confusing environment created by the coronavirus is growth in phishing emails and creation of domains for fraud. Phishing is an attempt to fraudulently obtain sensitive information such as passwords or credit card information by disguising oneself as a trusted entity. Landa says homebound workers should understand that phishing can come from a text, a phone call, or an email. Be wary of any form of communication that requires you to click on a link, download an attachment, or provide any kind of personal information, says Landa.Homebound workers should understand that phishing can come from a text, a phone call, or an emailEmail scammers often try to elicit a sense of fear and urgency in their victims emotions that are more common in the climate of a global pandemic. Attackers may disseminate malicious links and PDFs that claim to contain information on how to protect oneself from the spread of the disease, says Landa.Ron Culler, Senior Director of Technology and Solutions at ADT Cybersecurity, offers some cyber and home security tips for remote workers and their employers:When working from home, workers should treat their home security just as they would if working from the office. This includes arming their home security system and leveraging smart home devices such as outdoor and doorbell cameras and motion detectors. More than 88% of burglaries happen in residential areas.When possible, its best to use work laptops instead of personal equipment, which may not have adequate antivirus software and monitoring systems in place. Workers should adhere to corporate-approved protocols, hardware and software, from firewalls to VPNs.Keep data on corporate systems and channels, whether its over email or in the cloud. The cyber-protections that employees depended on in the office might not carry over to an at-home work environment.Schedule more video conferences to keep communication flowing in a controlled, private environment.Avoid public WiFi networks, which are not secure and run the risk of remote eavesdropping and hacking by third parties.In addition to work-from-home strategies, companies should consider ways to ensure business cyber-resilience and continuity, says Tim Rawlins, Director and Senior Adviser for risk mitigation firm NCC Group. Given that cyber-resilience always relies on people, process and technology, you really need to consider these three elements, he says. And your plan will need to be adaptable as the situation can change very quickly.Employees and their employersSelf-isolation and enforced quarantine can impact both office staff and business travelersSelf-isolation and enforced quarantine can impact both office staff and business travelers, and the situation can change rapidly as the virus spreads, says Rawlins.Employees should be cautious about being overseen or overheard outside of work environments when working on sensitive matters. The physical security of a laptop or other equipment is paramount. Its also important to look at how material is going to be backed up if its not connected to the office network while working offline, says Rawlins.Its also a good time to test the internal contact plan or call tree to ensure messages get through to everyone at the right time, he adds.

Original post:
Beyond Encryption Tests Its Remote Working Policy In Face Of Covid19 | Security News - SecurityInformed

From the 1930s to 1950s (far too long) the medical community just would not wake up to the fact that cigarettes could cause harm (see More Doctors Smoke Camels). Why did they stick with this misperception for so long? When so many good people come to the wrong conclusion it probably means some deeply human cognitive biases are at play. Most people have a long studied desire to prefer the status quo. If this is what was always thought, why think differently?

They are not the only groups of humans to stay anchored to old ways. For years nutritionists believed that all calories in food are the same, including all forms of sugar. This led to the conclusion that we might want to watch calories overall but sugar is great. Now that obesity is an epidemic and diabetes the fastest growing disease in the world, most professionals realize that too much sugar is bad. But even after it was discovered that Harvard medical researchers were paid to lie in studies about sugar, humanity is still almost totally ignoring this topic. Clearly there are cognitive bias issues here too.

The technology community is not immune to getting stuck with an opinion and not wanting to shift, even in the face of evidence. One of the big ones is that you need to use a personal VPN.

In 2010 it was good advice to recommend a VPN for personal use. But in my view, any technologist or security professional recommending that now should be ashamed for not keeping up with the enormous changes in technology over the last decade.

The rest of this post will dive a little deeper into the topic.

To summarize up front: For almost every use case, the only reason to use a VPN is if you are using one provided by a business that requires you to use it to access corporate resources. You do not need a VPN for your home or small business use, even when using public WiFi. Personal VPNs just dont add value to your security posture.

A sponsored piece at CNN says A VPN is vital when working from home. This piece, written in the form of a CNN article but apparently paid for by a VPN provider, claims that data that flows from your computer to the Internet is open and accessible to anyone who can intercept it (this statement is false). They also say that without a VPN, anyone with the right tools can intercept passwords, banking information and everything else you transmit (this is also a false statement).

CNET tells us that Anyone who wants to protect their privacy and security online should use a VPN. This myth is all over the place, especially on sites where companies that provide personal VPN services advertise.

Gizmodo asserts that: The benefits of virtual private networks, or VPNs, are well-documented: They keep you safer on public wi-fi This may have been true in 2010, but the technology of the Internet changed when Gizmodo wasnt watching.

Norton explains that: The encryption and anonymity that a VPN provides helps protect your online activities: sending emails, shopping online, or paying bills. Another 10 year old view.

The highly trusted Consumer Reports claims that Just about all security experts agree that using a VPN, or virtual private network, when youre accessing the internet via computer or phone is a good idea. In particular, a VPN is one of the easiest ways to avoid getting hacked while youre taking advantage of the free WiFi at an airport or library. (This is also a false statement. Additionally, saying Just about all security experts agree reminds me of More doctors smoke Camels.)

An Attorney with the Federal Trade Commission discussing VPNs asserts that: Public networks are not very secure or, well, private which makes it easy for others to intercept your data. This was once very true. But not quite right anymore.

You do not need to use a VPN if you are just trying to secure your personal Internet communications. If you have a well patched operating system and up to date applications, they already establish encrypted communications. This is just the way the Internet and computers work now.

VPN companies would gladly sell you a VPN even if you dont need one, but that may well just introduce more risk. And it does so while slowing your Internet connection and costing you money.

A decade ago having a VPN for your personal use was good advice. A savvy technologist could join a public WiFi network and capture packets and read information from other users, including logins, passwords, or even financial information, depending on what people were doing on the WiFi. Soon as a way of showing how this could be done was coded into a browser plugin called FireSheep. The author of this plugin, Eric Butler, did a great service for WiFi security. By showing these vulnerabilities he motivated significant changes.

Other attacks possible in the old days included ways to trick your browser into thinking an attacker is the ultimate destination. The attacker sits in the middle of comms between the user and the ultimate destination and breaks the encryption and replaces it with his own. This is a man-in-the-middle attack.

In part due to problems of unencrypted traffic and man-in-the-middle attacks, the technology of the Internet and devices and applications have changed pretty significantly.Changes in the way the Internet and our systems work include:

So, today Almost all web traffic is now encrypted. And ifan attacker tries a man in the middle attack against your web browsing session you will get a warning and the comms will stop. The warning varies from Chrome to Safari to FireFox but all now prevent this type of attack by checking to see if the certificate that set up the HTTPs encryption matches the correct version maintained in trusted stores online.

Here is what you will see if an attacker is on your public WiFi and tries a Man in the Middle Attack:

VPNs come with their own risk. There are risks that the VPN company you have picked are not protecting your traffic the way the promised. There are risks that they are logging your info in ways they claim they are not. If you think you are using a VPN to protect yourself from government surveillance, they may actually be making it easier on the government to surveil you. (the EFF provides many great references on some of the issues with VPNs, including here and here).

Nothing is ever perfectly safe (this is about managing risk). But since modern applications set up encrypted channels already, we are at the point where personal VPNs do not seem to add anything that reduces real risk.

As previously mentioned, there are reasons for companies to require a VPN for remote employees. This type of VPN can be used to help companies ensure governance over their data and ensure only authorized users are accessing corporate resources. These also help companies that want to search traffic for malicious code. This corporate VPN needs to be managed and updated of course (see recent CISA statement of corporate VPN vulnerabilities being exploited during the Coronavirus crisis). But in general it can be very smart for a corporation to use this method for access to corporate resources. There are new changes in the offing here too, and VPNs are not the answer to every corporate need (corporate technologists should be closely tracking developments in the software defined perimeter and zero trust worlds, including Googles Beyond Corp approach).

Many people recommend that journalists and activists and others operating overseas use a VPN, and there may be good reason to do this if operating in a hostile nation. However, the threat model there is very different. And in many cases, using a VPN there will just give a false sense of security. The hostile nation may well be reading all the VPN traffic and logs anyway. People in these situations need far more security than a VPN (including secure messaging systems).

Some people use VPNs so they can pretend to be using the Internet from a certain geography. This is certainly a good use case if you want to do that. But this does not add security.

But I have not seen any argument by a technologist familiar with how the Internet works today that says paying for a personal VPN makes sense for the average user or small business. It does nothing to improve your security or reduce risks in any meaningful way. In fact, it may actually introduce new risks.

How could it be that so many security professionals are out there right now advising people at home or small businesses to use a VPN? I can only imagine they have not kept up with how the architecture around them has been changing. And of course no VPN company is going to say they are not needed anymore. But the biggest reason is probably the same reason doctors promoted tobacco or we all thought sugar was ok. It is a bias towards the status quo by people who have not wanted to learn how the Internet has changed.

There are certainly many other important things to do to reduce risk.Chief among those things is using an up to date OS and up to date applications (see this list of tips to reduce personal risk and this list to reduce business risk).

And one final point: If the Chinese Ministry of State Security (MSS) or Russias Foreign Intelligence Service (SVR) wants to mount an effort against your Internet use, you have a different threat profile than most of us. But if you think a VPN will slow them down you are fooling yourself. If you need to mount a defense against them lets talk, we can help, but a VPN is not the thing that will save you from them.

Latest posts by Bob Gourley

Related

Originally posted here:
Think Twice Before Deciding To Use A Personal VPN: You could be getting some really bad advice - CTOvision

AUCKLAND, New Zealand, March 24, 2020 /PRNewswire/ -- MEGA The Privacy Company announced today that free 12 month PRO subscriptions would be available to teachers and students of verified educational institutions.

Stephen Hall, Executive Chairman of MEGA, said, "The encrypted cloud storage and chat provided by MEGA provides an excellent basis for continued teacher-student interaction, allowing effective remote learning."

Many educational institutions have closed in order to limit the spread of Covid-19. MEGA's platform provides the ideal features to allow students to continue their studies by connecting to teachers and teaching resources.

Recently a private school in Portugal quickly and easily shared folders to nearly 2,000 accounts, facilitating their remote learning activities.

MEGA is now offering all educational institutions free PRO accounts for all their teachers and students. This will allow them to

MEGA is available in Arabic, Chinese (Traditional and Simplified), Dutch, English, French, German, Indonesian, Italian, Japanese, Korean, Polish, Portuguese, Romanian, Russian, Spanish, Tagalog, Thai, Turkish, Ukrainian and Vietnamese.

Educational Institutions should apply to education@mega.nz

After verification of their status, MEGA will provide vouchers, or automatic upgrade for the verified domain, to give all their accounts free PRO status for 12 months, which provides 400 GB of file storage and 1 TB of transfer quota for every account.

*Note: The number of participants in multi-party chats depends on the quality of each user's internet connection. We recommend a maximum of 6 for full multi-party video.

An IT professional working for a Portuguese private school reported to MEGA:

"I'm writing this e-mail to compliment your service. I've created a free account last Friday to help teachers, parents and students to be able to share work while we are all at home because of the covid-19 pandemic. I've shared folders to almost 2,000 users and I must say it's impressive how Mega holds it together, it works flawlessly and every single person that created an account after I sent the invitations are very impressed. I'm here to congratulate you all on an amazing platform, the best I used so far and free. Keep up the excellent job and keep safe. Best regards from Portugal."

Store securely. Chat securely. See - https://mega.nz/pro

About MEGA

MEGA's end-to-end encrypted cloud storage and chat service has stored more than 72 billion files for over 170 million users in 250 countries / territories.

MEGA is accessible in multiple languages from desktop (Windows, macOS and Linux) and Android / iOS mobile apps.

User files are stored in secure facilities in Europe or in countries (such as New Zealand) that the European Commission has determined to have an adequate level of protection under Article 45 of the GDPR, depending where the user is based. No user files are stored in, or made available from, the United States of America.

MEGA The Privacy Companywas architected around the simple fact that cryptography, for it to be accepted and used, must not interfere with usability. MEGA is accessible without prior software installs and remains the only cloud storage provider with browser-based high-performance end-to-end encryption. Today, millions of business and personal users rely on MEGA to securely and reliably store and serve petabytes of data. We believe that this success is the result of MEGA's low barrier to entry to a more secure cloud.

Logo - https://photos.prnasia.com/prnh/20191219/2676241-1LOGO

SOURCE Mega Limited

Continue reading here:
MEGA Helps Education During Covid-19 with Free PRO Accounts for Teachers and Students - Yahoo Finance

In the past 12 months there have been 480 million downloads of mobile VPN apps an increase of 50% on the previous year. Thats according to the 2019 Global Mobile VPN reportand it shows that consumers around the world are starting to understand the benefits of connecting to the internet via a virtual private network when outand about.

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

But what about businesses? Have you ever stopped to think whether your business ought to be providing a VPN service to remote workers, or taking advantage of one to protect your sensitive data? We talked to industry experts to find out whether your business needs a VPN.

Before we can address the question of whether your business needs its own VPN, you need to understand exactly what a VPN can do for you and what it cant.

Advertisement - Article continues below

The network encryption provided by a VPN provides a business with confidentiality your data cant be read in transit and integrity your data, messages and transactions cant be tampered with, explainsCharl van der Walt, chief security strategy officer at security services provider SecureData. VPN services achieve this by creating a virtual tunnel between a remote device and your corporate network, requiring strict user authentication and allowing you to enforce access control.

Advertisement - Article continues below

The benefits of this should be obvious. When employees need to provide additional credentials remotely, said Chris Hykin, technical services director at Stone Group, it reduces the chance of the system being accessed by third parties, and prevents flexible working becoming a compromise to security.

Thats not necessarily all your VPN will do.As most VPN products require the installation of a low-level agent on the endpoint, many products also extend into the broader domain ofendpoint and internet protection, providing features like content filtering and blocking malicious sites, addsvan der Walt.

Advertisement - Article continues below

Your company VPN can, therefore, be more than simply a network service: you can think of it as the foundation of secure communication between systems, people and sites. With remote working becoming an increasingly important aspect of the business environment, the value of that is clear.

This all sounds super, smashing and lovely, but there are certain misconceptions about VPNs to clear up. SecureDatas van der Walt told us that, as VPNs have gradually become a commodity, some people have lost sight of their actual capabilities.

VPNs are often seen by the enterprise as a catch-all system that offers everything from confidentiality to access control, he said. Products are frequently over-simplified when theyre sold and deployed; subtle points are overlooked, sometimes resulting in more harm than good.

One important thing to realise is that all of the features offered by a VPN work differently in different phases of the data journey from the endpoint itself onto to the internet, through the VPN gateway and onto the LAN. As an example, lets think about cloud-based VPN products, where the gateway is hosted by a provider somewhere in the cloud.

Advertisement - Article continues below

The confidential data passing through the tunnel terminates at a single point, managed by a third party, which makes it a highly attractive target for attack, compromise or lawful (or unlawful) interception, van der Walt pointsout. These thirdparties often store logs and authentication data in ways which arevulnerable to compromise, as we saw recently withthe breach of NordVPN.

Advertisement - Article continues below

Its also important to recognise that a VPN product can provide complex functionality on both the endpoint and the gateway, which increases the potential exposure to attacks.

Enterprise VPN products that integrate with a directory (like Microsoft Active Directory) are susceptible to phishing, credential reuse, credential stuffing and other forms of credential theft exposing critical internal systems directly to an attacker over the internet, warnsvan der Walt. Indeed, he mentioned that hed seen precisely this type of attack being used successfully, both by red teamers security experts who carry out simulated attacks to expose holes in a companys defences and by genuine bad guys. Its safest to assume that all VPN gateway technologies even from the biggest names will be aggressively targeted in the wild, and any vulnerabilities will be exploited mercilessly.

Advertisement - Article continues below

Another vital point is that, while VPN services may be integrated into broader security solutions, the secure tunnel itself doesnt do anything to detect, block or remove malware or other unwanted content.

If the data payload travelling overthe VPN is infected, saysRyanOrsi, director of product management at WatchGuard, the VPN will securely deliver it to the endpoint where it could run wild if the endpoint doesnt have proper malware protection.

Lastly, we need to talk about the encryption misconception. That may sound like an episode of The Big Bang Theory, but its actually even less funny indeed, the consequences to your business of getting this concept wrong could be pretty darn serious.

A VPN does not encrypt any data at rest, only in transit, explained PaulBischoff, a privacy advocate at Comparitech.com. If the VPN server is acting as a middleman between theuser and the internet, that users traffic is only encrypted up to the VPNserver. The traffic between the VPN server and the final destination a website, for example is not encrypted by the VPN. In other words, the VPN doesnt provide true end-to-end encryption, and if youre relying on a third-party provider they could theoretically be monitoring your traffic, or storing it in a form that could later be released under the weight of legal pressure.

Advertisement - Article continues below

Advertisement - Article continues below

Indeed, the possibility of data logging is more than just a theoretical threat: in certain countries, such as China, its required. In other words, insome territories, private networks are fundamentally compromised by design

Now weve got a grip on those issues, we can start to address the actual question: does your business really need its own VPN, or not?

If youre looking for a simple answer, its yes. As David Emm, principal security researcher at Kaspersky, told PC Pro: A VPN is a necessary part of a business cybersecurity strategy, as it helps ensure that the credentials used to access corporate systems and websites that require input from a login and password cant be intercepted. In a cybersecurity landscape thats dynamically evolving with new threats and vulnerabilities at every turn, it makes sense to embrace all theprotection you can get.

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

At this point you might be wondering whether that really applies to all businesses. What if you dont have any remote workers, and all your office computers are connected to a wired LAN thats managed by a competent IT services provider? In such a scenario, VPN services are admittedly less critical. The added layer of encryption is good, notesPaul Rosenthal, CEO and co-founder of Appstractor. But for many companies, I would consider putting a VPN on each workstation asicing on the cake rather than essential.

Advertisement - Article continues below

Even then, though, a VPN has benefits, as it ensures that your activities cant be snooped on, and cuts down the possible avenues for a data leak.

And things change as soon as you introduce Wi-Fi into the equation, as this greatly increases your exposure to possible attacks. Its very easy for hackers to either intercept your traffic or trick you to connect to a fake access point, where all kinds of attacks can be launched, potentially exposing confidential and sensitive data, Rosenthal remindesus. In his view its pretty much essential that every non-wired device used by every employee should use a VPN.

For home users, choosing a VPN provider largely boils down to simple metrics such as speed and price. As Rosenthal puts it, arguably there isnt a huge amount of difference between the main consumer VPN brands, in terms of the technical level of security they provide.

Advertisement - Article continues below

Advertisement - Article continues below

In a professional context, however, there are other issues to think about. Businesses face a fundamentally different challenge, Rosenthal says, making sure that every device used by every employee has the VPN not only installed, but also switched on and used properly.

This is a key reason why you shouldnt rely on a consumer VPN service for business security: the client software doesnt support central management. Look for a VPN thats designed for deployment in a business, advisesRosenthal, where installation and administration are simplified, and compliance can be enforced. Otherwise youre leaving huge gaps in your cybersecurity defences.

The other option is to operate your own VPN, which you might do eitherby installing or enabling services on your internal servers, or investing in a dedicated gateway appliance.

Either way, the self-hosted approach has the advantage of putting you fully in control of your own security and the use case really kicks in when your business has multiple locations requiring access to a central network. Indeed, the value of this sort of system is understood even in environments that are broadly unfriendly to VPN usage.

Advertisement - Article continues below

In many cases, even countries that block VPN usage will allow corporate entities access to one by requiring either a fee or the collection of data relating to how the VPN is used, explainsLarry Trowell, principal security consultant at Synopsys.

That said, there are scenarios where running your own VPN is an unnecessary investment. Trowell points out that if your workers arent actively collaborating on documents, and you just need to periodically exchange and synchronise data, a secure FTP or email server may be all thats needed.

If you have decided toset up your own VPN, you will need toconfront the question of how its configured. The simplest approach is to route all your traffic through the VPN tunnel, but this can have an impact onperformance. If youre forcing all your network traffic through the VPN tunnel, your latency will increase, and the connection will be slower, warnsRon Winward, a security evangelist at Radware.

Advertisement - Article continues below

The solution could be split tunnelling, which routes only certain types of traffic over the VPN.

Perhaps you have a resource inside of the network that needs remote access, but dont want all your internet traffic to go through the VPN server, Winward says. Split tunnelling allows this. But if you do use split tunnelling, make sure your users understand that not all traffic traverses the VPN tunnel. Dont create a false sense of security for them.

Clearly there are multiple reasons and ways to use a VPN, and many people actually use several VPNs for different purposes. As a global business traveller, Winward says, I run my own VPN servers at trusted locations where I control the network devices on the remote end. Doing so gives him the confidence that his traffic is kept secure as it traverses networks outside of his control. But thats not the whole story: I also connect to other VPNs for different needs, including work, lab access, and basic security hygiene.

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

The upshot is that its essential to properly consider exactly what you want to achieve by using a VPN. Your needs could be best met by a third-party provider, or by running your own VPN or a combination of the two approaches.

Advertisement - Article continues below

Each option has its own considerations, Winward concludes. A service requires that you trust the vendor with your data and your privacy. Buying your own device requires knowledge and support of the device, as well as the cost of purchasing and maintaining it. Open source might reduce your capex spend, but at the cost of not having support from a vendor when you might need it most.

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

All-flash buyers guide

Tips for evaluating Solid-State Arrays

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Go here to read the rest:
Does your business need its own VPN? - IT PRO

Microsoft Teams and Slack arent the only names when it comes to remote teleconferencing solutions. Along with many others, theres also Zoom, which apparently experienced recent growth to 13 million monthly active users.

With a recent internal video leaking online, some have gone as far as to say that Microsoft at one point felt that Zoom video conferencing was as an emerging threat. So, what does Microsoft have to be afraid of? And how does Zoom stack up against Teams? In this guide, well pit the two against each other and help you see the difference.

To begin, well touch on the price. Just like Microsoft Teams, Zoom has a free plan and other paid options. However, its important to note that, unlike paid Teams plans with Office 365, paid Zoom plans do not come bundled with extra software. Zoom is mainly just a teleconferencing solution and not meant to be the Office 365 collaboration hub like Teams is.

There are, however, extra features in paid Zoom plans that help enhance the experience, which we describe more in-depth in the next section. These are divided into a $14.99 Pro plan, a $19.99 Business plan with a minimum of 10 hosts, and a $19.99 Enterprise plan, that has a minimum of 50 hosts. you can read more about the plans here.

Keep in mind that in Zoom terms, these prices are per host. This is someone who schedules, starts and controls the settings in a meeting. A standard Zoom free plan also allows you to invite up to 100 participants in a meeting. However, you can buy more as an add-on for $50 per month or choose a paid Business or Enterprise plan which has access to 300 or 500 participants.

Microsoft Teams and Slack aren't the only names when it comes to remote teleconferencing solutions. Along with many others, there's also Zoom, which apparently experienced recent growth to 13 million monthly active users. With a recent internal video leaking online, some have gone as far as to say t

On the Microsoft Teams front, you can always go with a Free plan, but there are multiple paid Office 365 plans which include Teams at no added cost, depending on the size of your company or business. These cover Office 365 Business Essentials, Office 365 Business Premium, and Office 365 Business. For larger corporations, there is also Office 365 Enterprise plans.

Under Office 365 Business Essentials, Microsoft Teams will start at $5.00 per user, per month. This is best for small businesses as it has the bare essentials. Then, theres Office 365 Business Premium, which is $12.50, per user, per month. Finally, there is Office 365 Business, which is $8.25 per user per month.

For larger organizations, Microsoft takes things a bit further as it has special Office 365 Enterprise plans (with Teams included.) Office 365 E1 plans include Teams for $8.00 per user, per month. Then, Office 365 E3 plans include Teams for $20.00 per user per month. Again, the differences in these plans boil down between access to email, Office apps, and a few other things, which weve explained here. Theres a lot of extra value in Teams if you need it for more than just video conferencing.

Weve explained the differences in these plans in a separate post, but it boils down to access to other Microsoft services, Office apps, and the Outlook email service. Again, you might not need these features, but its still great to have for day-to-day operations.

Microsoft Teams and Slack aren't the only names when it comes to remote teleconferencing solutions. Along with many others, there's also Zoom, which apparently experienced recent growth to 13 million monthly active users. With a recent internal video leaking online, some have gone as far as to say t

When it comes to features included, Zoom makes it pretty easy. The base plan of Zoom includes hosts of up to 100 participants. Theres also unlimited 1 to 1 meeting, but a 40 minute limit on group meetings. As for features of meetings, you can create an unlimited amount of meetings and even online support if things are to go wrong and you need help.

All Zoom Free plans also include HD video and voice calls, active speaker view, full-screen gallery view, screen sharing, and the ability to join by phone. Other features included in Zooms free plans can be seen below. These all carry over into the other tiers as well. However, please be aware that under the free plan if 3 or more participants join a meeting, the meeting will time out after 40 minutes. Other features covered in all Zoom plans can be seen in the chart below.

As we said under the pricing section, the biggest difference paid versions of Teams is that it gets you bonus features of Office 365. However, Teams mainly shares the same features across free and paid plans. Essentially, the differences between the free and paid versions of Microsoft Teams comes down to maximum members, file storage sizes, extra features in recording meetings as well as phone calls.

Free versions of Teams have a limit of up to 300 members (users) per organization. You also can enjoy up to 250 people on a meeting in Teams which is different from Zooms 100 person limit for the free plan.

Elsewhere, Free Microsoft Teams plans limit storage to 2GB per user, with 10GB shared storage. Paid plans, meanwhile, bump the storage up to 1TB per user. Paid Teams plans can also upgrade you to more maximum members and users per organization. All of the following features are included in both Free and paid versions of Teams.

Just like Zoom, Paid versions of Teams offer up Admin tools for managing users and apps, usage reporting for Office 365 services, 99.9% financially-backed SLA uptime, and Configurable user settings and policies. Compared to Zoom, Teams might work better as a phone solution, though, as paid versions of the plan let you include phone calling for $12-$20 per month. Zoom is a $15 per month add on.

Finally, you might be wondering where Teams and Zoom stands when it comes to security and privacy. Recently, a Twitter thread revealed that Zoom could be monitoring the activity on your computer. Some have also worried that it could collect data on the programs running. Prontonmail gives a good insight into all the privacy flaws of Zoom, so you give it a read.

The concerns, though, are in fact true, though Zoom seemed to dismiss it in a Tweet. Zooms Privacys page notes the following: Whether you have Zoom account or not, we may collect Personal Data from or about you when you use or otherwise interact with our Products. Zoom also claims that its Communications are established using 256-bit TLS encryption and all shared content can be encrypted using AES-256 encryption. Chats are also encrypted end-to-end by TLS 1.2 with the Advanced Encryption Standard (AES) 256-bit algorithm.

When it comes to Microsoft Teams, the story is different. Microsoft explains that it does not use your data for anything other than providing you with the service that you have subscribed to. The company claims it does not scan your email, documents, or teams for advertising or for purposes that are not service-related. Microsoft also doesnt have access to your uploaded content.

As far as encryption goes in Teams, it has one disadvantage to Zoom. Microsoft is using the lesser secure type of encryption policy. According to this support page, Microsoft Teams data is encrypted in transit and at rest. Unlike with end-to-end encryption, the data is not encrypted on a senders system or device, and not only the recipient is able to decrypt it. Teams is also Tier D-compliant. This includes the following standards: ISO 27001, ISO 27018, SSAE16 SOC 1 and SOC 2, HIPAA. More information on that is available here.

In choosing either Teams or Zoom, everything comes down to your needs as a business. Zoom is a great alternative for Teams when it comes to just video conferencing. It gives you access to calling without all the extra stuff. Teams, though, again has the most value for businesses. Its paid plans not only include audio and video calling under Teams, but you also get access to other Office 365 apps and Microsoft 365 services. This isnt something that everyone will need, but it sure might be useful for smaller organizations.

But its not to say that Zoom is just for small companies. Zoom is currently used by 21st Century Fox, Delta, Dropbox, Logitech, Rakuten, Salesforce, and many more. Thats just as Microsoft Teams, too, which is currently being used by BP, GE, NASCAR, Northwhell Health, Toshiba and many Fortune 500 companies, too.

Read the original here:
Microsoft Teams vs Zoom: What does Microsoft have to be afraid of? - OnMSFT