One thing that does not improve when moving to the Cloud (or outsourcing to any MSP) is privileged credential abuse. In fact, when you use the Cloud, the opportunity for privileged credential attacks expands substantially beyond what is available to attackers in the Enterprise – which is bad enough.
This author has yet to write their bio.Meanwhile lets just say that we are proud mmstaff contributed a whooping 16 entries.
Entries by mmstaff
Cord3 was selected by the Ontario Provincial Government to participate in its pavilion at the RSA Conference in San Francisco from March 5 – 7, 2019. The pavilion is booth #1953 in the South Hall of the Moscone Center.
4 March 2019 – Cord3 announced today that its cryptographic module is fully validated by NIST to the FIPS 140-2 standard. Cord3’s FIPS 140-2 certificate is #3369.
Are your IT people spending more time than you would like on security audits and administration? If your answer is yes, then you are certainly not alone.
We’ve got your data covered … For encrypting data at rest, Cord3 only uses symmetric cryptography. Cord3 uses the Advanced Encryption Standard (AES) algorithm with 256-bit keys. We’ve got your data covered against future advances in quantum computing that are projected to “completely break” widely used algorithms like RSA and ECC.
Cord3 implements its data-centric security in Intercepts. These Intercepts get overlaid onto a network between users and application servers. By “overlaid”, we mean that there are minimal changes required to get Intercepts to work because they simply get connected to a network and immediately begin capturing data asset packets flowing over a network between end points. When a data asset (e.g., a file or an email) is fully re-built on an Intercept, the Intercept applies the organization’s security policy to that data asset before delivering the now-secured data to its destination.
Intercepts capture data asset packets flowing over a network and re-build the original data asset (e.g., a file or an email). When a data asset is fully re-built on an Intercept, the Intercept applies the organization’s security policy to that data asset, whether that is to protect an asset going to a server or make an access decision about data on a server.
“It’s your worst nightmare, and a cyber attacker’s dream come true: the credentials of a privileged user getting stolen or otherwise compromised. After all, privileged users can go practically anywhere and do anything in your network as they go about the business of configuring servers and systems and setting security policies.” CSO Online, January 2018
“Why is encryption software so horrid to use?” The long answer to that question is complex and diverse. The short answer is that encryption comes in two fundamental forms and one of the forms is actually easy to use – that form is “in transit” encryption, like SSL and VPN. The second form – encryption “at rest” – is a completely different story.
Privileged credential abuse has been traditionally difficult to detect and stop because data security is tightly integrated into applications and applications grant unrestricted access to privileged credential users, including access to sensitive data. Cord3 separates data security from applications. This separation of data security from applications enables two critical capabilities for protecting sensitive data against privileged credential abuse.
- The Cloud & Privileged Credential AbuseFebruary 28, 2019 - 4:23 pm
- Cord3 to Exhibit at RSA Conference 2019February 28, 2019 - 2:34 pm
- Cord3 Innovation receives FIPS 140-2 validation from the National Institute of Standards and Technology (NIST)February 26, 2019 - 4:53 pm
- Minimize Audit & AdministrationFebruary 26, 2019 - 11:37 am
900 Morrison Drive Suite 206