Connect with us

Features

INSIDE JOB

Published

on

Updated : September 11, 2013 03:44  pm,Dubai
By Editor

Cyber threats from cyber criminals are well known and largely defended against; not so for threats from inside the organization itself. ManageEngine works to protect organizations from this side of the firewall

Organizations spend inordinate amounts of money safeguarding their perimeter from without while doing little to secure the network from within.

Security threats from inside the organizations themselves can have as disastrous effects as hacking from cyber criminals. This is especially true for banks and other financial institutions. That is where strong IT management policy and internal controls come in, with ManageEngine providing the tools to help protect these IT resources.

Among others, ManageEngine IT security solutions complement network management and IT operations. One such product from ManageEngine is the Privileged Password Management solution ‘Password Manager Pro’. Servers, databases, network devices and web applications of modern enterprises are all accessed and controlled by administrative passwords. Unfortunately, according to Bala Venkatramani, Marketing Manager, IT Security Solutions at ManageEngine, a lot of companies put administrative passwords in plain view-in texts; excel sheets, even on printouts. And then these passwords are all shared with all the members of the team. “This is where our product comes in,” explained Bala. “We provide a product to securely store the passwords in a centralized repository and share the passwords with members of the team on a need basis. We make sure all these members do not have free access to everything. Access is based on their jobs and responsibilities and then everything is properly audited, for instance who accessed what, and where.”

Even then, networks have to be monitored on a regular basis to make sure that security controls and best practices put in place are scrupulously followed. ManageEngine EventLog Analyzer is an agent-less log analytics and compliance reporting software solution. Organizations can centrally collect, archive, analyse and generate reports based on machine-generated logs obtained from heterogeneous systems, network devices and applications. The latest version of EventLog Analyzer (v8.5) offers file integrity monitoring, which lets organizations monitor their critical folders and files in real time to prevent sensitive data from being compromised and to fulfil regulatory compliance requirements.

“We have network monitoring applications as well as solutions to scan the network and proactively report on network vulnerabilities. ‘Security Manager Plus’ protects the network from security threats and malicious attacks through vulnerability scanning, open ports detection, patch management, Windows file/folder/registry change management,” said Bala.

Cross product integration is something customers want and ManageEngine is focusing on, according to Bala. All ManageEngine products have been architected on the same Java platform and are using common communication mechanism and data storing techniques, which make cross product integration simple. Customers can buy any product individually from the company’s broad product portfolio. “We offer an integrated IT Management solution ‘IT360’, an end-to-end monitoring solution that provides a single dashboard view of IT,” said Bala.

ManageEngine has also embraced mobility with a range of mobile apps for many of the solutions for instance to monitor what is going on in the network. Customers can get alerts on the smartphones and even take remedial actions through the same platform. “This year we are focused on mobile applications and making even more of them available,” said Bala.

Social media is proving the most convenient vehicle for hackers nowadays. 12% of the world’s population is said to be on social media, according to reports. Through social media networks, attackers want to siphon off login information of an employee through which they can get access to the entire organization’s network and steal date from these organizations. “The main problem is that a lot of people use the same password they use for social media, for banking access as well as internal IT resources,” explained Bala. “Through a simple phishing expedition, the attackers are able to get the administrative password using which they can gain access into the entire network.” Recent cases of this type of cybercrime include LinkedIn where hackers gained access into the LinkedIn database and stole millions of passwords of members as well as other private information.

ManageEngine Password Manager comes in handy in such circumstances. The reason why people use the same password is that they cannot remember all these passwords. So they need a secure mechanism. Ideally, people should use unique passwords in all their applications and all the IT resources. However, this is not practical at all without the right tool. “We provide the software to store passwords securely in a central repository without the need to remember all the passwords. IT managers can then follow all the IT best practices like periodically changing the password, assigning unique passwords to all the IT resources so that organizations can follow best practices,” said Bala.

And Password Management is not just about strong passwords, Bala said. A lot of security breaches happen at the password management level. “So, automating the entire life cycle of privileged password management is imperative, which enforces password management best practices company-wide. We have now released a separate version of Password Management for managed service providers, an industry-first. This is meant to strengthen our security product portfolio.”

For IT management to work in the modern office, the ability to react in real time is crucial.  “We refer to ourselves as a real-time IT company. The reports that our solutions provide focus on real-time alerts to the IT administrator so they can take remedial actions immediately,” said Bala. The EventLog Analyzer for instance is constantly monitoring user activities on the network.  It will notice failed log-in attempts and immediately alerts the IT administrator that someone is trying to access some resource. The IT manager can then immediately block that user from accessing the data. Another product ‘Firewall Analyzer’ provides instant alerts on possible network attacks and security breaches in the network.

The DeviceExpert on the other hand keeps monitoring for changes happening to the configurations of organization’s network devices, where even a minor or unintentional errors can result in a lot of vulnerabilities to the network. “DeviceExpert checks for changes in the network devices and alerts administrators immediately on any unauthorised changes so that they can immediately roll back those changes,” said Bala.

The real value of ManageEngine lies in providing highly affordable solutions, according to Bala. “We have a convenient pricing mechanism for instance through an annual subscription. Such options make our products very attractive for SMEs. We also have a distributed edition in most of our products that appeal to big enterprises as well-thus we are able to strike a balance between SMBs and the enterprise.”

Prominent in ManageEngine’s marketing strategy is a proposition dubbed “90:10” 90:10, Bala explained, is the company’s promise to offer 90% of all features you can find in other competitors’ products for just 10% of the price. “We compare with other big vendors feature-by-feature while making sure that our prices remain affordable,” Bala said.

Continue Reading

Features

Establishing data sovereignty in a ‘datafied’ world

Published

on

data

By: Omar Akar, Regional Vice President for Middle East & Emerging Africa, Pure Storage

Data is the currency of the digital domain, and with every passing day, the world is getting increasingly ‘datafied’. Billions of gigabytes of digital data pertaining to citizens, businesses, governments, and institutions are generated, collected, and processed every day. Understandably, there are concerns about how we can protect personal data, business data, as well as sensitive data that has implications for national security.

Challenges associated with data sovereignty

It is possible that a company based in a certain country uses cloud infrastructure from a provider abroad, and that cloud provider also has customers in other countries and regions. If data collection, data storage, and data processing happen in different countries, it will be subject to the data sovereignty rules of all those countries. Many of the concerns surrounding data sovereignty pertain to ensuring data privacy and preventing data that’s stored abroad from violating the laws of that country. Many countries have therefore introduced new laws, or modified the existing ones, so that data is kept within the boundaries of the country where the individual or entity is based. However, verifying that data indeed exists only at permitted locations can be very difficult.

On the other hand, storing huge amounts of data at only a few locations can increase the risk of data loss and data theft through cyberattacks, which can have huge ramifications on the financial health and reputation of businesses.

Moreover, data sovereignty makes it complex to share data across international borders. This can increase cost and inefficiencies for any business that operates across multiple countries and requires flow of data between its offices. Such businesses must now establish infrastructure in local data centers to comply with data protection regulations in each country. Companies also need to keep in view the data sovereignty requirements of each country and international data sharing agreements while wanting to share data which can impact business operations.

Ways to ensure data sovereignty and elevate data performance

Although establishing data sovereignty is undoubtedly challenging, there are some best practices and approaches that can help in achieving it and elevating data performance. Organizations should conduct a comprehensive audit of their data, including where it is stored, processed, and shared. This is the first step in identifying potential data sovereignty risks and ensuring compliance with the relevant laws and regulations of the concerned countries. It is also necessary to adopt data protection measures — such as encryption, access controls, and monitoring — to prevent unauthorized access and use of data, whether it is in transit or at rest.

The company’s data protection policy should define protocols for handling and storing data as well as measures for protecting it. This policy should be regularly reviewed and updated to keep up with any changes in data protection laws and regulations. If an organization has a footprint spanning multiple regions, it is a good idea to take the strongest data sovereignty laws among them and implement it across all regions. Cloud providers can be of assistance in this regard.

Benefits of working with cloud service providers

Most cloud providers have data centers in multiple countries. Organizations should go for a provider whose data residency provisions are aligned with their own data sovereignty requirements. Today, leading cloud providers also offer other features, including data encryption, that can help in achieving data sovereignty. To take it one step further, companies must introduce strict data governance processes in the cloud. This will ensure regulatory compliance, risk assessment, and risk mitigation at all times.

Data sovereignty laws apply not only to data but also to data backups. It is therefore important to understand how your organization backs up information — whether it is done on-premises or using dedicated cloud services or public cloud services. Adopting cloud-ready solutions and leveraging the benefits of all-flash storage is one of the ways to future-proof your organization’s data storage infrastructure. Uncomplicating storage will help in reimagining data experiences and powering the digital future of the business.

Finally, it is important to view data sovereignty holistically, and not as the exclusive responsibility of any one individual or team. The need to comply with data regulations extends across the board, from businesses to suppliers to the end-users. From a business perspective, ensuring data sovereignty calls for robust governance, holistic risk management, and concerted efforts on the part of the IT security, legal department, procurement, risk managers, and auditors — under the guidance and supervision of the company’s Chief Information Officer. It is a good way to build digital trust in today’s business environment.

Continue Reading

Features

HOW FSI INCUMBENTS CAN STAY RELEVANT THROUGH THE GCC’S PAYMENTS EVOLUTION

Published

on

payment

By Luka Celic, Head of Payments Architecture – MENA, Endava

Banks and payment services providers (PSPs) have been the region’s engines of economic growth for as long as anyone can remember. It is therefore jarring to imagine that this dominance is now under threat. After all, venerable banks and credit card companies have elegantly embraced the Internet, mobile banking, and the cloud to deliver self service banking to millions of customers. But consumers, especially digital natives, have never been known for congratulating an industry for a job well done. Instead, with each convenience, their expectations only grow. The siege reality of the pandemic accelerated a shift in consumer behaviour, and Middle East banks and PSPs now face challenges on three fronts.

The first is FinTechs. from Saudi Arabia’s BNPL (buy now, pay later) pioneer Tamara and Qatar’s unbanked oriented platform cwallet, to online financial services, Klarna, tech startups have been able to tap into rapidly changing consumer markets. New companies find it easier to pivot. And like speed boats racing against aircraft carriers, they weaved effortlessly to fulfil a range of desires amid high smartphone connectivity rates and a range of other favourable market conditions. By one estimate from 2022, BNPL alone accounted for US$1.5 billion (or 4%) of the Middle East and Africa’s online retail market.

The second threat is open banking, which comes in many forms, but one example is the instant-payments platforms being introduced by central banks such as those in Saudi Arabia and the United Arab Emirates. To get a sense of how this could play out, we need only look to Europe, where players who once relied on payments through card schemes are now pivoting towards open banking enabled payments. Closer to home, Al Ansari Exchange recently announced its customers can now transfer money and settle bills via the recipient’s mobile number, enabled by the UAE’s Aani IPP.

And finally, comes big tech. To augment its e-wallet service, Apple has signed up to an open banking service in the UK. The open banking framework which banks enabled through their investments is being exploited by a Big Tech firm that has access to 34% of UK smartphone users. Unsurprisingly, this sparked a fierce antitrust complaint by UK’s banks. Other big names will surely follow as they continue to craft ways of offering the digital experiences that garnered them user loyalty in the first place.

THE BALANCE

Apple Wallet is aimed at blending payment methods, loyalty cards, and other services into a single experience. But such moves have raised regulators’ eyebrows regarding a lack of interoperability and the preservation of competitive markets. Hence, Apple’s open banking foray — a gesture to calm the nerves of a finance market that fears having to compete with a company armed with countless millions of user transactions from which to draw insights. The massive user bases of tech giants will give any FSI CEO goosebumps. How does a traditional bank lure an Apple user? Open banking initiatives open the door to greater competition and innovation, both of which are good for consumers. But the only way to ensure both is by building an ecosystem that balances innovation with regulatory oversight.

FROM INCUMBENT TO INNOVATOR

Yes, smaller businesses have freedom of movement that larger incumbents do not. But that does not mean that there are no paths for banks and PSPs. There are, in fact, several strategies that larger FSI companies can employ to capitalise on the open banking revolution.

The first of these is collaborating to create ecosystems that provide users with frictionless experiences. Established FSIs already have access to a wealth of information about their customers and must now consider how to integrate data sources to create highly streamlined and frictionless workflows. A customer applying for a loan could then see their details auto populated, and credit history already accounted — all without the hassle of lengthy phone calls, application forms, or submission requests. In an age when instant is everything, it’s easy to see why the former approach could foster loyalty, while the latter would only serve to drive customers towards more capable competitors.

Card companies and issuer banks could also work with acquirers to smooth out the rough landscape that has arisen from the advent of digital payments. Acquirers traditionally acted on behalf of the merchants that accepted payment methods to recoup funds from the PSP through the issuing bank. This system has served the industry well, but with more payment methods emerging, acquirers have branched out into mobile wallets, QR codes, and gateway services. Gradually the relevance of established players has dwindled as their lack of representation at the critical checkpoint has diminished their significance. Incumbents must work to turn back the tide by recognising that acceptance and acceptance ownership are becoming increasingly important for maintaining market relevance.

Another strategy is diversification. Veteran FSIs may feel like they’ve lost ground to nimble start-ups and Neo Banks, but history shows value in patience — established FSI players now benefit from the investments of early innovators, and double down on payments innovations which have already shown the most promise. Moreover, if they diversify their portfolios through acquisitions, innovations, and partnerships, they can secure their future. Mastercard presents an excellent example with their US$200m investment into MTM payments. This single move has given the company access to MTM’s 290 million strong subscriber base, allowing these customers to become familiar with Mastercard products before getting entrenched with mobile wallet alternatives.

WHO’S ON TOP?

If we look at the rise of BNPL services, we see an origin story with — at least — major supporting roles for large card providers. But open banking has sidelined them in just a few years. BlackBerry was a stock market darling just five years before it sought a buyer. Traditional FSI players must innovate; they must collaborate with emerging disruptors; they must diversify. They can survive and thrive if they do these things — after all, they already have much of the infrastructure, and experience required for success. Middle East banks and PSPs have the existing user bases, so they have the scale to get out in front in the era of open banking. All they lack is the kind of compelling use cases that will entice the banking public. PSPs and their issuers could offer embedded payments, for example. The right services at the right time will be warmly received by consumers, no matter the scale of the offering institution, so there is every reason to believe that incumbents will come out on top against FinTech and Big Tech.

Continue Reading

Features

SEC paves way to approve spot ethereum ETFs

Published

on

ETF

By Simon Peters, Crypto Analyst at eToro

Ethereum spot ETFs took a significant step forward to being available to US investors last week with approval of the 19b-4 applications, allowing US exchanges (namely Cboe BZX, NYSE Arca and Nasdaq) to list and trade ethereum spot ETFs.

On the back of this, ethereum has been one of the best performing cryptoassets this week, gaining 19%.

According to a recent survey by eToro with retail investors in the UAE, over 74% respondents agreed that the prospect of an ethereum ETF will significantly influence their decision to increase, decrease or maintain their current ethereum allocation.
Focus now turns to the S-1 registration statements from the ETF issuers, as these still need to be approved by the SEC before the ethereum spot ETFs can actually launch and investors can buy them.

As to when the S-1s will be approved we have to wait and see. It could be weeks or months unfortunately.

Nevertheless, with the 19b-4s out of the way, it could be an opportunity now for savvy crypto investors to buy ethereum in anticipation of the S-1s being approved, frontrunning the ETFs going live and the billions of dollars potentially flowing into these.

We’ve seen what happened when the bitcoin spot ETFs went live, with the bitcoin price going to a new all-time high in the months after. Could the same happen with ethereum? The all-time high for ethereum is $4870, set back in 2021. We’re currently at $3650, about 35% away.

We’re also going into a macroeconomic climate with potentially looser financial conditions, i.e. interest rate cuts and a slowdown of quantitative tightening, conditions where risk assets such as crypto tend to perform well price-wise.

Continue Reading

Trending

Please enable JavaScript in your browser to complete this form.

Copyright © 2023 | The Integrator