Remote maintenance: Which tools should you choose? Although remote maintenance is essential to the proper operation of organizations, it has certain cyber risks related to remote accesses. These risks can be reduced or even eliminated by using the right IT tools. Several solutions are commonly used for remote maintenance, such as remote-control software, VPNs, ZTNA (Zero Trust Network Access) or PAM (Privileged Access Management) solutions. However, these solutions are not equal in terms of cyber security. Remote maintenance: a performance challenge but also a cyber risk The… Read More >>
Remote Control Software: A Dangerous Practice in a Telework Situation Although not suitable for teleworking, remote control software is unfortunately one of the tools used by companies to allow their employees to access their office workstations from home, from a personal computer. The relatively simple use of remote control software has sometimes made the security risks associated with this type of product seem less important. Remote control software is intended for remote maintenance with a user responsible for initiating the connection and monitoring the actions performed and is therefore clearly… Read More >>
The new security perimeter for organizations Slowly but surely, we are experiencing a radical change in the world of networks and access security. To illustrate this in a caricatured way, we are moving from a situation when an organization’s network was inside its walls and the Internet outside, to a situation where everything is based on the Internet, which is shared by all organizations’ networks. The networks of companies are now permanently installed in the Internet network via cloud infrastructures that go beyond the physical boundaries… Read More >>
PAM as a Service: Privileged Access Management for everyone? The protection of information systems requires the deployment of a PAM (Privileged Access Management) solution for the surveillance of privileged users, which if deployed on-premise, may be too restrictive to implement for some organizations. In this context, PAM as a Service, or Privileged Access Management as a public cloud service, will be a guarantee of simplicity for the IT teams involved. From a deployment in a few clicks to the guarantee of regular and automatic updates, PAM as a Service… Read More >>
What are the regulations for OVI and OES? The multiplication of attacks and threats to organizations’ information systems has prompted the French government and the European Union to implement recommendations and rules for private companies and public administrations. The requirement level of these rules and recommendations varies according to the importance of the target organization. They are optional for organizations considered as non-sensitive, but, at different levels, mandatory for OVI (Operators of Vital Importance) and OES (Operators of Essential Services). Limiting the cyber risk of OVI and OES… Read More >>
What exactly is Privileged Access Management? If you work in the IT industry, you’ve probably already heard terms like “Privileged Access Management” (PAM) and “Privileged User Management”. But you didn’t say anything because you didn’t know exactly what it was all about. Don’t worry, in this blog post you’ll learn everything you need to know about Privileged Access Management. PAM according to the Gartner According to the Gartner, “Privileged Access Management” (PAM) solutions are designed to help organizations provide a secure and privileged access to critical… Read More >>
The human face of the workplace A world without users? “Automation”, “DevOps”, “Robotic Process Automation” (RPA), bots, chatbots and other robots, “artificial intelligence” (AI), … According to some people, users will disappear from the scene: the omnipresence of computing, called “digital”, will eventually replace them, do everything for them, and even do more and better than they do. Clearly, as the French song goes, “we are very little things, …”. Will dematerialization go so far as to dematerialize the user? Is there anyone still behind the… Read More >>
European Cybersecurity Act : What certification process ? In 2017, the European Commission published a series of initiatives to strengthen the EU’s resilience, deterrence and defense against cyber attacks. These measures include the proposal for a Regulation on ENISA and the certification of information and communication technologies for cybersecurity (European Cybersecurity Act). This regulation gives ENISA a permanent mandate and strengthens its expertise in prevention, consultancy and cooperation. The European Cybersecurity Act also includes a second component aimed at creating a European cybersecurity certification framework, in which ENISA… Read More >>
Cybersecurity Act : What’s going to change? After being approved by the European Parliament on March 12, 2019, the Cybersecurity Act was finally adopted after its publication in the Official Journal of the European Union on June 7, 2019. The Cybersecurity Act strengthens the European Union Agency for Cybersecurity (ENISA) and establishes a European framework for the certification of cybersecurity products and services. A permanent mandate and more resources for ENISA With the Cybersecurity Act, ENISA, the European Union Agency for Cybersecurity, created in 2004, receives a… Read More >>
Move on, there’s nothing to see! or why “security by obscurity” is not a solution We don’t know what’s hidden in the obscurity. David Lynch At the end of the 19th century, Auguste Kerckhoffs published the principles of military cryptography [01]. In this document (accessible on the Web for free), we learn that an encryption system can be known by the enemy and its security must be based on the non-disclosure (and unlimited change) of the keys used to configure the system. Appendix B1 of the RGS (Référentiel Général de Sécurité that is General Security… Read More >>