Category: Tech Buzz Page 2 of 10

In order to understand the concept of Identity Management, let us consider a simple scenario. If a user locks himself out of a personal email, he can simply reset the password and log in. The only requirement is that the user has to prove his identity by answering some security questions or through other means like providing OTP (One Time Password) sent by the service on user’s email/ mobile. However, the scenario is not so simple for users in a business environment.

To simplify the process for business users, most of the cloud based applications uses an Identity Management Service, commonly known as IDaaS.

What Is IDaaS?

IDaaS stands for Identity-as-a-Service. It is an Identity and Access Management (IAM) service that is offered through the cloud.
Organizations use IAM to provide secure access to its employees, contractors, customers, and partners. The main purpose of this system is to verify the identity of the person requesting access.
The system uses different ways to confirm identity.
Once identity is confirmed, IDaaS provides access to resources depending upon permissions granted.
Since IDaaS is deployed on the cloud, user can request secure access irrespective of his location or the device being used by him.

Reasons To Adopt IDaaS:

There are three main reasons that support the increasing adaptation of IDaaS by organizations:

New Capabilities: IDaaS facilitates new capabilities such as Single Sign-On (SSO). This allows business users to access multiple resources using a single login. When any user logs in to an application, IDaaS creates a token. This token is then shared with other applications. Thus, users are not required to sign in repeatedly for individual applications. Other capabilities supported by IDaaS include Security Assertion Markup Language (SAML), OAuth, OpenID Connect (OIDC), etc.

Easy Implementation: Another driving factor behind adapting IDaaS is that it is easy and quick to implement. The hardware required to implement is easily provisioned by the provider and it takes a few weeks or months to implement it. Additionally, in case you are reluctant to switch to IDaaS after trying it for some time, it can be easily uninstalled.

Innovation: Some major hurdles that stop organizations from pursuing innovation are understaffed IT teams, lack of technology, complicated IT infrastructure, etc. IDaaS removes these barriers and allows business organizations to innovate their processes, products, and marketing strategies.

For more information on Identity Management for cloud based solutions, contact Centex Technologies at (254) 213 – 4740.

Understanding New Evasion Techniques Followed By Web Skimmers

By centexitguy

On February 22, 2020

In Tech Buzz

Cyber criminals have been stealing the card details of users for years. They have been successful at card skimming, both at server-side and client-side, without attracting much attention. However, some notable breaches in past few years put them under the scrutiny of security researchers. To tackle the situation, the threat actors have employed new evasion techniques to evolve their craft.

In order to safeguard yourself from web skimming attacks, it is important to be aware of following new evasion techniques adopted by the cyber criminals:

Steganography: Steganography is the technique of hiding data directly on the pixel value of an image in such a manner that the effect of data is not visible on the image. First case of using steganography to hide a malicious code was ‘ZeusVM’ in 2014. It was a Zeus banking Trojan that used a beautiful sunset image to hide its configuration data. The technique is now being used by web skimmers to trick the website security and users.A simple example may be of any ecommerce website. An e-commerce website loads numerous images such as logos, product images, offer images, etc. The web skimmers use these images (that attract user clicks such as free shipping banners) to embed their code. On studying the image properties, they may show a ‘Malformed’ message and additional data after normal end of the file. Threat actors use code snippets to load the fake images and parse the website’s JavaScript content via the slice() method.
It is an easy way to slide past the website security because the web crawlers and scanners tend to focus on HTML and JavaScript while ignoring media files. To protect yourself from skimming acts, scan the source file of any media files downloaded from third party sites.
WebSockets Instead of HTTP: HTTP follows a request and response communication channel to a server and from a client. WebSockets, on the other hand, is a communication protocol that allows streams of data to be exchanged between a client and server over a single TCP connection. It allows a more covert way to exchange data as compared to HTTP. The web skimmers use a skimming code and data exfiltration to launch the attack. The code is obfuscated in the communication in a way that it is concealed from DOM. Once the code is run in the browser, it triggers client handshake request. The request is received by the server controlled by the cyber criminals which responds to it. This establishes the connection between victim client browser and malicious host server. Now the skimming code is downloaded on the victim system and run as JavaScript code.

Centex Technologies provide cyber & network security solutions for businesses. For more information on new evasion techniques followed by web skimmers, call Centex Technologies at (254) 213 – 4740.

All You Need To Know About DevOps

By centexitguy

On January 21, 2020

In Tech Buzz

As a term, DevOps is derived by combining two different terms- Dev and Ops. “Dev” is a vast term that covers all kinds of software developers and “Ops” includes system engineers, system administrators, operations staff, release engineers, network engineers, system security professionals, and various other sub-disciplines.

DevOps is a practice rather than a set of tools. It can be defined as a setup where the development and operations engineers work together through all the stages of a service lifecycle including design, development, production support, deployment, testing, and continuous improvement.

DevOps is essentially based upon a CAMS structure:

Culture: This practice requires the organization to build a culture where people and processes are top priorities. It focuses on the overall service that is delivered to the customer instead of the ‘working software’ only.
Automation: In order to implement the DevOps practice to its complete capabilities, it is essential to build an automated fabric of tools. Common tools that should be a part of this fabric are the tools for release management, provisioning, configuration management, systems integration, monitoring, control, and orchestration.
Measurement: Successful implementation of DevOps requires a team to regularly measure some metrics such as performance metrics, product metrics, and people metrics. Regularly measuring these metrics helps the team to make improvements, where required.
Sharing: Sharing of ideas is an important part of DevOps implementation. It involves a thorough discussion of problems between the development and operations teams to find common solutions.

Challenges Solved By DevOps:

In the absence of DevOps application development, a general development scenario includes:

A development team that is responsible for gathering business requirements for software and writing code.
A QA team that is responsible for testing the software in an isolated development environment and releasing the code for deployment by the operations team, if requirements are met.
A deployment team that is further fragmented into independent groups such as networking and database teams.

Since the teams functioned independently, new challenges are added whenever software is pushed from one phase to another. Some of the challenges arising from this setup are:

The development team is unaware of the problems faced by the QA and Operations teams which may prevent the software from functioning as required.
QA and operations teams have little information about the business purpose and value that formed the basis of software development.
Each team has independent goals that may contradict each other leading to reduced efficiency.

DevOps application development helps in integrating the teams and thus, overcoming these challenges. It establishes cross-functional teams that run in collaboration to maintain the environment that runs the software.

For more information on DevOps, call Centex Technologies at (254) 213 – 4740.

Advancements In Biometrics

By centexitguy

On October 29, 2019

In Tech Buzz

Biometrics and secure digital solutions are evolving continuously with the increasing need for surveillance and security. Availability of greater computer processing power and sophisticated software algorithms have contributed towards the improvement of existing methods. These advancements have transformed the conventional ways of user identification and verification. The paradigms of next-generation biometrics have evolved in every aspect, from fingerprint scanning to voice recognition.

Major vendors are investing significantly in bringing advancements in biometric solutions. Technologies that are transforming our conventions are:

Phone ID and Voice ID: Combining phone ID and voice ID will not require the customers to enter personal ID or security numbers for completion of authentication. The unique enrollment process involves repetition of a short phrase to create a unique voice print. This proceeds with the need for customers to call from their registered phone numbers. This advanced technology comes with the ability to detect if user’s voice is being played on a recorder. The technology is a unique combination that offers the highest standards of security and also prevent fraud.
Facial Recognition For Airport Security: Advanced facial recognition play a vital part in ensuring safety and security. Thus, it has found an important application in airport security. There is an upcoming facial recognition technology at the airports that will ensure security in its highest standards. The security scanners, through which the passengers pass, will be equipped with an advanced biometric security system. With implementation of this technology, the passengers will not be required to print their boarding pass. This will facilitate paperless and self-boarding process.
Fingerprint Biometrics For Voter Verification Systems: Fingerprint biometric technologies are being implied to voter verification systems. These are developed to conduct elections in a peaceful and fair manner. This technology assists the authorities to verify and identify voters through fingerprints. It will reduce the chances of fraud, streamline the verification process and offer convenience to the citizens by reducing waiting times. This system will avoid the chances of multiple votes with different identities. Also, this will help in maintaining quality and confidentiality of data.
Cybersecurity With Biometrics: Improved biometric technologies provide new kind of digital identity data, ways to collect it and opportunities for its use. It greatly reduces the risk of unknown individuals attacking confidential data in different fields. Hence, biometrics will become an increasingly valuable tool for verifying identities in a deeply interconnected national security environment.

For more information on advancements in biometric industry, call Centex Technologies at (254) 213 – 4740.