“Planning without taking action is the slowest route to victory. Taking action without planning is the noise before defeat.” - Sun Tzu, The Art of War Introduction to cloud computing It is said that the world evolves at the speed of technological evolution. Organizations are constantly looking for new technologies...
“The best way to predict the future is to invent it.” - Peter Drucker, American economist and corporate philosopher Cloud computing, the advancement of computing over a network of servers, was a key driver of the tech industry in 2018. Mergers and acquisitions between large and small companies led to...
How to Streamline Your Data Archival Process using the Cloud Data archiving is the process of moving data that is no longer essential to a separate data store for long-term retention. Archived data consists of older data that might serve some importance to the organization, possibly for future reference or...
Event Date: 10-11 April 2019 Last Updated: 27 May 2019 The AWS Summit Singapore brings together the cloud computing community to connect, collaborate and learn about AWS. Cloudsine was recognized as an AWS Technology Partner and an AWS Consulting Partner last year. During the Summit, we showcased WebOrion™, an all-in-one...
Event Date: 23 May 2019 Last Updated: 27 May 2019 Startup Quarter - Secure your cloud, was a meetup organized by Division Zero (Div0) on 23rd May 2019 at ACE. Div0 an open, inclusive, and completely volunteer-driven cybersecurity community with a mission of promoting a vibrant cybersecurity community and safer...
Event Date: 4 Sept 2019 Last Updated: 10 Sept 2019 Cloudsine is glad to host our very own seminar on the theme of Cloud Security: Myths, New Security Concerns and Mitigations on 4 Sept 2019. Glad to engage and interact with an audience of Singapore and Indonesia customers, resellers and...
Event Date: 21 Nov 2019 Last Updated: 25 Nov 2019 Cloudsine had our first RPA seminar in collaboration with Automation Anywhere on the theme of the “Future of Digital Workforce with Intelligent Automation” on 21 November 2019. It was our pleasure to have Ehunt Siow and Sundarraj Subrammani from Automation...
Cloudsine Accelerates Centre for Evidence and Implementation (CEI)’s Cloud Adoption Journey by Providing Data Migration, a Customized File Portal that Integrates with AWS S3 and Cloud Data Security Assurance. The Centre for Evidence and Implementation (CEI)is a global team of research, policy and practice experts based in Australia, Singapore…
Part 1 of our own series of articles on CloudGoat and mitigation strategies. This is a step by step breakdown on how to interpret and think like an attacker and also how to go about mitigating the attacks.
Part 2 of our own series of articles on CloudGoat and mitigation strategies. This is a step by step breakdown on how to interpret and think like an attacker and also how to go about mitigating the attacks.
In this third part, we will explore privilege escalation using EC2 instance profile attachment to obtain full admin privileges on the AWS account and also exploiting SSRF on EC2’s metadata service to get credentials.
This is part 4 of the series on AWS Cloudgoat Scenarios and the mitigation strategies series where we explore and see how remote command injection on a web application can be used to compromise the AWS environment.
Part 2 of our own series of articles on CloudGoat and mitigation strategies. This is a step by step breakdown on how to interpret and think like an attacker and also how to go about mitigating the attacks.
WebOrion® is pleased to announce the launch of our new Javascript Malware Detection Engine(JME). The JME adds to the powerful capabilities of our WebOrion® Monitor to detect defacements, malicious scripts and other website threats. Today, practically every website uses JavaScript. The power and flexibility of a scripting language embedded within...
AI Security Quarter of Div0 was officially launched on 31 Mar 2021 over virtual Zoom and attended by >50 cybersecurity and AI enthusiasts in Singapore. Cybersecurity and AI are both critically important technologies for the digital future. Attackers are using more automation and AI to help them probe and attack...
Cloudsine is excited to partner with SGInnovate at the New Frontier event on 10 Apr 2021 to help build up the deeptech community. The New Frontier event is organized by SGInnovate with Guest of Honour, Lawrence Wong (Minister for Education), to promote the growth of the deeptech ecosystem in Singapore...
Email alerts are the primary method that WebOrion Defacement Monitor uses to inform our customers about the changes to their websites. Through these email alerts, users are informed if their website becomes unreachable, or if any of WebOrion’s various engines are triggered during webpage monitoring. The email alerts are important...
Cloudsine, the parent company of WebOrion, is excited to announce the technology alliance partnership with New Net Technologies (NNT). NNT is a Cybersecurity and Compliance software company based in UK and is widely deployed in many Enterprise and Government Organizations globally. Cloudsine provides cloud consulting services and offers web defacement...
Cloudsine is honoured to partner with SUTD to sponsor the artificial intelligence award to nurture interests and identify talents in this area. Students from SUTD who are interested may enroll in 50.021 Artificial Intelligence module offered by the Information Systems Technology and Design (ISTD) pillar. In this course, students will...
"The PowerX Programme has given young Cybersecurity companies like us a boost to identify, recruit and train cyber talents that are critical for our growth." Matthias Chin, Founder and CEO of Cloudsine. The PowerX Cybersecurity and Software & Product Development programmes are SGInnovate’s 12-month programmes including structured training and industry...
There was a high severity vulnerability (CVE-2021-44228) impacting multiple versions of the Apache Log4j which was disclosed publicly on December 9, 2021. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. The vulnerability impacts...
Cyber Threat Activities from the Russia-Ukraine Cyberwar The Russian incursion into Ukraine has led to a conflict that involves both the physical and cyber domains, with hacking groups of differing allegiances launching cyberattacks on government, military, financial and telecommunication websites. Cybersecurity specialists worldwide have highlighted growing concerns that the intensifying...
The Resurgent Threat of Hacktivism As the Russia-Ukraine conflict intensifies, cyberwarfare continues to be waged between the two countries. Concerns remain that state-backed hacker groups may target organisations outside of Eastern Europe in retaliation for the global sanctions imposed on Russia, or as false-flag operations to further promote political narratives....
WebOrion® is glad to introduce a new feature into the existing Integrity Analytics engine – Smart Image Hash (SIH). SIH helps reduce false alerts regarding image changes by analysing them in a smarter way. Images can make websites look more attractive and have been widely adopted ever since the inclusion...
AI technologies have been widely applied to different fields, but have you ever heard of using AI technologies to monitor the defacement of webpages? WebOrion is glad to introduce a new engine to the WebOrion defacement monitoring platform – AI Natural Language Processing (NLP) Engine. This engine analyzes webpage-changes and...
Cloudsine, the parent company of WebOrion, is pleased to announce the technology alliance partnership with Netrust Pte Ltd. Netrust is an established company since 1997 and is Asia’s first Public Certification Authority (CA) andSingapore’s only commercial IMDA-accredited CA. Cloudsine provides cloud consulting services and offers web defacement detection and response...
“Serverless” is a buzzword that is thrown around especially in the cloud industry. For the inexperienced, it may seem intuitive - “server” and “less”. It does not mean having less servers, but it actually refers to lesser (or no) management of servers. Serverless services allow developers to build and run...
Discover what is the WebOrion® API and the benefits of integrating the API with various systems such as Content Management Systems like Wordpress, and in the coming days, SIEM and SOAR systems. Our simple and easy-to-follow demonstration will also show you how to seamlessly integrate the WebOrion® API with your...
For the past decade, Cloudsine has been working with Amazon Web Services (AWS) to serve the market. Cloudsine is a consulting and technology partner with AWS and has used cloud computing to build and run many secure applications to support enterprise and government customers across Asia Pacific countries including Singapore,...
Thanks to all who visited our booth at GovWare 2022, held on 18-20 October 2022, at Sands Expo and Convention Centre, Singapore. We sincerely hope that all who visited us were able to catch a glimpse of what we currently do in the cybersecurity space with WebOrion, as well as...
As a website owner, one would surely come across the Domain Name Service (DNS). DNS is an extremely critical system on the Internet, as it is a system that helps translate domain names (which are easily recognisable and remembered) into IP addresses. It is important for all website owners to...
In this video, we will be sharing with you why your DNS records are important. How an outsider can conduct DNS enumeration to determine the attack surface. What can you do to hide and secure your DNS records. What are some tools WebOrion provide that can detect changes to the...
In computer networking, ports are points of entry to your computer – virtual origins and/or destinations of network connections. Port number definition and standardisation is overseen by the Internet Assigned Numbers Authority (IANA). Based on the list maintained by IANA, there are three types of ports amongst the total number...
In this video, we will discuss how hackers can easily enumerate your web server and potentially find vulnerabilities that they can exploit. It is important to understand how these attacks work so that you can take steps to protect your server and your website. We will walk through the process...
Today, we are excited to announce WebOrion® Defacement Monitor and Restorer is listed as a partner of LKPP E-Katalog, https://e-katalog.lkpp.go.id/, for PEP Category, Software Security, and Antivirus License. This opens up a new channel for Indonesian public sector agencies to quickly start protecting and monitoring their websites from cyber attacks...
Hari ini, dengan gembira kami mengumumkan WebOrion® Defacement Monitor and Restorer terdaftar sebagai mitra LKPP E-Katalog, https://e-katalog.lkpp.go.id/, untuk Kategori Peralatan Elektronik dan Pendukungnya, Keamanan Perangkat Lunak, dan Lisensi Antivirus. Hal ini membuka saluran baru bagi lembaga sektor public dan Pemerintah di Indonesia untuk segera mulai melindungi dan memantau situs website...
PCI-DSS is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment. This article is part of a series of articles under the “What’s New in PCI-DSS v4.0” series where we explore what has changed in...
PCI-DSS is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment. This article is part of a series of articles under the “What’s New in PCI-DSS v4.0” series where we explore what has changed in...
What is Magecart? Magecart is a type of cybercriminal group that specializes in stealing credit card information from online stores (a.k.a card skimming). The group's attacks typically involve injecting malicious code into the checkout pages of e-commerce websites to steal payment card data from customers. The Magecart group is known...
PCI-DSS is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment. This article is part of a series of articles under the “What’s New in PCI-DSS v4.0” series where we explore what has changed in...
PCI-DSS is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment. This article is part of a series of articles under the “What’s New in PCI-DSS v4.0” series where we explore what has changed in...
While web defacements may not be the most prevalent cyber attack in recent years, the consequences of web defacements are real – reputations may be damaged, client-customer relationships may be broken, financial losses may occur, etc. Web defacements can come in various forms, visual or non-visual (script inclusions). Hackers may...
In this video, we'll be discussing the important topic of preventing web defacement - a type of cyber attack that involves unauthorized alteration of a website's content or appearance. As a technical manager or CTO, it's crucial to understand the methods and motivations behind web defacement attacks and take steps...
“Serverless” is a buzzword that is thrown around especially in the cloud industry. For the inexperienced, it may seem intuitive – “server” and “less”. It does not mean having less servers, but it actually refers to lesser (or no) management of servers. Serverless services allow developers to build and run applications without the need to manage servers since the cloud service provider handles the maintenance of the server infrastructure. Serverless applications have the ability to respond automatically to demand, and scale as required.
In a typical Infrastructure as a Service (IaaS) cloud computing model, end-users pay a cloud service provider for servers (running 24/7) to run their applications. It is the end-user who is responsible for scaling up during periods of high demand and scaling down when the additional capacity is no longer required. On the other hand, with serverless architecture, resources are provided automatically when required. When applications are running, the cloud service providers dynamically provision resources for them based on demand. End-users only pay for what is used, and when the applications stop running, the end-user stops paying.
Serverless Functions
One example of a serverless service is serverless function. Serverless functions potentially lasts for seconds and is designed to be triggered by a specific condition, such as placing an e-commerce order. A typical serverless function process would have the following steps:
1. Writing a function; the developer writes a function that fulfils a specific purpose
2. Defining an event; this event allows the cloud service provider to execute the function by defining a trigger event.
3. Triggering an event; a user triggers the defined event such as clicking a button
4. Deploying and executing a function; the cloud service provider starts a new instance of the function
5. Passing the result to the client.
If the service gets a lot of requests, an appropriate number of instances are made available, and if the requests drop, the resources used scale down accordingly. This way, the customer (of the cloud platform) only pays for the resources the function used. Serverless functions are applicable in many situations, and they affect the way we carry out certain tasks. Serverless functions are often used in building websites and web applications as they allow developers to focus on the core product without worrying about the maintenance of the cloud infrastructure. Serverless functions are also used in routine tasks, as it allows for automation of tasks that must be performed at a specific time or interval.
Benefits of The Serverless Model
Building upon a serverless architecture brings about a myriad of benefits, mainly, not needing to manage the infrastructure. This is a major benefit for developers since the responsibilities of server and hardware maintenance are now the cloud service providers’.
Serverless services are also beneficial to business owners as it optimises the costs of running services, largely due to its auto-scaling capabilities. Since services’ resources are scaled based on demand, there is no need to cater for scenarios where resources are found wanting in times of high demand. As cloud service providers only charge based on usage, serverless services allow end-users, which include business owners, to only pay for the resources used. They are not required to pay for idle CPU time and/or unused space. .
Finally, using a serverless development model, allows developers to add and modify the code piecemeal. Bug fixing and adding of features for applications will be done significantly faster.
Drawbacks of The Serverless Model
Despite the numerous benefits of using a serverless architecture, they are not without its cons. Using serverless services can quickly turn expensive, especially when resources are required and usage is sustained in large amounts. It would be cheaper if resources are purchased and reserved beforehand, since usage is expected for an extended period of time. Additionally, there are several Platform as a Service (PaaS) offerings that can manage infrastructural overheads, that include security patches, auto-scaling, and monitoring that can bridge the gap between serverless and server-based managed offerings – for a portion of the price. In some cases, end-users can save up to 80% when running their applications server-based on cloud.
Another issue is being vendor locked-in. Many serverless services are proprietary to that specific cloud service provider and cannot be migrated from one cloud service provider to another. This is due to a lack of consistency between cloud service providers, meaning the same serverless services can be extremely different in form from one cloud provider to another, even though its main functions are similar.
For the uninitiated, I hope this article helps to clear up some misconceptions surrounding the serverless model. It is evolving at an unprecedented rate, and as we move towards Serverless 2.0, cloud service providers will continue adding on to their serverless offerings to make it more suitable for general-purpose business workloads.
References
https://www.redhat.com/en/topics/cloud-native-apps/what-is-serverless
https://enterprisersproject.com/article/2019/2/serverless-how-explain-plain-english
https://www.splunk.com/en_us/data-insider/what-are-serverless-functions.html#:~:text=Serverless%20functions%20are%20a%20single,all%20architectures%2C%20including%20cloud%20infrastructure.
https://hackernoon.com/cons-of-serverless-architectures-7b8b570c19da
