October is Cybersecurity Awareness Month under the leadership of CISA and the National Cyber Security Alliance (NCSA). The goal is to continue to raise awareness about the importance of cybersecurity across our Nation. This year’s theme is to be #cybersmart, as we all play a role in the security of our own “cyberspace”. Focusing on cybersecurity and being cybersmart can positively impact our lives, but also the organization we work for and our nation.

To kick off cybersecurity awareness month, here are the five tips to be #cybersmart.

1. Use a password manager – It’s important to have great password hygiene. This means making sure your passwords are hard to crack, that it is long enough and a combination of uppercase and lowercase characters, numbers and special characters. You also don’t want to reuse passwords for various accounts, so the best way to manage this is to use a password manager that will securely store all your passwords for your various accounts.
2.  Don’t use public hotspots – When you’re at the airport, your favorite coffee place or at the library, do you connect to the public WI-FI network? A safer option is to connect to your phone’s hotspot, or use a VPN. There are no guarantees that public WI-FI networks are secure. In fact, with the flaws discovered in WPA2, the encryption standard that secures modern WI-FI networks, attackers within the range of vulnerable wireless access points can become a “man-in-the-middle”, intercepting passwords, emails and other sensitive data. In many cases, they can also inject malware into the sites that you’re visiting.
3. Update your applications – whether you’re on your mobile device or laptop, you’re probably running a number of key applications that will come with vulnerabilities. Enable automatic updates on your applications or make sure that you’re updating them regularly with patches. This includes browser updates such as Chrome or Safari.
4. Use multi-factor authentication – Many applications offer multi-factor authentication. This means you’re required to validate your identify via two or more pieces of credential. Your credentials fall into any of these three categories: something you know (like a password or PIN), something you have (like a smart card), or something you are (like your fingerprint or faceID). Your credentials must come from two different categories to enhance security. You can add an extra layer of defense to your accounts by enabling multi-factor authentication.
5. Beware of phishing scams – One of the most common delivery systems for malware is via phishing scams, via attachments that come to you in an email, masquerading as a file you should trust. Once they’re downloaded and opened, they can take over you computer. Avoid clicking on links from people you don’t know about, or clicking on links in email messages with grammatical errors and details that don’t make sense. Some phishing scams are very targeted so beware of oversharing sensitive information on social media that would make it easy for hackers to target you.

Danelle Au

Danelle Au has more than 20 years of experience bringing new technologies to market. Prior to Ordr, she was CMO at Blue Hexagon, a deep learning for malware protection company, and CMO at SafeBreach where she helped build the marketing organization and and define the Breach and Attack Simulation category. Previously, she led strategy and marketing at Adallom, a cloud security company acquired by Microsoft. She was also Director, Security Solutions at Palo Alto Networks, driving growth in critical IT initiatives like virtualization, network segmentation and mobility. Danelle was co-founder of a high-speed networking chipset startup, co-author of an IP Communications Book and holds 2 U.S. Patents. She has an MSEE from UC Berkeley

SANTA CLARA, Calif. – December 22nd, 2021 – Ordr, the leader in connected device security, today announced that the company has successfully completed the System and Organization Controls (SOC) 2 audit for the Ordr Systems Control Engine. Developed by the American institute of CPAs (AICPA), SOC 2 defines criteria for managing customer data in accordance with five key service principles: security, availability, processing integrity, confidentiality, and privacy. Ordr’s SOC 2 certification demonstrates its commitment to robust information security and the implementation of controls, systems, and processes to protect sensitive customer data.

“Protecting our customers’ business is our top priority, which requires strict controls to secure their data, ” said Pandian Gnanaprakasam, co-founder and Chief Product Officer of Ordr. “We’ve invested heavily in our security programs and operations. Today’s SOC 2 announcement is a testament to the rigor and diligence in the way we build our product, run our cloud and data center operations, how we protect our IT assets, and  how we secure our customer instances on a daily basis. It demonstrates to our customers our commitment to security, and is another example of how Ordr is leading the connected device security market.”

To complete the audit, Ordr engaged with an independent third-party auditing firm, who performed an extensive audit and examination of Ordr Systems Control Engine systems, tools, processes and operations. This rigorous and comprehensive audit validated that Ordr controls were implemented properly in the following areas:

• Information security policies and procedures
• Systems, information, network, infrastructure security
• Secure software development methodologies
• Employee engagement and training
• Customer support
• Vendor management
• Cloud and data center operations
• Risk mitigation and incident response
• Logical and physical access controls

“With cybersecurity attacks hitting the headlines every week, security vendors play a critical role in securing any customer data outside the confines of an organization’s own technical infrastructure. As a result, SOC 2 certification is a key requirement for CISOs when they look at partnering with a new security vendor. Achieving SOC 2 compliance means that Ordr’s existing and future customers can be confident that their data is being handled with the proper security, confidentiality and privacy controls,” said Greg Murphy, CEO, Ordr.

The Ordr SCE platform provides comprehensive visibility and security into all connected devices  including workstations, servers, PCs and tablets, loT, IoMT, and OT. Customers discover granular details about every connected device, gain actionable insights into threats, vulnerabilities, or anomalous behavior, and can automate the implementation of proactive, reactive, or retrospective policies to rapidly mitigate risk.

Santa Clara, CA and Dubai, UAE – March 14, 2023 – Ordr, the leader in connected device security, today announced its partnership with Dubai-based Spire Solutions, the Middle East & Africa region’s leading cybersecurity solution provider and value-added distributor (VAD). Spire Solutions will offer its channel partners Ordr`s award-winning attack surface visibility, asset management and security platform across multiple specialized verticals including healthcare, government, finance and banking, insurance, oil and gas, manufacturing, retail, and telecommunications.

Organizations in the Middle East are increasing their adoption of connected devices, including Internet of Medical Things (IoMT), Internet of Things (IoT) and Operational Technology (OT). Each new device, however, also increases the attack surface, and the potential for a security breach or cyberattack. In order to keep the connected enterprise secure, full visibility is needed into devices and their vulnerabilities, along with automated policies to secure them – whether during an incident, proactively or retrospectively.  

Sanjeev Walia, Founder and President of Spire Solutions said, “It is a challenge to truly protect your organization unless you have accurate, real-time information about which devices are connecting to your network – and what they do once they connect. We are honored to partner with Ordr to address these challenges and enable our channel partners and end-user customers to benefit from industry-leading technology that truly enables customers to manage their entire attack surface whether that be traditional IT, IoT, OT or IoMT.“

“The Middle East is one of the fastest growing economies in the world and we’re proud to partner with Spire Solutions in this region. Spire Solutions has a proven track record of providing best-in-class security solutions and we’re honored to work with a team who shares our commitment to customer success, and protecting the organizations entrusted to us.” said Kieran Wood, Sales Director, EMEA at Ordr.

“This partnership exemplifies Ordr’s commitment to investing in the global, collaborative partner ecosystem and represents another step forward in our international expansion plans,” said Jim Hyman, CEO at Ordr. “Organizations in the Middle East will now be able to accelerate their digital transformation journey and reduce cyber risks by unlocking unparalleled visibility into assets, vulnerabilities and threats.”

With the addition of Ordr’s AI-powered connected device security platform to the Spire solutions portfolio, all assets, connections and network flows can be profiled. By baselining normal behavior for connected assets, organizations can create policies to only enable appropriate access while limiting exposure, enabling a true Zero Trust security posture to be realized. Together, Ordr and Spire will provide customers and partners across the Middle East with unmatched security services, instant value and advanced expertise as they improve their cyber resilience. 

This strategic partnership is being celebrated at GISEC Global 2023, taking place this week at the World Trade Centre in Dubai. To learn more, please visit Ordr and the Spire Solutions team at stand A50, Hall 7.

To learn how Spire Solutions and Ordr can help your organization obtain full device visibility and security, please visit: www.ordr.net.

We’ve always known the value of partnering with Cisco Meraki. Recently we learned that we were selected by the Meraki team as the September 2023 Ecosystem Partner of the Month. This is a great honor for all of us at Ordr, we’re thrilled by the recognition of our efforts, and believe our deep integration and continued partnership is a Win/Win for our joint customers. 

The Ordr and Cisco Meraki joint solution is giving enterprise security teams what they want from the Cisco Meraki platform – ‘enterprise grade’ networking features, not the least of which includes policy and segmentation. By combining Ordr and Cisco Meraki customers can: 

• Discover every device via the seamless Ordr and Meraki cloud integration.
• Gain granular visibility into every single asset in their network including IT, Internet of Things (IoT), Internet of Medical Things (IoMT), and Operational Technologies (OT) devices.
• Identify their attack surface with insights such as devices with vulnerabilities, outdated operating systems, recalls, weak passwords, anomalous behaviors, and active threats.
• Simplify and automate policy creation to accelerate incident response and Zero Trust projects.

Our successful partnership is not just about technology but also includes a strong collaboration to keep customer needs at the forefront of everything we do together. Ordr is a Cisco Co-Sell partner focused on finding the best integrated solutions for our customers through our global, shared partner community.

Our successful partnership is not just about technology but also includes a strong collaboration to keep customer needs at the forefront of everything we do together. Ordr is a Cisco Co-Sell partner focused on finding the best integrated solutions for our customers through our global, shared partner community. 

A big shout out to our Cisco Meraki colleagues who make working together fun and rewarding Alicia Lorenzetti David Hoysan Jacky Lo Matthew D’Angelico Joe Maestri Shayna Boudreau, MBA Anna (Ania) Esipova Disha Moses Hope Galley Stephanie Feliciano Allison Norfleet, Oren Brigg, Albert Chen, Shweta Palande, Vasundhra Dewangan, Cory Guynn, John M. Kuchta Danna Simon.

Watch the live Cisco Meraki Ecosystem Partner of the Month announcement 

And don’t forget to request a demo on the Meraki Marketplace 

Read the announcement on the Meraki Community

Julie Criscenti Heck

Head of Global Partner Ecosystem Marketing

Julie Criscenti Heck

Head of Partner Marketing

Julie is Head of Partner Marketing, engaging with Ordr channel partners, and technology partners on driving connected device security initiatives, and working on joint solutions and marketing activities.

Ordr welcomes Wes Wright as our new Chief Healthcare Officer with immense pleasure and pride. Wes’s distinguished military background, extensive expertise in healthcare, and unwavering commitment to patient safety make him an invaluable addition to our organization. Wes’s appointment reflects Ordr’s continued commitment to our innovation leadership in healthcare.

Already the market leader in healthcare connected device security, Ordr continues to accelerate our customer acquisition rate. More importantly, we are enabling our customers to be healthcare cybersecurity “heroes” by more effectively securing their environment of care and making hospital operations more efficient. We are excited about being in a great place to expand the team and make additional investments to support healthcare security and HTM teams everywhere.

I’ve known Wes for many years (read his recent blog here). He was an early proponent of our technology and mission, and there are several reasons why he’s such a great fit for Ordr:

Valuing Relationships: Building Bridges to Success

Having had the privilege of knowing Wes for several years, I have witnessed firsthand his business acumen, attention to detail, and strength in building relationships. Formerly an Ordr advisor, his guidance and insights, from day one when I met him until now, highlight his dedication to fostering strong relationships and going above and beyond to support our shared goals.

Healthcare Expertise: Passion for Patient Safety

Wes embodies the mantra “cybersecurity is patient safety.” His extensive experience in patient care delivery, as a former CIO of military and children’s hospitals, and his adroit navigation of complex regulatory landscapes will be invaluable to Ordr. Additionally, his tenure as a CTO in a major healthcare organization and technology provider strengthens our ability to drive innovation and maintain a leading edge in healthcare excellence.

Mission-Orientated Leader: A North Star for Excellence

Wes’s military background, serving in multiple roles in the U.S. Air Force, instills in him discipline, strategic thinking, and unwavering resilience—qualities vital to addressing healthcare’s daily security challenges. His ability to set clear objectives, mobilize resources, and lead by example will be instrumental in realizing our collective mission here at Ordr.

Wes’s prowess in rallying and motivating teams is a true asset. Wes’s leadership style, characterized by inspiration, approachability, and a genuine interest in others, is bound to bring out the best in every member of our organization. And beyond his influence with Ordr team, I know Wes will also inspire our partners, prospects, and customers and propel us toward shared success.

Welcome to our team, Wes. We are delighted to have you on board and eagerly anticipate a remarkable journey ahead.

Pandian Gnanaprakasam

Pandian has more than 20 years of product and engineering leadership experience and is also a serial entrepreneur. Before founding Ordr, he was the Chief Development Officer at Aruba, responsible for all of engineering and product management functions. Aruba, an enterprise mobile wireless company, was acquired by HPE for $3 Billion in March 2015. Before Aruba, Pandian served as the head of engineering for Cisco’s multi-billion-dollar Wi-Fi business unit and before that as VP of engineering for low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT, Chennai, India and holds several patents to his credit in various networking technologies.

Background 

On March 2, 2021, the Microsoft Threat Intelligence Center (MSTIC), Microsoft 365 Defender Threat Intelligence Team, and Microsoft 365 Security teams released a blog post that disclosed multiple 0-day exploits that were being used to attack on-premises versions of Microsoft Exchange Server. The MSTIC team attributed the campaign to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology and Tactic, Techniques, and Procedures (TTPs). If not already addressed, we would urge you along with the Microsoft team to update on-premises systems immediately. Currently, there are no reports of Exchange Online being affected.

The vulnerabilities exploited are:

• CVE-2021-26855
• CVE-2021-26857
• CVE-2021-26858
• CVE-2021-27065

Who is HAFNIUM? 

HAFNIUM primarily targets entities in the United States across a number of industry sectors which have included targets in legal, higher education, government, and even including infectious disease researchers, policy think tanks, and NGOs.

In the past, HAFNIUM compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, a red team framework for mapping the attack surface of .NET. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA, an end-to-end encrypted cloud storage and communication platform.

Impact Thus Far 

It has been reported that nearly 30,000 organizations, and as many as 250,000 individual users have been impacted. And, while Microsoft released a patch last week to shore up flaws in its email software, the remedy still leaves open a back door that can allow access to previously compromised servers and perpetuate further attacks by others. The back channels for remote access are most likely to impact credit unions, town governments and small businesses. Microsoft has two resources for learning more and patching:

• Microsoft Exchange Server Vulnerabilities Mitigations
• HAFNIUM targeting Exchange Servers with 0-day exploits

The White House is calling this an “Active Threat” and the President is apparently assembling an emergency group of government agencies as part of a “whole of government” approach.

“We can’t stress enough that patching and mitigation is not remediation if the servers have already been compromised, and it is essential that any organization with a vulnerable server take measures to determine if they were already targeted,” the White House official said. 

It is likely time to reconsider on-premise exchange if you have it 

On-premises Exchange is incredibly difficult to manage and maintain from both an IT and security perspective. Exchange is usually tied integrally into a networks authentication sources and typically contains very sensitive data. Exchange has several configuration options that allow for interoperability with devices and services wanting to communicate over email (usually over insecure or basic authentications), however lacks the ability to properly secure these necessary configurations within Exchange itself and instead usually requires other security controls.

From a cybersecurity perspective on-premise Exchange is a nightmare because its complicated, tied integrally into authentication sources like Active Directory, holds very sensitive information, and typically has a large internet facing attack surface, and because of this it has several research teams solely focused on finding vulnerabilities to exploit within Exchange.

One of the best things Microsoft did with Exchange is begin hosting it within O365/Exchange Online and slowly removing support for insecure configurations. This made organizations running Exchange internally to either migrate to Exchange Online and remove the legacy systems and services that are no longer supported because it required insecure configurations, or unfortunately stick with on-premises Exchange and attempt to properly secure it themselves.

To drive the point home Microsoft themselves no longer run on-premises Exchange servers and have migrated the company to Exchange Online.

How Ordr Can Help 

As most organizations have moved to the cloud or at least a hybrid model, we have found there are not many on-premises Exchange servers out there amongst our customers. However, if they are out there, Ordr will be able to detect the devices and will alert the proper workflow based on the associated the CVEs that have been issued.