Blogs

As more and more users are using remote access VPNs and probably using FortiClient, I wanted to share the errors you are encountering based on the percentage when it fails and some troubleshooting steps around Remote Access VPNs. Percentage and Possible Issue - 10% – Local Network/PC issue - 40% – Application or the Fortigate causing the error, occasionally caused by the local machines/network setup - 45% – MultiFactor Authentication - 80% – Username/Password issue - 98% – corruption of services/often resolved by reinstalling the client on the laptop. Here are some troubleshooting commands for the SSL VPNs on the FortiGate.  You can run them from the GUI Console screen or by using your favorite terminal application (e.g. SecureCRT, PuTTY, ZOC, etc.) di deb reset di deb app sslvpn -1 di deb en Set the terminal to capture the output to a file.  This will be useful to provide to TAC if needed. diag deb reset diag deb console time en diag deb app fnbamd -1 diag deb en The comma

Background AnyDesk is a remote desktop solution for customers to access their machines over the internet wherever they are located. AnyDesk has 170,000 customers worldwide including major players in different industry verticals.   On February 2,2024, AnyDesk reported they found indications that their production server was compromised. AnyDesk revoked all security-related certificates that were used to sign their binaries and issued a new one.    The Problem FortiGuard Applied Threat Research (ATR) team suspects attackers who have access to the revoked certificate can use it to sign and distribute malware disguised as legitimate software. This can bypass security measures and have devastating consequences, like data breaches, ransomware attacks, and reputational damage.   FortiGuard ATR FortiGuard ATR continually processes threat intel from various sources, creating detections to ensure FortiNDR Cloud customers can detect and respond to any network related thre

Fortinet Application Security Landscape   Introduction Web Application Security deployment has been critical in recent years as applications have become highly dynamic and critical in every business. As remote users have increased in recent years, more and more applications are deployed. As the business grows, the requirement to dynamically change content, react to real-time events, and deploy systematically is essential. With these dynamic changes to the application, the ability to secure and protect data/network assets are critical, especially when a business is under pressure to deliver. This document gives you a complete perspective of how Fortinet security solutions can secure and protect applications across your enterprise. Fortinet provides a whole gamut of Application Security Solutions, ensuring your applications/data are protected, strengthen business resilience and improve application security posture.   What is Application Security? Web applications are hackers'

Fortinet’s highest level of strategic partnership available is the Fabric-Ready Technology Alliance Program. It consists of hundreds of partners with over 500+ technical integrations. The program is not limited to traditional, enterprise cybersecurity partners. In fact, the Fabric-Ready program has a vibrant collection of Operational Technology-focused cybersecurity partners.  This aligns with Fortinet’s goal of being #1 in OT.  Partners in the program benefit from their solutions being pre-validated and ready for deployment in OT environments.  These solutions leverage the collaborative power of the Fabric to share information and mitigate threats, leading to rapid response from network end-to-end, and seamlessly covering the entire attack surface of your company.    As in-person events have continued to increase in attendance following the recent pandemic, Fortinet’s Technology Alliance Program has responded with a strong presence supporting Operational Techn

Have you ever wondered how organizations successfully determine if they are susceptible to malware or ransomware attacks, and are able to remediate quickly? The answer is their people. There is always a team of security experts working behind the scenes to ensure their infrastructure is protected and up to date. Although every company may name the role differently, all organizations have similar responsibilities assigned to their “Security Operations Center”, also commonly known as a SOC team.   SOC teams face countless challenges and are usually understaffed to deal with and investigate into the most important threats, often leading to alert fatigue. It takes numerous hours to sift through these alerts, determine suspicious activities, and to find a possible fix. SOC teams employ SOC analysts/security analysts – the frontliners to fight against threats. Here are few of their responsibilities:   Detecting and hunting threats Operating and maintaining various monitoring and t

What is Wi-Fi 7 and why should you care? Wi-Fi 7, technically known as IEEE 802.11be or Extremely High Throughput (EHT), is the next generation of wireless technology that will revolutionize the way we connect to the internet. Building on the foundation of Wi-Fi 6 and Wi-Fi 6E, Wi-Fi 7 promises to deliver unprecedented speed, capacity, and reliability for a wide range of applications and devices. In this blog, we will explore some of the key features and benefits of Wi-Fi 7 and how it will impact our digital lives. How we reached here? As with most generational improvements, Wi-Fi 7(802.11be) is designed to offer faster speeds and improved performance than its predecessor, Wi-Fi 6(802.11ax). When FCC voted to open a part of 6 GHz spectrum in April 2020 for unlicensed use, all wireless industry experts saw this the biggest opportunity for Wi-Fi upgrade since the FCC opened DFS channels for Wi-Fi in 2003. This quadrupled the amount of spectrum available to users, meaning the Wi-Fi issue

FortiSIEM is a highly flexible solution providing a wide collection of inbuilt Remediation Scripts, integrating FortiSOAR Playbooks or giving the user the ability to create his own custom remediation scripts.Predefined and custom FortiSIEM scripts can be invoked on-demand (manually) or automatically when the incident happens. A common situation for using remediation scripts includes blocking sources and/or destinations IP address for reported attacks or suspicious activities (ex. port scanning activities, communication with a C&C server, botnets, etc.). These situations can also be addressed in an easy and reliable way by using a new remediation method based on a FortiSIEM publishing script leveraging Fortinet Security Fabric External Connectors and/or 3rd party NGFW Connectors.  Video Presentation & Demo Main advantages of this method: One single publishing script can be used to integrate multiple and different FGT FOS versions and/or 3rd party firewall devices Sources

Description:   This article describes how FortiWeb's Machine Learning for Anomaly Detection can detect and protect against such attacks out of the box, without requiring any special configuration.   Recently, security researchers posted several blogs describing a method for bypassing some vendor's WAF solutions. The method described bypasses malicious requests that used JSON (JavaScript Object Notation) syntax appended to SQL injection payloads. Attackers could then use these techniques to get access to a backend database and use additional vulnerabilities to exfiltrate information via either direct access to the server or over the cloud.   Fortinet customers using the FortiWeb web application firewall are protected against this type of evasion technique using FortiWeb's Machine Learning for Anomaly Detection.   Scope: FortiWeb   Solution:   The attack:  The researchers crafted new SQLi payloads by appending JSON syntaxes. These payloads, since it is

This is a real-world example of how not to design a Wi-Fi network. Some caveats upfront – the serious Wi-Fi guys around here are not going to learn anything new, but they might slow down and look, just like for a train wreck. And I don’t mean to pick on the motel I’m using for an example – why would a motel manager know how this stuff works? I do, however, blame whatever consultant/reseller/brother-in-law set this network up. That guy needs to be kept away from anything technical forever! Earlier this year, I took my wife and kids on a long overdue trip to see grandma. Making a leisurely trip of it, we stopped a few other places for the night, including a few popular California tourist destinations. Now, I guarantee you the most important thing to the kids when we got to any motel (dad too, truth be told) was to get on the Wi-Fi – immediately! I’m sure readers can relate. In fact, customer satisfaction with Wi-Fi is a key metric across the hospitality industry these days. One particula

Feature Introduction AWS Cloud WAN AWS Cloud WAN provides a central dashboard for making connections between your branch offices, data centers, and Amazon Virtual Private Clouds (Amazon VPCs)—building a global network with only a few clicks. You use network policies to automate network management and security tasks in one location. Cloud WAN generates a complete view of your on-premises and AWS networks to help you monitor network health, security, and performance.   Fortinet SD-WAN Fortinet SDWAN (software-defined wide-area network) solution enables enterprises to transform and secure all WAN edges. Leveraging the Security-driven Networking approach that uses one operating system and one centralized management console, enterprises realize superior user experience, enhanced security posture effectiveness with converged networking and security, and achieve operational continuity and efficiency. Fortinet FortiGate delivers fast, scalable, and flexible Secure SD-WAN for cloud-firs

Fortinet is one of the leading Firewall vendors that Alkira’s customers use in their deployments. These enterprise customers consider Fortinet their trusted partner whether they are looking to deploy security appliances inside their data centers or as a virtual form factor in private and public cloud environments. Figure 1: Network View on Alkira Portal with Fortinet Firewall Service Firewall deployments in the public clouds are complex, require many steps, lack standardization in the Multi-Cloud environment, and do not offer the same functionality as the on-premise deployment. For example, at a minimum, a cloud engineer needs to do the following for a successful cloud firewall deployment in any CSP environment: Deploy a Security VPC/VNET spanning multiple Availability Zones for high-availability Support connecting large quantities of cloud networks and propagating routes dynamically. Secure inbound and outbound traffic flows. Ensure traffic symmetry when there are multiple fir

Feature IntroductionAWS Cloud WAN AWS Cloud WAN provides a central dashboard for making connections between your branch offices, data centers, and Amazon Virtual Private Clouds (Amazon VPCs)—building a global network with only a few clicks. You use network policies to automate network management and security tasks in one location. Cloud WAN generates a complete view of your on-premises and AWS networks to help you monitor network health, security, and performance.  Fortinet SD-WAN Fortinet SDWAN (software-defined wide-area network) solution enables enterprises to transform and secure all WAN edges. Leveraging the Security-driven Networking approach that uses one operating system and one centralized management console, enterprises realize superior user experience, enhanced security posture effectiveness with converged networking and security, and achieve operational continuity and efficiency. Fortinet FortiGate delivers fast, scalable, and flexible Secure SD-WAN for cloud-first, se

Feature IntroductionAWS Cloud WAN AWS Cloud WAN provides a central dashboard for making connections between your branch offices, data centers, and Amazon Virtual Private Clouds (Amazon VPCs)—building a global network with only a few clicks. You use network policies to automate network management and security tasks in one location. Cloud WAN generates a complete view of your on-premises and AWS networks to help you monitor network health, security, and performance.  Fortinet SD-WAN Fortinet SDWAN (software-defined wide-area network) solution enables enterprises to transform and secure all WAN edges. Leveraging the Security-driven Networking approach that uses one operating system and one centralized management console, enterprises realize superior user experience, enhanced security posture effectiveness with converged networking and security, and achieve operational continuity and efficiency. Fortinet FortiGate delivers fast, scalable, and flexible Secure SD-WAN for cloud-first, se

Feature Introduction AWS Cloud WAN AWS Cloud WAN provides a central dashboard for making connections between your branch offices, data centers, and Amazon Virtual Private Clouds (Amazon VPCs)—building a global network with only a few clicks. You use network policies to automate network management and security tasks in one location. Cloud WAN generates a complete view of your on-premises and AWS networks to help you monitor network health, security, and performance.   Fortinet SD-WAN Fortinet SDWAN (software-defined wide-area network) solution enables enterprises to transform and secure all WAN edges. Leveraging the Security-driven Networking approach that uses one operating system and one centralized management console, enterprises realize superior user experience, enhanced security posture effectiveness with converged networking and security, and achieve operational continuity and efficiency. Fortinet FortiGate delivers fast, scalable, and flexible Secure SD-WAN for cloud-firs

Secure RISE with SAP – How to secure the unknown?What is RISE with SAP? Today enterprises are turning to new business models to avoid disruption, to gain efficiencies, to drive innovation, and to transform mission-critical systems without business risk. SAP offers RISE with SAP to enable companies in all industries to reach these goals. SAP for Rise includes Cloud ERP for every business need, industry best practices and extensibility, analytics and business process intelligence, and outcome-driven services from SAP and partners.With RISE, customers can take the lead with industry innovation for top-line, bottom-line, and green-line growth. Rise enables customers to constantly improve with real-time insights, allowing them to continuously optimize processes. Rise includes embedded cybersecurity and automated data protection to help to protect SAP applications and data.But are these security features and functions sufficient? Let’s look at this more in detail. Challenges to sec

Our previous blog covered how FortiEDR eliminates malware and attacks early in the cyber kill chain and the benefits of proactive security. We know nothing in this life is guaranteed and no form of security is perfect. As stated before, Threat Hunting helps identify what circumvented the first line of defence. This blog will cover post-attack threat hunting. Post-attack, Threat Hunting can assist in ‘following the breadcrumbs’ and identifying patient zero, peering back days, weeks or even months. While FortiEDR’s Forensics suite provides much of the answer with patented code-tracing technology, Threat Hunting is also an essential component. While investigating an event, FortiEDR provides an intuitive experience with contextualised Threat Hunting hyperlinks enabling the SOC analyst to quickly retrieve the information required. Figure 1.1 – Contextualized Threat Hunting – Events View Figure 1.2 – Contextualized Threat Hunting – Forensics View   It is also possible to scan all (or

Fortinet releases a new version of FortiClient to protect classrooms that adopt Chromebook usage integrated into the curriculum. This adds to Fortinet’s significant investment to secure the Education segment.   FortiClient Chromebook Benefits: Automated updates keep defenses up-to-date with the latest website ratings. Fully customized policy-based access control based on categories, websites, and individual pages via granular blocking & filtering. Comprehensive protection - URL database with more than 75 categories, more than 43 million rated websites, and more than two billion web pages. Faster update times by customizable update options. Helps attain CIPA (US HR4577) and BECTA (UK) compliance. It is astounding that education has more security incidents than healthcare or manufacturing as evidenced by 254 incidents recorded in 20151 and accounts for 27.4% of all attacks seen across various verticals2. Schools continue to be key targets for cyber attackers since they possess

Fortinet's annual mid-year check-in with Global Security Strategist Derek Manky (FortiGuard Labs) is live. This is an update to our yearly predictions rolled out at the beginning of each year.    More Information! Read can read Derek's blog, an article in CSO.com, and a Dark Reading byline about the topic.   Excerpts: Technology is making our lives easier. We have access to unprecedented levels of information, resources, social media, and entertainment at our fingertips, 24 hours a day. Much of our reliance on this technology has become invisible, from traffic control systems to medical devices to applications that allow us to make and monitor financial transactions. While new classes of connected devices provide valuable services, they are being woven into an increasingly complex ecosystem of data, devices, applications, and services that we are becoming more dependent on every day. Which is why we are also seeing a rise in the number and

Outside of the various forms of social engineering such as phishing, the most common observed access vector for adversaries is the targeting of external facing services/applications (T1190 – Exploit Public-Facing Application). In the last 12 months there has been a significant focus from threat actors on targeting zero- day vulnerabilities present in external facing services like Microsoft Exchange1 2, Confluence3, and services employing vulnerable log4j libraries4. Despite intrusions related to exploitation of these new zero-day vulnerabilities dominating the spotlight recently the FortiGuard Responder Managed Detection and Response (MDR) team continues to observe attacks where the initial attack vector is a brute-force attack on an external facing service, most commonly SQL database services such as postgres and MSSQL. Attacks on these services are linkedto multiple different actors, majority of which are financially motivated groups (criminals) looking to deploy ransomware or cr

Executive Summary Organizations with global offices delivering hypeconnectivity between workloads and users face more challenges than ever due to market economics, competitor dynamics, and consumer behaviors. Competitors are changing strategies and product iterations faster than ever to match consumer expectations. Those expectations might include 24/7 great user experience, secure connectivity, and high performance. Fortinet can work with AWS Cloud WAN to deliver the secure connectivity across your global private networks by providing complete end to end security through each part within the transit network. Fortinet's Security Fabric can integrate with AWS Cloud WAN to help customers onboard their journey to the cloud or provide smart routing through its SD-WAN capabilities to help customers have more flexibility in their design architecture. Ultimately, the integration between Fortinet and AWS Cloud WAN help reduce complexity in your network while still securing your last mile traff

FortiSIEM 6.4.0 introduces the ability of enriching Analytics with information from Lookup Tables to provide insight into the data being retrieved from logs. It also introduces the ability to create Correlation Rules based on contents and conditions in one or more Lookup Tables. New out of the box LookupTables have been included in this release, which rely on reports to create a baseline of processes and user logins:AWSLoginCountry – Source countries for successful AWS loginAzurePortalLoginCountry – Source countries for successful Azure Portal loginGSuiteLoginCountry – Source countries for successful GCP loginCommonLinuxProcess – Common Linux Process CreatedCommonWindowsProcess – Common Windows Process CreatedO365MailLoginCountry – Source countries for successful O365 Mail loginServerLogin – Servers that users login toVPNLoginCountry – Source countries for Successful VPN LoginThese are accompanied by new Correlation Rules which will trigger in real-time when FortiSIEM receives an

Over 2,500 CISOs and other leaders in IT security attended the annual Gartner Security & Risk Summit in National Harbor, MD. We had the privilege to not only meet with customers at the event but to also attend several sessions and speak with numerous Gartner subject matter experts about trends in the market. Judging from that, here are some key highlights for us: XDR language was everywhere, and diverse. Many attendees were not sure what XDR is and were looking for definitions. We think many vendors had conflicting positioning, often quite different than Gartner’s definition in the XDR market guide. It was a modern example of the proverbial blind men trying to explain their part of the elephant. We feel our XDR is closely aligned with Gartner expectations and will be a market leader as industry adoption continues to accelerate. With market penetration being around 1%, you can ignore those who claim to be an XDR leader. For now, we suggest focusing on what makes you more secure whi