Sabastian H.

Are you following these steps? Do you need to go back a few steps to ensure smooth implementation of ISO 27001? Read my blog and find out 👇 https://lnkd.in/earEfWeu #iso #27001 #isms #cybersecurity #infosec #informationsecurity #smb #yorkshirebusiness #businessuk #voragosecurity

3

Investigation Scenario 🔎 You've discovered that a Windows file server on your network has RDP enabled. It should not have RDP enabled. What do you look for to determine if a compromise has occurred? #InvestigationPath #DFIR #SOC

75

25 Comments

There's a new cyberespionage campaign targeting government agencies in EMEA and Asia by a group called SneakyChef. They use lures that are scanned documents related to government affairs. This campaign uses a wider range of targets and infection techniques than previous ones. Stay vigilant and educate your colleagues about these threats! #cybersecurity #APT #governmentthreats https://lnkd.in/dM9qz5EM

18

I've got some news about a potential new feature in Windows 11 that could make sharing files and links between devices even easier. Windows 11 is testing a feature in its Share menu that allows you to generate QR codes for URLs and files right from your desktop. Imagine no longer needing to email links to yourself or juggling multiple devices - just scan a QR code with your phone, and you're good to go. It’s in the latest preview build of Windows 11. This feature is especially handy for those of us who are always on the move. Whether you're rushing between meetings or managing business from different locations, this quick share option can save you time and hassle. Plus, Microsoft is making it even easier by making sure the Share menu won't close if you accidentally click outside it. For anyone using a Gmail address with their Microsoft account, you can now send yourself emails directly from the Share menu - not just to Outlook or Hotmail. It's still in the testing phase for now, but keep an eye out for updates... #Windows11 #QRCodes #Share https://lnkd.in/eJmFfj3G

2

💭🦅🔐 A few thoughts as the chaos of today dies down. 🔐🦅 💭 - The Protos Networks SecOps team have been absolute heroes today. A particular shoutout to Robert Zabel, who was on shift at 6 am when calls and alerts started coming in, and he has continued grafting all day. - Likewise, the IT teams at our customers and partners have been outstanding. Most of our customers had their critical systems back before 9 am due to their efforts, and our partner MSPs have been helping our team remediate customer issues. Thank you to all of you - you know who you are 😍 - Apart from the odd opportunistic ambulance-chasing ghoul, seeing the industry support each other has been great. Every MSP, IT Manager, SysAdmin, and vendor hopes this never happens to them, but eventually, everyone has a turn. 🤓💻 - This stuff happens😟; I have seen many other bits of security (and non-security) software BSOD devices over the years. If technology never broke things, many of us wouldn't have jobs. - I send my best wishes to the IT and security teams that are still working to fix these issues. At times like this, organisations often realise how important IT is. In a world where everything is connected, and supply chains rely on IT, days like today are inevitable. However, fixing these issues can often become life-or-death in industries such as healthcare and emergency services. 👨‍🏭 - Finally, we should all spare a thought for CrowdStrike's fantastic staff. This incident is significant because so many organisations use CrowdStrike—and with good reason. We put several EDRs through their paces when we selected one as part of our MSSP services, and CrowdStrike came top for us. We also have an incredible partner support team who have been helpful and responsive all day. Yes, the reputation and share price have taken a knock today, but CS still offers fantastic solutions disrupting the cyber security market. 🦅 #GlobalOutage #BSOD #CrowdStrike #Microsoft #P1Friday #CyberSecurity #IT #Tech Jack Hobden Rhia Jenkins Joe Joinson Damien Sansom Luke Martin Gareth Guest Sophie Mossman Sean Kinsella Jamie Barnes-Hockings Luke Payne Hollie Joinson Tom Heard Phil Lewis David Lenagh

72

5 Comments

What should your Incident Response procedure look like? Like your wife writing down instructions for you to make a sandwich... Notice a few things: 🔸 Everything you will need is listed 🔸 Potentially harder to find items are called out 🔸 The list DOESN'T include silly instructions about how to spread the mayo/mustard or how to position the bread The list is detailed enough for someone (i.e. me) with at least some familiarity with the tools and environment (i.e. the kitchen) can handle the process (i.e. making a sandwich) without detailing so much that the instructions have to handle any conceivable possibility (i.e. the cat eats the bread). Your processes to handle security issues should follow the same concept - and that goes for small and large business alike! The only difference is the number of steps that are listed. And yes... my wife did actually write out instructions for me for making a sandwich. I feel the love ❤️ #security #incidentresponse #dadlife #cybersecurity

27

12 Comments

Pupils miss classes as school cyber-attacks rise! "The type of cyber-attack which increased most across all sectors between the end of 2022 and 2023, according to the ICO, was ransomware, incidents of which increased by 170%". As we know, these attacks are getting more and more regular. What is happening with your Cyber/ IT Security budget, is it stagnant or increasing? We are hearing in almost every conversation with Cyber/ Security leaders that they are under resourced, but budget restraints are holding them back from recruiting the skills they need. https://lnkd.in/e4eF_D5B. #ciso #cisos #cisolife #cyber #cuberjobs #cybersecurity #infosec #bbcnews #informationsecurity

2

1 Comment

Security 101: Never hardcode your passwords and/or cert keys into your devices. Lock control maker Chirp might have missed that introduction to security class since they hardcoded their passwords and private keys (no pun, well sort of a pun) into their applications. Chirp made CISA so mad they they were issued their own advisory (see below), as well as earning a "Exploitable remotely/low attack complexity" on CISA's executive summary. "Low attack complexity" means even your grandmother could attack these locks, remotely too. If you are one of the 50,000 households that use Chirp, well, sit by your front door with a loaded shotgun until Chirp fixes this issue. If you aren't a fan of loaded weapons, take a look at the newest Nerf Blasters. If you aren't a fan of Nerf, get yourself a wonderful mastiff dog (or two, very family friendly and protective, just cowards during lightening storms). https://lnkd.in/gQKWQE9t

8

Having a 27001 certificate doesn't necessarily mean you are 'more secure' than a company who hasn't certified. It simply means you are managing information security risk to a level which is deemed sufficient by a certification body. Take this in to consideration when you're completing supplier due diligence and the only question you ask is 'are you 27001 certified?' If you're not sure what questions you should ask as part of your supplier due diligence process, drop me a PM and I'll see if I can give you some pointers.

20

5 Comments

Investigation Scenario 🔎 A large file with a CPL extension executed from a user temp directory on a Windows system. What do you look for to investigate whether an incident occurred and what caused it? #InvestigationPath #DFIR #SOC

28

2 Comments

Let's be real, we're all 'faking it till we make it', right?... The word 'expert' is something I hear a lot in the IAM industry (and just about everywhere else - 'I'm an expert' or 'I want to become an expert in X Y Z' The word expert itself is firstly open to lots of interpretation In simple terms, 'experts' will have some form of 'high level' of achievement, knowledge and skill in their area... But how do you know when you 'make it'? When are you considered an expert at what you do? Like a true expert. There's many 'claiming to be' or who are 'influencers', or just those who are 'shouting the loudest' Seems a lot harder in some sense nowadays to discern who the true experts are anyway! >> I'd love to hear anyone's thoughts on this topic! << Personal experience, tips, do's and don'ts etc 👉🏻 When are you an expert!? 👈🏻 (Just complete 10,000 hours of work to become an expert, right!? 😜) #careers #iam #identityandaccessmanagement #fakeittillyoumakeit

22

6 Comments

Malware often relies on named pipes for inter-process communication, but many analysts don't understand them well. With his event, it's helpful to take inventory of what information comes with it and where you can pivot from there. Sysmon EID 17 describes the creation of named pipe. However, you may also have EID 18, which describes a connection to a named pipe. There are many useful data points between these two events... A few of those: - Timestamp of creation/connection - Process that created the pipe - Parent process of the process that created the pipe - User that created the pipe A lot of your analysis here may center on the legitimacy of the process/parent process. Does the file hash or name associate with known malware? Is the parent/child process pair inherently suspicious? What else executed around the same time? Of course, you can also perform prevalence searches for the named pipe and its characteristics on other systems. That helps you establish some sense of disposition based on frequency of occurrence. It's often a useful technique to pause, consider what artifacts you have available given the interesting events you've already identified, and then pivot from those artifacts to related evidence sources. This scenario presents lots of opportunities for that! All that said, the most important thing we have to work with here is the pipe name. That has to be set by whoever wrote the code that created the pipe, so if it's unique, there's a lot we might learn from intelligence-centered searches. If you do some digging, you'll find that the Wild Neutron malware uses the LSASSW named pipe. Given that, you can research other characteristics of this malware and check the host/network for those artifacts to confirm compromise. https://lnkd.in/enJYMGkJ By the way, if you're not super familiar with named pipes and how to hunt for them, we've got an Analyst Skills Vault lesson dedicated to the topic. https://lnkd.in/ez456_dK Speaking of named pipes, what are some that are common amongst systems on your network? That’s something to think about... 🚀 #InvestigationPath #DFIR #SOC

56

1 Comment

Sorry but this feels insane to me! If you're a provider of SOC 2 reports, and you allow your auditee to put periodic in their control testing for their SOC 2 Type 2 report. What exactly are you testing as part of that control that it operates in an ad-hoc manner? Am I missing something? I understand firms want to 'de-risk' their reports, but it also removes the value and validity of the control testing. How do you reviewing access quarterly or within 24 hours of a user terminating when your report states you do it periodically? #SOC2 #VendorManagement #AICPA

11

1 Comment

Threat actor group #Handala has claimed responsibility for an alleged 51 TB of data being dumped and wiped, with some emails also being sent out from #Zerto, a Hewlett Packard Enterprise company. Zerto is known for its robust data management and protection solutions, trusted by over 9,500 customers globally and integrated with major cloud platforms such as Microsoft Azure, AWS, Google Cloud, and more. 👾 This incident underscores the persistent and evolving nature of cyber threats facing even the most well-established and secure companies. Key Points: 👾 Scope: 51 TB of data compromised 👾 Company: Zerto, a subsidiary of Hewlett Packard Enterprise 👾 Services Affected: #DataProtection, #recovery, and mobility services 👾 Implications: Potential disruptions for clients utilising Zerto's services for disaster recovery and data mobility.... Let's use this incident as a reminder of the ever-present need for robust security postures - not just framework compliance, and regular audits to ensure our systems are as resilient as possible against such threats. Greatest sympathies are with Zerto and those having to deal with the associated implications of this. #SecurityBreach #BreachRadar #CyberChatter

10

4 Comments

Maybe this will become an article later, but a thought in explaining what a shortcoming of much of cyber engineering came to me this AM. We've moved from plugging holes in operation or right before fielding (bolting on) to plugging holes in design phase (baking in) - and call that now "secure by design". But we still aren't avoiding holes during design - all our activity tends to be assessing holes and planning the plugs. That is - determine design then modify it to secure it rather than a security foundational in determining design. Thoughts?

17

9 Comments

OT networks and ICS platforms are going to continue to be a festering wound for organizations. They've been neglected for years because organizations could not or would not justify the downtime to maintain them. They hid behind the shield of you can't connect to the network except through "highly" controlled means and toss out phrases like "We implemented the Purdue Model" as mantras to ward off objections from IT security professionals and auditors alike. All the while the same organizations were punching holes into the Purdue model in the name of JIT, QA, real time order tracking, streamlined design, process improvement and every other latest trend under the sun. Well attackers are actively exploiting all the holes organizations have punched in their OT Networks. Time to pay attention and start the care and feeding of your OT networks because announcements like this are not going to end. Start identifying your critical assets, mapping you data flows, looking at micro-segmentation.....hey wait that sounds like Zero Trust 🤔 #OTSECURITY #ZEROTRUST https://lnkd.in/gw7v-2Hr https://lnkd.in/gw7v-2Hr

17

1 Comment

The campaign pushes the malware via phishing emails disguised as invitations to webinars or online courses. The emails redirect the targets to archives containing malicious payloads hosted on the Egnyte secure file-sharing platform. Some versions found in the wild also come with a custom malware loader designed to inject it into the active processes of a handful of apps, including Microsoft Edge, Google Chrome, AnyDesk, Microsoft OneDrive, PowerShell, and Opera. #Muddywater #Phishing #malware #BugSleep #malwarebackdoor #implantdelivery #ttp #MITRE https://lnkd.in/gnqZDe3t

6