Ville Hämäläinen

Key takeaways for critical OT environments such as energy, transport, and water management about NIS2: ✅ NIS2 establishes a set of rules and minimum requirements to foster EU wide cooperation and reporting. ✅ NIS2 has evolved from the original NIS Directive, including new OT verticals such as certain manufacturing sectors, and new requirements for increasing accountability and reporting. ✅ Article 21 encourages the use of appropriate measures based on risk, which in the case of critical infrastructures is likely to translate into the application of stricter standards and regulations. ✅ Article 23 requires the prompt reporting of cyberattacks, which will enhance transparency. ✅ Accountability provisions may include fines for businesses and direct responsibility for top company officials. ✅ OT operators should use as guidance enhanced EU vertical standards and guidance such as NCCS for energy and TS 50701 for rail, as well as evolving US regulations. ✅ The strict separation of OT and IT segments simplifies implementation of NIS2 and is consistent with NCCS, TS 50701, and new US regulations. For more information download our complete guide "NIS2 Compliance Guide for OT systems" ➡️ https://bit.ly/45ncZ5a Feel free to message me if you have any questions. #OTsecurity #NIS #ICSsecurity #IEC #NCCS #cyberrisk #cybersecurity #criticalinfrastructure #transportation #oilandgas #powerindustry #wastewater

33

The Danish SektorCERT reported two waves of attacks on 22 large and small critical infrastructure providers via unpatched vulnerabilities in Zyxel firewalls deployed between IT networks and the Internet. The SektorCERT report describes the first wave as exploiting a Zyxel vulnerability published two weeks before the first attack, and the second as exploiting a Zyxel zero day. The CERT further reported that in response to the attacks, utilities went into “island mode,” disconnecting their firewalls from the Internet until they could be repaired. Interested in learning more about the 68 cyber attacks that impaired operations at over 500 sites in 2023? Download the 2024 Threat Report ➡️ https://bit.ly/3wZhx58

11

🌐 Sitemap reorganized! Now sorted by second-level domain then top-level domain, making it easier to assess a domain's attack surface.

340

5 Comments

Join us at our Let's Talk Software Security event this Weds (5/15) for an open discussion about what can go wrong with security champion programs, and how to fix them. The link to the event is in the comments - see you there! This is not a presentation, rather a topic-focused virtual chat for all of us. No matter your experience level, join us to share your opinions, or just listen and learn! We'll cover: - What are security champion programs? - What metrics or indicators can measure the effectiveness of a security champion program? - Who holds the champions accountable to meet them & distributes rewards for exceeding them? - How do you maintain engagement and motivation among security champions? - What is the optimal number of champions? Many have had success with security champion programs, but many have also struggled. Come and share your stories so we can learn from each other! #securitychampions #softwaresecurity #applicationsecurity #productsecurity #securityculture #securityawareness

41

14 Comments

𝗚𝗲𝘁 𝗮 𝗖𝗼𝗺𝗽𝗹𝗶𝗺𝗲𝗻𝘁𝗮𝗿𝘆 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁 𝗧𝗼𝗱𝗮𝘆! We are currently offering a no-obligation assessment, including 30 days of continuous monitoring against active abuse of privileges and paths to privileges. There are many already taking advantage of Identity Security Insights, and now is your chance to see it in action. With this complimentary assessment, you'll: 🚀 Get up and running in less than an hour 🔎 Gain actionable findings with rich context in 24 hours 🔒 Proactively harden identity security posture Users will uncover and understand all identities, entitlements, configurations, and paths to privileges that attackers could exploit across on-premises, cloud, #SaaS, and IdPs. Learn more in the video below, and request more information today. https://lnkd.in/eVZPqA9M #IdentitySecurityInsights #InsightsAssessment #IdentitySecurity #Cloud

5

𝐂𝐢𝐬𝐜𝐨 𝐈𝐒𝐄 - 𝐓𝐨𝐩 𝐑𝐞𝐚𝐬𝐨𝐧𝐬 𝐘𝐨𝐮𝐫 𝐄𝐀𝐏 / 𝐂𝐞𝐫𝐭𝐢𝐟𝐢𝐜𝐚𝐭𝐞 𝐀𝐮𝐭𝐡𝐞𝐧𝐭𝐢𝐜𝐚𝐭𝐢𝐨𝐧𝐬 𝐀𝐫𝐞 𝐅𝐚𝐢𝐥𝐢𝐧𝐠 This article written by Jacob Fredriksson takes a look at the most common pitfalls when it comes to configuring and troubleshooting 802.1x (EAP) authentications in which certificates are involved one way or the other, and what kind of error messages show themselves in different situations. To access this fantastic article, go to the following link: https://lnkd.in/deDWavhR #ise_quick_tip

70

1 Comment

For the last 6 months or so, I have been struggling with market definitions in identity and access management. I used to understand markets such as identity governance and administration and access management; I understood what the feature boundaries were; I could map vendors to those markets. But honestly, lately, I feel like those maps and those boundaries aren’t as accurate as they once were. So, in some regards, this post is my attempt to work through ways of defining what IAM looks like in the modern era, what parts should enterprises be willing to pay for, which are table stakes, and where is this all going. There is change in the air; people are willing to consider new solutions and new architectures. What follows is a reframing of the enterprise identity space, one not based on "classical" market definitions, instead one based on capabilities, and it starts with identifying the four major components to new world of identity: * Policy * Orchestration * Execution * Data Read the rest at Weave Identity https://lnkd.in/eu78FS5d

128

48 Comments

Hosted by Mona Kriesten — check out the 📡Cyber Threat Intelligence Village 📡 This village will introduce you to the world of cyber threat intelligence and the field of collecting and correlating information from past, present and evolving threats to enhance decision-making and combat cyber threats. You will learn about the foundational models and frameworks in the area and have first hands-on experiences with CTI tools. Learn about and explore the capabilities and benefits that CTI can provide to improve cybersecurity. #bsidesADL #bsides #threatintelligence #cyberthreat

19

#Safety, #governance, safety! - Where in the system should these be positioned? - What became of #EO13636? ⚠🚨 The criticality of #cni is deadly important (it cannot be overstated) and should not be ignored due to the lack of action. It is really time for governments and CNI Operators to start activities to build CNI Resilience, reduce attack surfaces, and, worst case scenario, reduce knowing and unknowing deaths and consequences. "....the agency will review its security measures and improve cybersecurity after the investigation, which he said is being led by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency." #criticalinfrastructureprotection #securityleadership https://lnkd.in/eUMNkKuy

2

🎩 Two Gentlemen MVPs Sami Lamppu and Joosua Santasalo demonstraiting AitM attack, it’s detection and mitigation. Amazingly executed demo, thanks guys! 👉🏼 Key takeaway: require device compliance and don’t enable MFA as fallback option using ‘OR’ in CA control. #microsoft #aitm #attack #detection #conditionalAccess #mfa #cookietheft #accesstoken #azure

39

3 Comments

Any interest in how to handle an ongoing ransomware attack in the best way possible? Or even to prevent it? Then you should subscribe and attend this webinar hosted by itm8 Incident Response Team in cooperation with the hostages negotiation specialists from Delta Crisis Management. Based on experience from 100s of cyber security incidents, knowledge and insights are shared on the befores, the doing and the afters. Introducting Michael Sjøberg, Simon B. and Anders Urban 💪🏻

13

Compliance with NIS2 regulations does not guarantee protection against external cyberattacks, and the minimum measures outlined in NIS2 may be inadequate for OT systems Download our guide "NIS2 Compliance Guide for OT systems" ➡️ https://lnkd.in/diNQSigC

25

1 Comment

Unidirectional gateways are essential to SEC-OT in any environment where impaired industrial production is an unacceptable consequence. The most common deployment of such gateways is at the IT/OT interface, where the gateway can transmit monitoring data out of a control-critical network without the ability to send any information or attacks back into the system from the IT network. The most robust unidirectional hardware design consists of a fibre-optic transmitter connected to a fibre-optic receiver with a short piece of fibre-optic cabling. The receiver in such designs has no laser, and so is physically unable to send any information or attack back to the transmitter. The transmitter has no photocell or fibre-optic receiver able to receive a signal, even if one were sent. With this type of physical protection in place, it does not matter if the software components of a unidirectional gateway are compromised – no software compromise can impair the ability of the gateway to physically prevent online attacks from reaching the transmitting network. If it feels like this could be the right fit for you, reach out to schedule a meeting with a member of my team. There is no charge and we have solutions for all the usual needs ➡️ https://bit.ly/3X9Dcly

42

When a successful attack hits your organisations, or your customers, you need to be prepared. Elin Richarz will describe what you need to do when it happens and how you can prepare for it. This is all part of the EU cyber regulations - having a plan for handling attacks and informing both authorities and customers while working with stopping it. #NSSS24 #EUCRA #CRA #NIS2

3

New Report on Cyber Security in Small Firms reveals 62% of small firms in Finland outsource some Cyber Security services Full Report = https://lnkd.in/g_g5Av_z

3

🚨 Urgent Security Advisory: regreSSHion Vulnerability in OpenSSH (CVE-2024-6387) 🚨 Dear Security Professionals, We're alerting you to a critical vulnerability, regreSSHion, discovered in OpenSSH by the award-winning Qualys Threat Research Team, in collaboration with SecuriGeek. This vulnerability, if left unpatched, can lead to full system compromise, allowing attackers to execute code, install malware, and create backdoors across networks. Key Details: 👉 Affected Versions: Earlier than 4.4p1 and from 8.5p1 to 9.8p1 👉 Impact: Potential for significant data breaches and network propagation 👉 Actions: Immediate patching, SSH access controls, and network segmentation recommended How SecuriGeek and Qualys Can Help: 👉 We can Detect vulnerable assets with Qualys External Attack Surface Management 👉 Explore a 30-day free trial of Qualys CyberSecurity Asset Management here https://lnkd.in/gFz8Epz For detailed remediation steps and additional resources, visit Qualys regreSSHion. https://lnkd.in/gtxJiTgu. Let's stay vigilant and secure our networks together. 🛡️ #CyberSecurity #OpenSSH #Vulnerability #Qualys #SecuriGeek #NetworkSecurity

1