Vishnu Varma

Great information, Here are few more: - Having Compliance-Driven Priorities (focusing too much on non-technical aspect of security) - Absence of Remediation Framework (not knowing what to do after getting the vulnerabilities detected) - Lack of Vulnerability Management (Knowing what to do with vulnerabilities, but not being able to drive a system to keep it running for a really long time)

9

Privileged accounts pose significant security risks. NIS/NIS2 mandates robust Privileged Access Management (PAM) solutions. PAM ensures only authorized users access critical resources, enhancing compliance and improving security posture. #NIS2Compliance #PrivilegedAccessManagement

35

1 Comment

#APT #Cyber #Attack #Alert A recent article in @Gbhackers.com has revealed the following cyberattack methodology. 1. Recent surge in cyberattacks against Indian government entities reported by SEQRITE Labs' cybersecurity experts. 2. Pakistani Advanced Persistent Threat (APT) groups, particularly SideCopy and its parent group APT36, are active in deploying Remote Access Trojans (RATs) like AllaKore and Crimson RAT against Indian defense and government entities. 3. The primary targets of these cyberattacks are Indian defense and government entities, with persistent efforts dating back to at least 2019. 4. Decoy files with names such as "Grant_of_Risk_and_HardShip_Allowances_Mar_24.pdf" have been used, showing the targeting of sensitive documents within India's Ministry of Defence. 5. The cyberattacks also involve other malicious tools such as Ares RAT, Action RAT, Reverse RAT, and Margulas RAT, posing a significant threat to the security and integrity of critical government systems. 6. Indian cybersecurity forces are urged to strengthen their defenses, update security protocols, conduct regular system checks, and train personnel to effectively recognize and respond to cyber threats. 7. The escalating threats underscore the need for robust cybersecurity measures to protect against sophisticated and persistent cyberattacks. https://lnkd.in/gqJGhUW2

3

——————- This post is dedicated for control DMZ security controls not a comprehensive OT CS strategy! ——————- As per CISA recent report, Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions As per recent SANS report IT is the largest attach entry point to OT . What can you do? 1. 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻     ▪️Establish Control DMZ ▪️all inbound and outbound traffic to and from OT must stop at DMZ ▪️every traffic is inspected twice ▪️use segmentation inside the DMZ ▪️If possible,  use two pairs of firewalls north firewall under IT, south firewall under OT control. ▪️ISA/62443 Island mode control ▪️Separate IT  operations form OT operations especially AD, SIEM ,Patch Management 2. 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴     ▪️Deploy NIDS at choke points ▪️monitor boundary firewall log ▪️deploy Honeypots 3. 𝗢𝘁𝗵𝗲𝗿 𝘁𝗵𝗶𝗻𝗴𝘀 𝘁𝗼 𝗸𝗲𝗲𝗽 𝗶𝗻 𝗺𝗶𝗻𝗱: ▪️no sliver bullet ▪️the control is as strong as its user and configuration ▪️beware of dual homed devices ▪️periodic audit and tuning ▪️be ware of transient asset ▪️Take care of usb devices ▪️Keep your incident response plan near and ready what else? you tell me! #icscybersecurity #otcybersecurity #cybersecuritybitsandbytes

119

22 Comments

SOC .. Detection and Response .. Every company, been there and done that What is the next in the world of SIEM/Monitoring? 1. SLAs? 2. Metrics? 3. Advance Analytics? I would say a true transformation of a SOC is shifting itself to intelligence operations centre. But that, kind of needs a complete change of model & frameworks. When you flip a SOC on its head, Threat Hunting becomes a prominent part of the monitoring. The challenge is, threat hunting is less operations, more intelligence. If not powered by deep intelligence, hunting reduces to operations. Most of what gets passed today, as threat intelligence, is in fact threat data feed. Blacklisted elements collected and curated from variety of sources. A genuine threat intelligence will come from sustained tracking, collection & analysis of following three important elements. 1. Specific threat actors in the wild 2. Targeted threat infrastructure against company 3. Signals from movement and data (darkweb & internet) Threat intelligence of this above type, can be done, only if entire intelligence model is designed and operated around following pillars. A. Sustained monitoring of 1. actors, 2. infra & 3. movement B. Continuous analysis and correlation of above three C. Counter intelligence initiatives & operations Such threat intelligence does not exist for most of the companies. Most companies consume commoditized threat intelligence. And hence, threat hunting also continues being an operational activity, instead of being driven from genuine intelligence. Get an extended and resourceful threat intel team or partner, the one who focuses on your company specific intelligence, and feed that to your internal threat hunting team. Today ! #threathunting #threatintelligence #threatintel #cyberattack #cyberbreach #breach #intel Image Credit - Firsy Org

18

1 Comment

China-Linked Hackers Target Asia-Pacific with Two-Stage RATs A recent report by The Hacker News details a two-stage cyberespionage campaign by China-linked hackers targeting the Asia-Pacific region. The attack leverages two Remote Access Trojans (RATs): Deuterbear, a more sophisticated version of Waterbear. These RATs enable attackers to steal sensitive data and gain control over infected systems. Phishing emails with AI themes are used to target specific organizations. This highlights the evolving tactics of cybercriminals and the importance of cybersecurity vigilance, particularly in the Asia-Pacific region. #cybersecurity #APT #RAT #phishing #espionage https://lnkd.in/geBbVBQd

6

👉 CISO2CISO.COM 👈 DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS - Classification, Attacks, Challenges and Countermeasures - CRC Press Book Distributed Denial of Service (DDoS) Attacks Classification, Attacks, Challenges, and Countermeasures by Brij B. Gupta & Amrita Dahiya Preface Massive technological breakthroughs have pioneered the complexity, scale, and magnitude of DDoS attacks from a very simple Trinoo platform to the Mirai botnet. The days are gone when DDoS attacks were bound to run iterations for vandalism in the small-scale network. #CRCPress Read the complete post in 👉 CISO2CISO.COM 👈 or clicking here in the image below 👇. If you find this information useful and valuable share it with your professionals contacts & networks and leave your comments. Thanks The CISO2CISO Advisors Team. #CISO2CISO #Cybersecurity #CISO https://lnkd.in/dbUu4EVQ

3

Urgent Chrome Update Needed in India! High-severity vulnerabilities reported in Chrome versions before 124.0.6367.78/.79 (Windows & Mac) could allow attackers to remotely harm your system. Fix it now! Update Chrome through Settings > About Chrome. #Futuristicgeeks #ChromeSecurityAlert #CybersecurityAwareness #ProtectYourData #UpdateYourSoftware #IndiaCyberAlert #StaySafeIndia #CERT_in #UpdateChromeNow #PatchYourSystem #DigitalHygiene #BeCyberSmart #tech

1

Don't just tell me you are a CSP, because CSP has multiple meanings, including: 1. Cloud Service Provider 2. Content Security Policy 3. Cyber Security Provider 4. Cloud Storage Provider 5. Communication Service Provider 6. Customer Service Provider 7. Cloud Solution Provider 8. Content Service Provider 9. Compute Service Provider 10. Consulting Service Provider 11. Critical Systems Provider 12. Creative Service Provider 13. Customer Support Provider 14. Channel Service Provider 15. Compliance Service Provider 16. Certified Speaking Professional 17. Certified Service Professional 18. Credential Service Provider 19. Certified SCRUM Professional Z.A. Ramlan 20. Central Service Provider This list is not exhaustive, as CSP can have other meanings depending on the context and industry. Please help to add on to the list in the comment if I missed yours. 🙏 Same for so many other acronyms. #communication #acronyms #csp

7

6 Comments

CMMC Level 2 Assessment Objective: Physical Access Logs (CUI Data) PRACTICE: Organizations must maintain audit logs of physical access. ASSESSMENT: Organizations have flexibility in the types of audit logs they employ. Audit logs can be procedural, such as a written log of individuals accessing the facility; automated, such as capturing identification through an electronic badge; or some combination thereof. Be prepared! Your assessor could ask to: 🔍 EXAMINE physical and environmental protection policy 🗣 INTERVIEW personnel with physical access control responsibilities 📝 TEST organizational processes for physical access control (CMMC Assessment Guide: Level 2 Version 2.11, page 182) #CMMC #DoD #cybersecurity #NIST #InformationSecurity

48

1 Comment

#AppSec Insights Digital signatures: The easy way to say, 'Yes, I really sent this!" Asymmetric encryption: Because your data deserves a better bodyguard than 'password123." Asymmetric #encryption and #signatures are key concepts in application security, used to protect data and verify identities online. Asymmetric encryption involves a pair of keys—a public key, which anyone can use to encrypt data, and a private key, which the recipient uses to decrypt it. This method is ideal for sending information securely over the internet. Asymmetric signatures, or digital signatures, use these keys differently. The sender signs a message with their private key, which anyone can verify using the corresponding public key. This ensures the message is genuine and unchanged. These techniques are essential for secure digital communication, like emails, software downloads, and more. #pki #cybersecurity #infosec #cryptography

6

🔑 Pass the Hash With Mimikatz: Complete Guide Mimikatz can retrieve plaintext passwords, password hashes, PINs, and Kerberos tickets directly from memory, primarily by accessing credential data within the Local Security Authority Subsystem Service (LSASS) process responsible for managing user authentication and security policies. This detailed article explains Mimikatz, how pass-the-hash attacks work, and the prerequisites for such an attack. We'll guide you through using Mimikatz, including leveraging its Kiwi module within Meterpreter to maximize your capabilities in real-world scenarios. By the end of our guide, you'll understand how to perform pass-the-hash attacks and be equipped to apply these techniques effectively during the post-exploitation phase of your cybersecurity assessments. Enhance your knowledge and skills in cybersecurity by exploring our full guide on passing the hash with Mimikatz here 👉 https://lnkd.in/erV9WwVf

14

1 Comment

Ransomware Alert: Key Insights from Sophos' 'State of Ransomware in India 2024' Report Sophos has released its annual 'State of Ransomware in India 2024' report, which highlights a decrease in the number of attacks but an increase in their impact. While the percentage of organizations hit by ransomware dropped from 73% to 64%, the average ransom demand soared to $4.8 million! 😱 Additionally, recovery costs have risen. The report is based on a survey of 5,000 IT decision makers (including 500 from India), and uncovers troubling trends such as a rise in data theft (34%) and a higher tendency for organizations to pay ransoms (65%) rather than rely on backups (52%). What does this report tell us? 💠 Decrease in Attacks: Ransomware attacks against Indian organizations have declined from 73% to 64%. 💠Increased Impact: Higher ransom demands and escalating recovery costs. Critical Statistics: 44% of computers were encrypted, and 34% of incidents involved data theft. 💠Ransom Demands: The average ransom demand is $4.8 million, with 62% of demands exceeding $1 million. Qualimatrix Technologies Pvt Ltd Recommendation Invest in fundamental security measures like firewalls, endpoint protection, and dependable antivirus software to safeguard your systems, data, and networks. Continue to keep a close eye on your networks, systems, and data to quickly identify and address any indications of possible online threats. Maintain patched and updated systems: To close holes that hackers could exploit, make sure you routinely apply security updates and patches to your systems and apps. Keep up with software updates apps, and software to the most recent versions. This procedure lowers the possibility of security breaches and provides vital defense against emerging internet dangers like ransomware and viruses. Source credit : https://lnkd.in/dX_xw3Jt To know more about sophisticated cybersecurity practices  Reach out Qualimatrix Technologies Pvt Ltd 📩 raj@qualimatrix.tech 📲 8103353297 Also, to mitigate the Chances of ransomware attacks https://lnkd.in/diY4Efx4 and generate a cyber audit report within a matter of few minutes. #cyberawareness #qualimatrix #cybersecurity #cybershield

13

How can I ensure my email communication complies with data privacy regulations? Emcrpt offers access logs and tracking capabilities, enabling you to monitor email access and identify any suspicious activity, aiding in auditing and detection. Follow us on LinkedIn - https://lnkd.in/ggi_8FPq #CyberSecurity #Legal #DataSecurity

4

How Domain Trust Relationships Can Be Exploited in Active Directory #cybersecurity #InfoSec #SecurityAwareness #ThreatDetection #NetworkSecurity #ITSecurity #CyberAware #DigitalSecurit #cyberdefense #SecurityTips #PasswordSecurity

17

3 Infostealers related blogs we published this month ⬇ 1. Single Citrix Compromised Credential Results in $22,000,000 Ransom to Change Healthcare (https://lnkd.in/dV_GTvuk) 2. Identity Behind Massive Discord Spying Tool Revealed due to Infostealer Infection (https://lnkd.in/dyFkgSwJ) 3. Initial Access Brokers, Infostealers, and Everything Between Them (https://lnkd.in/d7Hx2znF) Submit your email to get free alerts in case you ever get infected by an Infostealer!

26

5 Comments

I wrote about the various rule combinations I’ve been testing in this post to block known bad and reduce load on the firewall. ~~ Are Your pfSense Filters Really Working? ~~ Too many rules and logs (?) makes them randomly fail ~~ To spot this you need to be monitoring your logs. I have been testing various combinations of rules and noticed this issue in certain scenarios. https://lnkd.in/eknrE6zG

3

1 Insider ⚡= $678,000 💸 💸 Today, we see the real impact of insider threats in cybersecurity, with an ex-employee causing a $678,000 loss after hacking his former company's servers. This case sheds light on the dangers insiders pose. Did you know 15-20% of all attacks come from within organizations? To mitigate such risks, companies can take crucial steps: - Revoke system access promptly upon employee termination. - Implement RBAC and least-privilege to limit access. - Regularly review access rights. - Protect against credential misuse with strong passwords and two-factor authentication. - Establish an incident response plan and practice it. - Create a positive work environment to reduce disgruntlement and insider risks. While no solution is fool proof, adopting a layered approach involving technical controls, processes, and a security-aware culture is vital. Neglecting these measures can have devastating consequences. #Cybersecurity #Insiderthreat

9

2 Comments