Konrad Kaluzny

🚀 CTI Workshop at BSides Athens 2024! 🚀 🧱 "Block By Block: Building Your CTI Program" �� Join me on June 29, 2024, for a 2-hour workshop designed to simplify the complexities of Cyber Threat Intelligence (CTI) and provide a clear roadmap to develop your own CTI program. 🔍 What will you gain? - Understand the foundational principles of CTI and its critical role in cyber threat management. - Learn the steps to initiate a CTI program and integrate it seamlessly into your business processes. - Discover practical strategies for quick wins and establishing core CTI capabilities. - Explore how to leverage technology to empower your CTI efforts, enhance the skills of CTI analysts, and use maturity models to measure and boost your program's effectiveness. 🎯 Who should attend? - Cybersecurity professionals at any stage of CTI implementation, from those considering starting a program to those refining an existing one. - Business leaders looking to understand how CTI can safeguard and add value to their operations. 📅 Mark Your Calendar! Date: June 29, 2024 Event: BSides Athens 2024 Session: Block By Block: Building Your CTI Program Don’t miss this chance to transform your approach to cyber threat intelligence. Whether you're starting from scratch or scaling up, this workshop will arm you with the insights and tools you need to succeed. 🔗Link to BSides Athens 2024 Agenda -https://lnkd.in/dFdV3J_H See you on Saturday! #BSidesAthens #CyberSecurity #CTI #ThreatIntelligence #InfoSec #threatintel #BSides #threatmanagement #cyberthreat #training #athens #greece

236

3 komentarze

Our intern Andreas Volynets, demonstrates how the TOR functionality is applied with easy steps to provide the basic algorithmic weapon for cyber security (A critical aspect of the comprehensive security services we offer to companies). With our intricate know-how, we ensure your safety, confidentiality and integrity. Ready to uncover the secrets of cyber defence. More info: https://lnkd.in/ddf6MdGm #algopan #AlgopanInc #CyberSecurity #KaliLinux #TORBrowser #Privacy #DataProtection #TechExpertise #InformationSecurity #CyberDefense #CorporateSecurity

10

1 komentarz

MerkSpy is designed to clandestinely monitor user activities, capture sensitive information, and establish persistence on compromised systems. But opening the file triggers the exploitation of CVE-2021-40444, a high-severity flaw in MSHTML that could result in remote code execution without requiring any user interaction. It was addressed by Microsoft as part of Patch Tuesday updates released in September 2021. #MSHTML #patching #security

1

New article published: "EU Cybersecurity Legislation Overview – NIS-2 and DORA with Complementary #SOC2 and #GDPR Frameworks" Link here: https://lnkd.in/e5k45Qns Trade Commissioner Service | Service des délégués commerciaux EU Economy and Finance Belgian Cyber Security Coalition TotalEnergies Power & Gas Belgium #NIS-2 #fintech #criticalinfra #europe #cybersecurity #compliance #blockchain

2

I wrote about the various rule combinations I’ve been testing in this post to block known bad and reduce load on the firewall. ~~ Are Your pfSense Filters Really Working? ~~ Too many rules and logs (?) makes them randomly fail ~~ To spot this you need to be monitoring your logs. I have been testing various combinations of rules and noticed this issue in certain scenarios. https://lnkd.in/eknrE6zG

3

Introduction to KQL for Security Analysis from Blu Raven #DFIR #ThreatHutning #KQL #cybersecurity

33

𝘛𝘩𝘦 𝘗𝘢𝘳𝘢𝘥𝘰𝘹 𝘰𝘧 𝘚𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘗𝘳𝘰𝘥𝘶𝘤𝘵𝘴: 𝘈 𝘙𝘦𝘤𝘦𝘯𝘵 𝘈𝘞𝘚 𝘝𝘗𝘕 𝘊𝘭𝘪𝘦𝘯𝘵 𝘝𝘶𝘭𝘯𝘦𝘳𝘢𝘣𝘪𝘭𝘪𝘵𝘺 https://lnkd.in/dRT-KrUr A PoC by WithSecure Labs demonstrates a paradox: a security product that inadvertently compromised security. Specifically, the AWS VPN Client for macOS version 3.9.0 allowed for Local Privilege Escalation, a critical vulnerability that could be easily exploited. Thankfully, AWS addressed this in version 3.9.1 released on February 16, 2024. 🛡️ 𝙺𝚎𝚢 𝚃𝚊𝚔𝚎𝚊𝚠𝚊𝚢𝚜: 1. Security Products and Their Vulnerabilities: Even tools designed to enhance security can sometimes introduce new risks. This paradox underscores the importance of continuous vigilance and proactive security measures. 2. The Importance of Staying Up-to-Date: Regular updates are not just about new features—they are crucial for security. Organizations must ensure that all systems and tools are kept current to protect against newly discovered vulnerabilities. 3. Agility in Cybersecurity: An agile mindset is essential in cybersecurity. While agile processes help in rapid development and deployment, they must be complemented by an agile mindset focused on quick adaptation and continuous improvement to effectively mitigate new threats. 4. Learning from Missed Issues: This incident reminds us that vulnerabilities can be missed and may exist in unexpected places. Regular security audits and thorough testing are vital in identifying and addressing these issues before they can be exploited. 🔄 Action Steps: - Immediate Update: Ensure all instances of the AWS VPN Client are updated to version 3.9.1 or later. - Regular Audits: Conduct regular security audits to identify potential vulnerabilities in your systems. - Education and Awareness: Keep your team informed about the importance of updates and the potential risks of outdated software. 𐅼𐅼𐅼𐅼𐅼𐅽𐅽𐅽𐅽𐅽𐅽𐅼𐅼𐅼𐅼𐅼 With extensive experience in AWS security, cost optimization, and well-architected solutions design, I help companies identify vulnerabilities, enhance their cloud strategies, and ensure financial efficiency. I provide tailored solutions that address specific business needs, enabling organizations to thrive in a secure and cost-effective cloud environment. Let’s connect if you have exciting projects or want to discuss potential collaborations! 🤝 𐅼𐅼𐅼𐅼𐅼𐅽𐅽𐅽𐅽𐅽𐅽𐅼𐅼𐅼𐅼𐅼 #CloudComputing #AWS #CyberSecurity #FinOps #RiskManagement #CostOptimization #CloudSecurity #CloudStrategy #TechInnovation #DataProtection

1

This post highlights the vital importance of FedRAMP's focus on vulnerability scanning. Any missteps in this area can cause substantial delays in receiving authorization, even if all other FedRAMP controls are met. #FedRAMP #CyberSecurity

7

⚠️Medium Risk Vulnerability Alert⚠️: CVE-2024-4183 Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table. CVSSv3.1 Base Score: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) #mattermost #devops #apisecurity #owasp https://lnkd.in/gfz7Cgvb

5

A rare story in natsec cybersecurity that we have full control to do something about… The Federal Bureau of Investigation (FBI), the U.S. Department of State, and the National Security Agency (NSA) have jointly issued an advisory to highlight attempts by Democratic People’s Republic of Korea (DPRK, a.k.a. North Korea) Kimsuky cyber actors to exploit improperly configured DNS Domain-based Message Authentication, Reporting and Conformance (DMARC) record policies to conceal social engineering attempts. Under sanctions from The White House since last November, Kimsuky (or APT43) -- believed to operate under North Korea's premier military intelligence organization, the Reconnaissance General Bureau -- has continued to take advantage of domains with DMARC enabled that have been permissively configured, allowing the group great advantage in spearphishing. Remember that DMARC - the Domain-based Message Authentication, Reporting & Conformance protocol - is meant to stop email spoofing by letting recipients verify the origin of the email through the domain name system. But misconfigurations are far too common and can lead to a false sense of security, with costly breaches, payouts, and remediation to follow. The good news is that this one we can shut down, together, by getting DMARC right. PDFs of the advisory and a statement from the Department of State in my comments below. Paul Veeneman Andrew Borene Micki Boland Sam Curry Tina Meeker, MBA, CISSP David Notch Wendy Meadley Devin Shirley, C-CISO, CISSP, CRISC Andy Mayer Helio Cabral SantAna Yavor Todorov Ben Varney Amy Howland Brian Westnedge Tony Naples, MS, PMP, CISM, C-CISO, GSTRT Scott Handler Nollag Conneely Rebecca Warren Uwe Stöber Loris Gutic Dr. Nebile Pelin MANTI Todor Tagarev Andro Gotsiridze Pradeep Menon Perinchery David Mussington Ph.D. CISSP Cathy Luders Tim Crothers Raymond "RJ" Welsh Rachel Bush, CISSP Megan Samford Craig A. Miller Mihoko Matsubara Ali Johnston Mitko Bogdanoski Max Wolff Red Sift #DMARC #cybersecurity

30

9 komentarzy

We have four articles dedicated to threat intelligence. If you are relatively new to this area we recommend checking Cyber Threat Intelligence - Overview. https://lnkd.in/daeUck8w #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #coding

5