🤖 Radosław Gnat

Cybersecurity is a hot topic! Countries should spend more on cybersecurity awareness/training both in industry and education sectors.

8

🔥🔥hot off the presses! We just released actionable guidance on all things DevSecOps! Meeting you where you’re at and taking you to where you need to go!

31

https://lnkd.in/d5nBHuMs 🔒 Cybersecurity Alert: Polish Institutions Targeted by APT28 Malware Campaign 🚨 Attention all stakeholders, Recent reports indicate that Polish government institutions have fallen victim to a significant malware campaign orchestrated by a Russia-linked nation-state actor known as APT28. 🔍 According to CERT Polska, this campaign employs sophisticated tactics, such as sending enticing emails to recipients in an attempt to persuade them to click on malicious links. Clicking these links redirects victims to run.mocky[.]io, eventually leading to webhook[.]site—a legitimate platform used to disguise the download of malware. 📂 The attackers ingeniously disguise malicious files within ZIP archives, masquerading a Windows Calculator binary as a JPG image ("IMG-238279780.jpg.exe"). Furthermore, the campaign utilizes DLL side-loading techniques to execute hidden batch scripts and download additional payloads onto compromised systems. 🔑 Notably, APT28 leverages authentic services like Mocky and webhook[.]site to evade traditional security measures, a tactic previously observed in similar campaigns involving custom backdoors like HeadLace. This alert serves as a crucial reminder for organizations and individuals alike to remain vigilant against phishing attempts and suspicious links. Regular security awareness training and robust endpoint protection are essential defenses in combating such sophisticated threats. Stay informed, stay secure. #Cybersecurity #Malware Cybersecurity #news and Learning, Security Awareness, Cyber Security Basics, Cybersecurity #Vulnerabilities, Cyber Security Attacks and #CyberSecurity #Breaches, IT Security Training, Security Best Practices, Latest Trends, Latest Cyber News, Security #Threathunting, Security #Threat #Intelligence https://lnkd.in/eqpPwT6R This group is for Cyber Security Latest Trends, Latest Cyber Attacks, Cyber Security Vulnerabilities, Cyber Security Breaches, IT Security Training, Security Advisory and Best Practices... All Cyber Security Trainees, IT Security Aspirants, IT Security Experts, IT Engineers, IT Consultants, etc... all are welcome to Join... Regards, Ahsan Khan & Cyber Security News and Learning Updated...Team #cybersecurity #cyberattack #informationsecurityawareness #securityawarenesstraining #cybersec #cybersecurityawareness #learning #cybersecuritynews #cybersecuritytips #hackernews #securitybestpractices #cybersecuritynewsandlearningupdated #cybersecurityanalyst #cybersecurityexpert #informationgovernance #latestcyberattacks #latestcyberbreaches #latestsecurityvulnerabilities #latestcybersecuritybreaches #cybersecurity #phishingattack #ransomware #securityawareness #howtoprotectyourbusiness #businessemailcompromise #vendorsecurity #cyberinsurance #physicalsecurity #nistframework #emailauthentication #secureremoteaccess #phishing #cyberattack #cybercrime #elearning

1

How to ‘kill it’ when it comes to public speaking within your security career………. Elena Raileanu, PHR, SPHR HR Director at Beyond Mission Capable Solutions LLC show us all how getting comfortable being uncomfortable will mean great success over the long term when this approach is adopted consistently……….

9

With EU elections ending, and the Olympics coming, while unresolved conflicts are still underway, governments, NGOs and critical industries are threatened more than they usually are. The more sophisticated state-sponsored cyber operations tend to take longer to be properly observed. What happens right now might be revealed only months later. The urge to patch critical vulnerabilities is always high, but we may consider it higher now.

15

My comments about an unknown #threat actor exploiting #Microsoft #PowerPoint #CVE-2017-8570 to target government personnel was recently published in the Dark Reading! Check them out and let me know what do you think! #cyberattack #breach #0day

42

3 komentarze

How the updated NCSC CAF 3.2 and the new IGP can help you improve your cyber security posture The National Cyber Security Centre (NCSC) has recently released the updated version of its Cyber Assessment Framework (CAF) 3.2, which provides a comprehensive and consistent way of assessing the cyber security of organisations. The CAF 3.2 is now closer aligned with the 14 principles of the Cyber Essentials Scheme, the government-backed certification scheme for cyber security. The CAF 3.2 have made significant changes to sections of the CAF covering remote access, privileged operations, user access levels and multi-factor authentication (all of which are covered in Principles B2a and B2c). https://lnkd.in/e3yVjGNU The CAF collection is aimed at helping an organisation achieve and demonstrate an appropriate level of cyber resilience about certain specified essential functions performed by that organisation. By completing the CAF indicators of Good Practice (IGP), organisations can gain a better understanding of their information governance maturity and identify any gaps or areas for improvement. The IGP can also help organisations demonstrate their compliance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR), as well as other relevant standards and frameworks, such as ISO 27001 and NIST SP 800-53. At Methods, we are committed to helping our clients improve their cyber security posture and achieve their cyber security goals. We have extensive experience in conducting CAF assessments and providing tailored recommendations and guidance on how to implement the CAF principles and the IGP questions. We can also help you prepare for the Cyber Essentials certification and provide ongoing support and advice on maintaining and enhancing your cyber security practices. If you are interested in learning more about how we can help you with the CAF 3.2 and the IGP, please get in touch with us at cyber@methods.co.uk or visit our website at https://lnkd.in/e3HX2MGT #Methodsforgood #cybersecurity #cybersecurityawareness #cyberattack #infosec #cyber #cyberresiliance #prepare

42

😃check out what security consultants and the business, can do to revise approaches, promote better engagement, build better rapport, bring greater value to the process, along with avoiding some of the common mistakes that we’ve all been known to make! 👀😎

2

Time for a rant! Boy, haven't I read this piece of utter BS from almost any "political" body. Whether UK / US / Germany ... doesn't matter. ALWAYS the same friggin idiocy. Let's put in some sense into this blabber. About not enough candidates in universities: Well, as "cyber, cyber, cyber" is first and foremost a software, then a complexity and then a configuration problem, it would be so INCREDIBLY AWESOME if those building this dire heap of shit we nowadays call software- or tech-stack would learn "how-to-build-software-securely" IN THE FIRST PLACE! Can't be that hard, can it? There're literally hundreds of books dealing with just that. How to actually build software - AND TEST IT THEN !! - securely. Developing software is NOT an IT-Sec Pro job! Same goes for "IT-professionals": Why don't they learn how our biggest attack surface ever - aka MS - can be administered securely? (Possible, indeed duh!) Yes, it's a huge, extremely overcomplex, monstrous hydra to be tamed. So, what? That's what businesses went for. Deal with your decisions consequesces and stop whining! Administering is NOT an IT-Sec Pro job! High attrition rate: No shit sherlock! IT-Security pros these days need a complete other skill set than trained! They need the capacity to deal with the harbingers of chaos -> humans! Because "humans" are the root cause for this incredibly shitty landscape of operated "days of open doors for anyone"! No, I don't mean normal office staff. Clicking on mail will hardly do any harm nowadays ... anymore -> IF you actually run a patched up, up-to-date Microsoft stack. ... and pay the money, of course. (Welcome to the golden cage.) Those posing the biggest threat are Managers and C-Levels in NOT allowing absolute basics to be done properly and demanding "Cyber,cyber, cyber" to clean up the mess they created. The job of a cyber-sec Pro is ACTUALLY to get "people" to either do the right things OR at least not stand in the way. Therefore you need the following skills: - Communication (happy nerding as a mole is no more! Learn business lingo.) - Psychology (You're dealing with THE most diffucult NI there is!) - Leadership skills (YOU're the expert! You tell them what to do.) - Influencing (They need to do what you want them to ...) - Self-confidence (shaking in front of C-Level decinding on your budget doesn't help) That's for starters. These very simple steps would close this "gap" already considerably!

2

7 komentarzy

I've just finished the course “Intro to Service Management with ITIL® 4” by Jason Dion! I really enjoyed this course and it's a useful addition for the Security bid project work I do. Check it out: https://lnkd.in/e6PRMMHR #itservicemanagement #itil4 #learninganddevelopment #knowledge

7

3 komentarze

🚨 Check out #CISOAssistant, it is probably one of the best #OpenSource #GRC tool I have ever seen👍It covers Risk, AppSec and Audit Management and supports ~50 frameworks worldwide! #ToBeTested #GitHub https://lnkd.in/eix4mqE4 We have all struggled with fragmentation and lack of efficient cyber structure. It is amazing to see the number of clients now setting up their cybersecurity program with a #GRC function... and this tool can definitely help! ➡️ This tool supports many #Frameworks, it is very comprehensive: #ISO 27001:2022 🌐, #NIST CSF v1.1 🇺🇸, NIST CSF v2.0 🇺🇸, SOC2 🇺🇸, PCI DSS 4.0 💳, GDPR checklist from GDPR.EU 🇪🇺, Essential Eight 🇦🇺, NYDFS 500 🇺🇸, DORA 🇪🇺, NIST SP 800-53 rev5 🇺🇸, #OWASP ASVS 🐝🖥️, Cyber Resilience Act (CRA) 🇪🇺, NIST Privacy Framework 🇺🇸, TISAX v5.1 and v6.0 🚘, CIS Controls v8 🌐, CSA CCM ☁️, FADP 🇨🇭...

1041

65 komentarzy

When I tell someone that I do security assessment for companies, I sometimes get a polite smile and a nod of the head and then we start talking about something else. Which is fine, I know I can go on a bit about cybersecurity, what can I say, I like the topic! 😊 But I also get that some folks don't know the difference between a penetration test, a vulnerability assessment, a risk assessment, and a compliance assessment. They are not the same, you get different results depending on what you do and what you need. So, if you've wondered what the difference is, I wrote a short blog post about it at the link below. It's a short read and I hope it helps you figure out what you need. #securityassessment #pentest #risk #assessment #compliance https://lnkd.in/g2zE_qXH

6

2 komentarze

This quote here --> "Human vulnerabilities are often the hardest aspects of op-sec and AI appears to already have made sufficient progress to offer a considerable challenge for security experts." Its only going to get harder as the hours and day go by! Thanks Aglika K. for sharing. @genAI #newcyberthreatlandscape #CollectiveDefense #IntelligenceSharing

2

Writing radically agnostic #InfoSec job descriptions leaves so much room for activities! And vision sharing. And top-down value alignment. And clearly structured expectations. And making it without faking it. 🙂

15

3 komentarze

The potential of GenAI is tempting but have you considered the information security risks of Copilot with Microsoft365? In summary, I see three main areas of risk. Firstly, when integrated with business systems, Copilot could amplify existing security vulnerabilities. It uses existing access permissions for OneDrive and SharePoint, which if incorrectly set, can lead to unauthorised access to information. Secondly, accounts with elevated privileges pose a risk as they have access to sensitive business and technical data. If compromised, these accounts can be used for rapid discovery of sensitive information. Finally, generative AI tools like Copilot may produce inaccurate or unreliable output as they cannot distinguish between outdated or informal notes and authoritative information sources. Don't jump into a widespread rollout without doing the prep to mitigating these risks by: ·       Ensuring the access permissions granted to Copilot and Graph API are appropriately restricted. ·       Implementing information classification labels ·       Review access management across OneDrive, SharePoint and other data sources. ·       Perform regular audits and real-time monitoring of Copilot’s activities as it learns more about the University’s environment, to help detect and mitigate potential security threats.  ·       Checking the generated output, particularly if used for coding and sensitive subjects. There is increasing concern about the use of generative AI services by cyber attackers. Awareness and adherence to security policies are key to preventing such attacks. Remember, as we continue to understand and navigate the landscape of AI tools, it’s crucial to stay informed and vigilant about potential risks and mitigations. #Copilot #Graph #InformationSecurity #Risk #GenAI

31

In a world where Freedom is threatened by our own less fortunate choices, may Privacy, that Human Right, be always, always respected. Privacy is a fundamental pillar of human dignity. And what more do we want from this brief stay on this planet, than to live in Peace and with Dignity?

12

It takes more than expertise to be a good consultant. Obviously a consultant must have good knowledge and experience along with strong credibility in their field. Pera Prometheus look beyond these requirements to deliver consultants who can: Quickly assess and understand an organisation’s requirements and challenges. Apply problem solving skills to identify suitable resolutions. Rapidly enter management’s OODA loop (Observe, Orientate, Decide, Act). Communicate effectively. Become, however temporarily, a valued member of your Team that delivers confidence and eases the burden for all around them. Visit our website for more information https://lnkd.in/daJpuq4F #BusinessImpactAssessment #BIA #CyberAssessmentFramework #CAF #VirtualSecurityManager #VSM #FacilitySecurityClearance #FSC #IndustryPersonnelSecurityAssurance #IPSA #securebydesignassurance #NIST #ISO27001alignment #DEFSTANadherence

5