Edward Scott

I usually don't read a ton of cybersecurity books. Lately I've been keeping skillsets sharp by attending IT Conferences, watching webinars, authoring my own cybersecurity courses with CodeRed/EC-Council, and going after a number of certifications like this one. 3, one hour online webinar courses, 3 exams reinforcing the content. Proofpoint is an excellent email security gateway vendor and they augment their offerings with great professional training. This course helps everyone understand the importance of SPF, DMARC, DKIM-signing and many other concepts. Another good one!View my verified achievement from Proofpoint.

19

4 Comments

🛡️ #DefenderForIdentity adds 6 new #detections (#preview): ✅ Possible #NetSync attack 💡 NetSync is a module in Mimikatz, a post-exploitation tool, that requests the password hash of a target device's password by pretending to be a domain controller. An attacker might be performing malicious activities inside the network using this feature to gain access to the organization's resources. ✅ Possible #takeover of a Microsoft Entra seamless SSO account 💡 A Microsoft Entra seamless SSO (single sign-on) account object, AZUREADSSOACC, was modified suspiciously. An attacker might be moving laterally from the on-premises environment to the cloud. ✅ Suspicious #LDAP query 💡 A suspicious Lightweight Directory Access Protocol (LDAP) query associated with a known attack tool was detected. An attacker might be performing reconnaissance for later steps. ✅ Suspicious #SPN was added to a user 💡 A suspicious service principal name (SPN) was added to a sensitive user. An attacker might be attempting to gain elevated access for lateral movement within the organization ✅ Suspicious creation of #ESXi group 💡 A suspicious VMWare ESXi group was created in the domain. This might indicate that an attacker is trying to get more permissions for later steps in an attack. ✅ Suspicious #ADFS authentication 💡 A domain-joined account signed in using Active Directory Federation Services (ADFS) from a suspicious IP address. An attacker might have stolen a user's credentials and is using it to move laterally in the organization. 👉 Source: https://lnkd.in/d8KFguz3 #MDI #ITDR

2

According to the 2023 Proofpoint State of the Phish Report, nearly 65% of people surveyed reported that their organization had experienced data loss because of an insider. Out of the 25% of people who said they had changed jobs in the last 2 years, 44% of them had admitted that they took data with them. Hence, #insiderthreats are one of the biggest concerns in the eyes of the CISO globally. Some of the ways to minimize the risks of insider threats: 📝 Enforce separation of duties and least privilege principle 📝 Use Multifactor Authentication (#MFA) 📝 Investigate unusual activities and monitor third-party access 📝 Develop a comprehensive employee termination procedure 📝 Perform background checks on new employees– Japanese companies often do not conduct background checks or requests for references at the time of hiring. You know why this is important? Let’s see what this Major General is planning to do… Saya University #securityawarenesstraining ❤️ #GoSaya #内部犯行 #サイバーセキュリティ #サイバーセキュリティ教育 #サイバー攻撃 #標的型メール攻撃 #アニメ #phishing #cybersecurityawareness #cybereducation #採用制度 Yoshitaka Kashiwagi Jonathan Hiroshi Rossi

9

MITRE systems were compromised for 4 months by chinese-state attackers. This after following all recommendations to upgrade,patch and replace Ivaniti systems. Having systems hardened is a good start but, it’s only part of a good Defense-in-depth strategy. What tools do you think would have helped detect and attack like this?

6

5 Comments

Widespread Windows Blue Screen of Death (BSOD) Issue Disrupts Banks, Airlines, and Broadcasters! 𝐓𝐨 𝐟𝐢𝐱 𝐭𝐡𝐞 𝐂𝐫𝐨𝐰𝐝𝐬𝐭𝐫𝐢𝐤𝐞/𝐁𝐒𝐎𝐃 𝐢𝐬𝐬𝐮𝐞: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching "C-00000291*.sys", and delete it 4. Boot the host normally CrowdStrike Engineering has pinpointed a content deployment as the cause of the issue and has rolled back those changes. Reddit: https://lnkd.in/eZJgqrPX https://lnkd.in/ejYfAFWN #microsoft #windows #CrowdStrike #BSOD

28

2 Comments

Armis is uniquely capable of managing and prioritizing risk in complex higher education environments. Learn how Lehigh is using Armis to see, protect, and manage IT, IoT, OT, all the T's!

6

https://lnkd.in/eYNBs3N4 This is big. I do not think I used any programs as much as these two when I was managing Linux VMs from my windows laptop. That said, this stuck out to me is this one paragraph: "While these sites impersonated the legitimate site for WinSCP (winscp.net), the threat actors imitated an unaffiliated site for PuTTY (putty.org), which many people believe is the real site. The official site for PuTTY is actually https://lnkd.in/edZDesXc." Come on now! Maybe, just maybe, the official site for PuTTY shouldn't looks more suspicious than the fake site? Who uses a tilde in a URL? Really?

3

Multiple hosted, outbound SMTP servers have vulnerabilities (CVE-2024-7208 and CVE-2024-7209) that allow authenticated users and trusted networks to send emails with spoofed sender information, bypassing SPF, DKIM, and DMARC policies.

2

Don't take your ICS/OT network down accidentally with patches! Vulnerability management is VERY different in ICS/OT networks. You think you're doing the right thing, but before you patch... Stop. Think. Does this vulnerability present a risk? -> To physical safety? -> To environmental safety? -> To the plant's uptime and operations? Just because a new vulnerability is announced, it doesn't necessarily mean - PATCH NOW! Work with the appropriate team members to understand the true risk. -> Engineers -> Operators -> Field technicians -> Maintenance techs -> Cyber security analysts -> Anyone who understands the implications Then, once the team has a complete understanding, determine how to address the risk. I'm not saying don't patch. Patch when you need to. Don't patch when you don't. I never determine that answer. The team does. P.S. What do you patch in ICS/OT?

421

54 Comments

Do you need to be CMMC Level 2 compliant, but are having trouble translating the cybersecurity gobbligook into real actions that your IT team can take? We are having a live webinar on June 27, 2024 at 2pm EST to demonstrate the Kieri Compliance Documentation. This is a full-featured program for CMMC Level 2 and NIST SP 800-171 compliance which includes policies, procedures, system security plan, user agreements, record-keeping databases, account request form, self-assessment form, and other vital resources needed to be compliant. Monthly Q&As and over 50 hours of video training included. Kieri Solutions uses this program to efficiently manage our CMMC Level 2 compliance. We passed a DoD assessment for CMMC Level 2 and NIST SP 800-171 compliance with a perfect 110 score using this governance program. We have over a hundred clients using the KCD to manage their compliance and prepare for CMMC Level 2 assessment themselves. 𝐃𝐨𝐞𝐬 𝐭𝐡𝐢𝐬 𝐬𝐨𝐮𝐧𝐝 𝐥𝐢𝐤𝐞 𝐲𝐨𝐮? 🔸 You are frustrated with your policies and procedures… 🔸 You don’t know how to perform some CMMC requirements, or how to answer assessment objectives like “define non-essential functions”… 🔸 Your documentation is out of date… 🔸 You bought compliance templates elsewhere and they are too complex to get through… 🔸 You are paying a huge monthly fee to a GRC website and you’re still stuck filling in blanks… 🔸 You don’t have a record keeping system that makes it easy to gather the info you need for assessment… 🔸 Your users are asking how to mark CUI and you don’t know how to help them… If so, please join us for this webinar. We will be showing the program that we use to reach and maintain a "110" score. https://lnkd.in/eRjbVFrD Kieri Solutions - Authorized C3PAO

36

6 Comments

There are several items that are missed on any data security audit. One is the Cybersecurity Risk Management Plan and Assessment. Typically found in only 1% of audits. An Incident Response Plan. Found less than 1% of the time. But almost never found are Data Flow Diagrams. With over 50% of the organization's data on the cloud, without the data flows completed, no one, yes no one in the organization knows where all the PII, PHI, PFI, PCI and other critical data is located. It takes about a month to complete all the data flows for an organization since all the department heads need to share their knowledge. When complete, these secure documents will allow the organization's leaders to strategize how they will protect their data. Without the data flows, many segments of the organization's data are not properly managed or protected. The organization will not have a backup plan if access to these systems is lost. So ID.AM.03 of the NIST Core V2 is a critical data security control. Please download the CSF and do the work that needs to be done to protect your organization.

7

A lot of system admins seem to either be asking or are being asked the question: "Why should we keep antivirus/EDR if it can cause the kind of damage we saw from the Crowdstrike incident?" We have to guide the conversation to the right questions, not the easy questions. This isn't a question about avoiding risk, it's a question about aligning risk posture to strategy. "What does our organization require for operations and competitive advantage?" "How do InfoSec capabilities support our ability to operate?" or "What will go wrong and how can we provide assurance?" "What requirements or limitations exist that can help inform our selection of technologies to deliver an InfoSec capability?" "Are our InfoSec capabilities enhancing our competitive advantage?" This aligns at a high level with the questions that frame the "Threat Modeling With ATT&CK" project. It's a good read and worth the time. https://lnkd.in/gGU3F8EX

1

Security solutions are merely software, they are prone to the same attack vectors as any other piece of software deployed in your environment.

1

If you're not sure what EDR is or where to start, MSP Academy is here to break it down for you. In this module, you'll learn: ▪️Comprehensive overview of what EDR is ▪️Evolution of EDR from antivirus to EDR, XDR, MDR, AI and ML ▪️Components of EDR such as endpoint agents, centralized management consoles, analytics engines and more ▪️Best practices for effective implementation ▪️How to integrate EDR with other security tools for increased cybersecurity Watch a 25-minute module, pass the exam and claim your Credly badge. Enroll now ➡️ https://lnkd.in/df6kPBqG #ManagedServices #MSPAcademy

8

The latest #cyberAB town hall answers the question if #MSPs are going to need to be #CMMC certified. It is YES! https://lnkd.in/g8pnnZ7R at 31 minutes and 12 seconds they explain that ESP (External Service Provider) does include MSPs that mean if you are an MSP we should talk as we can save your clients and your revenue. https://lnkd.in/gjmz2v3H

3